We found a critical auth bypass in @better_auth, one of the most popular auth libraries in 2026 with over 9.5 million weekly downloads. CVSS 9.1. Fixed in Better Auth 1.7.7 PoC below 👇

Memory corruption in Ghostscript 👻 This 1980's image parser might still get you shells in the big '26 PoC below

Shielded Bitcoin: Private Transfers on Bitcoin L1

NEW: Turning the HEIC decoder into a SHA-256 computer irisc2.com/blog/heic-hashqui…

i thought read() was a syscall wrapper, but it can dlopen a bytecode interpreter and execute your code "house of windy" turns this into leakless code execution with only OOB null byte writes pepsipu.com/blog/2026-09-dwa…

[KOLUMNA] Delo se mora splačati. Ne le v primerjavi z nedelom. Splačati se mora tudi delati več, bolj ambiciozno, prevzemati zahtevnejše delo, napredovati, se dodatno izobraževati in prevzemati vedno več odgovornosti. zdruzenje-manager.si/novice/…

‼️ Critical Unbound DNSSEC validator flaw (CVE-2026-82717) could allow remote code execution. An attacker who controls a malicious zone can trigger the heap overflow by querying a vulnerable resolver. 1.26.0 and earlier are affected. Read details → thehackernews.com/2026/09/cr…

According to LibreSSL developers, OpenSSL 4.1 has silently introduced an undocumented major breaking change to no longer NUL-terminate ASN.1 strings, in a minor release. "This will cause buffer overreads left and right." marc.info/?l=openbsd-cvs&m=1… github.com/openbsd/src/commi…

I thought the GitHub pages as a #nix substitute was interesting so I tugged on the thread a little more: fzakaria.com/2026/09/11/a-ni…

🚨POZOR, uporabniki Revoluta!🚨 Zakaj je hranjenje preveč podatkov lahko zelo nevarno. KYC delamo zaradi zaščite potem pa je to za nas največja nevarnost. Ja res. Bravo!!!! Revolut je zaradi ponarejene vladne zahteve razkril občutljive osebne in finančne podatke svojih strank. Napadalci so poslali zahtevo, ki je izgledala popolnoma legit– z uradno domeno in veljavnimi poverilnicami. Revolut je zahtevo sprejel kot legitimno in posredoval podatke. Kaj naj bi bilo razkrito: kopije potnih listov in vozniških dovoljenj selfiji za preverjanje identitete ime, datum rojstva, poklic, naslov e-pošta in telefonska številka IBAN, izpiski računov celotna zgodovina transakcij, vključno z Bitcoinom Sredstva niso bila ukradena. Sistemi Revoluta niso bili hekani. Gre za socialni inženiring, ne klasičen vdor. Prizadeti uporabniki so že prejeli obvestilo. Revolut naj bi vir blokiral in obvestil regulatorje. Če uporabljaš Revolut: preveri e-pošto in obvestila v aplikaciji bodi izjemno previden na klice in sporočila, ki se sklicujejo na “uradne organe” morebitne zahteve preverjaj samo znotraj aplikacije, nikoli prek povezav iz e-pošte Deli naprej, da izvedo tudi drugi. 💪

CVE-2026-85706 Gitlab Path Traversal CVSS 10.0 👀👀

🚨 PoC RELEASED: Public exploit code is now available for CVE-2026-28576, a CVSS 10.0 SQL injection vulnerability in the Android Contacts Provider. The flaw can allow access to the device’s contacts database without additional execution privileges or user interaction, potentially exposing sensitive contact information. ⚠️ A public PoC demonstrates how the vulnerability can be exploited to extract contacts from affected Android devices. 🔴 Android 17 users should apply the latest available security updates. 🔗 github.com/mobilehackinglab/… #Android #CVE #PoC #SQLInjection #ContactsProvider #CyberSecurity #Infosec

Today, Project Zero is releasing MAccConc, a tool by @tehjh that enables deterministic testing of race conditions on Linux. It can be used for fuzzing, ad-hoc exploration, regression tests and more! projectzero.google/2026/09/m…

