Zero Day Initiative | Blog - TheNote.app

Zero Day Initiative | Blog
Follow

The Zebra Dining is an online blog that focuses on dining and lifestyle services. They share various articles and guides related to food, restaurants, and dining experiences. Their blog offers reviews, recommendations, and insights that help readers enhance their dining experiences and lifestyle.

Zero Day Initiative - Blog thezdi.com

RSS zerodayinitiative.com

RSS Hunter • Aug 19, 2024

Thread Of Notes

The September 2026 Security Update Review

The September 2026 patch releases from Adobe and Microsoft address a significant number of vulnerabilities. Adobe issued ten bulletins, covering 172 CVEs across products like ColdFusion, Acrobat Reader, Commerce, and Experience Manager. The most critical Adobe patch addresses an actively exploited template-engine injection in Adobe Commerce. Microsoft's release is particularly large, with nearly 1,000 new CVEs impacting a wide range of products including Windows, Office, and Azure. Only one Microsoft vulnerability was listed as being actively exploited in the wild. Key Microsoft vulnerabilities include privilege escalation bugs in Windows Update Stack and ALPC, and a critical remote code execution flaw in Exchange Server. Over twenty of Microsoft's patches are classified as potentially wormable, allowing remote, unauthenticated attackers to execute code without user interaction. This includes vulnerabilities in DHCP Server, Active Directory, and DNS Server. The sheer volume of patches highlights the ongoing challenge of maintaining system security in the current threat landscape. Users are urged to prioritize patching, especially for actively exploited vulnerabilities and those with high severity ratings. The trend suggests an increasing reliance on AI for vulnerability discovery, leading to larger patch releases.

https://www.thezdi.com/blog/2026/9/8/the-september-2026-security-update-review thezdi.com

RSS Hunter • Yesterday

The August 2026 Security Update Review

The latest security patches from Adobe and Microsoft have been released, with Adobe addressing 51 unique CVEs in various products, including ColdFusion, Commerce, Lightroom Classic, Content Credentials SDK, and Adobe Campaign Classic. The patches from Adobe are considered critical, with the highest CVSS score being 10.0, and are recommended to be deployed as soon as possible, especially for Campaign Classic and ColdFusion. Microsoft's release includes 398 new CVEs, with 62 rated as Critical, and only one listed as being under active attack. The Microsoft patches impact a wide range of products, including Windows, Office, and Azure, and include several remote code execution vulnerabilities. One notable vulnerability is the Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability, which allows attackers to execute code at SYSTEM level. Another significant vulnerability is the Windows DNS Server Remote Code Execution Vulnerability, which allows a remote, unauthenticated attacker to execute code with elevated privileges. The patches also include several elevation of privilege vulnerabilities in Microsoft Exchange Server, Azure, and other products. It is essential to test and deploy these patches quickly, especially for internet-facing systems, to prevent potential attacks. The large number of patches released this month is consistent with the trend of increasing patch volumes, and it is crucial to stay on top of these updates to ensure the security of systems and data. Overall, the latest security patches from Adobe and Microsoft highlight the importance of regular updates and patch management to prevent cyber attacks and protect sensitive information.

https://www.thezdi.com/blog/2026/8/11/the-august-2026-security-update-review thezdi.com

RSS Hunter • Aug 11

The July 2026 Apple Security Update Review

Apple released 210 unique CVEs across multiple operating systems and Safari in July 2026, a significant increase from the previous month. As Apple does not provide severity scores, analysis relies on the nature of the vulnerabilities. CVE-2026-43818 (ImageIO) is a critical remote arbitrary code execution vulnerability, affecting iOS and all macOS versions, making it highly exploitable. CVE-2026-64747 (AVEVideoEncoder) allows an app to execute arbitrary code with kernel privileges, affecting most Apple platforms and representing a full system compromise. CVE-2026-64767 (afpfs) enables remote, unauthenticated kernel memory corruption or system termination, though limited to macOS.Other notable vulnerabilities include CVE-2026-43776 (AppleDouble) and several SceneKit bugs, which provide file-parsing paths to arbitrary code execution. CVE-2026-43750 (Wi‑Fi) allows code execution with elevated privileges outside the sandbox. Additionally, CVE-2026-64696 (SMB) and CVE-2026-43810 (Kernel) are identified as further remote kernel-corruption bugs. The total patches include 9 code execution, 26 elevation of privilege, 11 sandbox escape, and 75 denial of service vulnerabilities. This release highlights the ongoing "bug apocalypse" impacting vendors, even Apple.

https://www.thezdi.com/blog/2026/7/29/the-july-2026-apple-security-update-review thezdi.com

RSS Hunter • Jul 30

Pwn2Own Ireland 2026 – New Targets and Categories

Pwn2Own Ireland is returning to Cork for its third year, scheduled for October 6-9, 2026. Registration closes on October 1st, 2026, at 5:00 p.m. Irish Standard Time, with no exceptions for late entries. To ensure fairness, contestants must have earned at least $15,000 in aggregate bounty payments from ZDI programs lifetime. A maximum of 80 contestants will be accepted, with up to 10 new contestants considered at the organizers' discretion. The event features seven target categories: Mobile Phones, Smart Home Devices, Wellness, Printers, Messaging, AI Infrastructure, and AI Coding Agents. Mobile phones will be targeted using the default browser or short-distance protocols like NFC, Wi-Fi, or Bluetooth. Smart home devices can be attacked via exposed network services, RF attack surfaces, or features from a laptop within the contest network. The new Wellness category focuses on healthcare devices, with attacks launched against exposed network services or RF attack surfaces. Printers, often overlooked, will also be a target, though with a reduced number of devices. The Messaging category returns, specifically targeting WhatsApp with the hope of a functioning exploit leading to code execution. Both AI Infrastructure and AI Coding Agents are new or returning categories focusing on artificial intelligence technologies and their security. The overall winner will be crowned Master of Pwn, accumulating points for successful attempts across all categories. Results will be blogged and tweeted in real-time, and contestants are strongly encouraged to read the full rules thoroughly.

https://www.thezdi.com/blog/2026/7/21/pwn2own-ireland-2026-new-targets-and-categories thezdi.com

RSS Hunter • Jul 21

The July 2026 Security Update Review

The July 2026 patch release is described as a significant event, with "nay-sayers" being proven right about potential issues. Adobe has adopted a bimonthly patching schedule, releasing updates on the second and fourth Tuesdays of the month. This month's Adobe release addresses 88 unique CVEs across various products, including ColdFusion, Commerce, After Effects, and Creative Cloud applications. While no Adobe vulnerabilities are currently under active exploit, Cold Fusion and Commerce patches are prioritized due to their high CVSS scores. Microsoft's July release is characterized as exceptionally large, covering over 621 CVEs across a wide range of products. This count significantly exceeds previous years, indicating a record-breaking number of vulnerabilities. Notable Microsoft vulnerabilities being actively exploited include an Elevation of Privilege in Active Directory Federation Services and a SharePoint Server Elevation of Privilege. A critical Windows VMSwitch Elevation of Privilege vulnerability with a 9.9 CVSS score is also highlighted. Several SharePoint Remote Code Execution vulnerabilities, including those demonstrated at Pwn2Own, are also addressed. Other critical patches cover Remote Desktop Protocol, Exchange Server spoofing, and Windows DHCP Server Remote Code Execution. Even Minecraft Bedrock Dedicated Server has a critical vulnerability, emphasizing the widespread nature of these issues.

https://www.thezdi.com/blog/2026/7/14/the-july-2026-security-update-review thezdi.com

