Zero Day Initiative | Blog - TheNote.app

Zero Day Initiative | Blog
Follow

The Zebra Dining is an online blog that focuses on dining and lifestyle services. They share various articles and guides related to food, restaurants, and dining experiences. Their blog offers reviews, recommendations, and insights that help readers enhance their dining experiences and lifestyle.

Zero Day Initiative - Blog thezdi.com

RSS zerodayinitiative.com

RSS Hunter • Aug 19, 2024

Thread Of Notes

The November 2026 Security Update Review

November 2026 brings substantial patches from both Microsoft and Adobe, with Adobe addressing 110 CVEs across nine products. The most critical Adobe patch is for Connect, fixing 24 CVEs, 18 of which are critical with a CVSS score of 10.0, requiring immediate attention. The Experience Manager also received a critical update, addressing 14 CVEs, including four critical bugs with a CVSS of 9.9. All other Adobe patches this month are Deployment Priority 3, with none reported as publicly known or under active exploit.Microsoft released approximately 1,090 new CVEs, a significant but slightly lower count than the previous month. Only one Microsoft bug, CVE-2026-124194, a Microsoft Outlook Spoofing Vulnerability, is under active attack. Despite its "spoofing" label and moderate CVSS of 6.5, this vulnerability can disclose NTLMv2 hashes, enabling attacker authentication.Other notable Microsoft patches include CVE-2026-116928, a Windows Search RCE vulnerability reachable via Exchange Server, rated CVSS 9.8. CVE-2026-119958 addresses a critical Windows LDAP RCE vulnerability exploitable without authentication, potentially devastating on Domain Controllers. Azure OpenAI also received an Elevation of Privilege patch, CVE-2026-119990, raising concerns due to the lack of customer guidance.Additional critical Microsoft vulnerabilities include CVE-2026-119952 in Windows Schannel, a Remote Code Execution bug with high exploitation likelihood, and CVE-2026-95962 in Windows Virtual Filtering Platform (VFP), a use-after-free RCE. An Xbox Live Networking Service RCE, CVE-2026-112967, also rated CVSS 9.8, stands out due to its unusual target.Finally, 30 of the November Microsoft CVEs are identified as "wormable," allowing unauthenticated remote code execution without user interaction. These include multiple vulnerabilities in Message Queuing, DNS, Color Management, DHCP Server, DirectMusic, and Xbox, as well as single instances in Exchange Server, LDAP, Schannel, and IIS, among others.

https://www.thezdi.com/blog/2026/11/10/the-november-2026-security-update-review thezdi.com

RSS Hunter • Nov 10

CVE-2026-35273: SSRF to RCE in Oracle PeopleSoft

Mandiant reported ShinyHunters exploiting CVE-2026-35273, a vulnerability discovered by TrendAI. TrendAI investigated three distinct vulnerabilities in PeopleSoft components, not just the single CVE Oracle initially assigned. This report details these vulnerabilities, starting with a Server-Side Request Forgery (SSRF) in the PeopleSoft Integration Gateway (PSIGW). This SSRF allows attackers to bypass PeopleSoft's validateClient method, which is meant to restrict access to sensitive functionality. The PeopleSoft Environment Management Hub (PSEMHUB) implements this validateClient method, but the SSRF allows attackers to target it via the loopback interface.The first bug leverages the PSIGW SSRF to enable attackers to craft requests to internal PeopleSoft components. By controlling the URL and payload, attackers can effectively proxy requests. This SSRF is crucial because the validateClient method permits access from localhost by default. The second vulnerability, an External Control of File Path in PSEMHUB, allows an attacker to write arbitrary content to any file on the server. By combining the SSRF with this file write vulnerability, an attacker can write a web shell to the PSEMHUB WAR path, achieving remote code execution. The third vulnerability is a Deserialization of Untrusted Data in PSEMHUB. Attackers can place a malicious XML file in a specific directory, which is then deserialized by PSEMHUB upon startup or service restart, leading to code execution. These chained vulnerabilities allow complete compromise of affected PeopleSoft instances.

https://www.thezdi.com/blog/2026/10/20/cve-2026-35273-ssrf-to-rce-in-oracle-peoplesoft thezdi.com

RSS Hunter • Oct 27

The October 2026 Security Update Review

Adobe released eleven bulletins addressing 174 CVEs across various products. Critical issues were found in ColdFusion, Commerce, and Experience Manager, with ColdFusion being the most urgent due to multiple critical vulnerabilities including pre-authentication remote code execution. Commerce patches are also high priority due to its value as a target and a recent zero-day exploit. Experience Manager also had serious server-side flaws alongside numerous XSS vulnerabilities. All other Adobe patches are considered lower priority and were not publicly known or actively attacked.Microsoft set a new record with 1,415 new CVEs in October 2026, exceeding any previous year's total. This volume is attributed partly to AI accelerating bug discovery on both ends. Despite the high number, only one vulnerability was under active attack, a Windows Shell security feature bypass. Two bugs were publicly known but not actively exploited: a .NET Framework feature bypass and a MessagePack-CSharp denial-of-service bug.Notable Microsoft vulnerabilities include a SharePoint elevation of privilege exploit and a SQL Server remote code execution flaw, both exploitable by authenticated attackers. An Exchange Server remote code execution vulnerability was also released, though its exploitability is considered difficult. The release contained an alarming 59 potential wormable bugs, requiring urgent attention. Microsoft is also introducing "risk cohorts" to help customers organize their vulnerability analysis.

https://www.thezdi.com/blog/2026/10/13/the-october-2026-security-update-review thezdi.com

RSS Hunter • Oct 13

Pwn2Own Ireland 2026 - Day Three Results & Master of Pwn

Day Three of Pwn2Own Ireland 2026 wrapsup with 17 attempts scheduled, roughly $1.33 million on the board. The headliner is the Google Pixel 10, which draws three separate attempts: Xint at 11:15 AM, Ikotas Labs at 2:00 PM, and the Valsamaras/Ken Gannon (Djini.ai)/Valsamara team closing things out at 6:30 PM — by far the single biggest payday in play all week. The Samsung Galaxy S26 gets one more run too, from BunkyoWesterns at 4:15 PM. Smart Home stays busy with three attempts on the Philips Hue Bridge Pro and two closing attempts on Home Assistant Green, while AI Infrastructure sees two more shots at Oracle's Autonomous AI Database plus a single run at Chroma. Printers round things out with steady, lower-stakes attempts on the Brother, Canon, and Lexmark targets — and with Team MAMMOTH's 7:00 PM attempt as the last scheduled slot, the Master of Pwn title could still be unsettled heading into the final hour. Stay tuned for live results as we have them.

https://www.thezdi.com/blog/2026/10/8/pwn2own-ireland-2026-day-three-results-amp-master-of-pwn thezdi.com

RSS Hunter • Oct 8

Pwn2Own Ireland 2026 - Day Two Results

Day Two of Pwn2Own Ireland 2026 features 24 attempts and approximately $780,000 in prizes. The event runs from 9:30 AM to 7:30 PM IST. The Samsung Galaxy S26 will be targeted three times, but only the first successful exploit will claim the prize money. Home Assistant Green is the most-targeted device, with five scheduled attempts. AI Infrastructure will see four attempts across Dynamo, Chroma, and Oracle's Autonomous AI Database. Wellness has one scheduled attempt, while Printers have three attempts on the Lexmark CX532adwe. Yesterday, $388,500 was awarded for 32 unique zero-day exploits. Thanh Do of Team Confused failed to exploit the Brother MFC-L8970CDW printer. Yves Bieri of Xint successfully exploited Home Assistant Green, earning $30,000 and 3 Master of Pwn points. Eugene was unsuccessful in his attempt to exploit Chroma in the AI Infrastructure category.

https://www.thezdi.com/blog/2026/10/7/pwn2own-ireland-2026-day-two-results thezdi.com

