A PoC/exploit has been discovered for vulnerability in Ghostscript Vendor: Artifex Product: Ghostscript Description: A chain of memory-safety vulnerabilities in Ghostscript allows a malicious PostScript document to bypass the "-dSAFER" security sandbox and execute attacker-controlled shell commands. A use-after-free condition enables disclosure of heap memory, while an out-of-bounds heap write allows modification of the sandbox path-control state, resulting in arbitrary command execution with the privileges of the Ghostscript process. Link: github.com/v12-security/pocs…

RCE in Gitea (CVE-2026-60004) Read on dbugs: dbu.gs/news/rce-in-gitea-cve… The "diffpatch" endpoint in Gitea is affected by a vulnerability that allows remote code execution (RCE). The endpoint accepts a patch from the user and applies it to the repository. To do this, Gitea runs the command "git apply --index --recount --cached --binary -3" inside a bare temporary clone of the target repository. The vulnerability affects Gitea 1.17–1.27.0 and was fixed in 1.27.1; its CVSS score is 9.8. To understand where the RCE comes from, let’s break down three independent facts. Fact 1: the "-3" flag enables a fallback three-way merge. In normal operation, "git apply" fails with an error on a conflict. With the "-3" flag (on Git ≥ 2.32), Git attempts to resolve the conflict through a three-way merge. If the merge succeeds, Git can write the file to disk. Without "-3", this code path does not exist. Fact 2: an add/add collision forces this path. If the same crafted patch is submitted twice, the second time Git sees that the file already exists in the index and is being added again—this is an add/add collision. In normal mode, the "apply" operation would fail, but with "-3", a three-way merge takes place, and the file is written to disk. The operation was intended to update the index, but in practice the file ends up on disk. Fact 3: in a bare clone, the repository root is "$GIT_DIR". In an empty repository, there is no working directory—the repository root is also the "$GIT_DIR", where "hooks/" is located. Therefore, a file written to "hooks/post-index-change" lands directly in the active Git hooks directory. In a non-bare clone, "hooks/" is located inside ".git/", and a file written to the same relative path would instead be placed in the working tree, not in ".git/hooks/". Putting the three facts together: 1. Create an account with a repository and obtain write access. 2. The first created patch writes the payload to "hooks/post-index-change"—but only to the index, not to disk. 3. The second patch triggers an add/add collision → Git switches to a three-way merge → checks the payload file out to disk at "hooks/post-index-change" in the active hooks directory. 4. Git writes the index and triggers the "post-index-change" hook 5. The hook runs as the Gitea service account—this is RCE. The "diffpatch" route requires write access to the repository. However, Gitea ships with open registration enabled by default, and on instances where it has not been disabled, an external attacker can complete the entire chain without an existing account—by registering and creating a repository. The problem class is broader than Gitea. The underlying issue is not specific to Gitea itself: a self-hosted SCM frontend can be vulnerable if it applies attacker-controlled patches in a bare temporary repository using "git apply -3", allowing a three-way fallback to write files into "$GIT_DIR". Forgejo, a Gitea fork, is affected by the same underlying pattern. The vulnerability was actively exploited as part of the Red Heron campaign. Acronis reported that the group weaponized CVE-2026-60004 against internet-facing Gitea instances and used the resulting access for source-code theft, credential collection, persistence, and lateral movement. The campaign also involved the JITTERLY implant, which contained the SIXZUT LD_PRELOAD rootkit. Advisory: github.com/go-gitea/gitea/se… PoC: github.com/HORKimhab/CVE-202… Campaign and implant analysis: acronis.com/en/tru/posts/red… CVE-2026-60004 — PT-2026-65725: dbu.gs/vulnerability/PT-2026…

A PoC/exploit has been discovered for vulnerability CVE-2026-14281 PT ID: PT-2026-98362 Vendor: WordPress/101gen Product: Automation Web Platform – Notifications and OTP for WooCommerce Description: The Automation Web Platform – Notifications and OTP for WooCommerce, Advanced Country Code plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.8.6. This is due to missing permission enforcement on the publicly accessible REST route "POST /wp-json/wawp/v1/signup/<op>" and the absence of a key allowlist in the "finish_registration_logic" function, which copies the attacker-controlled "wawp_custom_fields" parameter directly into "update_user_meta()" — allowing sensitive meta keys such as "wp_capabilities" and "wp_user_level" to be set by the caller. This makes it possible for unauthenticated attackers to register a new account with the administrator role and gain full administrative access to the site. When OTP verification is enabled at signup, the OTP session token ("otp_transient") is returned in plaintext in the HTTP response body, and the "handle_magic_link_request()" handler marks that token as verified on any unauthenticated GET request containing it without ever checking the OTP code value — making the OTP step trivially bypassable with no inbox or SMS access required. References: • dbu.gs/vulnerability/PT-2026… • github.com/murrez/cve-2026-1…

