Exploit Blog 2026- 2026 2025 2024 2023 2021 2020 2019 2018
AI blog APT blog Attack blog BigBrother blog BotNet blog CyberCrime blog Cyber blog Cryptocurrency blog Exploit blog Hacking blog ICS blog Incident blog IoT blog Malware blog OS Blog Phishing blog Ransom blog Safety blog Security blog Social blog Spam blog Vulnerebility blog
DATE | NAME | Info | CATEG. | WEB |
| 27.8.26 | TrendAI™ Advances Threat Hunting to Dynamic, Real-World Exploitation of AI Infrastructure | The new threat hunting component of the TrendAI™ agentic exploit-remediation engine, code name AESIR, extends visibility beyond vulnerability disclosure. Its first published investigation links over a year of honeypot data to the LF3 loader framework. | Exploit blog | Trend Micro |
| 27.8.26 | Exploiting SMTP with Unicode Bidi Override Spoofing: The Gap Between Auth & Render | Security Joes researchers, led by Red Team Lead Anna Breeva, discovered a new email spoofing technique that abuses Unicode bidirectional (Bidi) controls together with SMTPUTF8 to make an attacker-controlled email address visually appear to belong to a trusted domain. | Exploit blog | Security Joes |
| 22.8.26 | Death By 20,000 PoCs | VulnCheck researchers curated 20K+ public exploits and vulnerability analyses in 2025. As of mid-August 2026, we’ve already reviewed 17,800+ PoCs and write-ups, putting us 87% of the way to 2025’s numbers with another 4.5 months left to go in the year. | Exploit blog | VULNCHECK |
| 22.8.26 | Stitching the Kill Chain: Detecting NTDS.dit Exfiltration with Trellix Helix Correlation | This blog continues the series exploring NTDS.dit credential theft, building on our earlier work. In this analysis, we examine the underlying methodologies used in these attacks and how Trellix Helix identifies them. We will highlight the Advanced Correlation Engine (ACE)'s capability to consolidate telemetry from policy, network, and endpoint sources. | Exploit blog | TRELLIX |
|
8.8.26 |
CrowdStrike 2026 Threat Hunting Report: Exploitation Window Closes as AI Use Accelerates | Real-world case studies and observations demonstrate an increase in attacks on trusted relationships and adversarial use of AI. | Exploit blog | CROWDSTRIKE |
|
1.8.26 |
Fastjson RCE (≤1.2.83): Active Exploitation Detected — Detection & Mitigation | A remote code execution vulnerability in Fastjson affects every version up to and including 1.2.83. A remote attacker can run arbitrary code on a vulnerable server by sending it specially crafted JSON — no user privileges, no victim interaction, and no third-party libraries required. ThreatBook TDP® (Threat Detection Platform) has already captured this vulnerability being exploited in the wild, so if you run an affected version without SafeMode enabled, treat remediation as urgent. | Exploit blog | THREATBOOK |
|
1.8.26 |
Open Directory Stages NGINX Rift and Ghost CMS Exploits Against Government and Financ | Disclosure note: This research was conducted jointly by Hunt.io and Bob Diachenko, security researcher and journalist. Thailand's national CERT and NCSA were notified on July 15, 2026, and acknowledged receipt the same day. Publication was held for the standard 7-day disclosure window. | Exploit blog | HUNT.IO |
|
1.8.26 |
XMRig Covert Ops: The Cryptomining Campaign That Abuses Trusted Access and Deploys Forensic Smokescreens | Dive into a covert Linux XMRig campaign exploiting trusted access, weaponizing PAM to create forensic smokescreens, and deploying self-unlinking payloads. | Exploit blog | GROUP-IB |
| 25.6.26 | Zero-Day Exploitation of Vulnerability (CVE-2026-20245) in Cisco Catalyst SD-WAN Manager | In early 2026, Mandiant identified a threat actor targeting SD-WAN infrastructure at a service provider. After gaining initial access, the threat actor exploited a zero-day vulnerability (CVE-2026-20245) in Cisco Catalyst SD-WAN to escalate privileges from a compromised administrative account to root-level access. | Exploit blog | GTI |
| 19.6.26 | From SQLi to RCE – Exploiting LangGraph’s Checkpointer | AI agents need memory. Frameworks like LangGraph provide it through checkpointers – persistence layers that store execution state. But what happens when that persistence layer isn’t locked down? | Exploit blog | CHECKPOINT |
| 13.6.26 | ShinyHunters Targets Education Sector with Oracle PeopleSoft Exploit | Mandiant and Google Threat Intelligence Group (GTIG) have identified an active compromise and extortion campaign attributed to UNC6240 (ShinyHunters) targeting Oracle PeopleSoft application infrastructure. | Exploit blog | GTI |