RSS Hunter • Oct 7

Pwn2Own Ireland 2026 - Day One Results

Pwn2Own Ireland 2026 commenced with 21 participants targeting various devices. The competition included attempts on Samsung devices and the first entry for a Pixel. Live updates and results were provided on a blog and social media platforms. Followers were encouraged to use hashtags like #Pwn2Own Ireland for continuous coverage. Unfortunately, Ikotas Labs, Inc. failed to demonstrate a working exploit on the Brother MFC-L8970CDW printer. However, McAulay Hudson successfully exploited the Sonos Era 300 using an OOB Write and a format string bug. This achievement earned him $50,000 and 5 Master of Pwn points. Taisic Yun from Xint also achieved success by exploiting LiteLLM. He utilized an Improper Input Validation bug and code injection to gain a reverse shell. Taisic Yun's exploit resulted in him winning $40,000 and 4 Master of Pwn points.

https://www.thezdi.com/blog/2026/10/6/pwn2own-ireland-2026-day-one-results thezdi.com

RSS Hunter • Oct 6

Pwn2Own Ireland 2026 - The Full Schedule

Pwn2Own Ireland 2026 has commenced in Cork with a record number of security researchers participating. The competition spans three days, featuring attempts across mobile phones, smart home devices, AI infrastructure, printers, and wellness products. Day one kicks off with multiple teams targeting devices like the Samsung Galaxy S26 and Sonos Era 300, offering significant prize money and Master of Pwn points. Notable attempts include VinSOC targeting the Philips Hue Bridge Pro and Summoning Team's pursuit of vulnerabilities in Garmin Index BPM. The day concludes with White Noise Club aiming for a substantial prize on the Google Pixel 10. Day two presents further challenges, with KAIST Hacking Lab focusing on the Google Pixel 10 via USB and Out of Bounds tackling Dynamo. Doyensec and RET2 Systems are scheduled to attempt exploits on Home Assistant Green and Sonos Era 300 respectively. Day three continues the intense cybersecurity battle, featuring Summoning Team and OtterSec targeting smart home and AI database systems. The competition highlights the diverse landscape of IoT and AI security, with significant financial incentives for successful exploits. The schedule indicates ongoing efforts throughout each day, with live leaderboards providing real-time updates.

https://www.thezdi.com/blog/2026/10/5/pwn2own-ireland-2026-the-full-schedule thezdi.com

RSS Hunter • Oct 5

CVE-2024-0244 – A heap buffer overflow in the Canon MF753Cdw printer

This post details the discovery and exploitation of CVE-2024-0244, a vulnerability in the Canon MF753Cdw printer. The researcher leveraged prior experience with Canon printers to investigate less obvious services. They focused on the fax driver, discovering that it sent SOAP messages to the printer. A malformed binary payload within these messages, specifically a large destination fax number, triggered a heap-based buffer overflow. This overflow led to an arbitrary free() vulnerability, where a controlled pointer was passed to the free() function. Exploiting this required a multi-step process involving the Canon proprietary BJNP protocol. First, fake heap chunks were placed at known addresses using BJNP. Then, shellcode was uploaded to another known BJNP address. The arbitrary free was triggered, placing a fake BJNP chunk onto the free list. A subsequent heap allocation reused this chunk. Finally, this reused chunk was overwritten through another BJNP session to redirect a function pointer to the uploaded shellcode. This allowed for arbitrary code execution, demonstrated by displaying DOOM on the printer's screen. The post concludes by acknowledging the evolving security of Canon printers and anticipates future research for Pwn2Own Ireland 2026.

https://www.thezdi.com/blog/2026/9/23/cve-2024-0244-a-heap-buffer-overflow-in-the-canon-mf753cdw-printer thezdi.com

RSS Hunter • Sep 23

The Apple Security Update Review for September 2026

Apple has released security patches for 273 CVEs across multiple operating systems in its September 2026 update. The update addresses vulnerabilities in macOS, iOS/iPadOS, visionOS, watchOS, tvOS, Safari, and Xcode. Many CVEs lack severity scores, but key ones have been identified.One critical vulnerability, CVE-2026-65400 in Screen Sharing Server, is actively exploited, allowing unauthenticated network access. Another critical bug, CVE-2026-65414 in Bluetooth, permits remote arbitrary code execution across all eight OS platforms.CVE-2026-65346 in ImageIO is a high-severity bug, enabling arbitrary code execution through malicious image processing. Other notable high-severity issues include CVE-2026-84607 in AVEVideoEncoder and CVE-2026-43790 in Kernel, both awaiting NVD scores.Additional high-severity vulnerabilities affecting CUPS (CVE-2026-43692) and autofs (CVE-2026-84568) are also highlighted. The release includes 134 scored CVEs: 2 critical, 46 high, 84 medium, and 2 low. 139 CVEs are still awaiting severity scores from NVD.The patches cover various components like WebKit, Kernel, SMB, and Screen Sharing. Users are advised to update their devices to mitigate these security risks.

https://www.thezdi.com/blog/2026/9/16/the-apple-security-update-review-for-september-2026 thezdi.com

RSS Hunter • Sep 16

The September 2026 Security Update Review

The September 2026 patch releases from Adobe and Microsoft address a significant number of vulnerabilities. Adobe issued ten bulletins, covering 172 CVEs across products like ColdFusion, Acrobat Reader, Commerce, and Experience Manager. The most critical Adobe patch addresses an actively exploited template-engine injection in Adobe Commerce. Microsoft's release is particularly large, with nearly 1,000 new CVEs impacting a wide range of products including Windows, Office, and Azure. Only one Microsoft vulnerability was listed as being actively exploited in the wild. Key Microsoft vulnerabilities include privilege escalation bugs in Windows Update Stack and ALPC, and a critical remote code execution flaw in Exchange Server. Over twenty of Microsoft's patches are classified as potentially wormable, allowing remote, unauthenticated attackers to execute code without user interaction. This includes vulnerabilities in DHCP Server, Active Directory, and DNS Server. The sheer volume of patches highlights the ongoing challenge of maintaining system security in the current threat landscape. Users are urged to prioritize patching, especially for actively exploited vulnerabilities and those with high severity ratings. The trend suggests an increasing reliance on AI for vulnerability discovery, leading to larger patch releases.

https://www.thezdi.com/blog/2026/9/8/the-september-2026-security-update-review thezdi.com

RSS Hunter • Sep 8

The August 2026 Security Update Review

The latest security patches from Adobe and Microsoft have been released, with Adobe addressing 51 unique CVEs in various products, including ColdFusion, Commerce, Lightroom Classic, Content Credentials SDK, and Adobe Campaign Classic. The patches from Adobe are considered critical, with the highest CVSS score being 10.0, and are recommended to be deployed as soon as possible, especially for Campaign Classic and ColdFusion. Microsoft's release includes 398 new CVEs, with 62 rated as Critical, and only one listed as being under active attack. The Microsoft patches impact a wide range of products, including Windows, Office, and Azure, and include several remote code execution vulnerabilities. One notable vulnerability is the Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability, which allows attackers to execute code at SYSTEM level. Another significant vulnerability is the Windows DNS Server Remote Code Execution Vulnerability, which allows a remote, unauthenticated attacker to execute code with elevated privileges. The patches also include several elevation of privilege vulnerabilities in Microsoft Exchange Server, Azure, and other products. It is essential to test and deploy these patches quickly, especially for internet-facing systems, to prevent potential attacks. The large number of patches released this month is consistent with the trend of increasing patch volumes, and it is crucial to stay on top of these updates to ensure the security of systems and data. Overall, the latest security patches from Adobe and Microsoft highlight the importance of regular updates and patch management to prevent cyber attacks and protect sensitive information.

https://www.thezdi.com/blog/2026/8/11/the-august-2026-security-update-review thezdi.com