RSS Hunter • Jul 14

CVE-2026-47291: Remote Code Execution in the Windows HTTP.sys

A remote code execution vulnerability exists in the HTTP Protocol Stack for Microsoft Internet Information Services implemented in HTTP.sys, which can be exploited by sending crafted HTTP packets to the target system. The vulnerability is due to invalid validation of incoming HTTP requests, and successful exploitation can result in a denial-of-service condition or code execution with kernel privileges. HTTP.sys is the kernel-mode HTTP protocol driver in Microsoft Windows, and it provides HTTP request parsing, response caching, and SSL/TLS termination for Internet Information Services and other applications. The vulnerability is caused by an integer overflow in the buffer reference array during HTTP/1.x header parsing, which can lead to a kernel pool heap buffer overflow. To trigger the overflow, an attacker must craft an HTTP request with each header line encapsulated in a separate TLS application data record, requiring a minimum of 65,536 buffer references. The total request size would be approximately 262,144 bytes, which exceeds the default MaxRequestBytes registry value of 16,384 bytes. A remote unauthenticated attacker could exploit this vulnerability by sending a specially crafted HTTP/1.x request over a TLS connection to an affected server, resulting in unexpected system termination or arbitrary code execution in the context of the kernel. Detection of this vulnerability can be achieved by monitoring and parsing traffic on TCP port 443, either by decrypting the TLS traffic and counting the number of distinct header field lines or by inspecting the pattern of TLS application data records within the encrypted session. The vulnerability was patched by Microsoft in the June 2026 release cycle, and the best method to ensure remediation is to test and deploy the vendor-supplied patch. To prevent exploitation, keeping the MaxRequestBytes registry value at or below 65,535 bytes represents a conservative configuration, and users are advised to follow the latest security patches and exploit techniques from the TrendAI Research team.

https://www.thezdi.com/blog/2026/7/9/cve-2026-47291-remote-code-execution-in-the-windows-httpsys thezdi.com

RSS Hunter • Jul 10

The June 2026 Apple Security Update Review

Apple released 37 security updates in June 2026 for iOS, iPadOS, macOS, and Safari. The majority of these vulnerabilities, 31 in total, are related to WebKit and WebRTC, often leading to crashes or denial of service through malicious web content. However, a few kernel and sandbox escape bugs present higher risks.CVE-2026-43724 stands out as a kernel bug allowing unexpected system termination or kernel memory writes, a critical step for full device control. Another significant kernel vulnerability, CVE-2026-39868, could corrupt kernel memory and is attributed to elite security researchers, suggesting it's a weaponizable bug. Additionally, CVE-2026-43725 and CVE-2026-43701 are WebKit sandbox escapes that enable websites to bypass restrictions. These sandbox escapes are crucial as they bridge the gap between web content exploits and potential kernel-level attacks. While many WebKit bugs cause simple crashes, these specific ones are flagged for their potential to lead to more severe system compromises. The update also includes vulnerabilities like information disclosure, memory corruption, privilege elevation, and spoofing. Apple does not provide CVSS scores, making it necessary to infer severity from the reported impacts and attributions. The company will continue this security update coverage if readers find it beneficial.

https://www.thezdi.com/blog/2026/6/30/the-june-2026-apple-security-update-review thezdi.com

RSS Hunter • Jul 1

The June 2026 Security Update Review

Adobe released eleven bulletins addressing 123 CVEs in various products for June. The most critical update is for Adobe Campaign Classic with a CVSS score of 10.0, followed by ColdFusion with seven critical vulnerabilities. Adobe Acrobat Reader also received twenty critical vulnerability patches, which are common targets for ransomware. Microsoft's June Patch Tuesday was the largest ever, with 208 CVEs across Windows, Office, and Azure. Three of these vulnerabilities are publicly known, and one is under active exploitation in the wild. A critical Windows Kernel Remote Code Execution vulnerability, CVE-2026-45657, is particularly concerning due to its wormable nature. Another high-severity bug, CVE-2026-47291, affects HTTP.sys and allows remote code execution unless specific registry settings are in place. Microsoft Defender also has an elevation of privilege vulnerability, CVE-2026-41091, which is being exploited. Patches for BitLocker address vulnerabilities that could allow security feature bypass. The sheer volume of patches raises questions about AI's role in their discovery and creation. System administrators should prioritize deployment of these critical updates due to the number of zero-day threats and active exploits.

https://www.thezdi.com/blog/2026/6/9/the-june-2026-security-update-review thezdi.com

RSS Hunter • Jun 9

Pwn2Own Berlin 2026: Day Three Results and Master of Pwn

Pwn2Own Berlin 2026 concluded its third and final day, showcasing impressive research and exploitation techniques. Over the three days, a total of $908,750 was awarded for 39 unique zero-day vulnerabilities. Today's targets included Red Hat Linux, Windows 11, OpenAI Codex, VMware ESXi, and Anthropic Claude Code. Sina Kheirkhah of Summoning Team successfully exploited Red Hat Linux, receiving $7,000 for a partially known bug. Viettel Cyber Security earned $7,500 by exploiting Windows 11 using an integer overflow for privilege escalation. Satoki Tsuji of Ikotas Labs, Inc. successfully exploited OpenAI Codex, earning $20,000. Giuseppe Calì of Summoning Team was unsuccessful in exploiting VMware ESXi. Compass Security successfully targeted Anthropic Claude Code, receiving $20,000 despite a vulnerability collision. Hyunwoo Kim chained vulnerabilities to escalate privileges on Red Hat Enterprise Linux, earning $5,000.

https://www.thezdi.com/blog/2026/5/16/pwn2own-berlin-2026-day-three-results-and-master-of-pwn thezdi.com

RSS Hunter • May 16

Pwn2Own Berlin 2026 - Day Two Results

Day Two of Pwn2Own Berlin 2026 is ongoing, showcasing security researchers' prowess in exploiting enterprise systems. Yesterday, a substantial $523,000 was awarded for 24 unique zero-day exploits. DEVCORE currently leads in the race for Master of Pwn, but competition remains fierce with several high-value targets. Researchers attempted to exploit Safari, SharePoint, and other platforms, with some attempts failing due to time constraints. Ben Koo successfully escalated privileges on Red Hat, earning $10,000 and a point. OtterSec demonstrated a code injection bug in LM Studio, securing $20,000 and four points. Summoning Team and STARLabs SG achieved successful exploits using known vulnerabilities, receiving rewards, while Le Duc Anh Vu successfully exploited Cursor. Orange Tsai of DEVCORE achieved Remote Code Execution on Microsoft Exchange, earning a significant $200,000 and 20 Master of Pwn points. Several teams withdrew their entries due to unforeseen circumstances.

https://www.thezdi.com/blog/2026/5/15/pwn2own-berlin-2026-day-two-results thezdi.com

RSS Hunter • May 15

Pwn2Own Berlin 2026 - Day One Results

Pwn2Own Berlin 2026 kicked off with security researchers targeting AI databases, coding agents, local inferences, and NVIDIA products. Several teams successfully exploited vulnerabilities, demonstrating impressive hacking skills. Orange Tsai of DEVCORE earned $175,000 for a Microsoft Edge sandbox escape. chompie of IBM X-Force exploited NV Container Toolkit, while k3vg3n took down LiteLLM. Satoki Tsuji used an allowed list bug on NVIDIA Megatron Bridge. Compass Security successfully exploited OpenAI Codex. Angelboy and TwinkleStar03 of DEVCORE also achieved privilege escalation on Windows 11. Ben Koo withdrew from the Mozilla Firefox category. Ikotas Labs successfully targeted LiteLLM using known bugs. Yoseop Kim exploited NVIDIA Megatron Bridge with a CWE-470 bug.

https://www.thezdi.com/blog/2026/5/13/pwn2own-berlin-2026-day-one-results thezdi.com