A PoC/exploit has been discovered for vulnerability CVE-2026-94128 PT ID: PT-2026-96033 Vendor: BioStar Product: VIVID LED DJ Description: A security vulnerability has been detected in BioStar VIVID LED DJ 4.0.2411.1500. This affects the function sub_1105C of the file BS_LED64.sys of the component IOCTL Handler. The manipulation of the argument AssociatedIrp leads to write-what-where condition. Local access is required to approach this attack. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way. References: • dbu.gs/vulnerability/PT-2026… • github.com/lzty/cve-2026-941…

A PoC/exploit has been discovered for vulnerability CVE-2026-93485 PT ID: PT-2026-95257 Vendor: Automattic Product: WordPress Description: Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Automattic WordPress core allows DOM-Based XSS. The Unauthenticated Stored XSS vulnerability in the WordPress core can be reproduced on a default WordPress installation. Comment moderation is disabled by default, and the requirement for commenters to have a previously approved comment can be bypassed. References: • dbu.gs/vulnerability/PT-2026… • github.com/deathshotxd/comme…

A PoC/exploit has been discovered for vulnerability CVE-2026-94127 PT ID: PT-2026-96761 Vendor: F5 Product: BIG-IP Description: When a BIG-IP APM access policy and an OAuth profile are configured on a virtual server, specific malicious traffic can lead to remote code execution (RCE). This vulnerability is only present when BIG-IP APM is configured as an OAuth Authorization Server. Deployments using APM strictly as an OAuth Client / Resource Server (without OAuth authorization server profiles configured) are not affected by this vulnerability. Impact: This vulnerability allows an unauthenticated attacker to perform remote code execution. The BIG-IP system in Appliance mode is also vulnerable. This is a data plane issue; there is no control plane exposure. References: • dbu.gs/vulnerability/PT-2026… • github.com/watchtowrlabs/wat…

A PoC/exploit has been discovered for vulnerability CVE-2026-12227 PT ID: PT-2026-97774 Vendor: WordPress/visualcomposer Product: Visual Composer Website Builder Description: The Visual Composer Website Builder plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 45.16.0 via the "vcv-template" parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included. References: • dbu.gs/vulnerability/PT-2026… • github.com/murrez/cve-2026-1…

ZTE SmartLife: Four Vulnerabilities and Account Takeover via Password Reset Read on dbugs: dbu.gs/news/zte-smartlife-fo… Researcher Mina Nageh Salama discovered a chain of four vulnerabilities in the ZTE SmartLife app that enabled account takeover without knowing the password. The entry point was CVE-2026-86555 (dbu.gs/vulnerability/CVE-202…): the Android app contained a hardcoded AES-128-GCM key that could be used to decrypt "result.data" returned by the public "/api/getUacSignInfo" endpoint. This exposed the client key, shared secret, access key, identifiers, and other data required to reconstruct a valid SmartLife app-auth context. Next, CVE-2026-86554 (dbu.gs/vulnerability/CVE-202…) made it possible to use "/account/verify.serv" to determine whether a given email address was registered and, for a registered account, obtain its internal "accountId". The key issue, CVE-2026-86553 (dbu.gs/vulnerability/CVE-202…), was in "/account/password/reset.serv": the endpoint accepted an "accountId" and a new password without requiring the old password, a reset code, or a verified reset transaction. The researcher tested the chain on his own account — the old password stopped working after the reset, while the attacker-selected new password produced a valid SmartLife session. The fourth issue, CVE-2026-86552 (dbu.gs/vulnerability/CVE-202…), allowed an arbitrary email address to be registered before ownership of the mailbox was verified, creating an account-squatting opportunity. Static analysis showed that the "token" and "accountId" obtained after login are passed to the ZTE Homecare SDK, which exposes APIs for homes, devices, cameras, sensors, sharing, cloud-to-device commands, and other functionality. However, the author confirmed exploitation only of the account flow; the broader Homecare attack surface was mapped through static analysis rather than exploited. Account deletion without a user token was also observed on an earlier runtime-selected backend. However, ZTE stated that this behavior was limited to a test environment and that the production path requires a token, so it was excluded from the four production CVEs. All four confirmed vulnerabilities have been fixed by ZTE. The author published technical details and PoCs, with live validation performed only against researcher-controlled accounts. Article: minanagehsalalma.github.io/z… PoC: github.com/minanagehsalalma/… CVE-2026-86552 — PT-2026-95905: dbu.gs/vulnerability/PT-2026… CVE-2026-86553 — PT-2026-95906: dbu.gs/vulnerability/PT-2026… CVE-2026-86554 — PT-2026-95940: dbu.gs/vulnerability/PT-2026… CVE-2026-86555 — PT-2026-95942: dbu.gs/vulnerability/PT-2026…