RSS Hunter • Aug 11

The July 2026 Apple Security Update Review

Apple released 210 unique CVEs across multiple operating systems and Safari in July 2026, a significant increase from the previous month. As Apple does not provide severity scores, analysis relies on the nature of the vulnerabilities. CVE-2026-43818 (ImageIO) is a critical remote arbitrary code execution vulnerability, affecting iOS and all macOS versions, making it highly exploitable. CVE-2026-64747 (AVEVideoEncoder) allows an app to execute arbitrary code with kernel privileges, affecting most Apple platforms and representing a full system compromise. CVE-2026-64767 (afpfs) enables remote, unauthenticated kernel memory corruption or system termination, though limited to macOS.Other notable vulnerabilities include CVE-2026-43776 (AppleDouble) and several SceneKit bugs, which provide file-parsing paths to arbitrary code execution. CVE-2026-43750 (Wi‑Fi) allows code execution with elevated privileges outside the sandbox. Additionally, CVE-2026-64696 (SMB) and CVE-2026-43810 (Kernel) are identified as further remote kernel-corruption bugs. The total patches include 9 code execution, 26 elevation of privilege, 11 sandbox escape, and 75 denial of service vulnerabilities. This release highlights the ongoing "bug apocalypse" impacting vendors, even Apple.

https://www.thezdi.com/blog/2026/7/29/the-july-2026-apple-security-update-review thezdi.com

RSS Hunter • Jul 30

Pwn2Own Ireland 2026 – New Targets and Categories

Pwn2Own Ireland is returning to Cork for its third year, scheduled for October 6-9, 2026. Registration closes on October 1st, 2026, at 5:00 p.m. Irish Standard Time, with no exceptions for late entries. To ensure fairness, contestants must have earned at least $15,000 in aggregate bounty payments from ZDI programs lifetime. A maximum of 80 contestants will be accepted, with up to 10 new contestants considered at the organizers' discretion. The event features seven target categories: Mobile Phones, Smart Home Devices, Wellness, Printers, Messaging, AI Infrastructure, and AI Coding Agents. Mobile phones will be targeted using the default browser or short-distance protocols like NFC, Wi-Fi, or Bluetooth. Smart home devices can be attacked via exposed network services, RF attack surfaces, or features from a laptop within the contest network. The new Wellness category focuses on healthcare devices, with attacks launched against exposed network services or RF attack surfaces. Printers, often overlooked, will also be a target, though with a reduced number of devices. The Messaging category returns, specifically targeting WhatsApp with the hope of a functioning exploit leading to code execution. Both AI Infrastructure and AI Coding Agents are new or returning categories focusing on artificial intelligence technologies and their security. The overall winner will be crowned Master of Pwn, accumulating points for successful attempts across all categories. Results will be blogged and tweeted in real-time, and contestants are strongly encouraged to read the full rules thoroughly.

https://www.thezdi.com/blog/2026/7/21/pwn2own-ireland-2026-new-targets-and-categories thezdi.com

RSS Hunter • Jul 21

The July 2026 Security Update Review

The July 2026 patch release is described as a significant event, with "nay-sayers" being proven right about potential issues. Adobe has adopted a bimonthly patching schedule, releasing updates on the second and fourth Tuesdays of the month. This month's Adobe release addresses 88 unique CVEs across various products, including ColdFusion, Commerce, After Effects, and Creative Cloud applications. While no Adobe vulnerabilities are currently under active exploit, Cold Fusion and Commerce patches are prioritized due to their high CVSS scores. Microsoft's July release is characterized as exceptionally large, covering over 621 CVEs across a wide range of products. This count significantly exceeds previous years, indicating a record-breaking number of vulnerabilities. Notable Microsoft vulnerabilities being actively exploited include an Elevation of Privilege in Active Directory Federation Services and a SharePoint Server Elevation of Privilege. A critical Windows VMSwitch Elevation of Privilege vulnerability with a 9.9 CVSS score is also highlighted. Several SharePoint Remote Code Execution vulnerabilities, including those demonstrated at Pwn2Own, are also addressed. Other critical patches cover Remote Desktop Protocol, Exchange Server spoofing, and Windows DHCP Server Remote Code Execution. Even Minecraft Bedrock Dedicated Server has a critical vulnerability, emphasizing the widespread nature of these issues.

https://www.thezdi.com/blog/2026/7/14/the-july-2026-security-update-review thezdi.com

RSS Hunter • Jul 14

CVE-2026-47291: Remote Code Execution in the Windows HTTP.sys

A remote code execution vulnerability exists in the HTTP Protocol Stack for Microsoft Internet Information Services implemented in HTTP.sys, which can be exploited by sending crafted HTTP packets to the target system. The vulnerability is due to invalid validation of incoming HTTP requests, and successful exploitation can result in a denial-of-service condition or code execution with kernel privileges. HTTP.sys is the kernel-mode HTTP protocol driver in Microsoft Windows, and it provides HTTP request parsing, response caching, and SSL/TLS termination for Internet Information Services and other applications. The vulnerability is caused by an integer overflow in the buffer reference array during HTTP/1.x header parsing, which can lead to a kernel pool heap buffer overflow. To trigger the overflow, an attacker must craft an HTTP request with each header line encapsulated in a separate TLS application data record, requiring a minimum of 65,536 buffer references. The total request size would be approximately 262,144 bytes, which exceeds the default MaxRequestBytes registry value of 16,384 bytes. A remote unauthenticated attacker could exploit this vulnerability by sending a specially crafted HTTP/1.x request over a TLS connection to an affected server, resulting in unexpected system termination or arbitrary code execution in the context of the kernel. Detection of this vulnerability can be achieved by monitoring and parsing traffic on TCP port 443, either by decrypting the TLS traffic and counting the number of distinct header field lines or by inspecting the pattern of TLS application data records within the encrypted session. The vulnerability was patched by Microsoft in the June 2026 release cycle, and the best method to ensure remediation is to test and deploy the vendor-supplied patch. To prevent exploitation, keeping the MaxRequestBytes registry value at or below 65,535 bytes represents a conservative configuration, and users are advised to follow the latest security patches and exploit techniques from the TrendAI Research team.

https://www.thezdi.com/blog/2026/7/9/cve-2026-47291-remote-code-execution-in-the-windows-httpsys thezdi.com

RSS Hunter • Jul 10

The June 2026 Apple Security Update Review

Apple released 37 security updates in June 2026 for iOS, iPadOS, macOS, and Safari. The majority of these vulnerabilities, 31 in total, are related to WebKit and WebRTC, often leading to crashes or denial of service through malicious web content. However, a few kernel and sandbox escape bugs present higher risks.CVE-2026-43724 stands out as a kernel bug allowing unexpected system termination or kernel memory writes, a critical step for full device control. Another significant kernel vulnerability, CVE-2026-39868, could corrupt kernel memory and is attributed to elite security researchers, suggesting it's a weaponizable bug. Additionally, CVE-2026-43725 and CVE-2026-43701 are WebKit sandbox escapes that enable websites to bypass restrictions. These sandbox escapes are crucial as they bridge the gap between web content exploits and potential kernel-level attacks. While many WebKit bugs cause simple crashes, these specific ones are flagged for their potential to lead to more severe system compromises. The update also includes vulnerabilities like information disclosure, memory corruption, privilege elevation, and spoofing. Apple does not provide CVSS scores, making it necessary to infer severity from the reported impacts and attributions. The company will continue this security update coverage if readers find it beneficial.

https://www.thezdi.com/blog/2026/6/30/the-june-2026-apple-security-update-review thezdi.com

RSS Hunter • Jul 1

The June 2026 Security Update Review

Adobe released eleven bulletins addressing 123 CVEs in various products for June. The most critical update is for Adobe Campaign Classic with a CVSS score of 10.0, followed by ColdFusion with seven critical vulnerabilities. Adobe Acrobat Reader also received twenty critical vulnerability patches, which are common targets for ransomware. Microsoft's June Patch Tuesday was the largest ever, with 208 CVEs across Windows, Office, and Azure. Three of these vulnerabilities are publicly known, and one is under active exploitation in the wild. A critical Windows Kernel Remote Code Execution vulnerability, CVE-2026-45657, is particularly concerning due to its wormable nature. Another high-severity bug, CVE-2026-47291, affects HTTP.sys and allows remote code execution unless specific registry settings are in place. Microsoft Defender also has an elevation of privilege vulnerability, CVE-2026-41091, which is being exploited. Patches for BitLocker address vulnerabilities that could allow security feature bypass. The sheer volume of patches raises questions about AI's role in their discovery and creation. System administrators should prioritize deployment of these critical updates due to the number of zero-day threats and active exploits.

