🕵️ RESEARCH & DEEP DIVES
Hackers exploit 32 zero-days for $388,500 on day one of Pwn2Own Ireland 2026
Security researchers earned $388,500 after exploiting 32 zero-days on day one of Pwn2Own Ireland 2026, including two hacks of the Samsung Galaxy S26.- Applies to targets across seven categories: mobile phones (Samsung Galaxy S26, Google Pixel 10, iPhone 17), printers, smart home, AI infrastructure, AI coding apps, and wellness devices.
- Samsung Galaxy S26 was hacked three times (Viettel Cyber Security, Interrupt Labs, Ikotas Labs), though several bugs were known to the vendor; White Noise Club failed to exploit the Google Pixel 10 in time.
- VinSOC topped the leaderboard, chaining 7 zero-days against Philips Hue Bridge Pro ($40,000) and 5 zero-days against Oracle Autonomous AI Database ($40,000).
- Other successes: LiteLLM zero-days, Lexmark CX532adwe printer (including a single use-after-free), Sonos Era 300, Garmin Index BPM, and OpenAI Codex via a single argument-injection bug.
- ZDI gives vendors 90 days to patch before public disclosure; many day-one wins were marked as collisions with previously known bugs.
GitHub Copilot CLI can be tricked via encrypted 'Cryptographic Context Injection' pages into exfiltrating local secrets
Adversa AI researchers showed that encrypted web-page instructions can trick GitHub Copilot CLI in autopilot mode into reading local files and sending their contents to an attacker-controlled server.- Affects developers using GitHub Copilot CLI in autopilot mode when the agent is asked to fetch an external URL; GitHub says this is not a product vulnerability.
- Attack technique called Cryptographic Context Injection (CCI) hides malicious instructions as ciphertext that static prompt-injection filters cannot read.
- The page instructs the agent to decrypt content with Python; a decoy 'key' template makes the agent read local files (e.g. .env.prod) into the key, harvesting them before decryption 'fails'.
- A second valid key decrypts instructions telling the agent to fetch another URL, delivering the stolen data to the attacker; demo exfiltrated .env.prod contents in 28 seconds.
- Any agent-readable data is at risk, including source code, configs, credentials and tokens; Microsoft's mai-code-1.1-flash executed the chain in half of tests while GPT-5.6 models refused.
Sources 📄 Source: adversa.ai · 📎 Coverage: theregister.com · 👁 via Cyber Security News, cryptika.com (discovered)
📋 ADVISORIES
Apache Struts fixes four flaws enabling RCE, DoS and data disclosure in 7.4.0 and 6.12.0
Apache has fixed four Struts vulnerabilities that could enable remote code execution, denial-of-service, and data disclosure.- Affects Apache Struts applications across branches 2.x, 6.0.0–6.11.0, and 7.0.0–7.3.0; fixed in Struts 7.4.0 or 6.12.0
- CVE-2026-104711: OGNL injection in the legacy RESTful action mapper can lead to RCE via crafted requests; Struts 7 affected only if the OGNL allowlist is disabled
- CVE-2026-104712: BigDecimal parameters rendered via the Struts tag library let unauthenticated attackers exhaust CPU and bandwidth with low-volume traffic
- CVE-2026-104713 (Important): the optional REST plugin reads request bodies without a size bound, allowing heap exhaustion; fixed releases add a 2,097,152-character limit
- CVE-2026-104714: shared localized message formatters can leak one user's date/time values into another user's response under concurrent traffic
Sources 📄 Source: cwiki.apache.org · 📎 Coverage: cybersecuritynews.com · 👁 via Cyber Security News, cryptika.com (discovered)DNS root zone switches to KSK-2024 key-signing key on October 11, 2026
The DNS root zone will begin using only the new KSK-2024 key-signing key on October 11, 2026, and operators of DNSSEC-validating resolvers must verify they trust it.- Applies to operators of DNSSEC-validating recursive resolvers; unprepared validating resolvers can eventually fail to resolve domains across the internet, including unsigned domains.
- On 11 October 2026 the root zone starts signing only with KSK-2024 (key tag 38696), retiring the original key deployed in 2011; this is only the second root KSK rollover ever, after 2017.
- KSK-2024 has been published in the root zone since 11 January 2025 and became eligible for automatic RFC 5011 trust-anchor updates in February 2025, but operators should not assume automatic updates worked.
- Failures may emerge as cached root keys expire, often within 48 hours; RFC 8145 signalling and RFC 8509 trust anchor sentinels can be used to test resolver readiness.
- 2026 .de and .al DNSSEC incidents showed how validation failures higher in the DNS hierarchy can make otherwise healthy websites unreachable.
📋 CVEs & KEV
CVE-2026-63692 — Dell Container Storage Modules — CVSS 10.0 — Dell Container Storage Modules Missing Authentication Enables Unauthenticated Privilege Escalation
CVE-2026-105857 — payloadcms payload — CVSS 10.0 — Payload CMS Plugin RCE: Critical Unauthenticated Server Takeover
CVE-2026-105859 — payloadcms payload — CVSS 9.8 — Payload CMS Access Control Bypass Enables Unauthorized Data Manipulation
CVE-2026-105845 — payloadcms payload — CVSS 9.8 — Payload is a free and open source headless content manage...
CVE-2026-67273 — Dell Container Storage Modules — CVSS 9.6 — Dell Container Storage Modules Template Engine Flaw Allows Remote Privilege Escalation
📋 ADVISORIES
- 📄 Source for ASOS confirms data breach after hackers send 'HACKED' push notifications via its own app — tools.eurolandir.com