CVE-2026-66804: dangling COM registration leads to SYSTEM in Windows Read on dbugs: dbu.gs/news/cve-2026-66804-d… James Forshaw from Google Project Zero analyzed CVE-2026-66804 (dbu.gs/vulnerability/CVE-202…) — an LPE in Windows caused by an incomplete fix for the earlier CVE-2026-50343 (dbu.gs/vulnerability/CVE-202…) (Dark Elevator). The system retained a CrossDevice COM registration with the CLSID "{E9F83CF2-E0C0-4CA7-AF01-E90C70BEF496}", pointing to a missing "%PROGRAMDATA%\CrossDevice\CrossDevice.Streaming.Source.dll". Because regular users can create directories under "C:\ProgramData", an attacker can plant their own DLL at the expected path. The main challenge is getting a privileged process to load it. Forshaw used custom COM marshaling: an object implementing "IMarshal" can specify an arbitrary CLSID to use during unmarshaling, causing the COM runtime to look up the corresponding in-process server and load its DLL. Exploitation therefore requires a privileged COM server that does not disable custom marshaling. Forshaw found one in the Shell Create Object Handler, hosted in "dllhost.exe" as "NT AUTHORITY\SYSTEM" with "CustomMarshalAllowed=True". A regular user can start the privileged server through the "\Microsoft\Windows\Shell\CreateObjectTask" scheduled task, after creating the global "ShellCreateObjectTaskReadyEvent" event. The attacker can then pass a specially crafted COM object to the "ICreateObject" interface. During unmarshaling, COM resolves the CrossDevice CLSID and loads the planted DLL from "%PROGRAMDATA%" into the SYSTEM process, resulting in privilege escalation. Forshaw published a fully working exploit. He also included a PowerShell script using "OleViewDotNet" and "NtObjectManager" to identify other registered in-process COM classes whose DLLs cannot be found by "LoadLibrary". The resulting paths must then be manually checked to determine whether an attacker can plant a DLL there. Forshaw notes that the same exploitation technique can simplify exploitation of other dangling COM registrations and can also be applied to buggy custom COM unmarshalers. Article: projectzero.google/2026/09/w… PoC: project-zero.issues.chromium… CVE-2026-50343 — PT-2026-58331: dbu.gs/vulnerability/PT-2026… CVE-2026-66804 — PT-2026-70703: dbu.gs/vulnerability/PT-2026…

WerEnc.dll: A Microsoft library as an attacker-controlled encryption primitive Read on dbugs: dbu.gs/news/werenc-dll-a-mic… Researcher Mr.Z (0xsp) demonstrated how to turn a signed Microsoft library "WerEnc.dll" into an attacker-controlled payload encryption mechanism — without implementing cryptography from scratch. "WerEnc.dll" ships with Windows 10 1607+ and Windows 11 and exports the undocumented "EncryptDumpFile" and "EncryptDumpStream". The library generates a random 32-byte AES-256 key and a 16-byte IV, encrypts the data with AES-CBC, and separately wraps the key and IV with Microsoft's built-in RSA-4096 public key. Since the resulting session material cannot be decrypted without the corresponding private key, the author implemented BYOK (Bring Your Own Key) by replacing the built-in RSA public key directly in process memory. The library's ".rdata" section contains a 539-byte "BCRYPT_RSAKEY_BLOB" holding an RSA-4096 public key. "BCryptImportKeyPair" reads it directly from the mapped image, so the PoC locates the blob using the "RSA1" magic, uses "VirtualProtect" to make the region writable, and replaces the 539-byte blob with one containing the operator's own RSA-4096 public key. After that, "WerEnc.dll" continues to perform cryptographic operations through Windows CNG, but the AES key and IV are now RSA-encrypted with the operator's key. The corresponding private key can then be used to recover them from the container and decrypt the payload with AES-256-CBC. The author also reconstructed the container format: a 64-byte header, a 539-byte RSA blob, two 512-byte RSA blocks containing the wrapped AES key and IV, followed by the ciphertext. RSA wrapping in "EncryptDumpFile" uses PKCS#1 padding, while the stream path uses OAEP-SHA256. The practical PoC supports pre-encrypted ".byok.enc" files, encrypting a raw payload through "WerEnc.dll" in memory, and a beacon mode in which the stager receives BYOK keys from an HTTP C2, keeps them in memory, and patches the library after launch. The researcher thus demonstrated the abuse of a legitimate Windows cryptographic component: AES/RSA operations are performed by a Microsoft DLL through native CNG rather than by custom cryptographic code in the loader. Article: 0xsp.com/research/turning-we… PoC: github.com/0xsp-SRD/0xsp.com…