There's some confusion about what, exactly, was exploited here. I've seen claims that this was a long-standing bug, exploited after the "fix" was pushed to the open source repo but before that fix could be rolled out in production. That does not appear to be true. Instead, it seems that the fix *was* deployed, but inadvertently introduced a new bug which was subsequently exploited. Most of the network was still running official releases, none of which contain the new bug. Those nodes correctly rejected the block containing the exploit and stalled at height 4050335. The timeline is roughly as follows: • 2016-07-12: Range proof caching added • 2017-11-08: Range proofs extended to support assets • 2019-03-19: Range proof cache key "simplified", dropping asset & script fields. introduces Bug A. • 2026-09-01: Bug A "fixed" by extending cache key to include asset + script. introduces Bug B. • 2026-09-06: Bug B exploited, reserves drained, chain split. The original "Bug A" allows some limited cache poisoning because the cache key doesn't commit to the asset and script, allowing a cached result for a range proof for one asset to be applied to a different asset or context. Exploiting this in practice looks quite difficult, since the amount must match the primer and the proof must be genuine. The 2026 "fix" added those missing fields to the cache key, producing a format like: "proof | amount | asset | scriptpubkey" But this unfortunately made the key easier to manipulate and exploit: The four fields are concatenated without separators or length indicators. Since both the proof and the scriptpubkey are variable length, an attacker can stretch the proof and shrink the script to produce the exact same cache key from different proofs, amounts, assets and scripts. This lets an attacker smuggle arbitrary confidential output amounts and junk proofs past the range proof checker without proper validation, which breaks the guarantees that prevent hidden inflation. On-chain evidence suggests that this second bug is what was exploited: Two primer transactions each created an op_return with carefully constructed scriptpubkey and valid range proof for a (presumably) zero value output. blockstream.info/liquid/tx/2… blockstream.info/liquid/tx/7… This produced a cache key like: "<valid proof> | <valid amount> | <L-BTC> | OP_RETURN <negative amount> <L-BTC> OP_RETURN" The exploit transaction then created a large negative op_return output with an invalid range proof: blockstream.info/liquid/tx/f… The invalid proof is padded with bytes corresponding to the primer's valid amount and asset fields, aligning the actual amount and asset fields with the same bytes from the primer's opreturn payload: "<valid proof> <valid amount> <L-BTC> OP_RETURN | <negative amount> | <L-BTC> | OP_RETURN" The exploit transaction could then include a second output crediting the attacker with a large positive value, balanced out by the fake negative amount. Because the success was already cached, the invalid proof was never actually checked and the transaction was accepted as valid by nodes running versions of the software vulnerable to bug B. Although the amounts are blinded, this is the only output with an invalid range proof anywhere in the peg-out's recent ancestry, so this must be where the inflated coins were created. And since the padding only produces a cacheable key under the new format, it must have been the newer bug that was exploited.

Liquid hack explained. Liquid has confidential transactions that hide the amounts for improved privacy. A bug in how these transactions are validated caused inflation of Liquid BTC (L-BTC) and allowed hackers to empty the entire side chain. Liquid nodes don't see the amounts of a confidential transaction, so to make sure that the transaction is still valid and doesn't cause inflation nodes check something called a balance proof and a range proof. The balance proof establish that sum of the input amounts equal the output amounts, i.e., that "x L-BTC going in and x L-BTC going out". But there's a catch. Only relying on a balance proof isn't enough. You also need the range proof. The range proof establishes that a hidden output amount falls within a positive range. That means a valid output must be at least 1 L-sat and at most 2^64 − 1 L-sats. Range proofs make sure that you can't mint "negative L-BTC". Why is this even necessary? Remember, the amounts are hidden and a hidden negative amount would allow extra positive outputs to balance against it. Without a range proof, a transaction could say "I've put 1 L-BTC in, and I'm taking two outputs out: one with 4000 L-BTC and one with -3999 L-BTC)." This is going to cause a disaster in a little bit. Once the balance proof, the range proof, and other validations pass, a transaction is regarded as valid and can pass consensus. However, because especially the range proof is computationally expensive, Liquid nodes cache the result of a successful range proof in memory. Essentially, the node remembers "I saw this range proof before and it was valid, all good!". In order to recognize the same range proof later on, you need to assign a label to it. This is called a cache key. This cache key is the actual cause of the bug. The way this cache key was constructed allowed two different transactions to collide on their cache key. Essentially, one valid transaction (1 L-BTC in, 1 L-BTC out) had the same cache key as an invalid transaction (1 L-BTC in, 4000 L-BTC out). Here's the hack: the attackers submitted the valid transaction (1 L-BTC in, 1 L-BTC out) first. Liquid nodes verified this transaction successfully, created a cache key called REKT and stored it in their cache. Then the attackers carefully crafted a second invalid transaction with (1 L-BTC in, 4000 L-BTC out) that created the same cache key REKT. Instead of validating the second transaction and realizing that it printed money out of thin air, Liquid nodes found it in their cache and said "hey I saw this transaction before, everything is fine" and that caused the inflation. The attackers then took their 4000 L-BTC and withdrew 4000 BTC onto the Bitcoin base chain. Note: I might have gotten some details wrong, and I'm aware that I simplified quite a bit. I wrote this post to help people understand what happened. Please feel free to correct me in the comments or add more details below.

looks like liquid got hacked by convincing the functionaries to sign a 'valid' peg-out tx for 4k bitcoins

A JPEG-XL file that displays its own SHA-256 hash value This is something that I have been using to benchmark various AI models for the last several months In a future blog post, I will explain how it works github.com/JayGLXR/JXLaiBenc…

🚨 Attackers hijack MikroTik routers through internet-exposed SSH. No authentication required. Update RouterOS immediately, then check for unknown users and scripts, CERT Polska advises. See affected versions and recovery steps → thehackernews.com/2026/09/at…

‼️ WARNING - Attackers are exploiting a Chrome V8 zero-day. CVE-2026-85046 allows arbitrary code execution inside the browser sandbox via a crafted HTML page. Google fixed it in Chrome 152.0.7977.82/.83. How the V8 type confusion works: thehackernews.com/2026/09/go…

JUST IN: Patch release v26.06.7 of Core Lightning (@core_ln) is now available, including patches for a bevy of recent LLM-powered security scans contributed from the wider open source community