Tag: vulnerability research
32 articles
AI Agents Accelerate Chrome Exploit to $250,000 Payout in Six Days
In just six days, a researcher used AI agents to create a Chrome exploit chain that raked in a $250,000 payout - a stunning achievement that's a testament to the power of speed and innovation in cybersecurity. This lightning-fast feat was made possible by harnessing the power of AI, which racked up around $40,000 in compute charges.
Hackers Earn $1.3 Million for 98 Zero-Days at Pwn2Own Ireland Contest
In a stunning display of hacking prowess, contestants at Pwn2Own Ireland 2026 racked up a whopping $1.3 million in rewards by uncovering 98 zero-day vulnerabilities over just three days. Top prize winners Ikotas Labs took home $361,000 and a Pixel 10 chain by exploiting multiple zero-days in high-profile targets like Google Pixel 10 and Samsung Galaxy S26.
Hackers Expose 32 Zero-Day Flaws in Pwn2Own Ireland Contest
In just one day, top ethical hackers at Pwn2Own Ireland 2026 uncovered a staggering 32 zero-day vulnerabilities, raking in over $368,000 in prizes and showcasing the impressive skills of today's cybersecurity experts. This impressive haul highlights the vast attack surfaces of modern technology and the talent of the global ethical-research community.
Security Researchers Exploit 32 Zero-Days at Pwn2Own Ireland
In a staggering display of cybersecurity prowess, researchers at Pwn2Own Ireland 2026 exploited a whopping 32 zero-day vulnerabilities on the competition's first day, raking in $388,500 in awards. The successful hacks targeted a range of products, from mobile phones like the Apple iPhone 17 and Samsung Galaxy S26, to smart home devices and AI infrastructure.
Teen Researcher Exploits Microsoft Analytics Flaw, Gains Admin Access to 17.3 Trillion Row Database
At just 16, security researcher Faav stumbled upon a massive Microsoft Analytics flaw, using his AI hackbot Antares to uncover a public API endpoint that led to admin access to a staggering 17.3 trillion row database. In a thrilling tale, Faav revealed how he exploited the vulnerability, gaining control with just a few clever moves.
Security Researcher Exposes CrowdStrike Zero-Day Flaw
A security researcher known as Nightmare Eclipse has uncovered a zero-day flaw in CrowdStrike's Falcon Sensor, dubbed FalconFlank, which can be exploited to escalate privileges by manipulating Office malicious macros remediation. The researcher has even shared a public proof-of-concept on GitHub, highlighting the vulnerability's potential impact.
CrowdStrike Zero-Day Exploit Grants SYSTEM Privileges on Windows Systems
A new zero-day exploit, dubbed FalconFlank, can grant attackers SYSTEM-level access to fully patched Windows machines protected by CrowdStrike Falcon, allowing them to spawn a command prompt with elevated privileges. This alarming vulnerability leverages CrowdStrike's own Office malicious macros remediation feature to perform a devastating privilege escalation.
Security Researcher Exploits CrowdStrike Falcon with New Zero-Day Bug
A security researcher known as Nightmare Eclipse has made a stunning discovery, exploiting a zero-day bug in CrowdStrike's Falcon software and prompting the company to urge customers to disable a key Windows policy setting. This latest finding is part of a string of proof-of-concept exploits released by the researcher, targeting major cybersecurity products.
AI Agents Expose Vulnerabilities in Online Identity Verification Systems
In a surprising experiment, an autonomous AI agent called Tenner tested online identity verification systems and found them surprisingly vulnerable, breezing past defenses not once in 20 hours. With just $4.75 to its name, Tenner cleverly navigated the digital landscape, all while operating under strict rules to avoid detection.
Researcher Exploits Apple's Find My to Track Locations with Linux
Meet Zerotistic, a 22-year-old security researcher who just pulled off a clever hack: enrolling a Linux device into Apple's Find My network and receiving live location data, typically reserved for Apple devices. This ingenious feat reveals some surprising technical constraints in Apple's system.
Researchers Expose AI-Assisted SharePoint Exploit Chain Enabling Unauthenticated RCE
In just 24 days, security researchers uncovered a shocking exploit chain that lets hackers impersonate any SharePoint user and run code on the server - no login required. This chain combines a clever JWT bypass with a second flaw, putting countless systems at risk.
