exploiting Archives

Winsage

August 17, 2026

⚡ Weekly Recap: VMware Exploits, Windows 0-Day, MCP Attacks, Browser Hijacks and More

A suspected advanced persistent threat (APT) group linked to China exploited a newly patched vulnerability in VMware vCenter (CVE-2026-59310), which has a critical CVSS score of 9.8, allowing for arbitrary code execution and the deployment of Babuk-derived ransomware. A recently patched vulnerability in Apple macOS (CVE-2026-65400) has been exploited to deploy a cryptocurrency miner, granting unauthorized root access. The Lazarus Group from North Korea exploited a zero-day vulnerability in Microsoft Windows, targeting defense and aerospace sectors. GeoServer patched a critical SQL injection vulnerability that was actively exploited. A new macOS malware, Amnesia Stealer, targets users through ClickFix attacks, stealing data and allowing real-time access to authenticated sessions. A novel attack technique named GhostSplice can manipulate AI coding assistants. Research revealed a method exploiting Chromium's DevTools Protocol for data theft. Noteworthy CVEs this week include CVE-2026-68820, CVE-2026-58231, and multiple others across various platforms. A high-severity command injection flaw in FileRun allows remote code execution. An advanced ClickFix attack has been reported, deploying sophisticated malware. A heap overflow vulnerability in Citrix NetScaler was patched after indications of exploitation. A new malware loader targeting Portuguese-speaking users has been identified. A significant reduction in exposed Automatic Tank Gauge systems has been observed. A phishing campaign targeting Brazil has been detected, and an F.B.I. agent faces charges for unauthorized crypto withdrawals. Authorities in Ukraine dismantled fraudulent call centers, and a North Carolina man was sentenced for cyber extortion. Unauthorized access to sensitive data by the ExfilSquad group has been confirmed. LightSpy activity linked to China has been detected in over 13 countries. A supply chain attack exposed over 2,500 companies, and an Azure exfiltration campaign has exposed millions of enterprise records.

AppWizard

August 17, 2026

Marvel Rivals players are messing with their config files ‘to cancel games with no consequence’ before they get a loss

Players are exploiting the cheating detection system in Marvel Rivals to manipulate match outcomes by canceling games when losing, using configuration files during gameplay. Streamer LytePk reported this issue on social media, stating he experienced it multiple times in one day. Evidence includes a player named Murder Rate leaving a game while at a disadvantage, leading to a cancellation attributed to cheating, with teammates expressing disbelief in the chat. NetEase has issued warnings about modded configurations, but penalties have been mild, mainly resulting in auto-cancellations without serious consequences. The community is calling for more stringent penalties to address this challenge to fair play.

Tech Optimizer

August 16, 2026

4 Outdated Cybersecurity Tips That No Longer Keep You Safe

Creating strong passwords and storing them securely in a password manager is essential. Utilizing multi-factor authentication (MFA) adds an extra layer of security, with passwordless options like passkeys and security keys enhancing convenience and security. Public Wi-Fi networks pose significant risks, as hackers can use Man-in-the-Middle (MitM) attacks to intercept data. Using a Virtual Private Network (VPN) can enhance security by encrypting data. Traditional antivirus software may struggle against adaptive malware, which uses machine learning to evade detection. Companies like Bitdefender have integrated machine learning into their antivirus solutions. Two-factor authentication (2FA) is commonly used but can be bypassed by hackers. Transitioning to passkeys and security keys can improve protection against unauthorized access.

Tech Optimizer

August 15, 2026

4 Outdated Cybersecurity Tips That No Longer Keep You Safe

Creating robust passwords and storing them securely in a password manager is essential. Utilizing multi-factor authentication (MFA) is recommended for added security. Passwordless options like passkeys and security keys enhance convenience and security. Public Wi-Fi networks pose significant security risks, and caution is necessary when connecting. Hackers often use Man-in-the-Middle (MitM) attacks to intercept data on unsecured networks. Using a Virtual Private Network (VPN) can safeguard data by encrypting it before transmission. VPN routers can encrypt data for devices that cannot install a VPN. Traditional antivirus software may struggle against adaptive malware, which uses machine learning to evolve and evade detection. Companies are integrating machine learning into their antivirus solutions. Two-factor authentication (2FA) is commonly used but has diminished effectiveness due to new tactics employed by cybercriminals. Users should consider transitioning to passkeys and security keys for better protection against unauthorized access.

