Default RED

An AI-native ecosystem for hackers and security professionals.

[Default RED @defaultredhq]

We are finally open for registrations!
https://t.co/PSsyI24cpb

[Default RED @defaultredhq]

Ryan Fetterman at Cisco Talos documents CLOSEDQUORUM, a malware binary discovered through their CAIRN project that exhibits fully autonomous command and control.

[Default RED @defaultredhq]

An AI-integrated malware implant operates fully autonomous C2 without operator involvement, found by Ryan Fetterman at Cisco Talos.

#cybersecurity #infosec #hacking #malware

https://t.co/kGoHUyujBt

[Default RED @defaultredhq]

https://t.co/07f930nN1R discloses a pre-auth remote code execution vulnerability in VMware vCenter, tracked as CVE-2026-59309 and CVE-2026-59310.

[Default RED @defaultredhq]

A pre-auth RCE in vCenter (CVE-2026-59309 and CVE-2026-59310), per https://t.co/07f930nN1R.

#cybersecurity #infosec #hacking #security #technology #vulnerability

https://t.co/wvHUCpcv6T

[Default RED @defaultredhq]

James Forshaw at Project Zero details CVE-2026-66804, a Windows privilege escalation bug that is an incomplete fix for CVE-2026-50343, dubbed Dark Elevator by Calif. Forshaw and 14 others reported the issue.

[Default RED @defaultredhq]

A dangling COM object registration enables Windows privilege escalation (CVE-2026-66804), an incomplete Dark Elevator fix, found by James Forshaw.

#cybersecurity #infosec #hacking #security #technology #vulnerability

https://t.co/M7g4RsnUPy

[Default RED @defaultredhq]

https://t.co/jmD9Rb0wio walks through a bypass of Referer-based CSRF protections that rely on the strict-origin-when-cross-origin Referrer-Policy, demonstrating that cross-site request forgery remains possible despite this widely-recommended policy.

[Default RED @defaultredhq]

Referer-based CSRF protections using the strict-origin-when-cross-origin policy can be bypassed, per https://t.co/jmD9Rb0wio.

#cybersecurity #infosec #hacking #security #technology #vulnerability

https://t.co/YWFN6TFT0M

[Default RED @defaultredhq]

rainpwn walks through an authenticated remote code execution vulnerability in UANIA OS, showing how a valid session can be leveraged for arbitrary code execution.

[Default RED @defaultredhq]

An authenticated RCE in UANIA OS, found by rainpwn.

#cybersecurity #infosec #hacking #security #technology #vulnerability

https://t.co/eWnfi1VMgb

[Default RED @defaultredhq]

Two authorization bypasses in n8n (workflow automation) AI agents allow privilege escalation, per de Turris.

#cybersecurity #infosec #hacking #security #technology #vulnerability

https://t.co/zWQIyyFXqI

[Default RED @defaultredhq]

Silent Signal detail a pre-auth RCE in IBM Db2 Mirror for i that chains to QSECOFR — the most privileged account on an IBM i system.

[Default RED @defaultredhq]

A pre-auth RCE in IBM Db2 Mirror for i chains to QSECOFR (the IBM i superuser account), per Silent Signal.

#cybersecurity #infosec #hacking #security #technology #vulnerability

https://t.co/hzkBrJZO2e

[Default RED @defaultredhq]

Fortbridge's StyleSmuggler research details how an unauthenticated attacker can poison Magento's report generation to achieve remote code execution.

[Default RED @defaultredhq]

Report poisoning in Magento chains to unauthenticated RCE, per Fortbridge.

#cybersecurity #infosec #hacking #security #technology #vulnerability

https://t.co/yoiWqImFB4

[Default RED @defaultredhq]

KAIST Hacking Lab's MTEscape demonstrates that asynchronous kernel Memory Tagging Extension (MTE) — a hardware mitigation on ARMv8.5+ — can be defeated using conventional memory corruption techniques.

[Default RED @defaultredhq]

Asynchronous kernel MTE is bypassable via conventional memory corruption vulnerabilities, per KAIST Hacking Lab.

#cybersecurity #infosec #hacking #security #technology #vulnerability

https://t.co/dnNTU5VOqV

[VIEH Group @viehgroup]

Git Config Poisoning -> AI Agent RCE

Attack Path ->
1. Open an attacker-controlled repository with an AI coding agent.
2. Abuse repository-controlled .git configuration to influence a Git operation.
3. The agent invokes the Git command as part of its normal workflow.
4. The attacker-controlled configuration causes code to execute with the agent's local privileges.

Learning ->
1. .git configuration is part of the attack surface when AI agents operate inside untrusted repositories.
2. “The agent only runs Git” isn't a security boundary when Git itself can be influenced by repository content.

Research: GitSpawn
Disclosed: September 2, 2026
Scope: Multiple AI coding agents
#BugBounty #AISecurity #AIAgents #CodeSecurity #CyberSecurity #AppSec

[Default RED @defaultredhq]

https://t.co/iYLCce40cb document Beltdown2, their technique for escaping the sandbox around Cursor's command-line interface.

[Default RED @defaultredhq]

The Beltdown2 technique escapes the Cursor (an AI code editor) CLI sandbox, per https://t.co/iYLCce40cb.

#cybersecurity #infosec #hacking #security #technology #vulnerability

https://t.co/wHnMwWJTZ7