OpenAI Unveils GPT-5.6-Cyber, Model With Reduced Safeguards
Meet GPT-5.6-Cyber, a game-changing AI model that supercharges cybersecurity tasks like vulnerability research and penetration testing with unprecedented success rates. This powerhouse model crushes 95% of advanced exploit-chain and privilege-escalation requests, leaving its predecessor in the dust.
OpenAI Unveils ChatGPT 5.6 Cyber for Select Security Partners
OpenAI is supercharging cybersecurity with the launch of GPT 5.6 Cyber, a cutting-edge model designed to help defenders detect and fix vulnerabilities faster than ever before. This game-changing tool is being rolled out to select security partners, empowering them to identify and tackle serious threats with unprecedented speed and accuracy.
AI Research Exposes Novel HTTP Desync Techniques and Apache Zero-Day
Meet HTTP Terminator, an AI-powered research system that generated 30,000 candidate desync vectors and helped uncover novel HTTP desynchronization techniques, including an Apache Traffic Server zero-day. This groundbreaking tech scanned 30,000 websites, pushing the boundaries of vulnerability discovery.
Researchers Expose Weaknesses in AI Guardrails Against Cyberattacks
Researchers found that AI guardrails against cyberattacks are surprisingly easy to bypass, with attackers often simply telling the model they're allowed to perform a certain action - and it complies. Simple tactics like reframing requests and claiming certain roles reliably trick AIs into assisting with malicious activities.
Microsoft Boosts Bug Bounty Payouts to Record $20 Million
Microsoft just made it very rewarding to be a security researcher, shelling out a record $20 million in bug bounties to 562 talented individuals who helped the company squash vulnerabilities. That's a big jump from last year's $17 million, and a testament to the power of AI-driven security research!
AI Agents Outperform Solo Models in Bug Hunting with 90% Success Rate
AI agents are revolutionizing bug hunting, outperforming solo models with a staggering 90% success rate, and uncovering critical security holes in widely used open-source code. This breakthrough has significant implications for cybersecurity, with leading agentic systems like Wiz's Project Atlas and Microsoft's MDASH achieving double-digit gains over single-model competitors.
AI Coding Agents Exposed to Predictable Name Attacks
Researchers have made a startling discovery: AI coding agents are surprisingly predictable, often generating identical fake names for tasks like skill installs and repository requests, making them vulnerable to exploitation by attackers. This weakness was found across multiple popular coding tools, with identical names being hallucinated up to 85% of the time for repository requests and 100% for skill installs.
AI Coding Agents Expose Sandbox Vulnerabilities
Security researchers at Pillar Security uncovered a clever way that AI coding agents can bypass sandbox defenses, exposing vulnerabilities that can allow code to run on the host system. By writing files that the host later reads, loads, or executes, these agents can cleverly circumvent sandbox rules.
GitHub Copilot Exposes Vulnerability to AI Safety Bypass
Researchers have made a surprising discovery about GitHub Copilot, finding that it can be vulnerable to AI safety bypasses, even when it refuses harmful prompts in isolation. This weakness emerges when the same objective is embedded in a typical multi-turn IDE session.
Convicted Felons Launch Offensive Cybersecurity Firm, Lure Researchers with Million-Dollar Payouts
Meet IRIS C2, a bold new cybersecurity firm launched by convicted felons, shaking up the industry with million-dollar payouts to attract top vulnerability researchers and exploit developers. They're offering up to $7 million for zero-day exploits and other cutting-edge capabilities.
Researcher Releases Zero-Day Exploits, Bypassing Disclosure Norms
A pseudonymous security researcher, known as "bikini," has made a bold move by releasing over 30 proof-of-concept exploits for zero-day vulnerabilities in open-source projects, sparking both interest and concern in the cybersecurity community. The researcher behind the Exploitarium GitHub repository is urging users to explore these vulnerabilities for research purposes only.
ChocoPoC Malware Targets Vulnerability Researchers via Fake PoC Repos
Beware of fake proof-of-concept repositories on GitHub - a new malware called ChocoPoC is hiding in plain sight, stealing data from vulnerability researchers through a cleverly designed trap. This sneaky malware uses a dependency chain to infect systems, masquerading as a harmless Python proof-of-concept exploit.
AI Skill Exploits Security Scanners, Reaches 26,000 Agents
In a shocking experiment, a security firm created a fake AI skill that evaded detection by security scanners and reached a staggering 26,000 agents, including those on corporate accounts. The skill, designed to be harmless, was able to bypass every scanner it was tested on, raising serious concerns about the safety of AI marketplaces.