Tag: proof of concept
34 articles
Zero-Day Tool Blocks Microsoft Defender Updates
Meet BigDiskBuster, a newly released zero-day tool that cleverly blocks Microsoft Defender updates by maxing out disk space, leaving users vulnerable until a fix is found. Its creator, Abdelhamid Naceri, a former Microsoft security researcher, has made the proof-of-concept tool publicly available on GitHub.
Microsoft Defender Zero-Day Blocks Antivirus Updates
A security researcher just released a clever tool called BigDiskBuster that can block Microsoft Defender updates, leaving your antivirus stuck in limbo. This sneaky proof-of-concept allows anyone to prevent Defender from getting the latest signature and platform updates, as long as the tool is running in the background.
Meta's Muse AI Assistant Vulnerable to Backdoor Exploit
A security researcher has discovered a shocking vulnerability in Meta's new AI assistant, Muse, that allows malware on a Mac to hijack the tool, giving hackers an easy backdoor into sensitive personal data. This exploit is particularly alarming since it can be triggered by malware that's already on the device, making it a nearly effortless way for attackers to take control.
Malicious Extensions Exploit AI Browser Agents
Imagine a single malicious browser extension handing an AI-powered browser agent a set of instructions, allowing it to act with the browser's existing privileges - and putting your entire online presence at risk. Security researcher Gal Weizman has uncovered this vulnerability with his proof-of-concept, BragJack, which can hijack AI assistants embedded in popular Chromium-based browsers.
Microsoft Defender Exposed to New Zero-Day Exploit
A security researcher known as Nightmare Eclipse has just dropped a proof-of-concept exploit for a new Microsoft Defender zero-day vulnerability, dubbed ShieldCrash, which surprisingly still works on Windows systems that have already applied the latest September patches. This marks the researcher's 11th Microsoft zero-day exploit to be made public.
Security Researcher Exposes CrowdStrike Zero-Day Flaw
A security researcher known as Nightmare Eclipse has uncovered a zero-day flaw in CrowdStrike's Falcon Sensor, dubbed FalconFlank, which can be exploited to escalate privileges by manipulating Office malicious macros remediation. The researcher has even shared a public proof-of-concept on GitHub, highlighting the vulnerability's potential impact.
Researcher Exposes Privilege Escalation Flaw in CrowdStrike Falcon
A security researcher, known as Chaotic Eclipse, has uncovered a zero-day privilege escalation flaw in CrowdStrike Falcon, dubbed FalconFlank, which exploits the office malicious macros remediation feature. This vulnerability allows for a potentially devastating escalation of privileges, and a public proof-of-concept has been released.
Attackers Exploit SharePoint Flaw After Public PoC Release
Microsoft warned that a critical SharePoint flaw, patched in July 2026, could allow attackers to bypass authentication and disclose files or modify data. This vulnerability, tracked as CVE-2026-55040, has now been exploited by attackers following the public release of a proof-of-concept exploit.
Hackers Exploit New Microsoft SharePoint Vulnerability in Attacks
Hackers are already exploiting a newly discovered critical flaw in Microsoft SharePoint, with over 8,500 servers exposed online and vulnerable to attacks. This authentication bypass vulnerability, known as CVE-2026-55040, allows hackers to disclose files, modify data, and wreak havoc on your system.
CSS Attacks Break Webmail Defenses to Steal Passwords and Tokens
Researchers have discovered alarming proof-of-concept techniques that allow attackers to exploit styled HTML in emails, breaking through webmail defenses to steal passwords, tokens, and even hijack trusted actions. This vulnerability affects major email services including Outlook, Gmail, and Yahoo Mail, and public proof-of-concept code is readily available.
GitLab RCE Exploit Published, Targets Unpatched Servers
A security researcher has just published a working exploit that can execute commands on unpatched GitLab servers, putting sensitive data and systems at risk. If your GitLab server is unpatched, it's crucial to update now to prevent potential code execution and data breaches.
AWS Kiro Flaw Enables Remote Code Execution Through Poisoned Web Pages
Researchers just uncovered a major flaw in AWS Kiro that lets hackers execute remote code through manipulated web pages, putting developers' machines at risk. A simple request to summarize a webpage was all it took to expose this vulnerability.