RSS Hunter • May 14

Pwn2Own Berlin 2026: The Full Schedule

Pwn2Own Berlin 2026, hosted at OffensiveCon, features security researchers targeting enterprise-focused technologies. The competition includes categories for AI Databases, Coding Agents, Local Inferences, and NVIDIA products. The schedule, detailing the order of attacks, is already set based on a random draw. Day one kicked off with attacks on NVIDIA, Coding Agents, and Web Browsers. Researchers are also targeting Local Escalation of Privilege and AI Database categories. Day two saw continued attacks on Software like Windows, Firefox and Safari. Several teams targeted the Coding Agent, Local Inference and Server categories. Day three features further attacks in the Coding Agent category. The final day includes targets such as Windows, Red Hat Enterprise Linux, VMware ESXi and Microsoft SharePoint. The competition provides opportunities for security researchers to showcase their skills. Real-time updates and results are available on social media.

https://www.thezdi.com/blog/2026/5/13/pwn2own-berlin-2026-the-full-schedule thezdi.com

RSS Hunter • May 13

The May 2026 Security Update Review

Adobe released ten bulletins patching 52 vulnerabilities across various products, with Adobe Commerce and Connect being high priorities. Microsoft's Patch Tuesday included 138 new CVEs, including fixes for Windows, Office, and Edge. Notably, no currently exploited bugs were identified. Several critical vulnerabilities exist, including RCE bugs in DNS Client and Netlogon. The Netlogon flaw allows unauthenticated remote code execution, making it a critical patch. Dynamics 365 on-premises also has a critical RCE vulnerability calling for quick deployment. A TCP/IP stack vulnerability, though less likely to be exploited, also requires patching. The sheer volume of Microsoft's fixes is significant, echoing industry trends. The article also provides a full list of Microsoft CVEs with details on severity and type. This Patch Tuesday release comes just before Pwn2Own Berlin.

https://www.thezdi.com/blog/2026/5/12/the-may-2026-security-update-review thezdi.com

RSS Hunter • May 12

The Apple macOS Security Update Review

The blog provides an analysis of macOS security updates released in May 2026. Apple released 82 unique CVEs across three macOS versions: Tahoe, Sequoia, and Sonoma. The blog highlights three potentially severe vulnerabilities without assigned severity scores from Apple. CVE-2026-28819, related to Wi-Fi, allows arbitrary code execution with kernel privileges across all versions. CVE-2026-43668, concerning mDNSResponder, enables remote attackers to corrupt kernel memory. Another critical vulnerability is CVE-2026-28972, enabling apps to write to kernel memory. The document includes a detailed table listing all released CVEs, components affected, and their impact. The blog concludes by stating the intention to continue the macOS update analysis if readers find it helpful.

https://www.thezdi.com/blog/2026/5/12/the-apple-macos-security-update-review thezdi.com

RSS Hunter • May 12

CVE-2026-33824: Remote Code Execution in Windows IKEv2

TrendAI Research identified a double free vulnerability, CVE-2026-33824, in the Windows Internet Key Exchange (IKE) service, originally discovered by the WARP & MORSE team at Microsoft. This flaw, present in IKEv2's fragment processing, could lead to a crash of the IKEEXT service or arbitrary code execution. The vulnerability stems from improper ownership handling of a heap-allocated blob pointer during IKEv2 fragment reassembly within ikeext.dll. During the IKE_SA_INIT exchange, a Security Realm Vendor ID payload causes IkeHandleSecurityRealmVendorId() to allocate a blob, stored in the MMSA structure. When a fragmented IKE_AUTH message is reassembled, IkeReinjectReassembledPacket shallow-copies this blob pointer into a local stack struct. This struct is then shallow-copied into a heap-allocated work item by IkeQueueRecvRequest. The first free occurs when IkeDestroyPacketContext processes the work item and releases this shallow-copied blob pointer. The MMSA structure still holds the original pointer to the same allocation. The second free happens when the MMSA is cleaned up via IkeCleanupMMNegotiation, which eventually triggers IkeFreeMMSA, attempting to free the already released allocation. An unauthenticated, remote attacker can exploit this by sending a crafted IKE_SA_INIT message followed by two or more Encrypted Fragment payloads with an invalid IKE_AUTH message. Detection requires monitoring UDP ports 500 and 4500 for a specific IKE_SA_INIT sequence (including the Microsoft Security Realm Vendor ID) followed by a fragmented IKE_AUTH request containing a particular byte sequence. Microsoft patched this vulnerability in April 2026, recommending blocking inbound traffic on UDP ports 500 and 4500, or restricting traffic to known peer addresses, as temporary mitigations. Applying the vendor's update is the only full remediation.

https://www.thezdi.com/blog/2026/4/22/cve-2026-33824-remote-code-execution-in-windows-ikev2 thezdi.com

RSS Hunter • Apr 23

The April 2026 Security Update Review

April 2026's Patch Tuesday is significant due to a high volume of fixes and active exploits. Adobe released 12 bulletins addressing 61 CVEs in various products, with one Acrobat Reader bug being actively exploited. A separate Adobe ColdFusion bug also has a deployment priority of one. Microsoft released a massive 163 new CVEs across numerous products and components, totaling 247 with third-party fixes. One Microsoft SharePoint Server Spoofing Vulnerability is actively exploited, and a Defender Elevation of Privilege Vulnerability is publicly known. Two critical Windows vulnerabilities, one in TCP/IP and another in IKE, are potentially wormable. The size of Microsoft's release might be due to increased AI-driven vulnerability submissions. Prioritize patching actively exploited vulnerabilities in Adobe Reader and Microsoft Sharepoint. Enterprises using IPv6 or IKE should expedite patching related to their respective vulnerabilities. Testing and deploying the Microsoft Defender fix is crucial for those relying on it.

https://www.thezdi.com/blog/2026/4/14/the-april-2026-security-update-review thezdi.com

RSS Hunter • Apr 14

Node.js Trust Falls: Dangerous Module Resolution on Windows

The blog details a local privilege escalation vulnerability affecting Node.js applications on Windows, arising from its module resolution behavior. Node.js searches for modules in C:\node_modules by default, allowing attackers to create this directory. Malicious modules placed there can be executed within the context of a user running an application. The issue stems from Node.js's stance of "trusting the file system", considering it intentional behavior. This negligence transforms optional dependencies into a dangerous attack vector. npm CLI and Discord are demonstrated as vulnerable, exploiting missing optional dependencies. The npm CLI vulnerability, CVE-2026-0775, leverages a missing "bluebird" package. Discord, through CVE-2026-0776, is vulnerable due to a missing "utf-8-validate" dependency, and remains unpatched. These vulnerabilities are triggered when launching the applications, without user interaction. Node.js, npm, and Discord do not consider this a valid security issue. The blog encourages researchers to investigate more applications for similar vulnerabilities.

https://www.thezdi.com/blog/2026/4/8/nodejs-trust-falls-dangerous-module-resolution-on-windows thezdi.com

RSS Hunter • Apr 8

Announcing Pwn2Own Berlin for 2026

Pwn2Own is returning to Berlin for its second competition, co-sponsored by AWS, with over $1 million in prizes. The event features expanded AI categories including AI Databases, Coding Agents, Local Inferences, and NVIDIA products. Existing categories like web browsers, containers, servers, virtualization, and operating systems are also included. Registration closes on May 7th for the contest that begins on May 14th, with 31 targets across 10 categories. The Master of Pwn will be crowned based on accumulated points from unique, successful entries, receiving significant rewards. Virtualization targets include VMware ESXi, Microsoft Hyper-V, and KVM, with potential bonuses for advanced exploits. Web browser exploits, including renderer-only, have increased award values this year. Enterprise applications like Adobe Reader and Microsoft Office components are targets, with a new bonus for Copilot data exfiltration. Server targets include Microsoft Exchange and RDP/RDS due to their high-risk nature. Local Escalation of Privilege requires kernel vulnerabilities on Linux, macOS, and Windows. Container exploits must achieve host OS execution from within a container, featuring Firecracker. New AI categories focus on exploiting AI databases, coding agents, and local inference models. The NVIDIA category targets specific NVIDIA products and their associated software. Participants are strongly encouraged to read the complete rules and contact for registration and specific questions.