https://www.thezdi.com/blog/2026/6/9/the-june-2026-security-update-review thezdi.com

RSS Hunter • Jun 9

Pwn2Own Berlin 2026: Day Three Results and Master of Pwn

Pwn2Own Berlin 2026 concluded its third and final day, showcasing impressive research and exploitation techniques. Over the three days, a total of $908,750 was awarded for 39 unique zero-day vulnerabilities. Today's targets included Red Hat Linux, Windows 11, OpenAI Codex, VMware ESXi, and Anthropic Claude Code. Sina Kheirkhah of Summoning Team successfully exploited Red Hat Linux, receiving $7,000 for a partially known bug. Viettel Cyber Security earned $7,500 by exploiting Windows 11 using an integer overflow for privilege escalation. Satoki Tsuji of Ikotas Labs, Inc. successfully exploited OpenAI Codex, earning $20,000. Giuseppe Calì of Summoning Team was unsuccessful in exploiting VMware ESXi. Compass Security successfully targeted Anthropic Claude Code, receiving $20,000 despite a vulnerability collision. Hyunwoo Kim chained vulnerabilities to escalate privileges on Red Hat Enterprise Linux, earning $5,000.

https://www.thezdi.com/blog/2026/5/16/pwn2own-berlin-2026-day-three-results-and-master-of-pwn thezdi.com

RSS Hunter • May 16

Pwn2Own Berlin 2026 - Day Two Results

Day Two of Pwn2Own Berlin 2026 is ongoing, showcasing security researchers' prowess in exploiting enterprise systems. Yesterday, a substantial $523,000 was awarded for 24 unique zero-day exploits. DEVCORE currently leads in the race for Master of Pwn, but competition remains fierce with several high-value targets. Researchers attempted to exploit Safari, SharePoint, and other platforms, with some attempts failing due to time constraints. Ben Koo successfully escalated privileges on Red Hat, earning $10,000 and a point. OtterSec demonstrated a code injection bug in LM Studio, securing $20,000 and four points. Summoning Team and STARLabs SG achieved successful exploits using known vulnerabilities, receiving rewards, while Le Duc Anh Vu successfully exploited Cursor. Orange Tsai of DEVCORE achieved Remote Code Execution on Microsoft Exchange, earning a significant $200,000 and 20 Master of Pwn points. Several teams withdrew their entries due to unforeseen circumstances.

https://www.thezdi.com/blog/2026/5/15/pwn2own-berlin-2026-day-two-results thezdi.com

RSS Hunter • May 15

Pwn2Own Berlin 2026 - Day One Results

Pwn2Own Berlin 2026 kicked off with security researchers targeting AI databases, coding agents, local inferences, and NVIDIA products. Several teams successfully exploited vulnerabilities, demonstrating impressive hacking skills. Orange Tsai of DEVCORE earned $175,000 for a Microsoft Edge sandbox escape. chompie of IBM X-Force exploited NV Container Toolkit, while k3vg3n took down LiteLLM. Satoki Tsuji used an allowed list bug on NVIDIA Megatron Bridge. Compass Security successfully exploited OpenAI Codex. Angelboy and TwinkleStar03 of DEVCORE also achieved privilege escalation on Windows 11. Ben Koo withdrew from the Mozilla Firefox category. Ikotas Labs successfully targeted LiteLLM using known bugs. Yoseop Kim exploited NVIDIA Megatron Bridge with a CWE-470 bug.

https://www.thezdi.com/blog/2026/5/13/pwn2own-berlin-2026-day-one-results thezdi.com

RSS Hunter • May 14

Pwn2Own Berlin 2026: The Full Schedule

Pwn2Own Berlin 2026, hosted at OffensiveCon, features security researchers targeting enterprise-focused technologies. The competition includes categories for AI Databases, Coding Agents, Local Inferences, and NVIDIA products. The schedule, detailing the order of attacks, is already set based on a random draw. Day one kicked off with attacks on NVIDIA, Coding Agents, and Web Browsers. Researchers are also targeting Local Escalation of Privilege and AI Database categories. Day two saw continued attacks on Software like Windows, Firefox and Safari. Several teams targeted the Coding Agent, Local Inference and Server categories. Day three features further attacks in the Coding Agent category. The final day includes targets such as Windows, Red Hat Enterprise Linux, VMware ESXi and Microsoft SharePoint. The competition provides opportunities for security researchers to showcase their skills. Real-time updates and results are available on social media.

https://www.thezdi.com/blog/2026/5/13/pwn2own-berlin-2026-the-full-schedule thezdi.com

RSS Hunter • May 13

The May 2026 Security Update Review

Adobe released ten bulletins patching 52 vulnerabilities across various products, with Adobe Commerce and Connect being high priorities. Microsoft's Patch Tuesday included 138 new CVEs, including fixes for Windows, Office, and Edge. Notably, no currently exploited bugs were identified. Several critical vulnerabilities exist, including RCE bugs in DNS Client and Netlogon. The Netlogon flaw allows unauthenticated remote code execution, making it a critical patch. Dynamics 365 on-premises also has a critical RCE vulnerability calling for quick deployment. A TCP/IP stack vulnerability, though less likely to be exploited, also requires patching. The sheer volume of Microsoft's fixes is significant, echoing industry trends. The article also provides a full list of Microsoft CVEs with details on severity and type. This Patch Tuesday release comes just before Pwn2Own Berlin.

https://www.thezdi.com/blog/2026/5/12/the-may-2026-security-update-review thezdi.com

RSS Hunter • May 12

The Apple macOS Security Update Review

The blog provides an analysis of macOS security updates released in May 2026. Apple released 82 unique CVEs across three macOS versions: Tahoe, Sequoia, and Sonoma. The blog highlights three potentially severe vulnerabilities without assigned severity scores from Apple. CVE-2026-28819, related to Wi-Fi, allows arbitrary code execution with kernel privileges across all versions. CVE-2026-43668, concerning mDNSResponder, enables remote attackers to corrupt kernel memory. Another critical vulnerability is CVE-2026-28972, enabling apps to write to kernel memory. The document includes a detailed table listing all released CVEs, components affected, and their impact. The blog concludes by stating the intention to continue the macOS update analysis if readers find it helpful.

https://www.thezdi.com/blog/2026/5/12/the-apple-macos-security-update-review thezdi.com

RSS Hunter • May 12

CVE-2026-33824: Remote Code Execution in Windows IKEv2

TrendAI Research identified a double free vulnerability, CVE-2026-33824, in the Windows Internet Key Exchange (IKE) service, originally discovered by the WARP & MORSE team at Microsoft. This flaw, present in IKEv2's fragment processing, could lead to a crash of the IKEEXT service or arbitrary code execution. The vulnerability stems from improper ownership handling of a heap-allocated blob pointer during IKEv2 fragment reassembly within ikeext.dll. During the IKE_SA_INIT exchange, a Security Realm Vendor ID payload causes IkeHandleSecurityRealmVendorId() to allocate a blob, stored in the MMSA structure. When a fragmented IKE_AUTH message is reassembled, IkeReinjectReassembledPacket shallow-copies this blob pointer into a local stack struct. This struct is then shallow-copied into a heap-allocated work item by IkeQueueRecvRequest. The first free occurs when IkeDestroyPacketContext processes the work item and releases this shallow-copied blob pointer. The MMSA structure still holds the original pointer to the same allocation. The second free happens when the MMSA is cleaned up via IkeCleanupMMNegotiation, which eventually triggers IkeFreeMMSA, attempting to free the already released allocation. An unauthenticated, remote attacker can exploit this by sending a crafted IKE_SA_INIT message followed by two or more Encrypted Fragment payloads with an invalid IKE_AUTH message. Detection requires monitoring UDP ports 500 and 4500 for a specific IKE_SA_INIT sequence (including the Microsoft Security Realm Vendor ID) followed by a fragmented IKE_AUTH request containing a particular byte sequence. Microsoft patched this vulnerability in April 2026, recommending blocking inbound traffic on UDP ports 500 and 4500, or restricting traffic to known peer addresses, as temporary mitigations. Applying the vendor's update is the only full remediation.