Windows Zero-Day Exploit LegacyHive Grants Hackers Admin Privileges
A security researcher, known as Nightmare Eclipse, has uncovered a new Windows zero-day exploit called LegacyHive, which can grant hackers admin privileges with just a few simple steps and some standard user credentials. This alarming vulnerability targets the Windows User Profile Service, putting users at risk of serious security breaches.
Microsoft Faces New Zero-Day Exploit Disclosure Amid Ongoing Security Dispute
A security researcher has unveiled a proof-of-concept exploit, called LegacyHive, that targets a vulnerability in Windows User Profile Service, allowing for a potential elevation of privileges. This newly disclosed exploit requires just a standard user credential and a third username to launch.
Nightmare Eclipse Unveils Windows Zero-Day Exploit
A security researcher is sounding the alarm about a newly unveiled Windows zero-day exploit, dubbed LegacyHive, which targets the Windows User Profile Service and could allow for a full system compromise. The proof-of-concept exploit, published by a zero-day hunter known as NightmareEclipse, is just a glimpse of the potential damage this vulnerability could cause.
Ghostcommit Exposes AI Code Reviewers to Secret Theft via Image Steganography
Researchers have uncovered a sneaky way to steal secrets from AI code reviewers using image steganography, as demonstrated in a proof-of-concept on GitHub. This Ghostcommit technique hides malicious instructions inside PNG images, exploiting a gap in the review process.
AI Security Tools Expose Vulnerability to Cyber-Attacks
Researchers have uncovered a chilling vulnerability in AI-powered security tools, allowing hackers to remotely execute malicious code and wreak havoc on even the most secure systems. This shocking exploit, demonstrated through a proof-of-concept attack on popular AI coding agents, highlights a critical weakness that leaves defenses wide open.
Researcher Releases Zero-Day Exploits, Bypassing Disclosure Norms
A pseudonymous security researcher, known as "bikini," has made a bold move by releasing over 30 proof-of-concept exploits for zero-day vulnerabilities in open-source projects, sparking both interest and concern in the cybersecurity community. The researcher behind the Exploitarium GitHub repository is urging users to explore these vulnerabilities for research purposes only.
libssh2 Flaw Exposes Clients to Code Execution Risk
A critical flaw in libssh2, known as CVE-2026-55200, can be exploited by a malicious SSH server to trigger memory corruption on a connecting client, with no credentials or user interaction required. This vulnerability can be easily triggered with a public proof-of-concept now available.
Apple SecureROM Exploit Bypasses Patching on A12, A13 Chips
Security researchers have uncovered a major vulnerability in Apple's A12 and A13 chips, exploiting a flaw in the Synopsys DWC2 USB controller to gain bootROM-level control and bypass patching. This breakthrough could pave the way for new avenues of attack on Apple devices.
Disgruntled Bug Hunter Exposes New Windows 0-Day Vulnerability
A disgruntled bug hunter, known as Nightmare Eclipse, has revealed a new zero-day vulnerability called RoguePlanet, which can give attackers SYSTEM-level control over fully patched Windows 10 and 11 systems. The exploit, fueled by a grudge against Microsoft, targets a weakness in Windows Defender.
Microsoft Defender Zero-Day Exploited for SYSTEM Access
A security researcher, known as Chaotic Eclipse, has discovered a Microsoft Defender zero-day exploit, dubbed RoguePlanet, that can give attackers unrestricted access to compromised machines. The proof-of-concept exploit, released under the handle MSNightmare, can yield a shell with SYSTEM-level privileges, allowing hackers to run arbitrary code and perform unauthorized actions.
AI Worm Uses Open-Weight Models to Spread, Evade Defenses
Imagine a self-navigating AI worm that can identify vulnerabilities and gain access to over 70% of a network's hosts - in a test, it found 31.3 vulnerabilities and elevated access on 23.1 hosts in just 15 isolated runs. Researchers at the University of Toronto and elsewhere have now created a proof-of-concept AI-driven worm to demonstrate this unsettling possibility.
Bug Hunter Exposes Microsoft VS Code Flaw in Protest of Disclosure Handling
A bug hunter's frustrating experience with Microsoft's disclosure process sparked a protest, as Ammar Askar publicly exposed a VS Code flaw that could allow attackers to steal OAuth tokens and access GitHub repositories. Askar's proof-of-concept exploit highlights the vulnerability, which was previously mishandled by Microsoft's security response team.