https://www.thezdi.com/blog/2026/3/11/announcing-pwn2own-berlin-for-2026 thezdi.com

RSS Hunter • Mar 12

The March 2026 Security Update Review

The author is reviewing security patches released for March 2026 from Adobe and Microsoft. Adobe released eight bulletins addressing 80 CVEs across various applications, with Acrobat Reader being a priority for patching. Microsoft's release includes 84 new CVEs, with five reported through the TrendAI ZDI program. Several Microsoft vulnerabilities are detailed, including an Excel information disclosure bug related to the Copilot Agent. Office Remote Code Execution vulnerabilities, like previous months, continue to be present and need addressing. A Windows Print Spooler RCE vulnerability that works similarly to the "Print Nightmare" is also present, requiring quick patching. A Windows Graphics Component Elevation of Privilege vulnerability that was identified as variants needs to be addressed. The post concludes with a comprehensive list of the CVEs released by Microsoft for March 2026, including their severity and related details. The author emphasizes the importance of testing and deploying these security updates promptly.

https://www.thezdi.com/blog/2026/3/10/the-march-2026-security-update-review thezdi.com

RSS Hunter • Mar 10

CVE-2026-20841: Arbitrary Code Execution in the Windows Notepad

This report details a command injection vulnerability in Microsoft Windows Notepad (CVE-2026-20841). The vulnerability stems from improper validation of links within rendered Markdown files. Exploitation involves enticing a user to open a crafted malicious Markdown file containing a harmful link. When the user clicks the link, arbitrary commands can execute within the victim's account's security context. The Notepad application tokenizes input and renders Markdown files if the file extension is ".md". The vulnerability exists in the function handling link clicks, sub_140170F60(), which calls ShellExecuteExW(). Insufficient filtering allows attackers to use "file://" and "ms-appinstaller://" protocol URIs. The vulnerability was patched by Microsoft in February 2026. The report includes detection guidance for identifying potential exploitation attempts. The guidance suggests monitoring traffic for malicious links within ".md" files using specific regular expressions. The provided patch restricts links to local files and HTTP(S) URIs, potentially leading to false positives. The report concludes user interaction is required for exploitation and recommends patching to remediate the vulnerability. The research was done by Nikolai Skliarenko and Yazhi Wang from TrendAI.

https://www.thezdi.com/blog/2026/2/19/cve-2026-20841-arbitrary-code-execution-in-the-windows-notepad thezdi.com

RSS Hunter • Feb 19

The February 2026 Security Update Review

The post discusses the February 2026 Patch Tuesday updates from Adobe and Microsoft. Adobe released patches for various applications, with After Effects receiving the most significant update, fixing several critical bugs. None of Adobe's fixes were actively exploited or publicly known at the time of release. Microsoft's update addresses 62 CVEs across multiple products, and six are actively exploited, a higher-than-usual number. Several critical vulnerabilities are highlighted, including Windows Shell and Internet Explorer security bypasses, which could lead to code execution. The DWM elevation of privilege vulnerability makes a second consecutive appearance as an actively exploited vulnerability. A Windows Remote Desktop Services privilege escalation bug is also actively exploited. The post urges quick testing and deployment of these specific Microsoft patches. Microsoft also addressed vulnerabilities in Azure, .NET, Office, and other components. The high number of actively exploited bugs raises concerns about a resurgence of widespread exploitation.

https://www.thezdi.com/blog/2026/2/10/the-february-2026-security-update-review thezdi.com

RSS Hunter • Feb 10

CVE-2025-6978: Arbitrary Code Execution in the Arista NG Firewall

A command injection vulnerability in Arista NG Firewall, reported by TrendAI Research, allows arbitrary command execution. This vulnerability, tracked as CVE-2025-6798, stems from inadequate validation within the diagnostics component. Attackers can exploit this via crafted requests to the JSON-RPC interface, specifically the runTroubleshooting method. User-supplied data within parameters like "HOST" or "URL" isn't fully sanitized, allowing for the injection of malicious commands. The backtick character is an example of an unsafe character that can be used to inject commands. Successful exploitation grants attackers root privileges on the compromised system. Detection involves monitoring HTTP/HTTPS traffic for malicious JSON-RPC requests. The provided detection guidance details specific checks within request bodies using regular expressions. The vulnerability lies in the runTroubleshooting command's handling of user input within the NetworkManagerImpl class. Arista has addressed the issue in version 17.4 or higher. The report emphasizes the importance of applying the vendor's security patch. This thorough analysis was conducted by Jonathan Lein and Simon Humbert from the TrendAI Research team.

https://www.thezdi.com/blog/2026/2/4/cve-2025-6978-arbitrary-code-execution-in-the-arista-ng-firewall thezdi.com

RSS Hunter • Feb 5

Pwn2Own Automotive 2026 - Day Three Results and the Master of Pwn

Pwn2Own Automotive 2026 concluded with security researchers demonstrating 76 unique 0-day vulnerabilities, awarding over $1 million USD. The Fuzzware.io team, comprising Tobias Scharnowski, Felix Buchmann, and Kristian Covic, secured the Master of Pwn title. They earned 28 points and $215,500 USD for their exploits. Several teams targeted various automotive systems, including Alpine, Kenwood, and Sony infotainment units. Some exploits involved buffer overflows, while others utilized race conditions and incorrect permission assignments. Collisions, where vulnerabilities were already known or demonstrated by another team, occurred frequently, impacting some prize amounts. The Juurin Oy team notably demonstrated a TOCTOU bug on an Alpitronic charger, even installing the game Doom. Other successful exploits gained root access on infotainment systems and charging stations. The competition highlighted the ongoing security challenges within modern automotive technology.

https://www.thezdi.com/blog/2026/1/23/pwn2own-automotive-2026-day-three-results-and-the-master-of-pwn thezdi.com

RSS Hunter • Jan 23

Pwn2Own Automotive 2026 - Day Two Results

The Pwn2Own Automotive 2026 competition is underway, with security researchers competing to find vulnerabilities in the latest automotive systems. The competition has already awarded over $516,500 for 37 unique 0-day vulnerabilities. Researchers are targeting various automotive systems, including the Alpine iLX-F511, Grizzl-E Smart 40A, and Kenwood DNR1007XR. Team MAMMOTH successfully exploited a command injection vulnerability against the Alpine iLX-F511, earning $10,000 and 2 Master of Pwn points. Julien COHEN-SCALI of FuzzingLabs also had a successful exploit, chaining two vulnerabilities to earn $20,000 and 4 Master of Pwn points. Neodyme AG exploited a buffer overflow vulnerability in the Sony XAV-9500ES, earning $10,000 and 2 Master of Pwn points. Hank Chen of InnoEdge Labs exploited an exposed dangerous method against the Alpitronic HYC50, earning $40,000 and 4 Master of Pwn points. Several other researchers also had successful exploits, including Nguyen Thanh Dat, BoredPentester, and Sina Kheirkhah. The competition is ongoing, with researchers continuing to probe and challenge the latest automotive systems, and the stakes are rising as the race for Master of Pwn heats up.

https://www.thezdi.com/blog/2026/1/22/pwn2own-automotive-2026-day-two-results thezdi.com