https://www.thezdi.com/blog/2026/4/22/cve-2026-33824-remote-code-execution-in-windows-ikev2 thezdi.com

RSS Hunter • Apr 23

The April 2026 Security Update Review

April 2026's Patch Tuesday is significant due to a high volume of fixes and active exploits. Adobe released 12 bulletins addressing 61 CVEs in various products, with one Acrobat Reader bug being actively exploited. A separate Adobe ColdFusion bug also has a deployment priority of one. Microsoft released a massive 163 new CVEs across numerous products and components, totaling 247 with third-party fixes. One Microsoft SharePoint Server Spoofing Vulnerability is actively exploited, and a Defender Elevation of Privilege Vulnerability is publicly known. Two critical Windows vulnerabilities, one in TCP/IP and another in IKE, are potentially wormable. The size of Microsoft's release might be due to increased AI-driven vulnerability submissions. Prioritize patching actively exploited vulnerabilities in Adobe Reader and Microsoft Sharepoint. Enterprises using IPv6 or IKE should expedite patching related to their respective vulnerabilities. Testing and deploying the Microsoft Defender fix is crucial for those relying on it.

https://www.thezdi.com/blog/2026/4/14/the-april-2026-security-update-review thezdi.com

RSS Hunter • Apr 14

Node.js Trust Falls: Dangerous Module Resolution on Windows

The blog details a local privilege escalation vulnerability affecting Node.js applications on Windows, arising from its module resolution behavior. Node.js searches for modules in C:\node_modules by default, allowing attackers to create this directory. Malicious modules placed there can be executed within the context of a user running an application. The issue stems from Node.js's stance of "trusting the file system", considering it intentional behavior. This negligence transforms optional dependencies into a dangerous attack vector. npm CLI and Discord are demonstrated as vulnerable, exploiting missing optional dependencies. The npm CLI vulnerability, CVE-2026-0775, leverages a missing "bluebird" package. Discord, through CVE-2026-0776, is vulnerable due to a missing "utf-8-validate" dependency, and remains unpatched. These vulnerabilities are triggered when launching the applications, without user interaction. Node.js, npm, and Discord do not consider this a valid security issue. The blog encourages researchers to investigate more applications for similar vulnerabilities.

https://www.thezdi.com/blog/2026/4/8/nodejs-trust-falls-dangerous-module-resolution-on-windows thezdi.com

RSS Hunter • Apr 8

Announcing Pwn2Own Berlin for 2026

Pwn2Own is returning to Berlin for its second competition, co-sponsored by AWS, with over $1 million in prizes. The event features expanded AI categories including AI Databases, Coding Agents, Local Inferences, and NVIDIA products. Existing categories like web browsers, containers, servers, virtualization, and operating systems are also included. Registration closes on May 7th for the contest that begins on May 14th, with 31 targets across 10 categories. The Master of Pwn will be crowned based on accumulated points from unique, successful entries, receiving significant rewards. Virtualization targets include VMware ESXi, Microsoft Hyper-V, and KVM, with potential bonuses for advanced exploits. Web browser exploits, including renderer-only, have increased award values this year. Enterprise applications like Adobe Reader and Microsoft Office components are targets, with a new bonus for Copilot data exfiltration. Server targets include Microsoft Exchange and RDP/RDS due to their high-risk nature. Local Escalation of Privilege requires kernel vulnerabilities on Linux, macOS, and Windows. Container exploits must achieve host OS execution from within a container, featuring Firecracker. New AI categories focus on exploiting AI databases, coding agents, and local inference models. The NVIDIA category targets specific NVIDIA products and their associated software. Participants are strongly encouraged to read the complete rules and contact for registration and specific questions.

https://www.thezdi.com/blog/2026/3/11/announcing-pwn2own-berlin-for-2026 thezdi.com

RSS Hunter • Mar 12

The March 2026 Security Update Review

The author is reviewing security patches released for March 2026 from Adobe and Microsoft. Adobe released eight bulletins addressing 80 CVEs across various applications, with Acrobat Reader being a priority for patching. Microsoft's release includes 84 new CVEs, with five reported through the TrendAI ZDI program. Several Microsoft vulnerabilities are detailed, including an Excel information disclosure bug related to the Copilot Agent. Office Remote Code Execution vulnerabilities, like previous months, continue to be present and need addressing. A Windows Print Spooler RCE vulnerability that works similarly to the "Print Nightmare" is also present, requiring quick patching. A Windows Graphics Component Elevation of Privilege vulnerability that was identified as variants needs to be addressed. The post concludes with a comprehensive list of the CVEs released by Microsoft for March 2026, including their severity and related details. The author emphasizes the importance of testing and deploying these security updates promptly.

https://www.thezdi.com/blog/2026/3/10/the-march-2026-security-update-review thezdi.com

RSS Hunter • Mar 10

CVE-2026-20841: Arbitrary Code Execution in the Windows Notepad

This report details a command injection vulnerability in Microsoft Windows Notepad (CVE-2026-20841). The vulnerability stems from improper validation of links within rendered Markdown files. Exploitation involves enticing a user to open a crafted malicious Markdown file containing a harmful link. When the user clicks the link, arbitrary commands can execute within the victim's account's security context. The Notepad application tokenizes input and renders Markdown files if the file extension is ".md". The vulnerability exists in the function handling link clicks, sub_140170F60(), which calls ShellExecuteExW(). Insufficient filtering allows attackers to use "file://" and "ms-appinstaller://" protocol URIs. The vulnerability was patched by Microsoft in February 2026. The report includes detection guidance for identifying potential exploitation attempts. The guidance suggests monitoring traffic for malicious links within ".md" files using specific regular expressions. The provided patch restricts links to local files and HTTP(S) URIs, potentially leading to false positives. The report concludes user interaction is required for exploitation and recommends patching to remediate the vulnerability. The research was done by Nikolai Skliarenko and Yazhi Wang from TrendAI.

https://www.thezdi.com/blog/2026/2/19/cve-2026-20841-arbitrary-code-execution-in-the-windows-notepad thezdi.com

RSS Hunter • Feb 19

The February 2026 Security Update Review

The post discusses the February 2026 Patch Tuesday updates from Adobe and Microsoft. Adobe released patches for various applications, with After Effects receiving the most significant update, fixing several critical bugs. None of Adobe's fixes were actively exploited or publicly known at the time of release. Microsoft's update addresses 62 CVEs across multiple products, and six are actively exploited, a higher-than-usual number. Several critical vulnerabilities are highlighted, including Windows Shell and Internet Explorer security bypasses, which could lead to code execution. The DWM elevation of privilege vulnerability makes a second consecutive appearance as an actively exploited vulnerability. A Windows Remote Desktop Services privilege escalation bug is also actively exploited. The post urges quick testing and deployment of these specific Microsoft patches. Microsoft also addressed vulnerabilities in Azure, .NET, Office, and other components. The high number of actively exploited bugs raises concerns about a resurgence of widespread exploitation.

https://www.thezdi.com/blog/2026/2/10/the-february-2026-security-update-review thezdi.com

