ThreatHuntersJournal
VulnerabilitySecurityWeek·2 days ago

Encrypted Prompts Bypass AI Safety Guardrails in Grok and Gemini

Researchers have identified a new attack technique called Cryptographic Context Injection that encrypts malicious instructions to evade safety guardrails in AI models including Grok and Gemini. The method works by concealing harmful prompts until they are decrypted within a trusted execution environment, effectively bypassing existing content filtering mechanisms. This vulnerability highlights a novel attack vector against popular large language models that defenders should monitor.

VulnerabilityThe Cyber Express·2 days ago

Microsoft Says CVSS 10.0 Entra ID Code Execution Flaw Was Exploited Before Server-Side Fix

Microsoft disclosed a maximum-severity unauthenticated remote code execution vulnerability in Entra ID (CVE-2026-69836, CVSS 10.0) that was exploited in the wild before the company applied a server-side fix to its infrastructure; the flaw stems from unsafe deserialization of untrusted data and affects the identity service underlying Microsoft 365, Azure, and Dynamics 365. Because Entra ID is a managed cloud service, Microsoft says remediation is complete with no customer action needed, but the advisory omits critical details including attribution, the exploitation window, affected tenant count, post-exploitation activity, and indicators of compromise—leaving security teams without independent means to verify exposure or review their own logs for signs of compromise.

VulnerabilityMalwarebytes Labs·2 days ago

Zombie Card: An expired Visa credit card can be used for purchases

Researchers have discovered that expiration dates on certain Visa credit cards can be manipulated to enable fraudulent transactions with expired cards, a vulnerability termed "Zombie Card" attacks. This finding demonstrates a potential weakness in Visa's payment validation mechanisms that could allow attackers to reactivate cards that should no longer be functional for purchases.

VulnerabilityBishop Fox·2 days ago

No Crash Required: Verifying the Citrix NetScaler SAML Patch for CVE-2026-8452

An unauthenticated attacker can exploit CVE-2026-8452 to corrupt memory in Citrix NetScaler's SAML parser through a single request, creating a potential remote code execution vector without requiring a system crash. Bishop Fox provides technical analysis of the patch, methods for verifying its deployment across multiple systems, and guidance on identifying exploitation attempts in security logs.

VulnerabilitySecurityWeek·2 days ago

Critical Isolated-vm Vulnerability Leads to RCE on Host

A critical type confusion vulnerability in isolated-vm enables V8 sandbox escape and allows attackers to hijack the control flow of the host process, ultimately achieving remote code execution. This vulnerability demonstrates how memory safety issues in JavaScript engines can be exploited to break out of isolation boundaries and compromise the underlying system.

VulnerabilityHelp Net Security·2 days ago

Critical Microsoft Entra ID vulnerability exploited in the wild (CVE-2026-69836)

Microsoft has patched a critical remote code execution vulnerability (CVE-2026-69836) in Entra ID, its cloud identity service that manages authentication and access controls for Microsoft 365, Azure, and third-party applications. The flaw carries a maximum CVSS score of 10.0 and has been exploited in active attacks, allowing unauthenticated attackers to execute code remotely. The vulnerability was discovered by Microsoft Principal Security Engineer Robert Fitzpatrick.

VulnerabilityCISA Advisories·2 days ago

CISA Adds One Known Exploited Vulnerability to Catalog

CISA has added CVE-2026-73570, an OS command injection vulnerability in Zimbra Collaboration Suite, to its Known Exploited Vulnerabilities Catalog based on active exploitation evidence. The addition underscores the vulnerability's severity as a frequent attack vector and reinforces BOD 26-04 requirements for federal agencies to prioritize rapid remediation of KEV-listed vulnerabilities on publicly exposed assets. CISA encourages all organizations to adopt risk-based vulnerability management practices and address cataloged vulnerabilities as a priority.

VulnerabilityThe Hacker News·2 days ago

Cisco Patches Nine Crosswork and Secure Workload Flaws, Five Scoring CVSS 10.0

Cisco has released security patches addressing nine vulnerabilities across its Crosswork and Secure Workload platforms, with five flaws rated at the maximum CVSS score of 10.0. Four of the vulnerabilities impact multiple Crosswork products including Data Gateway, Network Controller, and Planning, affecting systems regardless of device configuration. The updates are part of Cisco's ongoing comprehensive internal security review initiative.

VulnerabilitySecurityWeek·2 days ago

Microsoft Patches Exploited Entra ID Vulnerability

Microsoft has released 22 patches addressing vulnerabilities in Entra ID, including a flaw that has been actively exploited in the wild. The updates primarily target code execution, privilege escalation, and information disclosure issues within the identity platform.

VulnerabilityHelp Net Security·2 days ago

Citrix urges customers to fix critical NetScaler authentication bypass (CVE-2026-19490)

Citrix has released patches for two vulnerabilities in NetScaler ADC and NetScaler Gateway, with CVE-2026-19490 being a critical authentication bypass flaw that poses significant risk to affected deployments. The company is urging customers to immediately review their systems, determine if they are impacted, and upgrade to the recommended builds without delay.

VulnerabilitySecurityWeek·2 days ago

CISA Urges Immediate Patching of Exploited TrueConf Vulnerabilities

CISA has issued an urgent patching advisory for TrueConf vulnerabilities currently being exploited in active attacks. The Head Mare hacktivist group is leveraging these flaws to deploy PhantomCore malware, making immediate remediation critical for affected organizations.

VulnerabilityThe Hacker News·2 days ago

GitLab CVE-2026-19478 Comes Under Active Exploitation Within Days of Disclosure

A newly disclosed security flaw in GitLab has come under active exploitation within days of public disclosure, according to watchTowr. The vulnerability in question is CVE-2026-19478 (CVSS score: 9.4), a case of code injection that allows an unauthenticated attacker to modify or delete publicly accessible GitLab projects and rewrite their data under certain conditions without requiring

VulnerabilityThe Hacker News·2 days ago

Microsoft Patches Severe Entra ID Flaw (CVSS 10.0) Allowing Remote Code Execution

Update: The story was updated after publication to note that the vulnerability has not been exploited. Although the security bulletin originally marked the "Exploited" field under the Exploitability Assessment table as "Yes," on August 21, 2026, Microsoft corrected the "Exploited" status to "No" after The Hacker News contacted the company for comment. It also noted, "this vulnerability was not

VulnerabilityDark Reading·2 days ago

What We Missed: Delta Flight Disrupted With Wi-Fi Hack

In this video, Dark Reading editors discuss some of the news they didn't get a chance to cover, including some scary airplane security risks and the US government's newest "hack back" strategy.

VulnerabilityDark Reading·3 days ago

N-able Bug Exposes Password Vault Master Keys

N-able's Passportal password manager contained a vulnerability exposing master keys to the password vault, leaving sensitive credentials at risk for managed service providers and small-to-medium businesses. Despite the availability of patches, security concerns persist due to the product's cloud-based architecture, raising questions about whether such sensitive security tools should rely on cloud infrastructure at all.

VulnerabilityThe Hacker News·3 days ago

ThreatsDay: Gogs 10.0 RCE, n8n Workflow-to-RCE, $10M Reward, GLM-5.3 AI Exploit, and More

A lot of this week’s trouble starts with something trusted doing exactly what it was allowed to do. Signed drivers get turned against defenses. Legitimate apps help malware blend in. A weak header check opens a path to code execution. Elsewhere, exposed systems, old bugs, odd hiding tricks, and AI-assisted exploit research keep lowering the effort needed to cause damage. Nothing here needs

Load more