RSS Hunter • Jan 22

Pwn2Own Automotive 2026 - Day One Results

Day One of Pwn2Own Automotive 2026 commenced with thirty entries targeting the latest automotive systems, featuring exploits and security breakthroughs from top researchers. The competition saw significant success across various categories, particularly in exploiting in-vehicle infotainment (IVI) systems and electric vehicle chargers. Several teams, including Neodyme AG and Synacktiv, successfully gained root-level access on IVI units like the Alpine iLX-F511 and Sony XAV-9500ES through vulnerabilities such as buffer overflows and chained exploits. EV chargers proved lucrative targets, with Fuzzware.io, PetoWorks, and others manipulating charging signals or achieving code execution on devices like the Autel charger and Phoenix Contact CHARX SEC-3150, often chaining multiple bugs. Notably, the Grizzl-E Smart 40A charger was successfully exploited multiple times, including a win by SKShieldus using hardcoded credentials and an authentication bypass leading to remote code execution by Compass Security. Some attempts resulted in failure, such as the initial exploit against the Kenwood DNR1007XR and attempts by Fuzzware.io against the EMPORIA Pro Charger. However, subsequent attempts quickly exploited the Kenwood unit through command injection and out-of-bounds writes by other researchers. The competition also included successful collisions where multiple teams exploited the same or similar vulnerabilities, resulting in split rewards and Master of Pwn points. Synacktiv achieved a full win in the Tesla Infotainment category by chaining an information leak and an out-of-bounds write via a USB-based attack. Overall, the day was marked by numerous successful exploits, demonstrating critical vulnerabilities in modern automotive and charging infrastructure components.

https://www.thezdi.com/blog/2026/1/21/pwn2own-automotive-2026-day-one-results thezdi.com

RSS Hunter • Jan 21

Pwn2Own Automotive 2026 - The Full Schedule

The third annual Pwn2Own Automotive competition has begun at Automotive World in Tokyo, featuring a record 73 entries from talented security researchers. The competition aims to test the latest automotive components in a real-world environment, with participants attempting to exploit vulnerabilities in various categories. The categories include In-Vehicle Infotainment, Level 2 Electric Vehicle Chargers, and Level 3 Electric Vehicle Chargers, among others. The schedule for the competition has been released, with each team having a limited time to demonstrate their exploits. The teams are competing for cash prizes and Master of Pwn points, with the total prize pool being substantial. The competition is expected to be intense, with many teams targeting the same devices and categories. The event will feature demonstrations and discoveries, and updates will be posted as the competition progresses. The Pwn2Own Automotive competition is a major milestone, with this year's event being the largest and most competitive yet. The competition will run for several days, with the schedule subject to change as the event unfolds. The outcome of the competition is highly anticipated, with the winning teams being awarded significant cash prizes and recognition in the security research community.

https://www.thezdi.com/blog/2026/1/20/pwn2own-automotive-2026-the-full-schedule thezdi.com

RSS Hunter • Jan 20

The January 2026 Security Update Review

This article reviews the January 2026 security patches from Adobe and Microsoft. Adobe released 11 bulletins addressing 25 CVEs across various Creative Cloud and ColdFusion products. These patches fix code execution and memory leak vulnerabilities, with no publicly known or actively exploited bugs reported by Adobe. Microsoft, on the other hand, issued a large release with 112 new CVEs affecting numerous Windows components, Office, Azure, and Edge. Eight of Microsoft's patches are rated Critical, with the majority being Important. One vulnerability, CVE-2026-20805, an information disclosure bug in the Desktop Window Manager, is listed as actively exploited. Another notable patch addresses a Secure Boot certificate expiration that could impact future updates. Microsoft Office bugs related to the Preview Pane are also highlighted, with a recommendation to disable it as a precaution. Additionally, a critical vulnerability in Windows Virtualization-Based Security allows for elevation to the highest privilege level. The article suggests that large January releases are common due to vendors holding back updates over the holiday season.

https://www.thezdi.com/blog/2026/1/13/the-january-2026-security-update-review thezdi.com

RSS Hunter • Jan 13

The Alpitronic HYC50 Hardware Teardown for Pwn2Own Automotive 2026

Trend Micro's ZDI provides a preliminary hardware reconnaissance report for the Alpitronic HYC50 charger, a target for Pwn2Own Automotive 2026. Researchers will receive a modified enclosure isolating digital and communication components for safer analysis. The main control board manages charging, communication, and user authentication, using an i.MX6 processor and eMMC storage. The report details the board's PLC controllers for vehicle communication and Ethernet interfaces. A custom System on a Module (SOM) based on Variscite's design houses the main processing components. The COMM board handles communication via LTE, Wi-Fi/Bluetooth, and NFC interfaces. The HYC50 has mature documentation available online, which can prove useful. ZDI urges participants to check the development units before use. The report emphasizes the HYC50's hardware potential for the competition. Happy hunting to those participating in Pwn2Own, looking to exploit the charging station.

https://www.thezdi.com/blog/2026/1/11/the-alpitronic-hyc50-hardware-teardown-for-pwn2own-automotive-2026 thezdi.com

RSS Hunter • Jan 12

Breaking Down the Attack Surface of the Kenwood DNR1007XR – Part Two

This blog post analyzes the attack surfaces of the Kenwood DNR1007XR in-vehicle infotainment system. The main potential attack vectors include USB, supporting various audio and video file formats, and SD card for media playback and map updates, both using FAT and NTFS file systems. Bluetooth, utilizing version 5 with multiple profiles, offers another avenue, especially exploring undocumented services. A built-in Wi-Fi access point, secured with a discovered password, exposes open ports, including an SSH server and non-standard services, creating vulnerabilities. Android Auto and Apple CarPlay, both wired and wireless, present further targets, particularly via the secure Wi-Fi network. Kenwood's Portal and Remote S apps, facilitating image transfer and multimedia control via Bluetooth, expand the attack surface. The blog emphasizes the importance of thorough investigation and reverse engineering. The post intends to inspire security research, encouraging explorations beyond the discussed surfaces. The author highlights the complexity of file parsing and the role of user-supplied data, such as images, in expanding the attack surface. Open source licenses present another potential area of investigation despite the disclaimer of actual usage. The author encourages participation in the upcoming Automotive Pwn2Own event.

https://www.thezdi.com/blog/2026/1/8/breaking-down-the-attack-surface-of-the-kenwood-dnr1007xr-part-two thezdi.com

RSS Hunter • Jan 9

Breaking Down the Attack Surface of the Kenwood DNR1007XR – Part One

The Kenwood DNR1007XR head unit is a target for the Pwn2Own Automotive contest, offering features like Android Auto and Apple CarPlay. This blog post details its external features, including an SD card slot behind the screen and a USB port for various functionalities. Internally, the unit features multiple interconnected boards, with the main board housing key components.The primary processor is the Dolphin+ TCC8034 System on a Chip, capable of running Android, Linux, and QNX. It runs on Linux and is similar to a SoC used in last year's Kenwood target. A Kioxia eMMC chip stores the device firmware, and a Winbond flash chip holds additional data.A Murata radio module handles Wi-Fi and Bluetooth operations, with its specific model number being LBEE6ZZ1WD-334. This module lacks publicly available datasheets, making its details obscure. A significant discovery is a debug connector on the main board's right edge.This connector provides access to a Linux login prompt via UART at 115200bps. Successful authentication grants a shell, presenting a potential attack vector. The post aims to provide sufficient information for vulnerability research, with more analysis to follow. The authors encourage keeping an eye on automotive vendor security improvements for future contests. They share their social media handles for those interested in exploit techniques and security patches.

https://www.thezdi.com/blog/2026/1/6/breaking-down-the-attack-surface-of-the-kenwood-dnr1007xr-part-one thezdi.com