Two pre-auth vulnerabilities in VMware vCenter: authentication bypass and RCE Read on dbugs: dbu.gs/news/two-pre-auth-vul… Raphaël Dray of Mobeta analyzed CVE-2026-59309 (dbu.gs/vulnerability/CVE-202…) and CVE-2026-59310 (dbu.gs/vulnerability/CVE-202…) — two critical VMware vCenter vulnerabilities that can be exploited without prior authentication. CVE-2026-59309 (dbu.gs/vulnerability/CVE-202…) — an authentication bypass in VMware Directory Service ("vmdird"). The flaw was in the Cyrus SASL "libsrp.so" library, which implements SRP (Secure Remote Password) for LDAP authentication. The server checked that the public value "A" was greater than zero but omitted the required "A mod N != 0" check. By sending "A = N", an attacker can obtain a predictable shared secret and generate a valid authentication proof without knowing the password. The researcher confirmed the attack by performing an SRP bind as "administrator@vsphere.local" without a password and gaining access to the vSphere SSO directory. Patch diffing showed that the fix added the missing modulo check in "srp_server_mech_step2". CVE-2026-59310 (dbu.gs/vulnerability/CVE-202…) affects vCenter's Syslog infrastructure. Sender-controlled "HOSTNAME" and "APP-NAME" values were inserted into "rsyslog" output paths without protection against path traversal. A specially crafted Syslog message allows an attacker to escape "/var/log/vmware/" and write a file to an arbitrary location where "rsyslog" has write permission. The researcher demonstrated writing to the VAMI web root and confirmed RCE, but intentionally did not disclose the full code-execution chain. Exploitation requires network access to the Syslog listener — UDP/TCP 514 or TLS Syslog. "rsyslog" itself is not vulnerable: the issue was in VMware's configuration template, and the fix uses "secpath-replace" to sanitize attacker-controlled path components. Mobeta's analysis compares the vulnerable vCenter 8.0.3.00900 with the fixed 8.0.3.01000, in which both issues are patched. Article: mobeta.fr/blog/vcenter-cve-2… CVE-2026-59309 — PT-2026-65832: dbu.gs/vulnerability/PT-2026… CVE-2026-59310 — PT-2026-65833: dbu.gs/vulnerability/PT-2026…

Sale of 0-day exploits for FiberHome and GL.iNet networking equipment Read on dbugs: dbu.gs/news/sale-of-0-day-ex… Vulnerability Type: RCE / Authentication Bypass / Local Privilege Escalation / Information Disclosure Products: GL.iNet GL-BE9300 (Flint 3), FiberHome routers/ONT Affected versions: GL.iNet firmware 4.10.0; FiberHome — unknown The author claims to have discovered a set of vulnerabilities in FiberHome and GL.iNet networking equipment while analyzing firmware using AI, and then verified the results manually. In the case of GL.iNet, the device in question is presumably the GL-BE9300 (Flint 3) running firmware 4.10.0. This is a current tri-band Wi-Fi 7 router designed for home and small office use. The published PoC demonstrates several attack chains. Via SSH, the author demonstrates obtaining a root shell without a password and full RCE. The second method involves connecting to the Wi-Fi network, followed by logging in via SSH as root. Through the Web UI, the researchers report bypassing authentication with an empty root password: while arbitrary commands cannot be executed this way, system operations such as reboot, factory reset, and service restart are available. The second part of the research concerns FiberHome—a manufacturer of GPON/ONT equipment that operators install for subscribers in FTTH networks. The company officially positions its GPON ONTs for home and SOHO fiber connections. Regarding FiberHome, the researcher reports several independent issues: a command execution mechanism, an additional vulnerability in the /boa/frm web interface handler and related CmdType, as well as an authentication issue—the “fiberhome” key used for HMAC, he claims, is extracted directly from the client-side JavaScript. The author has not publicly disclosed the exact models, firmware versions, or exploitation details. Separately, the author claims that there are approximately 1.1 million potentially accessible devices on the open internet.