RSS Hunter • Feb 10

CVE-2025-6978: Arbitrary Code Execution in the Arista NG Firewall

A command injection vulnerability in Arista NG Firewall, reported by TrendAI Research, allows arbitrary command execution. This vulnerability, tracked as CVE-2025-6798, stems from inadequate validation within the diagnostics component. Attackers can exploit this via crafted requests to the JSON-RPC interface, specifically the runTroubleshooting method. User-supplied data within parameters like "HOST" or "URL" isn't fully sanitized, allowing for the injection of malicious commands. The backtick character is an example of an unsafe character that can be used to inject commands. Successful exploitation grants attackers root privileges on the compromised system. Detection involves monitoring HTTP/HTTPS traffic for malicious JSON-RPC requests. The provided detection guidance details specific checks within request bodies using regular expressions. The vulnerability lies in the runTroubleshooting command's handling of user input within the NetworkManagerImpl class. Arista has addressed the issue in version 17.4 or higher. The report emphasizes the importance of applying the vendor's security patch. This thorough analysis was conducted by Jonathan Lein and Simon Humbert from the TrendAI Research team.

https://www.thezdi.com/blog/2026/2/4/cve-2025-6978-arbitrary-code-execution-in-the-arista-ng-firewall thezdi.com

RSS Hunter • Feb 5

Pwn2Own Automotive 2026 - Day Three Results and the Master of Pwn

Pwn2Own Automotive 2026 concluded with security researchers demonstrating 76 unique 0-day vulnerabilities, awarding over $1 million USD. The Fuzzware.io team, comprising Tobias Scharnowski, Felix Buchmann, and Kristian Covic, secured the Master of Pwn title. They earned 28 points and $215,500 USD for their exploits. Several teams targeted various automotive systems, including Alpine, Kenwood, and Sony infotainment units. Some exploits involved buffer overflows, while others utilized race conditions and incorrect permission assignments. Collisions, where vulnerabilities were already known or demonstrated by another team, occurred frequently, impacting some prize amounts. The Juurin Oy team notably demonstrated a TOCTOU bug on an Alpitronic charger, even installing the game Doom. Other successful exploits gained root access on infotainment systems and charging stations. The competition highlighted the ongoing security challenges within modern automotive technology.

https://www.thezdi.com/blog/2026/1/23/pwn2own-automotive-2026-day-three-results-and-the-master-of-pwn thezdi.com

RSS Hunter • Jan 23

Pwn2Own Automotive 2026 - Day Two Results

The Pwn2Own Automotive 2026 competition is underway, with security researchers competing to find vulnerabilities in the latest automotive systems. The competition has already awarded over $516,500 for 37 unique 0-day vulnerabilities. Researchers are targeting various automotive systems, including the Alpine iLX-F511, Grizzl-E Smart 40A, and Kenwood DNR1007XR. Team MAMMOTH successfully exploited a command injection vulnerability against the Alpine iLX-F511, earning $10,000 and 2 Master of Pwn points. Julien COHEN-SCALI of FuzzingLabs also had a successful exploit, chaining two vulnerabilities to earn $20,000 and 4 Master of Pwn points. Neodyme AG exploited a buffer overflow vulnerability in the Sony XAV-9500ES, earning $10,000 and 2 Master of Pwn points. Hank Chen of InnoEdge Labs exploited an exposed dangerous method against the Alpitronic HYC50, earning $40,000 and 4 Master of Pwn points. Several other researchers also had successful exploits, including Nguyen Thanh Dat, BoredPentester, and Sina Kheirkhah. The competition is ongoing, with researchers continuing to probe and challenge the latest automotive systems, and the stakes are rising as the race for Master of Pwn heats up.

https://www.thezdi.com/blog/2026/1/22/pwn2own-automotive-2026-day-two-results thezdi.com

RSS Hunter • Jan 22

Pwn2Own Automotive 2026 - Day One Results

Day One of Pwn2Own Automotive 2026 commenced with thirty entries targeting the latest automotive systems, featuring exploits and security breakthroughs from top researchers. The competition saw significant success across various categories, particularly in exploiting in-vehicle infotainment (IVI) systems and electric vehicle chargers. Several teams, including Neodyme AG and Synacktiv, successfully gained root-level access on IVI units like the Alpine iLX-F511 and Sony XAV-9500ES through vulnerabilities such as buffer overflows and chained exploits. EV chargers proved lucrative targets, with Fuzzware.io, PetoWorks, and others manipulating charging signals or achieving code execution on devices like the Autel charger and Phoenix Contact CHARX SEC-3150, often chaining multiple bugs. Notably, the Grizzl-E Smart 40A charger was successfully exploited multiple times, including a win by SKShieldus using hardcoded credentials and an authentication bypass leading to remote code execution by Compass Security. Some attempts resulted in failure, such as the initial exploit against the Kenwood DNR1007XR and attempts by Fuzzware.io against the EMPORIA Pro Charger. However, subsequent attempts quickly exploited the Kenwood unit through command injection and out-of-bounds writes by other researchers. The competition also included successful collisions where multiple teams exploited the same or similar vulnerabilities, resulting in split rewards and Master of Pwn points. Synacktiv achieved a full win in the Tesla Infotainment category by chaining an information leak and an out-of-bounds write via a USB-based attack. Overall, the day was marked by numerous successful exploits, demonstrating critical vulnerabilities in modern automotive and charging infrastructure components.

https://www.thezdi.com/blog/2026/1/21/pwn2own-automotive-2026-day-one-results thezdi.com

RSS Hunter • Jan 21

Pwn2Own Automotive 2026 - The Full Schedule

The third annual Pwn2Own Automotive competition has begun at Automotive World in Tokyo, featuring a record 73 entries from talented security researchers. The competition aims to test the latest automotive components in a real-world environment, with participants attempting to exploit vulnerabilities in various categories. The categories include In-Vehicle Infotainment, Level 2 Electric Vehicle Chargers, and Level 3 Electric Vehicle Chargers, among others. The schedule for the competition has been released, with each team having a limited time to demonstrate their exploits. The teams are competing for cash prizes and Master of Pwn points, with the total prize pool being substantial. The competition is expected to be intense, with many teams targeting the same devices and categories. The event will feature demonstrations and discoveries, and updates will be posted as the competition progresses. The Pwn2Own Automotive competition is a major milestone, with this year's event being the largest and most competitive yet. The competition will run for several days, with the schedule subject to change as the event unfolds. The outcome of the competition is highly anticipated, with the winning teams being awarded significant cash prizes and recognition in the security research community.

https://www.thezdi.com/blog/2026/1/20/pwn2own-automotive-2026-the-full-schedule thezdi.com

RSS Hunter • Jan 20

The January 2026 Security Update Review

This article reviews the January 2026 security patches from Adobe and Microsoft. Adobe released 11 bulletins addressing 25 CVEs across various Creative Cloud and ColdFusion products. These patches fix code execution and memory leak vulnerabilities, with no publicly known or actively exploited bugs reported by Adobe. Microsoft, on the other hand, issued a large release with 112 new CVEs affecting numerous Windows components, Office, Azure, and Edge. Eight of Microsoft's patches are rated Critical, with the majority being Important. One vulnerability, CVE-2026-20805, an information disclosure bug in the Desktop Window Manager, is listed as actively exploited. Another notable patch addresses a Secure Boot certificate expiration that could impact future updates. Microsoft Office bugs related to the Preview Pane are also highlighted, with a recommendation to disable it as a precaution. Additionally, a critical vulnerability in Windows Virtualization-Based Security allows for elevation to the highest privilege level. The article suggests that large January releases are common due to vendors holding back updates over the holiday season.

https://www.thezdi.com/blog/2026/1/13/the-january-2026-security-update-review thezdi.com

RSS Hunter • Jan 13

The Alpitronic HYC50 Hardware Teardown for Pwn2Own Automotive 2026

Trend Micro's ZDI provides a preliminary hardware reconnaissance report for the Alpitronic HYC50 charger, a target for Pwn2Own Automotive 2026. Researchers will receive a modified enclosure isolating digital and communication components for safer analysis. The main control board manages charging, communication, and user authentication, using an i.MX6 processor and eMMC storage. The report details the board's PLC controllers for vehicle communication and Ethernet interfaces. A custom System on a Module (SOM) based on Variscite's design houses the main processing components. The COMM board handles communication via LTE, Wi-Fi/Bluetooth, and NFC interfaces. The HYC50 has mature documentation available online, which can prove useful. ZDI urges participants to check the development units before use. The report emphasizes the HYC50's hardware potential for the competition. Happy hunting to those participating in Pwn2Own, looking to exploit the charging station.