RSS Hunter • Jan 7

The December 2025 Security Update Review

Adobe released updates for December 2025, addressing 139 CVEs across various products, including Reader and ColdFusion. While the number of CVEs is high, many are XSS bugs, though some critical code execution vulnerabilities exist. ColdFusion receives a patch with a deployment priority of 1 due to several code execution bugs. Microsoft's December 2025 Patch Tuesday includes 56 new CVEs across Windows, Office, and other components, with a total of 70 when including Chromium updates. This brings Microsoft's yearly total to 1,139 CVEs, making 2025 the second-highest volume year. One actively exploited vulnerability, CVE-2025-62221, is a Windows Cloud Files Mini Filter Driver elevation of privilege bug. Microsoft also addressed critical Office remote code execution vulnerabilities, including those affecting the Preview Pane. A publicly known command injection bug in GitHub Copilot, CVE-2025-64671, is also addressed. The updates include several elevation of privilege and remote code execution vulnerabilities across various Windows components.

https://www.thezdi.com/blog/2025/12/9/the-december-2025-security-update-review thezdi.com

RSS Hunter • Dec 9, 2025

The November 2025 Security Update Review

The text discusses the November 2025 security updates from Adobe and Microsoft. Adobe patched 29 CVEs across various products, with fixes for InDesign and Illustrator being prioritized. Microsoft released updates for 63 CVEs, including those for Windows, Office, and other components. One Microsoft vulnerability, CVE-2025-62215 (Windows Kernel EoP), is under active exploitation and should be a top priority. The report highlights an Office remote code execution bug, CVE-2025-62199, warranting preview pane disabling. Another notable vulnerability is CVE-2025-60709 (CLFS driver EoP), as CLFS has historical exploitation. The Agentic AI and Visual Studio Code remote code execution bug, CVE-2025-62222, is also significant. Microsoft's release total is lower than previous months, with a total of 1084 CVEs addressed this year. The document includes a detailed CVE list with severity and impact information. The author acknowledges that Windows 10 is no longer receiving updates this month. Overall, these updates aim to address various security flaws and protect users.

https://www.thezdi.com/blog/2025/11/11/the-november-2025-security-update-review thezdi.com

RSS Hunter • Nov 11, 2025

Pwn2Own Ireland 2025: Day Three and Master of Pwn

Pwn2Own Ireland 2025 is in its final day, already awarding $792,750 for 56 zero-day bugs. CyCraft Technology withdrew their attempt on the Amazon Smart Plug. Fuzzinglabs failed to exploit the QNAP TS-453E within the time limit. Xilokar successfully exploited the Phillips Hue Bridge with four bugs, though one collided with a prior submission, earning them $17,500. Chris Anastasio successfully exploited the Lexmark CX532adwe printer using a type confusion bug, earning $20,000. Interrupt Labs successfully compromised the Samsung Galaxy S25 using an input validation bug, gaining camera and location access and $50,000. Yannik Marchand also exploited the Phillips Hue Bridge, using three bugs, with two colliding, earning $13,333. The competition continues with 17 attempts remaining. The blog will be updated with live results. Several researchers successfully demonstrated the exploitation of various devices. These findings highlight vulnerabilities in common technology.

https://www.thezdi.com/blog/2025/10/23/pwn2own-ireland-2025-day-three-and-master-of-pwn thezdi.com

RSS Hunter • Oct 23, 2025

Pwn2Own Ireland 2025 - Day Two Results

Day Two of Pwn2Own Ireland 2025 continued with participants trying to earn points and money. Yesterday's competition awarded $522,500 for discovered vulnerabilities. The Summoning Team held a slight lead, but the leaderboard could change with more attempts. PHP Hooligans successfully exploited a Canon printer with an OOB Write, earning $10,000. Viettel Cyber Security used a command injection and other bugs to exploit Home Automation Green, earning $12,500. Qrious Secure exploited Phillips Hue Bridge with multiple bugs, earning $16,000. CyCraft Technology's Chumy Tsai exploited QNAP TS-453E with a code injection bug, earning $20,000. Sina Kheirkhah's exploit of Synology BeeStation Plus was deemed out of scope. Team Neodyme exploited Home Assistant Green with two bugs, earning $15,000. These successful exploits highlight the ongoing efforts to find and fix software vulnerabilities. The competition highlights the importance of cybersecurity. Many teams gained significant points towards the Master of Pwn title.

https://www.thezdi.com/blog/2025/10/22/pwn2own-ireland-2025-day-two-results thezdi.com

RSS Hunter • Oct 22, 2025

Pwn2Own Ireland 2025: Day One Results

Pwn2Own Ireland 2025's first day featured seventeen attempts with exciting cybersecurity research. Team Neodyme successfully exploited an HP DeskJet 2855e using a stack based buffer overflow. STARLabs successfully targeted a Canon imageCLASS MF654Cdw with a heap based buffer overflow. Synacktiv achieved root-level code execution on a Synology BeeStation Plus through a stack overflow. Team DDOS completed a complex SOHO Smashup compromising QNAP devices using eight different bugs. Team DDOS withdrew their attempt on the Philips Hue Bridge. GMO Cybersecurity by Ierae, Inc. successfully exploited another Canon imageCLASS MF654Cdw using a stack based buffer overflow. These successful exploits earned teams substantial prize money and Master of Pwn points. The event showcased a range of vulnerabilities and exploit techniques. Stay updated through their social media channels for more information. Pwn2Own Ireland 2025 is a demonstration of the current cybersecurity landscape.

https://www.thezdi.com/blog/2025/10/21/pwn2own-ireland-2025-day-one-results thezdi.com

RSS Hunter • Oct 21, 2025

Pwn2Own Ireland 2025: The Full Schedule

Pwn2Own Ireland 2025 is announced, promising up to $2,000,000 in prizes, including a $1,000,000 award for a WhatsApp 0-click exploit. The contest schedule is provided, detailing participating teams and their targets across multiple product categories. Numerous teams and individuals are set to attempt exploits on devices like printers, smart home hubs, and network storage systems. Prizes vary, with amounts based on the category and the severity of the identified security vulnerabilities. Specific targets include products from Canon, HP, Synology, Philips Hue, Home Assistant, and Samsung. Live streams for some attempts are available for viewing. The competition spans multiple days, with a wide array of teams and individuals competing. The final day includes an attempt for the major WhatsApp prize. Many different research groups are represented, including teams from DEVCORE, STARLabs, and Summoning Team. The contest focuses on discovering and demonstrating software vulnerabilities for financial rewards and recognition.

https://www.thezdi.com/blog/2025/20/pwn2own-ireland-2025-the-full-schedule thezdi.com

RSS Hunter • Oct 20, 2025

Pwn2Own Automotive Returns to Tokyo with Expanded Chargers and More!

Pwn2Own Automotive returns to Tokyo from January 21-23, 2026, awarding over $2 million for automotive exploits. The event features partnerships with VicOne, Tesla, Alpitronic, and the Open Charge Alliance. New targets include Level 3 EV chargers and the Open Charge Alliance’s OCTT. Existing categories include Tesla, In-Vehicle Infotainment, and Level 2 EV chargers. The Tesla category will use a benchtop unit, with some targets offering a vehicle prize. The Level 2 EV charger category offers bonus challenges for additional rewards and Master of Pwn points. Automotive Operating Systems are also a target, with bonuses for specific subsystem exploits. Master of Pwn is awarded based on points accumulated across successful attempts, regardless of cash prize. Contestants must register by January 15, 2026, and the event order will be determined by a random drawing. Results will be posted live via blog and social media platforms. The organizers anticipate innovative exploits and attack techniques.

https://www.thezdi.com/blog/2025/10/16/pwn2own-automotive-returns-to-tokyo-with-expanded-chargers-and-more thezdi.com

