🕵️ RESEARCH & DEEP DIVES
New Check Point flaw lets hackers execute code with root privileges — https://www.bleepingcomputer.com/news/security/check-point-warns-critical-flaw-lets-hackers-execute-code-as-root/
Claimed Bug Bounty Hunter Likely Used LLM to Build PhantomRaven npm Stealer — https://thehackernews.com/2026/09/claimed-bug-bounty-hunter-likely-used.html
A path traversal vulnerability has been identified in HCL AppScan 360° (CVE-2... — https://cve.threatint.com/CVE/CVE-2026-21822?utm_campaign=info&utm_medium=rss&utm_source=website
An improper certificate validation vulnerability in Email API in Synology Dis... — https://cve.threatint.com/CVE/CVE-2026-40539?utm_campaign=info&utm_medium=rss&utm_source=website
An improper restriction of excessive authentication attempts vulnerability in... — https://cve.threatint.com/CVE/CVE-2026-40538?utm_campaign=info&utm_medium=rss&utm_source=website
An exposure of sensitive information through data queries vulnerability in De... — https://cve.threatint.com/CVE/CVE-2026-40533?utm_campaign=info&utm_medium=rss&utm_source=website
Complianz GDPR/CCPA Cookie Consent Banner through 7.5.4 - Unauthenticated Stored C... — https://cve.threatint.com/CVE/CVE-2026-83561?utm_campaign=info&utm_medium=rss&utm_source=website
CSS & JavaScript Toolbox through 12.0.6 - Authenticated (Administrator+) Stored Cr... — https://cve.threatint.com/CVE/CVE-2025-13533?utm_campaign=info&utm_medium=rss&utm_source=website
A server-side request forgery (SSRF) vulnerability in PersonMail API in Synol... — https://cve.threatint.com/CVE/CVE-2026-40537?utm_campaign=info&utm_medium=rss&utm_source=website
A direct request ('forced browsing') vulnerability in Wallpaper Path in Synol... — https://cve.threatint.com/CVE/CVE-2026-40532?utm_campaign=info&utm_medium=rss&utm_source=website
An integer overflow or wraparound vulnerability in File Operation in Synology... — https://cve.threatint.com/CVE/CVE-2026-40531?utm_campaign=info&utm_medium=rss&utm_source=website
An improper neutralization of CRLF sequences ('CRLF injection') vulnerability... — https://cve.threatint.com/CVE/CVE-2026-40530?utm_campaign=info&utm_medium=rss&utm_source=website
HCL BigFix Service Management is affected by multiple security vulnerabilitie... — https://cve.threatint.com/CVE/CVE-2026-56595?utm_campaign=info&utm_medium=rss&utm_source=website
Brevo Supply Chain Attack Pushes WordPress Backdoors and ClickFix Malware to 100,000+ Sites — https://cybersecuritynews.com/brevo-supply-chain-attack/
Plugin4Shell Zero-Click RCE Hits Claude Code, Codex, Copilot and Gemini CLI — https://cybersecuritynews.com/plugin4shell-zero-click-rce/
AI-Powered Malware Rewrites Itself Every Hour to Evade Signature-Based Detection — https://cybersecuritynews.com/ai-powered-malware/
One Click in a Malicious VS Code Project Can Give Attackers Persistent Access to Your PC — https://cybersecuritynews.com/one-click-in-a-malicious-vs-code-project-give-persistent-access/
WordPress Urges Immediate Update After Fixing 11 Security Vulnerabilities — https://cybersecuritynews.com/wordpress-7-1-1-security-update/
Next.js on Windows is facing an immediate RCE threat. — https://www.reddit.com/r/cybersecurity/comments/1wjiq0d/nextjs_on_windows_is_facing_an_immediate_rce/
An idea I wanted to share in case anyone wants to use it — https://www.reddit.com/r/cybersecurity/comments/1wjl42y/an_idea_i_wanted_to_share_in_case_anyone_wants_to/