Exploitex

We challenge what others trust. An independent security company uncovering exploitable flaws in the systems the world relies on.

[Exploitex @Exploitex_]

Public exploit code is now available for a critical React Server Components flaw: CVE-2026-126187.

Specific Next.js cache configurations can expose servers to unauthenticated code execution. The fix shipped October 14. Check your deployed version, patch and redeploy.

[Exploitex @Exploitex_]

Initia says compromised cloud credentials enabled forged withdrawals from five rollups. The team is rebuilding affected infrastructure.

Cloud access controls are part of bridge security. Follow official recovery notices and avoid unsolicited claim links.

[Exploitex @Exploitex_]

CVE-2026-125350 lets a crafted page run code inside Chrome’s sandbox. Google confirms an exploit exists in the wild.

Update Chrome, relaunch, and check the version. IT teams: verify the fix across your browser fleet.

[Exploitex @Exploitex_]

Compromised bee-js 13.3.0 and Swarm Desktop 0.56.2 releases carried malware targeting Swarm wallet keys and installing backdoors.

Updating alone won’t remove persistent access. Isolate affected hosts and rotate exposed secrets from a clean device.

[Exploitex @Exploitex_]

A Web3Auth breach exposed private keys for some Keplr wallets created with Google or Apple login. The reported $6M+ theft total is unconfirmed; recovery transfers complicate the tally.

Affected users: stop deposits and follow Keplr’s guidance. Share this with Keplr users.

[Exploitex @Exploitex_]

Varonis researchers built NotC2, a proof-of-concept tool for controlling an already-compromised AWS account. It requires credentials with sufficient permissions.

SQS receives commands, Amazon Bedrock translates plain-language requests into AWS API calls, Lambda executes the operations, and SNS sends results back to the attacker.

This can make malicious activity resemble normal cloud traffic. AI simplifies the work but stays within the Lambda role’s permissions. Defenders should limit IAM permissions and investigate unexpected external SNS subscriptions or unusual Bedrock activity.

[Exploitex @Exploitex_]

Windows Update won’t fix this one.

Microsoft Paint’s CVE-2026-83844 (CVSS 8.1) could let attackers run code remotely.

Check your Paint version. Update through Microsoft Store to 11.2609.401.0 or later, then verify the installed build.

[Polymarket @Polymarket]

BREAKING: Hackers breach French bank Crédit Mutuel Arkéa, steal "undisclosed amount" of money through fraudulent transactions.

[Exploitex @Exploitex_]

Binance revoked SignalPlus-linked API keys after a potential security incident at the trading platform. It says user funds are safe.

OpenSSH released an emergency update for a login-bypass flaw affecting some Linux servers. Affected admins: update and restart SSH.

[The Hacker News @TheHackersNews]

‼️WARNING - OpenSSH issues emergency fix for a critical SSH authentication bypass on Alpine Linux.

A password longer than 256 bytes can unlock key-only accounts on affected servers, without knowing the actual credentials.

Here's how it works ↓ https://t.co/hOKc4hirLg

[Exploitex @Exploitex_]

One misplaced line can drain millions in seconds.

The code can compile perfectly. Pay out before updating the balance, and reentrancy can let an attacker withdraw repeatedly in one transaction.

Why do we treat “audited” like a warranty?

[Exploitex @Exploitex_]

Self-custody still trusts the OS.

Censys found iOS exploits targeting Trust Wallet and stealing recovery phrases. Read the research.

Exploitex challenges what others trust through independent research, finding vulnerabilities before attackers do.

[Daniel Lemire @lemire]

A CVE (Common Vulnerabilities and Exposures) is a publicly disclosed security flaw.

They increased following a slight upward slope all the way to early 2024, when there was a sudden small increase... then starting in 2026, we went full exponential.

In most instances, the vulnerabilities were pre-existing, so much of the increase is just our better ability to find the faults.

This is of historical importance. We have never witnessed anything of the sort.

[zoomer @zoomerfied]

[ ZOOMER ]

FRENCH ENTITY THAT GOT HACKED FOR $130M IN CRYPTO WAS CREDIT MUTUEL ARKA, A BANK WITH $235B IN AUM: ZACHXBT

[Binance @binance]

https://t.co/sU9dUqLQDH

[Exploitex @Exploitex_]

Your next security priority may be seconds old.

Track newly disclosed CVEs, recent Web3 hacks and security breaches with Exploitex Security Intelligence.

Explore for free: https://t.co/wVownZB2jo

Stay up to date. Your security may depend on it.

[Exploitex @Exploitex_]

It’s been a rough week for the crypto industry. Security needs attention across the whole company, from code and infrastructure to the way people work and how access is managed.