🕵️ RESEARCH & DEEP DIVES
Auktion NG Auktionssoftware password reset endpoint vulnerable to XSS (CVE-2026-96258)
A cross-site scripting vulnerability was disclosed in onSite internet GmbH Auktion NG Auktionssoftware's public password reset endpoint.- Affects onSite internet GmbH Auktion NG Auktionssoftware up to version 20260722.
- The /forgotpasswd.html file in the Public Password Reset Endpoint allows manipulation of the email argument, leading to cross-site scripting.
- The attack can be carried out remotely; the exploit has been publicly disclosed.
- The vendor was contacted early about the disclosure but did not respond.
- Severity is rated medium: CVSS 4.0 score 5.3 and CVSS 3.1 score 4.3.
Fast FAC1203R Gigabit Edition 2.0.4 stack overflow in Device Discovery Service (CVE-2026-96257)
A remotely exploitable stack-based buffer overflow was disclosed in the Fast FAC1203R Gigabit Edition router's Device Discovery Service.- Applies to Fast FAC1203R Gigabit Edition routers running firmware 2.0.4.
- The copy_msg_element function in the Device Discovery Service component is vulnerable to a stack-based buffer overflow (CWE-121).
- The flaw is remotely exploitable without authentication; CVSS scores are 10.0 (critical).
- A public exploit exists and the vendor was contacted but did not respond.
- Reported by xiaobor123 via VulDB (VDB-408707) as CVE-2026-96257.
CVE-2026-95957: XSS in SourceCodester Smart Attendance System QR Scanner 1.0 signup
A cross-site scripting vulnerability (CVE-2026-95957) was disclosed in SourceCodester Smart Attendance System with QR Code Scanner 1.0.- Affects SourceCodester Smart Attendance System with QR Code Scanner version 1.0, Self-Registration component.
- XSS via the full_name argument in the prepend function of student_signup.php (CWE-79).
- Remotely exploitable without authentication; exploit has been made public.
- CVSS 3.1 score 4.3 (Medium); reported by jinxing via VulDB.
Study: 4-bit quantization method affects PII leakage in fine-tuned small language models
Researchers show that the choice of 4-bit quantization method determines how much private fine-tuning data a small language model leaks.- Applies to organizations fine-tuning small language models (0.5-7B parameters) on private data and compressing them to 4 bits for deployment.
- Calibration-free GGUF Q4_K_M format reproduced 5.3% of planted private records, while calibration-based AWQ and GPTQ reproduced none on the primary model.
- AWQ leaked the least across five open models at every size and in both model families, with little accuracy loss at 3-7B parameters.
- The difference is attributed to calibration-induced rounding error in channels involved in rare-token prediction, making quantizer choice a deployment-time privacy decision.
- Code and per-seed results are public; the paper was accepted at SBSeg 2026.
CPyGraph: version-aware static analysis framework for native CPython bytecode released on arXiv
Researchers from Utah State University have released CPyGraph, a C++ framework for version-aware package-level static analysis of native CPython bytecode.- Applies to security researchers and tool builders analyzing Python packages across CPython releases 3.10 through 3.14
- CPyGraph uses version-specific adapters exposing stack, control, call, lexical, protocol, and exception semantics through a shared interface
- Combines an operand-stack-aware Andersen points-to analysis with call graph construction to a fixed point, supporting exception-aware CFGs, block-level CDGs, and interprocedural DDGs
- Evaluated on PYGBench (201 programs, 1,733 candidates): 91.40% precision and 100% recall on CPython 3.10; 1,328 of 1,334 version-invariant queries agree across CPython 3.10-3.14
- Matches PyCG on its 112-program call-graph benchmark
Community features in Android malware call graphs add signal but no stability under shift
A new study finds that community-structure features in Android malware function-call graphs add in-distribution signal but show no repeatable stability advantage under distribution shift.- Applies to graph-based Android malware classifiers evaluated on function-call graphs, where accuracy drops under malware-type or family distribution shifts
- Tested Leiden community descriptors against local degree profiles, global statistics, metadata, and size-matched random partitions using 15,000 MalNet-Tiny, Common, and Distinct graphs
- Communities raised MalNet-Tiny macro F1 from 78.7% to 81.3% but caused a 29.4-point degradation on source-only Common data
- Random partitions showed nearly identical degradation (27.8-27.9 points mean), with a 95% bootstrap interval of [-4.2, 1.2] points for random minus community degradation
- Authors used partition-matched controls, six pre-specified descriptors, five optimizer seeds, and two-level bootstrap to show mesoscopic graph claims require repeated null draws
📰 UNDER-REPORTED
JusticeRage Manalyze PE Parser pe.cpp _parse_relocations integer underflowA s... — CVE ThreatInt
A Vulnerability in F5 BIG-IP Access Policy Manager Could Allow for Remote Code Execution — CIS Advisories
Benchmarking Neural Defend ARCAS 1B: A Foundational Multimodal Deepfake Detection Model — arXiv cs.CR
Attack Success Rate Is Not a Number: On Measurement Validity in Agentic AI Security Evaluation — arXiv cs.CR
Controller-Only False Confirmation in Passive RF UAV Link Detection — arXiv cs.CR
SSP-Bench: A Hybrid Data Generation Framework for Safety, Security, and Privacy Evaluation — arXiv cs.CR
Quantum ROP: Using Quantum Algorithms for ROP Chain Selection in Exploit Construction — arXiv cs.CR
Identifying Suspected Mislabeled Apps in Google Play Application Removal Prediction: An Empirical Comparison of Label Noise Detection Methods — arXiv cs.CR
FASTAR: FRI Accelerator for Scalable Transparent ARguments of Knowledge — arXiv cs.CR
Rethinking Backdoor Repair Evaluation: Distinguishing Aggregate Clean Utility from Benign Performance Preservation — arXiv cs.CR
SLED-IFV: Solver-Validated LLM-Guided Decomposition for Scalable Hardware Information-Flow Verification — arXiv cs.CR
C-to-Rust Fallacy: Automatic Refactoring != Memory Security — arXiv cs.CR
GuidedRay: Diversity-Guided Direction Discovery for Targeted Hard-Label Black-Box Attacks — arXiv cs.CR
Adaptive Traffic Camouflage: Causal and Resource-Aware Defense Against IoT Fingerprinting — arXiv cs.CR
On the Construction of Trapdoor Claw-Free Functions with Certifiable Key — arXiv cs.CR
COBRA: A Content-Agnostic Framework for Zero-Day Detection of Suspicious Domains — arXiv cs.CR
LoRango: It Takes Two LoRAs to Unlock Hidden Behaviors in Diffusion Models — arXiv cs.CR
How It's Made: Uncovering Detection Engineering Processes for Network Intrusion Detection Rules — arXiv cs.CR
Toward Responsible AI-Augmented Cyber Defense: Pattern Recognition, Defense-in-Depth, and the Case for Human-AI Collaboration — arXiv cs.CR
Weekly update is up! We're live from Oslo with @ ScottHelme talking about the UniFi Travel Router, email signatures... — @troyhunt@infosec.exchange
ATT&CKing TACACS+ to Pwn Your Network via a Pre-Auth RCE - elttam — r/netsec
Leaked GitHub App private keys let researchers impersonate 440 apps including CDC and BuildBuddy — r/netsec