Sale of access to pharmaceutical company Pfizer’s corporate GitHub, including internal repositories and their management Read on dbugs: dbu.gs/news/sale-of-access-t… Industry: Pharmaceuticals / Biopharmaceuticals Revenue: $62 billion

What the EU cyber threat landscape looked like in 2025 Read on dbugs: dbu.gs/news/what-the-eu-cybe… The European Union Agency for Cybersecurity (ENISA) analyzed (enisa.europa.eu/sites/defaul…) 8 257 recorded incidents affecting the EU in 2025. One of the most interesting contrasts is that raw attack counts are a poor reflection of their actual impact: large-scale DDoS attacks and hacktivism significantly inflate the number of events, drawing attention away from less frequent financially motivated attacks and cyberespionage with more serious consequences. • DDoS accounted for 51.3% of all events, while hacktivism accounted for 57.3%, although most DDoS attacks had limited impact. Financially motivated attacks and cyberespionage accounted for just 29.3% and 6.3% of events, respectively, yet ENISA considers the former the primary short-term threat and the latter a significant strategic threat over a longer time horizon. • The government sector ranked first by number of attacks, at 31.8%. However, 81.8% of events were DDoS attacks, and their consequences were usually limited to temporary disruptions of public services. In other words, the leading position of government organizations largely reflects the intensity of hacktivism rather than the number of incidents with serious consequences. • Manufacturing ranked only fourth by total number of incidents, with a 6.9% share, but it suffered the highest share of ransomware attacks in the EU (25.2%). Ransomware was present in 82.8% of financially motivated attacks against manufacturing, causing disruptions to core IT systems and production processes. • The financial sector accounts for only 5.6% of the overall statistics, yet it accounted for 10% of all reviewed incidents with significant impact. ENISA specifically highlights attacks through suppliers, SaaS, cloud services, and other shared infrastructure. Ransomware attacks are also showing a shift toward data theft: exfiltration over a command-and-control channel occurred in 73.3% of the incidents studied, while encryption occurred in 13.7%. The report also focuses on hacktivism and information operations: • Hacktivism. ENISA recorded 4 709 hacktivist claims, with 45.8% of this activity targeting the government sector. More than 89% of the claims involved DDoS attacks, but the actual impact was significantly more limited: when one campaign was analyzed, target unavailability was independently confirmed for only 23.8% of the claimed attacks. • Information operations (FIMI). The European External Action Service (EEAS) recorded 540 FIMI incidents. They used around 10.5 thousand dissemination channels — from news websites to social media accounts — and approximately 43 thousand individual pieces of content across 19 platforms. 65% of the episodes remained unattributed, 29% were linked to Russia, and 6% to China. Although the report describes the situation in the EU, its main conclusion applies more broadly: the number of recorded incidents alone is a poor indicator of the actual level of risk. Large-scale and highly visible attacks have a greater effect on the statistics, but the most serious consequences are often associated with less frequent yet deeper and more persistent compromises.