RSS Hunter • Oct 16, 2025

The October 2025 Security Update Review

Adobe's October patch release addresses 36 CVEs across various products, with Substance 3D Stager, Dimension, and Illustrator updates being particularly important. Microsoft's October Patch Tuesday is massive, featuring 177 new CVEs, making it Microsoft's largest monthly release to date. Sixteen vulnerabilities are rated Critical and the rest Important, with some actively exploited. Three bugs are confirmed under active attack, including Windows Agere Modem Driver and Remote Access Connection Manager elevation of privilege bugs. Another notable vulnerability is a Secure Boot bypass in IGEL OS, warranting attention. The Windows Server Update Service (WSUS) remote code execution vulnerability also poses a significant risk. Microsoft's extensive release could be related to the end of Windows 10 support. The sheer volume underscores the need for prompt testing and deployment of security updates to mitigate risks. The provided list details the specific CVEs, their titles, severity ratings, and current status.

https://www.thezdi.com/blog/2025/10/14/the-october-2025-security-update-review thezdi.com

RSS Hunter • Oct 14, 2025

Crafting a Full Exploit RCE from a Crash in Autodesk Revit RFA File Parsing

The author investigated a crash in Autodesk Revit 2025, initially found through fuzzing RFA files, which led to a type confusion vulnerability. This vulnerability was a result of deserializing a std::pair type. The crash occurs when the program tries to call a destructor on a non-vtable value. The author exploited the vulnerability to achieve remote code execution. The research involved reverse engineering and debugging. Tools like IDA Pro, WinDBG, and Time Travel Debugging were used. A cloud-based supply chain vulnerability in Axis Communications Plugin for Autodesk Revit, which could distribute corrupted RFA files, greatly aided the exploit. The author created a tool, "CompoundFileTool," and another tool that mimicked Revit's gzip behavior, which were essential to modify RFA files effectively. The goal was to manipulate the deserialized object's offset 0x0 to point to a controlled vtable. The author ultimately successfully achieved arbitrary code execution by exploiting the type confusion. The research also included reversing and understanding Autodesk's RFA format, including the format of compressed data in Global/Latest stream.

https://www.thezdi.com/blog/2025/10/6/crafting-a-full-exploit-rce-from-a-crash-in-autodesk-revit-rfa-file-parsing thezdi.com

RSS Hunter • Oct 8, 2025

CVE-2025-23298: Getting Remote Code Execution in NVIDIA Merlin

The Trend Micro Zero Day Initiative discovered a critical vulnerability in NVIDIA's Transformers4Rec library, allowing remote code execution with root privileges. This vulnerability, CVE-2025-23298, stems from unsafe deserialization when loading model checkpoints using Python's pickle module. Transformers4Rec, part of the Merlin ecosystem, is widely used for recommendation tasks and integrates with Hugging Face Transformers. The flaw lies in the load_model_trainer_states_from_checkpoint function, which directly uses torch.load() without safety parameters, exposing it to malicious pickle files. Pickle's __reduce__ method allows arbitrary code execution during deserialization. The attack surface is significant due to common model sharing and the trust placed in checkpoint files, especially as these processes often run with elevated privileges. A malicious checkpoint could execute system commands before model weights are loaded. The real-world impact includes remote code execution, privilege escalation, data exfiltration, and supply chain attacks. NVIDIA has patched the vulnerability by implementing a custom loading mechanism that restricts deserialization to approved classes. This incident underscores the pervasive security challenges in the ML/AI ecosystem due to reliance on pickle. Developers are urged to avoid pickle for untrusted data, use weights_only=True, restrict trusted classes, and consider secure serialization formats like Safetensors. Organizations should audit model provenance, implement signing, and sandbox model loading. The ML community needs to move away from pickle and prioritize security in framework design.

https://www.thezdi.com/blog/2025/9/23/cve-2025-23298-getting-remote-code-execution-in-nvidia-merlin thezdi.com

RSS Hunter • Sep 24, 2025

The September 2025 Security Update Review

Adobe has released nine security bulletins for September, addressing 22 unique CVEs across various products like Acrobat Reader, After Effects, and Premiere Pro. Only the ColdFusion update is rated Priority 1, though no exploitation is detected. The Commerce update fixes a single Critical bug, also without noted exploitation. Acrobat receives a patch for one Critical and one Moderate bug. After Effects includes fixes for three Important bugs. Premiere Pro gets a patch for a potential code execution vulnerability. Substance 3D Viewer and Modeler each have three code execution bugs addressed. Experience Manager has the most fixes with seven, one of which is Critical. Dreamweaver's patch corrects a Cross-Site Request Forgery bug. None of Adobe's September vulnerabilities were publicly known or actively exploited at release. Microsoft released 80 new CVEs for September, covering Windows, Office, Azure, and more, with eight rated Critical and the rest Important. This volume places Microsoft significantly ahead of last year's patch releases. One publicly known bug exists, but none are under active attack. A critical vulnerability in Microsoft HPC Pack allows remote code execution without user interaction. Microsoft Office continues to have code execution vulnerabilities through its Preview Pane. A Windows NTLM Elevation of Privilege vulnerability allows escalation to SYSTEM with low exploit complexity.

https://www.thezdi.com/blog/2025/9/9/the-september-2025-security-update-review thezdi.com

RSS Hunter • Sep 9, 2025

The August 2025 Security Update Review

Adobe and Microsoft have released their monthly security patches, with Adobe addressing 68 CVEs across various products like Commerce, Illustrator, and Photoshop. Microsoft released a substantial 107 new CVEs impacting Windows, Office, Edge, and other services, the highest volume since 2020. Priority for Adobe updates includes Commerce and InCopy due to critical vulnerabilities. Microsoft's patches include several high-severity vulnerabilities like GDI+ and Windows Graphics Component RCEs, exploitable via web browsing. Microsoft Office is again affected by preview pane vulnerabilities, and SharePoint has a critical RCE similar to those used in recent attacks. Among Microsoft's fixes, 12 are rated Critical, with the majority rated Important. One publicly known vulnerability exists in Microsoft's releases, but none are reported as actively exploited. Adobe's patches do not list any publicly known or actively exploited vulnerabilities. Users are advised to prioritize patching the identified critical issues from both vendors. The full details and webcast recap are available for further review.

https://www.thezdi.com/blog/2025/8/12/the-august-2025-security-update-review thezdi.com

RSS Hunter • Aug 12, 2025

Pwn2Own Returns to Ireland with a One Million Dollar WhatsApp Target

Pwn2Own is returning to Cork, Ireland from October 21-24, 2025, with Meta joining as a co-sponsor. A significant $1,000,000 bounty is offered for a 0-click WhatsApp bug leading to code execution. The event will feature eight target categories, including Mobile Phones, Messaging, SOHO Smashup, Smart Home Devices, Printers, NAS Devices, Surveillance System Devices, and Wearables. Mobile phone targets will now include USB attack vectors, while the SOHO Smashup category has been made more challenging. Smart Home Devices and Surveillance System Devices are consolidated from previous categories. Printers will feature Brother as a new target alongside existing ones. NAS devices from Synology and QNAP are included, with specific Synology packages in scope. Wearable targets include Meta Ray-Ban Smart Glasses and Meta Quest 3/3S with different prize levels for interaction requirements. The Master of Pwn title will be awarded to the overall winner based on accumulated points. Registration closes on October 16th, 2025, at 5:00 p.m. Irish Standard Time, with no exceptions for late entries.

https://www.thezdi.com/blog/2025/7/30/pwn2own-returns-to-ireland-with-a-one-million-dollar-whatsapp-target thezdi.com

RSS Hunter • Jul 31, 2025

CVE-2025-20281: Cisco ISE API Unauthenticated Remote Code Execution Vulnerability