https://www.thezdi.com/blog/2026/1/11/the-alpitronic-hyc50-hardware-teardown-for-pwn2own-automotive-2026 thezdi.com

RSS Hunter • Jan 12

Breaking Down the Attack Surface of the Kenwood DNR1007XR – Part Two

This blog post analyzes the attack surfaces of the Kenwood DNR1007XR in-vehicle infotainment system. The main potential attack vectors include USB, supporting various audio and video file formats, and SD card for media playback and map updates, both using FAT and NTFS file systems. Bluetooth, utilizing version 5 with multiple profiles, offers another avenue, especially exploring undocumented services. A built-in Wi-Fi access point, secured with a discovered password, exposes open ports, including an SSH server and non-standard services, creating vulnerabilities. Android Auto and Apple CarPlay, both wired and wireless, present further targets, particularly via the secure Wi-Fi network. Kenwood's Portal and Remote S apps, facilitating image transfer and multimedia control via Bluetooth, expand the attack surface. The blog emphasizes the importance of thorough investigation and reverse engineering. The post intends to inspire security research, encouraging explorations beyond the discussed surfaces. The author highlights the complexity of file parsing and the role of user-supplied data, such as images, in expanding the attack surface. Open source licenses present another potential area of investigation despite the disclaimer of actual usage. The author encourages participation in the upcoming Automotive Pwn2Own event.

https://www.thezdi.com/blog/2026/1/8/breaking-down-the-attack-surface-of-the-kenwood-dnr1007xr-part-two thezdi.com

RSS Hunter • Jan 9

Breaking Down the Attack Surface of the Kenwood DNR1007XR – Part One

The Kenwood DNR1007XR head unit is a target for the Pwn2Own Automotive contest, offering features like Android Auto and Apple CarPlay. This blog post details its external features, including an SD card slot behind the screen and a USB port for various functionalities. Internally, the unit features multiple interconnected boards, with the main board housing key components.The primary processor is the Dolphin+ TCC8034 System on a Chip, capable of running Android, Linux, and QNX. It runs on Linux and is similar to a SoC used in last year's Kenwood target. A Kioxia eMMC chip stores the device firmware, and a Winbond flash chip holds additional data.A Murata radio module handles Wi-Fi and Bluetooth operations, with its specific model number being LBEE6ZZ1WD-334. This module lacks publicly available datasheets, making its details obscure. A significant discovery is a debug connector on the main board's right edge.This connector provides access to a Linux login prompt via UART at 115200bps. Successful authentication grants a shell, presenting a potential attack vector. The post aims to provide sufficient information for vulnerability research, with more analysis to follow. The authors encourage keeping an eye on automotive vendor security improvements for future contests. They share their social media handles for those interested in exploit techniques and security patches.

https://www.thezdi.com/blog/2026/1/6/breaking-down-the-attack-surface-of-the-kenwood-dnr1007xr-part-one thezdi.com

RSS Hunter • Jan 7

The December 2025 Security Update Review

Adobe released updates for December 2025, addressing 139 CVEs across various products, including Reader and ColdFusion. While the number of CVEs is high, many are XSS bugs, though some critical code execution vulnerabilities exist. ColdFusion receives a patch with a deployment priority of 1 due to several code execution bugs. Microsoft's December 2025 Patch Tuesday includes 56 new CVEs across Windows, Office, and other components, with a total of 70 when including Chromium updates. This brings Microsoft's yearly total to 1,139 CVEs, making 2025 the second-highest volume year. One actively exploited vulnerability, CVE-2025-62221, is a Windows Cloud Files Mini Filter Driver elevation of privilege bug. Microsoft also addressed critical Office remote code execution vulnerabilities, including those affecting the Preview Pane. A publicly known command injection bug in GitHub Copilot, CVE-2025-64671, is also addressed. The updates include several elevation of privilege and remote code execution vulnerabilities across various Windows components.

https://www.thezdi.com/blog/2025/12/9/the-december-2025-security-update-review thezdi.com

RSS Hunter • Dec 9, 2025

The November 2025 Security Update Review

The text discusses the November 2025 security updates from Adobe and Microsoft. Adobe patched 29 CVEs across various products, with fixes for InDesign and Illustrator being prioritized. Microsoft released updates for 63 CVEs, including those for Windows, Office, and other components. One Microsoft vulnerability, CVE-2025-62215 (Windows Kernel EoP), is under active exploitation and should be a top priority. The report highlights an Office remote code execution bug, CVE-2025-62199, warranting preview pane disabling. Another notable vulnerability is CVE-2025-60709 (CLFS driver EoP), as CLFS has historical exploitation. The Agentic AI and Visual Studio Code remote code execution bug, CVE-2025-62222, is also significant. Microsoft's release total is lower than previous months, with a total of 1084 CVEs addressed this year. The document includes a detailed CVE list with severity and impact information. The author acknowledges that Windows 10 is no longer receiving updates this month. Overall, these updates aim to address various security flaws and protect users.

https://www.thezdi.com/blog/2025/11/11/the-november-2025-security-update-review thezdi.com

RSS Hunter • Nov 11, 2025

Pwn2Own Ireland 2025: Day Three and Master of Pwn

Pwn2Own Ireland 2025 is in its final day, already awarding $792,750 for 56 zero-day bugs. CyCraft Technology withdrew their attempt on the Amazon Smart Plug. Fuzzinglabs failed to exploit the QNAP TS-453E within the time limit. Xilokar successfully exploited the Phillips Hue Bridge with four bugs, though one collided with a prior submission, earning them $17,500. Chris Anastasio successfully exploited the Lexmark CX532adwe printer using a type confusion bug, earning $20,000. Interrupt Labs successfully compromised the Samsung Galaxy S25 using an input validation bug, gaining camera and location access and $50,000. Yannik Marchand also exploited the Phillips Hue Bridge, using three bugs, with two colliding, earning $13,333. The competition continues with 17 attempts remaining. The blog will be updated with live results. Several researchers successfully demonstrated the exploitation of various devices. These findings highlight vulnerabilities in common technology.

https://www.thezdi.com/blog/2025/10/23/pwn2own-ireland-2025-day-three-and-master-of-pwn thezdi.com

RSS Hunter • Oct 23, 2025

Pwn2Own Ireland 2025 - Day Two Results

Day Two of Pwn2Own Ireland 2025 continued with participants trying to earn points and money. Yesterday's competition awarded $522,500 for discovered vulnerabilities. The Summoning Team held a slight lead, but the leaderboard could change with more attempts. PHP Hooligans successfully exploited a Canon printer with an OOB Write, earning $10,000. Viettel Cyber Security used a command injection and other bugs to exploit Home Automation Green, earning $12,500. Qrious Secure exploited Phillips Hue Bridge with multiple bugs, earning $16,000. CyCraft Technology's Chumy Tsai exploited QNAP TS-453E with a code injection bug, earning $20,000. Sina Kheirkhah's exploit of Synology BeeStation Plus was deemed out of scope. Team Neodyme exploited Home Assistant Green with two bugs, earning $15,000. These successful exploits highlight the ongoing efforts to find and fix software vulnerabilities. The competition highlights the importance of cybersecurity. Many teams gained significant points towards the Master of Pwn title.

https://www.thezdi.com/blog/2025/10/22/pwn2own-ireland-2025-day-two-results thezdi.com

RSS Hunter • Oct 22, 2025

Pwn2Own Ireland 2025: Day One Results

Pwn2Own Ireland 2025's first day featured seventeen attempts with exciting cybersecurity research. Team Neodyme successfully exploited an HP DeskJet 2855e using a stack based buffer overflow. STARLabs successfully targeted a Canon imageCLASS MF654Cdw with a heap based buffer overflow. Synacktiv achieved root-level code execution on a Synology BeeStation Plus through a stack overflow. Team DDOS completed a complex SOHO Smashup compromising QNAP devices using eight different bugs. Team DDOS withdrew their attempt on the Philips Hue Bridge. GMO Cybersecurity by Ierae, Inc. successfully exploited another Canon imageCLASS MF654Cdw using a stack based buffer overflow. These successful exploits earned teams substantial prize money and Master of Pwn points. The event showcased a range of vulnerabilities and exploit techniques. Stay updated through their social media channels for more information. Pwn2Own Ireland 2025 is a demonstration of the current cybersecurity landscape.