LPE Quartet: four Linux kernel bugs with PoCs to root Read on dbugs: dbu.gs/news/lpe-quartet-four… Researcher Asim Viladi Oglu Manizada published details of four Linux kernel vulnerabilities that had existed for 10 to 21 years. For each one, he developed a PoC demonstrating local privilege escalation to root. DirtyAH6 — CVE-2026-80844 (dbu.gs/vulnerability/CVE-202…).In IPv6 IPsec AH, "ipv6_rearrange_rthdr()" did not check that "segments_left" did not exceed the number of segments, allowing "memmove()" to go out of bounds. The PoC corrupts "skb_shared_info", replaces "pam_rootok.so" with "pam_permit.so", and gains root through "su". TUNderflow — CVE-2026-81000 (dbu.gs/vulnerability/CVE-202…). An integer underflow in "SKB_MAX_HEAD()" during receive-headroom calculation for TUN/TAP causes subsequent pointer arithmetic to place "skb->data" outside the allocated buffer. An out-of-bounds write through Open vSwitch then lets the PoC modify a file-backed pipe buffer and gain root through PAM. PPPoEject — CVE-2026-68121 (dbu.gs/vulnerability/CVE-202…). "pppoe_sendmsg()" stores a pointer inside the skb, even though the skb head can be reallocated and the old allocation freed during "dev_hard_header()". Subsequent writes through the stale pointer allow the PoC to corrupt "struct file" and ultimately set root credentials. DiagSpill — CVE-2026-74469 (dbu.gs/vulnerability/CVE-202…). In SCTP, the 16-bit "transport_count" wraps at 65,536 peer transports. "sctp_diag" then reserves no space for the peer list but copies all of it, producing an approximately 8 MiB out-of-bounds write from a Netlink buffer. The PoC corrupts page tables, maps host memory through them, finds a credential object, and rewrites it to gain root. The first three published LPEs use unprivileged user namespaces, although the affected paths are also accessible to processes with the necessary capabilities. DiagSpill does not require user namespaces or special capabilities if SCTP and "sctp_diag" are available. Two of the bugs have limited remote scenarios. DirtyAH6 can cause memory corruption on an IPv6 router/gateway with AH transport mode. In a lab environment, the author achieved remote root after preliminary memory grooming, but considers fully remote memory grooming extremely difficult. With SCTP ASCONF/ADD-IP enabled, DiagSpill allows remote corruption/DoS; however, the author found no practical path to remote root. The vulnerabilities were discovered as part of AI-assisted vulnerability hunting: the author combined graph-based tracking of security-relevant objects with agent tooling for analyzing memory state. The first stable kernel releases containing all four fixes are: 5.10.270, 5.15.221, 6.1.188, 6.6.157, 6.12.109, 6.18.50, and 7.2.4. Article: heyitsas.im/posts/lpe-quarte… PoC (DirtyAH6): github.com/manizada/DirtyAH6 PoC (TUNderflow): github.com/manizada/TUNderfl… PoC (PPPoEject): github.com/manizada/PPPoEjec… PoC (DiagSpill): github.com/manizada/DiagSpil… CVE-2026-74469 — PT-2026-72921: dbu.gs/vulnerability/PT-2026… CVE-2026-80844 — PT-2026-85722: dbu.gs/vulnerability/PT-2026… CVE-2026-81000 — PT-2026-90130: dbu.gs/vulnerability/PT-2026…

BragJack: one extension targeting the AI agents of five browser products Read on dbugs: dbu.gs/news/bragjack-one-ext… Gal Weizman of Forever Security presented BragJack — a series of attacks on the AI features of Chrome Gemini Live, Perplexity Comet, Microsoft Edge Actions, Opera Neon, and Claude in Chrome using a Chromium extension. The attacks build on a technique Weizman calls DiNneR Serving, which abuses "declarativeNetRequest" (DNR). A malicious extension can modify security-related HTTP headers and redirect JavaScript requests which, combined with product-specific flaws, can interfere with trusted AI interfaces. In Chrome, DNR unexpectedly continued to work inside the "gemini.google.com" WebView embedded in the privileged "chrome://glic". The researcher removed CSP restrictions, redirected JavaScript loading, and achieved JavaScript execution in the Gemini context, from which he could directly invoke GLIC capabilities. This provided access to websites, local files and directories via "file://", PDFs and screenshots, and profile information. The research also showed that GLIC exposes camera and microphone capabilities that could potentially be invoked without a new permission prompt if Gemini had already been granted access.The vulnerability was assigned CVE-2026-0628 (dbu.gs/vulnerability/CVE-202…). Unlike the other four cases, however, the author's results table does not classify the Chrome issue as a full browser-agent hijack. In Comet, Edge, Opera Neon, and Claude in Chrome, the attacks enabled Prompt Forcing — directly passing an arbitrary instruction to the AI agent through an interface it already trusts. Unlike Prompt Injection, the attacker does not need to convince the model to follow instructions hidden inside untrusted content. For example, in Comet, the researcher could invoke "START_AGENT" and instruct the agent to open email, collect messages, and send them to another address. Edge, Opera Neon, and Claude exposed comparable agent-control paths through their own integration flaws. After the extension was installed, the demonstrated chains required no additional user clicks, although the Edge and Claude exploits used the extension's "debugger" permission to synthesize a user click. The research resulted in $20,500 in bug bounties and two CVEs: CVE-2026-0628 (dbu.gs/vulnerability/CVE-202…) for Chrome and CVE-2026-55945 (dbu.gs/vulnerability/CVE-202…) for Edge. Article: forever.security/blog/bragja… CVE-2026-0628 — PT-2026-1549: dbu.gs/vulnerability/PT-2026… CVE-2026-55945 — PT-2026-55610: dbu.gs/vulnerability/PT-2026…