Tech Optimizer

August 14, 2026

‘This one just needs a script’: Researchers find ultimate Windows kill switch which can disable antivirus with almost no user interaction

Researchers have identified a significant vulnerability in consumer DDR4 and DDR5 memory modules, known as the “Download more RAM” flaw, which allows attackers to bypass advanced Windows security features, including Virtualization-Based Security (VBS) and Hypervisor Code Integrity (HVCI). This vulnerability enables the manipulation of configuration reports from RAM, misleading the system about its actual memory capacity, which can disable antivirus protections and allow the reintroduction of outdated drivers. The exploit can be executed via a single-click script, leading to security failures. Microsoft has released a patch for CVE‑2026‑23670 to enhance memory write protection against such exploits.

Winsage

August 12, 2026

After Microsoft threatened legal action, a security researcher publishes a new Windows zero-day bug

A security researcher named Nightmare Eclipse has discovered a vulnerability in Windows, called ShieldBreak, which allows hackers to gain system-wide access to users' devices and sensitive data by exploiting a flaw in Windows Defender. The vulnerability affects Windows 10, Windows 11 (including version 25H2), and Windows Server 2025. A proof-of-concept exploit has been provided, requiring users to run a Windows application to trigger the vulnerability. Security researcher Will Dormann confirmed that Windows Defender must be enabled for the exploit to work. Microsoft has not yet released a patch for ShieldBreak, which is classified as a zero-day vulnerability. This discovery follows previous vulnerabilities disclosed by Nightmare Eclipse, including RoguePlanet, for which Microsoft issued an inadequate patch. The situation has heightened tensions between the researcher and Microsoft regarding the handling of bug reports, especially after Microsoft threatened legal action against researchers disclosing zero-days outside established protocols. The disclosure of ShieldBreak occurred shortly after Microsoft's monthly security patch releases, which have been increasing in number.

Winsage

August 7, 2026

Microsoft Flags BNB Chain Malware Campaign Targeting Windows Users

Microsoft has identified a sophisticated malware campaign that uses the infrastructure of BNB Chain to spread harmful code through compromised websites. The attackers deceive visitors into executing malicious commands disguised as standard security checks, exploiting vulnerabilities in conventional website security measures. This campaign affects both businesses and individual users, utilizing ClickFix lures and EtherHiding techniques. An injected Base64-encoded JavaScript communicates with a BNB Smart Chain RPC gateway to facilitate these malicious operations.

Winsage

August 7, 2026

This ‘classic’ decades-old SQL injection flaw could let hackers take over entire Windows servers, thanks to a nifty database trick

Security researchers from Huntress discovered a sophisticated SQL Injection (SQLi) attack that led to the deployment of a rare toolkit called Khunt. The attackers exploited a public-facing application backed by an Oracle database by failing to validate user input, allowing malicious SQL commands to be executed. The Khunt toolkit enabled activities such as executing operating system commands, stealing credentials, and exfiltrating registry hive data. Experts recommend robust defense mechanisms, including input sanitation, regular security audits, and the implementation of web application firewalls to protect against such attacks.

AppWizard

August 7, 2026

Diablo 4’s newest class barely made a splash with Lord of Hatred, but it’s shaping up to be king of the next season

Warlocks were introduced in Diablo 4 with the Lord of Hatred expansion but initially struggled against other classes. Recent updates on the Public Test Realm (PTR) have buffed warlock skills, allowing players to tackle high-level dungeons even with suboptimal gear. MacroBioBoi noted that new strategies, such as using burning skull minions, have made warlocks more competitive. Additionally, Blizzard has made Mythic Uniques more accessible for crafting and acquisition, aiming to balance gameplay. There are questions about the absence of a new seasonal system, with speculation about future developments at BlizzCon.

Tech Optimizer

August 6, 2026

Antivirus software alone does not guarantee protection, this expert warns

Hackers have stolen over 0 million USD in Bitcoin by exploiting vulnerabilities in Canadian-made hardware wallet keys. The breach involved sophisticated tactics, including the use of an AI agent that deceived targets into installing malware and could alter its identity to avoid detection. Ritesh Kotak emphasized that reliance solely on antivirus software is insufficient, highlighting the need for a comprehensive approach to cybersecurity. The incident raises concerns about the effectiveness of current protective measures and the growing threat landscape in the digital economy.