https://www.thezdi.com/blog/2025/10/21/pwn2own-ireland-2025-day-one-results thezdi.com

RSS Hunter • Oct 21, 2025

Pwn2Own Ireland 2025: The Full Schedule

Pwn2Own Ireland 2025 is announced, promising up to $2,000,000 in prizes, including a $1,000,000 award for a WhatsApp 0-click exploit. The contest schedule is provided, detailing participating teams and their targets across multiple product categories. Numerous teams and individuals are set to attempt exploits on devices like printers, smart home hubs, and network storage systems. Prizes vary, with amounts based on the category and the severity of the identified security vulnerabilities. Specific targets include products from Canon, HP, Synology, Philips Hue, Home Assistant, and Samsung. Live streams for some attempts are available for viewing. The competition spans multiple days, with a wide array of teams and individuals competing. The final day includes an attempt for the major WhatsApp prize. Many different research groups are represented, including teams from DEVCORE, STARLabs, and Summoning Team. The contest focuses on discovering and demonstrating software vulnerabilities for financial rewards and recognition.

https://www.thezdi.com/blog/2025/20/pwn2own-ireland-2025-the-full-schedule thezdi.com

RSS Hunter • Oct 20, 2025

Pwn2Own Automotive Returns to Tokyo with Expanded Chargers and More!

Pwn2Own Automotive returns to Tokyo from January 21-23, 2026, awarding over $2 million for automotive exploits. The event features partnerships with VicOne, Tesla, Alpitronic, and the Open Charge Alliance. New targets include Level 3 EV chargers and the Open Charge Alliance’s OCTT. Existing categories include Tesla, In-Vehicle Infotainment, and Level 2 EV chargers. The Tesla category will use a benchtop unit, with some targets offering a vehicle prize. The Level 2 EV charger category offers bonus challenges for additional rewards and Master of Pwn points. Automotive Operating Systems are also a target, with bonuses for specific subsystem exploits. Master of Pwn is awarded based on points accumulated across successful attempts, regardless of cash prize. Contestants must register by January 15, 2026, and the event order will be determined by a random drawing. Results will be posted live via blog and social media platforms. The organizers anticipate innovative exploits and attack techniques.

https://www.thezdi.com/blog/2025/10/16/pwn2own-automotive-returns-to-tokyo-with-expanded-chargers-and-more thezdi.com

RSS Hunter • Oct 16, 2025

The October 2025 Security Update Review

Adobe's October patch release addresses 36 CVEs across various products, with Substance 3D Stager, Dimension, and Illustrator updates being particularly important. Microsoft's October Patch Tuesday is massive, featuring 177 new CVEs, making it Microsoft's largest monthly release to date. Sixteen vulnerabilities are rated Critical and the rest Important, with some actively exploited. Three bugs are confirmed under active attack, including Windows Agere Modem Driver and Remote Access Connection Manager elevation of privilege bugs. Another notable vulnerability is a Secure Boot bypass in IGEL OS, warranting attention. The Windows Server Update Service (WSUS) remote code execution vulnerability also poses a significant risk. Microsoft's extensive release could be related to the end of Windows 10 support. The sheer volume underscores the need for prompt testing and deployment of security updates to mitigate risks. The provided list details the specific CVEs, their titles, severity ratings, and current status.

https://www.thezdi.com/blog/2025/10/14/the-october-2025-security-update-review thezdi.com

RSS Hunter • Oct 14, 2025

Crafting a Full Exploit RCE from a Crash in Autodesk Revit RFA File Parsing

The author investigated a crash in Autodesk Revit 2025, initially found through fuzzing RFA files, which led to a type confusion vulnerability. This vulnerability was a result of deserializing a std::pair type. The crash occurs when the program tries to call a destructor on a non-vtable value. The author exploited the vulnerability to achieve remote code execution. The research involved reverse engineering and debugging. Tools like IDA Pro, WinDBG, and Time Travel Debugging were used. A cloud-based supply chain vulnerability in Axis Communications Plugin for Autodesk Revit, which could distribute corrupted RFA files, greatly aided the exploit. The author created a tool, "CompoundFileTool," and another tool that mimicked Revit's gzip behavior, which were essential to modify RFA files effectively. The goal was to manipulate the deserialized object's offset 0x0 to point to a controlled vtable. The author ultimately successfully achieved arbitrary code execution by exploiting the type confusion. The research also included reversing and understanding Autodesk's RFA format, including the format of compressed data in Global/Latest stream.

https://www.thezdi.com/blog/2025/10/6/crafting-a-full-exploit-rce-from-a-crash-in-autodesk-revit-rfa-file-parsing thezdi.com

RSS Hunter • Oct 8, 2025

CVE-2025-23298: Getting Remote Code Execution in NVIDIA Merlin

The Trend Micro Zero Day Initiative discovered a critical vulnerability in NVIDIA's Transformers4Rec library, allowing remote code execution with root privileges. This vulnerability, CVE-2025-23298, stems from unsafe deserialization when loading model checkpoints using Python's pickle module. Transformers4Rec, part of the Merlin ecosystem, is widely used for recommendation tasks and integrates with Hugging Face Transformers. The flaw lies in the load_model_trainer_states_from_checkpoint function, which directly uses torch.load() without safety parameters, exposing it to malicious pickle files. Pickle's __reduce__ method allows arbitrary code execution during deserialization. The attack surface is significant due to common model sharing and the trust placed in checkpoint files, especially as these processes often run with elevated privileges. A malicious checkpoint could execute system commands before model weights are loaded. The real-world impact includes remote code execution, privilege escalation, data exfiltration, and supply chain attacks. NVIDIA has patched the vulnerability by implementing a custom loading mechanism that restricts deserialization to approved classes. This incident underscores the pervasive security challenges in the ML/AI ecosystem due to reliance on pickle. Developers are urged to avoid pickle for untrusted data, use weights_only=True, restrict trusted classes, and consider secure serialization formats like Safetensors. Organizations should audit model provenance, implement signing, and sandbox model loading. The ML community needs to move away from pickle and prioritize security in framework design.

https://www.thezdi.com/blog/2025/9/23/cve-2025-23298-getting-remote-code-execution-in-nvidia-merlin thezdi.com

RSS Hunter • Sep 24, 2025

The September 2025 Security Update Review

Adobe has released nine security bulletins for September, addressing 22 unique CVEs across various products like Acrobat Reader, After Effects, and Premiere Pro. Only the ColdFusion update is rated Priority 1, though no exploitation is detected. The Commerce update fixes a single Critical bug, also without noted exploitation. Acrobat receives a patch for one Critical and one Moderate bug. After Effects includes fixes for three Important bugs. Premiere Pro gets a patch for a potential code execution vulnerability. Substance 3D Viewer and Modeler each have three code execution bugs addressed. Experience Manager has the most fixes with seven, one of which is Critical. Dreamweaver's patch corrects a Cross-Site Request Forgery bug. None of Adobe's September vulnerabilities were publicly known or actively exploited at release. Microsoft released 80 new CVEs for September, covering Windows, Office, Azure, and more, with eight rated Critical and the rest Important. This volume places Microsoft significantly ahead of last year's patch releases. One publicly known bug exists, but none are under active attack. A critical vulnerability in Microsoft HPC Pack allows remote code execution without user interaction. Microsoft Office continues to have code execution vulnerabilities through its Preview Pane. A Windows NTLM Elevation of Privilege vulnerability allows escalation to SYSTEM with low exploit complexity.

https://www.thezdi.com/blog/2025/9/9/the-september-2025-security-update-review thezdi.com

RSS Hunter • Sep 9, 2025