@_r_netsec

Follow for new posts submitted to the netsec subreddit. Unofficial.

 [root@netsec /]#
reddit.com/r/netsec/
Joined November 2014
  • Tweets18.6K
  • Following0
  • Followers34.3K
32Media
@[email protected] @r-netsec-bot.bsky.social
5
5,069
An attack that corrupts a LLM model about one specific fact - no file changes, no process, no network. Nothing to scan, and you can still detect. stealthium.io/blog/hands-off…

Hands Off: Detecting Model Weight Tampering

This article introduces Rank-One Model Editing (ROME) attacks, where a malicious Python module rewrites a model's weights in GPU memory to corrupt its answers, and explains why CPU-focused security...

stealthium.io
4
11
717
CVE-2026-108097 Deep Dive: Turning a Drupal Field UI Callback Into RCE fortbridge.co.uk/research/cv…

CVE-2026-108097 Deep Dive: Turning a Drupal Field UI Callback Into RCE - FORTBRIDGE

CVE-2026-108097: how a Drupal Field UI callback led to file disclosure and RCE in a paired lab. The contributed-module writer remains unverified.

fortbridge.co.uk
2
6
870
abuse list for ips · NicheDB nichedb.dev/traffic/review
780
PhantomBuffer: Effective EDR Evasion Through Stealth Injection zerosalarium.com/2026/10/Pha…

PhantomBuffer: Effective EDR Evasion Through Stealth Injection

PhantomBuffer EDR evasion uses stealth injection via SendMessage with WM_SETTEXT to effective bypass EDR (Endpoint Detection and Response)

zerosalarium.com
26
113
4,579
New web obfuscation technique where even just formatting rewrites script logic (Chromium DevTools, prettier, WebCrack, Terser and more) trustsig.eu/blog/javascript-…

Divergence: formatting a script can turn it into a different program, across 37+ JavaScript...

A formatter, minifier or deobfuscator can be made to turn one script into another. 186 techniques across 37+ JavaScript processors, from Chromium DevTools to WebCrack, plus a Tetris script that...

trustsig.eu
3
2
3
1,329
Web Environment Integrity vs. Private Access Tokens - They're the same thing! snellman.net/blog/archive/20…

Web Environment Integrity vs. Private Access Tokens - They're the same thing!

Why did people love Private Access Tokens but hate the Web Environment Integrity API? They're the same thing!

snellman.net
2
1
906
Deep-Dive into Android Binder UaF (CVE-2023-20938) using Time-Travel Debugging eshard.com/blog/kernel-uaf-1…

Kernel UaF to Root #1: Freeing an Object That’s Still in Use | eShard

A use-after-free in Android’s Binder driver, recorded once and replayed at will. Part 1 of a series building a full kernel exploit chain with time travel debugging.

eshard.com
2
4
1,129
Nadella Calls Your AI an Insider Risk. Lawmakers Already Put Your Name on the Liability Certification. galratner.substack.com/p/nad…
831
16% of RPKI-covered IPv4 routes still allow a forged-origin hijack that passes validation, the setup behind the Virtualizor update attack ipinfo.io/blog/rpki-protects…

RPKI Now Protects 70% of Internet Routes, Up From 54% a Year Ago | IPinfo.io

RPKI now protects 70% of Internet routes. See what drove the 2026 jump, how well it stops invalid routes, and where gaps remain.

ipinfo.io
1
2
1,200
CVE-2026-108082: Symfony ReDoS. One request. Seconds of CPU r3verii.github.io/cve/2026/1…

CVE-2026-108082: Symfony ReDoS. One request. Seconds of CPU

A trivial ReDoS in symfony/http-foundation, reachable by default and unauthenticated through Cache-Control: on Laravel + nginx it turns into an application-layer DoS

r3verii.github.io
2
3
1,328
The Cloudflare Appstore (Appflare) Malware Audit mainbrella.com/blog/the-clou…

The Cloudflare Appstore (Appflare) Malware Audit

139 catalog entries, 138 shipped bundles, and two apps whose outbound data sharing deserves a closer look.

mainbrella.com
1
4
1,279
PwnEscape: Guest-to-Host KVM Escape (CVE-2026-99999) pwn.ai/blog/pwnescape

PwnEscape: Guest-to-Host KVM Escape (CVE-2026-99999)

How a $1 million sandbox challenge led pwn to a Linux CHECKSUM_PARTIAL trust-boundary bug: a post-validation IPv4 header mutation, a 32-byte host-memory disclosure, and an owned-host VM escape.

pwn.ai
3
15
1,670
Exposing AdFection: How Discover-Tech Turned Targeted Ads Into a Pipeline for Zero-Click Mercenary Spyware citizenlab.ca/research/how-d…

Exposing AdFection: How Discover-Tech Turned Targeted Ads Into a Pipeline for Zero-Click Mercenary...

This is the first-ever public confirmation of zero-click mercenary spyware delivered via targeted ads. We call the technique AdFection, and show how it was used to infect devices at Al Jazeera with...

citizenlab.ca
6
1,309
Trivy and govulncheck found the same vulnerability, but the code wasn't in the binary a3thinker.it/articles/not-in…

Two scanners agreed, and the code was not in my binary - Luigi Iacuaniello

A scan of the web server my project builds reported a High-severity vulnerability in its HTTP/2 library. A second scanner, one that checks which functions a program actually calls, confirmed the...

a3thinker.it
1
1
1,072
Anthropic's Sept 2026 threat report: attackers prompt-injected an eval sandbox, stole customer API keys, then burned the victims' own compute to attack ~30 AI labs anthropic.com/threat-intelli…

Countering misuse of AI: September 2026 / Anthropic

Case studies from threat actors disrupted between December 2025 and August 2026 across seven areas of harm, from cyber operations to biological misuse.

anthropic.com
3
2
1,349
AhsayCBS Deep-Dive: Auth Bypass to RCE horizon3.ai/attack-research/…

AhsayCBS Auth Bypass & RCE: CVE Analysis

Technical analysis of CVE-2026-105133 and CVE-2026-105134 in AhsayCBS, revealing how authentication bypass and path traversal enable remote code execution.

horizon3.ai
1
2
5
1,344
[email protected]: A Worm With Valid Provenance, and the Firewall Rule That Stops It hextrap.io/blog/tensorlake05…

[email protected]: A Worm With Valid Provenance, and the Firewall Rule That Stops It

How the Shai-Hulud worm reached npm through [email protected], what it steals, how to check if you were affected, and how a 72-hour soak time blocks it.

hextrap.io
1
1,172
Vghost (CVE-2026-74580): Linux kernel vhost stale IOTLB cache leading to universal LPE and Guest-to-Host escape vector openwall.com/lists/oss-secur…
1
1,389
Passkeys are a trap nonfunctional.substack.com/p…
5
7
1,430
We Let AI Fuzz Adobe Reader for a Week. It Found a Critical Zero-Day CVE-2026-81983 remedio.io/blog/cve-2026-819…

Integer Overflow Vulnerability in Adobe Acrobat | CVE-2026-81983

CVE-2026-81983: an Adobe Acrobat integer overflow vulnerability that corrupts memory when a malicious PDF is opened.

remedio.io
2
11
61
3,652
Load more