A vulnerability in Cisco Identity Services Engine (ISE), specifically in the enableStrongSwanTunnel method, allowed command injection as root. This was initially reported as a deserialization vulnerability but also included a command injection flaw. The researcher, Kentaro Kawane, discovered that attacker-supplied data was used to execute shell scripts with sudo privileges. Exploitation proved more complex than initially anticipated due to how Java's exec() method tokenizes commands. Java's StringTokenizer ignores quotes, preventing direct command execution; however, the researcher circumvented this by using the bash Internal Field Separator (${IFS}) variable. This allowed injection of commands as a single argument, avoiding tokenization issues. The injected commands initially ran within a Docker container, but because the container ran in privileged mode, the researcher used a "User-Mode Helpers" technique to escape the container and gain root access on the host system. A base64 encoding was used to bypass the space character limitation in the payload. The complete exploit involved sending a specially crafted POST request to the vulnerable endpoint. This successful exploitation demonstrates a combination of vulnerabilities leading to complete system compromise. The researcher emphasizes the importance of understanding both Java's exec() behavior and the capabilities of privileged Docker containers. Further research into this area is planned.

https://www.thezdi.com/blog/2025/7/24/cve-2025-20281-cisco-ise-api-unauthenticated-remote-code-execution-vulnerability thezdi.com

RSS Hunter • Jul 25, 2025

CVE-2025-4919: Corruption via Math Space in Mozilla Firefox

Manfred Paul exploited a vulnerability (CVE-2025-4919, ZDI-25-291) in Firefox's IonMonkey JavaScript JIT compiler at Pwn2Own Berlin 2025. The vulnerability resided within the ExtractLinearSum function, used for simplifying linear expressions. This function incorrectly handled the Modulo math space, causing issues with bounds checks. The TryEliminateBoundsCheck function, utilizing ExtractLinearSum, merged bounds checks without accounting for potential integer overflows. This flaw allowed bypassing bounds checks in large typed arrays. Exploiting this involved creating a large typed array and manipulating indices to trigger an out-of-bounds read or write. The exploit used bitwise operations to force wrapping additions, misleading the bounds check elimination. A BigInt was used to prevent compiler optimizations that might otherwise hinder the exploit. The vulnerability's root cause lies in inconsistent math space handling within the ExtractLinearSum function's various call sites. Similar vulnerabilities might exist in other parts of the Ion compiler that use ExtractLinearSum for loop analysis. Mozilla patched the vulnerability in Firefox 138.0.4. The exploit demonstrated the danger of unchecked integer operations in JIT compilers.

https://www.thezdi.com/blog/2025/7/14/cve-2025-4919-corruption-via-math-space-in-mozilla-firefox thezdi.com

RSS Hunter • Jul 15, 2025

The July 2025 Security Update Review

Adobe has not yet released its scheduled patches for July, but Microsoft has released 130 new CVEs in various products, including Windows, Office, and Azure. Eight of these bugs were reported through the Trend ZDI program, bringing the total to 140 CVEs. Ten of the patches are rated Critical, and the rest are rated Important in severity. One bug is publicly known, but none are currently under active attack. A notable bug is CVE-2025-47981, a heap-based buffer overflow in the Windows SPNEGO Extended Negotiation component that allows remote, unauthenticated attackers to execute code. Another critical bug is CVE-2025-49717, a heap-based buffer overflow in Microsoft SQL Server that could lead to code execution. A third critical bug is CVE-2025-49704, a remote code execution vulnerability in Microsoft SharePoint that was used in a Pwn2Own Berlin demonstration. There are also four Critical-rated Office bugs, all of which have the Preview Pane listed as an attack vector. Microsoft has not yet released updates for Microsoft Office LTSC for Mac 2021 and 2024. The full list of CVEs released by Microsoft for July 2025 is provided.

https://www.thezdi.com/blog/2025/7/8/the-july-2025-security-update-review thezdi.com

RSS Hunter • Jul 8, 2025

Extracting Embedded MultiMediaCard (eMMC) contents in-system

The text discusses accessing eMMC storage without removing it from a device, a process preferable to the challenging BGA reballing. The author aims to provide a structured guide for reading and writing data on eMMC chips. Prerequisites include a device to analyze, an interface device, and microsoldering equipment. Key eMMC signals like CLK, CMD, DAT0, and power lines are explained. The text outlines the process of locating eMMC signals on a board, typically using a logic analyzer. Powering the eMMC chip is addressed, with advice on using either the device's power supply or an external one, considering potential risks. The text highlights the need to determine VDD and VDDQ voltages and address voltage level translation if necessary, especially for devices using lower voltages. The document provides a starting point for accessing the data stored on eMMC without desoldering the chip.

https://www.thezdi.com/blog/2025/6/18/extracting-embedded-multimediacard-emmc-contents-in-system thezdi.com

RSS Hunter • Jun 20, 2025

The June 2025 Security Update Review

Adobe released seven bulletins addressing 254 CVEs in various products, including Acrobat Reader, Experience Manager, and Substance 3D Sampler. None of the bugs fixed by Adobe are listed as publicly known or under active attack. Microsoft released 66 new CVEs, with 10 rated Critical and the rest Important in severity. One bug is listed as being under active attack, and one is publicly known. A Critical-rated bug in WEBDAV forces Windows to use the deprecated Internet Explorer, allowing code execution. Another Critical-rated bug in Netlogon allows threat actors to execute code on domain controllers. A bug in Office allows code execution without user interaction, and four other Office-related bugs are also Critical-rated. Microsoft lists one bug as being under active attack, with one other being publicly known. The patches released by both companies should be applied as soon as possible to prevent potential attacks.

https://www.thezdi.com/blog/2025/6/10/the-june-2025-security-update-review thezdi.com

RSS Hunter • Jun 10, 2025

Pwn2Own Berlin 2025: Day Three Results

The third and final day of Pwn2Own Berlin 2025 has concluded, with a total of $1,078,750 awarded during the event. The STAR Labs SG team won Master of Pwn, earning $320,000 and 35 Master of Pwn points. Seven of the 28 unique 0-days disclosed during the event came from the AI category. Angelboy from DEVCORE Research Team demonstrated a privilege escalation on Windows 11, earning $11,250 and 2.25 Master of Pwn points. FPT NightWolf successfully exploited NVIDIA Triton, earning $15,000 and 1.5 Master of Pwn points. Manfred Paul exploited Mozilla Firefox using an integer overflow, earning $50,000 and 5 Master of Pwn points. Nir Ohfeld and Shir Tamari exploited the NVIDIA Container Toolkit, earning $30,000 and 3 Master of Pwn points. Dung and Nguyen from STARLabs escaped the VM and escalated privileges on Windows, earning $70,000 and 9 Master of Pwn points. The event concluded with Miloš Ivanović escalating privileges to SYSTEM on Windows 11, earning $15,000 and 3 Master of Pwn points.

https://www.thezdi.com/blog/2025/5/17/pwn2own-berlin-2025-day-three-results thezdi.com

RSS Hunter • May 17, 2025

Pwn2Own Berlin 2025: Day Two Results

Pwn2Own Berlin's second day concluded with $435,000 awarded, bringing the total contest prize money to $695,000. Researchers demonstrated 20 unique zero-day vulnerabilities throughout the competition so far. FuzzingLabs exploited NVIDIA Triton with a known but unpatched vulnerability, earning them a partial reward. Viettel Cyber Security successfully exploited Microsoft SharePoint using an authentication bypass and insecure deserialization. STAR Labs achieved a historic first by exploiting VMware ESXi with an integer overflow. Palo Alto Networks exploited Mozilla Firefox using an out-of-bounds write. Wiz Research successfully exploited Redis, marking another AI category win. Qrious Secure achieved a full win against NVIDIA Triton with a four-bug chain. Viettel Cyber Security also performed a guest-to-host escape on Oracle VirtualBox. STAR Labs further escalated privileges on Red Hat Enterprise Linux.

https://www.thezdi.com/blog/2025/5/16/pwn2own-berlin-2025-day-two-results thezdi.com

RSS Hunter • May 16, 2025