A PoC/exploit has been discovered for vulnerabilities CVE-2026-52910 and CVE-2026-80521 PT ID: PT-2026-50928 Vendor: Linux Product: Linux Kernel Description: CVE-2026-52910 is a use-after-free vulnerability in the Linux kernel's reuseport classic BPF handling, while CVE-2026-80521 is a race condition in AF_UNIX garbage collection that can result in access to partially freed kernel objects. Exploitation of these vulnerabilities can allow an attacker with code execution inside a container to corrupt kernel memory and escape container isolation. References: • dbu.gs/vulnerability/PT-2026… • github.com/Markakd/Container…

A PoC/exploit has been discovered for vulnerability CVE-2026-62878 PT ID: PT-2026-70575 Vendor: Microsoft Product: Windows DNS Server Description: A stack-based buffer overflow vulnerability in Windows DNS Server allows an unauthenticated remote attacker to corrupt memory by sending specially crafted DNS queries. Successful exploitation can lead to denial of service and may allow arbitrary code execution in the context of the DNS Server process. Microsoft classifies the vulnerability as a remote code execution vulnerability. References: • dbu.gs/vulnerability/PT-2026… • github.com/nmlz/CVE-2026-628…

CVE-2026-77179: Docker container escape to the macOS filesystem Read on dbugs: dbu.gs/news/cve-2026-77179-d… Researcher Oren Yomtov of Accomplish discovered CVE-2026-77179 (dbu.gs/vulnerability/CVE-202…) — a sandbox escape in Docker’s hypervisor for Mac that allows code running inside a container to gain complete read and write access to the host filesystem. The issue lies in virtio-fs, which Docker VMM uses to expose mounted directories to containers. When the guest first accesses a path, the file server returns a "nodeid" and stores the path. On subsequent requests, the guest refers to the file by "nodeid", so the server has to resolve it again. It first tries to locate the file by inode through macOS "volfs"; if that fails, it falls back to the path string saved during the initial lookup. The attacker creates and opens a file inside the permitted mount and keeps the handle open, preventing the server from dropping its "nodeid". The file and its parent directory are then deleted, removing the "volfs" path, and the directory is replaced with a symbolic link to an arbitrary location on the host. When virtio-fs falls back to the stored path, its check still sees a path inside the permitted mount, but macOS follows the symlink when opening it and resolves the request outside the mount. This gives the container access to host files. The author demonstrates the escape in just three lines of Bash. This is not a remote attack on its own: an attacker needs the ability to execute code inside the container. The issue is particularly relevant to AI agents, which routinely execute untrusted code and rely on the sandbox to isolate it from the host system. The vulnerability was fixed in Docker Sandboxes 0.42.0 and Docker Desktop 4.88.0. Docker Desktop is affected on macOS only when Docker VMM is selected as the Virtual Machine Manager. Docker committed the fix to Sailor, the internal name of its hypervisor, about 31 hours after receiving the report. Docker Desktop 4.88.0 shipped the fix on August 24, and Docker Sandboxes 0.42.0 followed on September 7. Article: accomplish.ai/blog/escaping-… CVE-2026-77179 — PT-2026-92018: dbu.gs/vulnerability/PT-2026…

A PoC/exploit has been discovered for vulnerability CVE-2026-62878 PT ID: PT-2026-70575 Vendor: Microsoft Product: Windows DNS Server Description: A stack-based buffer overflow vulnerability in Windows DNS Server allows an unauthenticated remote attacker to corrupt memory by sending specially crafted DNS queries. Successful exploitation can lead to denial of service and may allow arbitrary code execution in the context of the DNS Server process. Microsoft classifies the vulnerability as a remote code execution vulnerability. References: • dbu.gs/vulnerability/PT-2026… • github.com/nomi-sec/PoC-in-G…