| 13.6.26 | Borrowed Trust – Systematic Exploitation of Abandoned Cloud DNS Delegations to serve Thai Gambling SEO Content | Cyble's latest analysis exposes 163 organizations compromised via abandoned DNS delegations in a Thai gambling SEO poisoning campaign. | Exploit blog | Cyble |
| 13.6.26 | From SQLi to RCE – Exploiting LangGraph’s Checkpointer | AI agents need memory. Frameworks like LangGraph provide it through checkpointers – persistence layers that store execution state. But what happens when that persistence layer isn’t locked down? | Exploit blog | CHECKPOINT |
| 30.5.26 | While Russian-speaking threat actors have historically dominated the phishing-as-a-service (PhaaS) landscape, a rival ecosystem is rapidly growing within the Chinese-language underground. Google Threat Intelligence Group (GTIG) analyzed a dozen current PhaaS offerings in the Chinese underground, all of them mature services and many likely tied intricately to the broader criminal ecosystem in that region. | Exploit blog | GTI | |
| 16.5.26 | Ongoing exploitation of Cisco Catalyst SD-WAN vulnerabilities | Cisco Talos is tracking the active exploitation of CVE-2026-20182, an authentication bypass vulnerability in Cisco Catalyst SD-WAN Controller, formerly SD-WAN vSmart, and Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage. | Exploit blog | CISCO TALOS |
| 11.4.26 | Adobe Reader zero-day vulnerability in active exploitation | On April 7, 2026, a security researcher described an Adobe Reader zero-day vulnerability that has been exploited since at least December 2025. The vulnerability allows threat actors to execute privileged Acrobat APIs via specially crafted malicious PDF files that execute obfuscated JavaScript when opened. Exploitation allows attackers to steal sensitive user and system data and to potentially launch additional attacks and remotely execute code. | Exploit blog | SOPHOS |
| 8.3.26 | Look What You Made Us Patch: 2025 Zero-Days in Review | Google Threat Intelligence Group (GTIG) tracked 90 zero-day vulnerabilities exploited in-the-wild in 2025. Although that volume of zero-days is lower than the record high observed in 2023 (100), it is higher than 2024’s count (78) and remained within the 60–100 range established over the previous four years, indicating a trend toward stabilization at these levels. | Exploit blog | GTI |
| 1.2.26 | PeckBirdy: A Versatile Script Framework for LOLBins Exploitation Used by China-aligned Threat Groups | PeckBirdy is a sophisticated JScript-based C&C framework used by China-aligned APT groups to exploit LOLBins across multiple environments, delivering advanced backdoors to target gambling industries and Asian government entities. | Exploit blog | Trend Micro |
| 17.1.26 | A 0-click exploit chain for the Pixel 9 Part 3: Where do we go from here? | While our previous two blog posts provided technical recommendations for increasing the effort required by attackers to develop 0-click exploit chains, our experience finding, reporting and exploiting these vulnerabilities highlighted some broader issues in the Android ecosystem. This post describes the problems we encountered and recommendations for improvement. | Exploit blog | Project Zero |
| 17.1.26 | A 0-click exploit chain for the Pixel 9 Part 2: Cracking the Sandbox with a Big Wave | With the advent of a potential Dolby Unified Decoder RCE exploit, it seemed prudent to see what kind of Linux kernel drivers might be accessible from the resulting userland context, the mediacodec context. As per the AOSP documentation, the mediacodec SELinux context is intended to be a constrained (a.k.a sandboxed) context where non-secure software decoders are utilized. Nevertheless, using my DriverCartographer tool, I discovered an interesting device driver, /dev/bigwave that was accessible from the mediacodec SELinux context. | Exploit blog | Project Zero |
| 17.1.26 | A 0-click exploit chain for the Pixel 9 Part 1: Decoding Dolby | Over the past few years, several AI-powered features have been added to mobile phones that allow users to better search and understand their messages. One effect of this change is increased 0-click attack surface, as efficient analysis often requires message media to be decoded before the message is opened by the user. | Exploit blog | Project Zero |
| 10.1.26 | CISA Known Exploited Vulnerabilities Surged 20% in 2025 | CISA’s Known Exploited Vulnerabilities (KEV) catalog grew by 20% in 2025, including 24 vulnerabilities exploited by ransomware groups. | Exploit blog |