The Button Was the Payload: A2UI CVE-2026-10032
CVE-2026-10032 shows how an agent-generated button can turn declarative UI data into browser behavior. Trace the sink, safe lab, patch, and detections.
- FeaturedOffensive Security
Shodan.io for Offensive Security: Getting the Most Out of the Internet’s Search Engine
Practical Shodan.io guide for security teams: build precise queries, use facets, avoid false positives, automate checks, and validate internet exposure.
-
-
The Browser Changed the Address: DBHub DNS Rebinding to SQL
CVE-2026-61742 turned a browser into a network pivot against DBHub MCP. We reproduce the DNS rebinding flaw, compare 0.22.4 with 0.22.5, and map practical detection and defense.
-
The Template Passed Review: Nuclei Scanner Trust
Five Nuclei flaws show how alternate loaders, embedded runtimes, and response evaluation can turn a security scanner into the asset under attack.
-
The Proxy Saw One Request: http4s Ember HTTP Desync
Three http4s Ember flaws let proxies and origins disagree about HTTP request boundaries. Trace the mechanics, safe lab, detection, and durable fixes.
-
The Username Was a File Descriptor: Inside MikroTrick
CVE-2026-86060 turned a crafted RouterOS SSH identity into administrative policy. Trace MikroTrick, a safe lab, detection logic, and trusted recovery.
-
The Link Was Checked Too Late: CVE-2026-81963
CVE-2026-81963 is an exploited Windows Update link-following flaw. Trace the SYSTEM escalation model, safe mechanism lab, detection logic, and patch validation.
-
The Constructor Was the Endpoint: Jenkins Stapler Data Binding
Jenkins configuration forms can become constructor dispatch. Trace the September 2026 flaws, a safe mechanism lab, detection signals, and durable fixes.
-
The ID Was in the Body: CVE-2026-47849 and JSON Patch
CVE-2026-47849 let JSON Patch mutate Spring Data REST identifiers and version fields. This analysis verifies the binding flaw, traces the cross-record overwrite path, and maps practical detection and hardening controls.
-
Two Patches, One Hook: Inside Gitea CVE-2026-60004
CVE-2026-60004 turns duplicate Gitea diffpatch requests into an executable Git hook. Analyze the attack chain, detection signals, and containment.
-
The Model Returned Python: CVE-2026-61539 and Tool-Parser RCE
CVE-2026-61539 turned attacker-influenced Llama tool output into Python RCE inside Xinference. This analysis traces the parser boundary, validates the primitive in a safe local lab, and maps durable detection and hardening controls.
-
ShieldBreak: When Defender Becomes the Privilege Boundary
ShieldBreak (CVE-2026-69414) abuses file-path resolution around Microsoft Defender. Trace the privilege chain, detection telemetry, and interim controls.
-
Pass-ta-Key: When Synced Passkeys Trust a Compromised Host
Unit 42’s Pass-ta-key research exposes device-trust and recovery attacks around Google-synced passkeys. Trace the mechanics, detection, and defensive choices.
-
Gunra Before Encryption: Detect the Ransomware Handoff
Gunra’s locker is the last stage. Detect the earlier handoff from VPN compromise to remote access, exfiltration, backup deletion, and offline encryption.
-
The Page Was Blank: Inside macOS ClickFix Cloaking
A macOS ClickFix campaign hid its lure behind browser fingerprinting. This analysis reproduces the gate safely and builds detection across web, endpoint and identity telemetry.
-
An SBOM Is Not an Alarm: Build a VEX Decision Pipeline
CISA’s 2026 SBOM baseline improves software identity and evidence quality. This advanced guide turns that inventory into an auditable VEX pipeline for exploitability decisions, release policy, and detection.
