368 Bytes Entered nslookup.exe Through Its Keyboard. Then They Became Executable.
A Windows proof of concept turned redirected standard input into a shellcode staging area inside nslookup.exe, removing two API calls many injection detections expect.
Security
Vulnerabilities, defensive security, architecture and operational security.
A Rancher Login Page Could Hand Attackers the Clusters Behind It
A critical Rancher flaw could let an unauthenticated attacker poison the login page and expose administrator access. Five branches have fixed releases.
Three Ways the Host Can Cross Contrast’s Confidential Boundary
The host was inside the threat model, yet attestation, a file-copy policy and ACPI each gave it a route back into the confidential workload.
Why a MONAI Model Bundle Deserves a Software Review
A model bundle, shared cache or medical-imaging data file can cross from content into code when a pipeline uses unsafe Python loading paths.
Froxlor’s Cleanup Job Could Erase Another Tenant’s Files
Froxlor's FTP cleanup queued a root command, then trusted that the path would still mean the same thing when the cron job ran.
A Prefix Check Could Let JavaScript Escape vm2
A missing path boundary turned an allowed module into a route to neighbouring code running inside the host process.
A Sylius Customer Login Could Open the Admin API
In vulnerable Sylius shops, one reused email address can turn a customer token into administrator access while a separate flaw can mark an enlarged order paid.
A Wrong Password Could Run Code Inside hMailServer
Progressive Robot’s hMailServer 6.3.4 fixes code execution through specific Windows scripting settings. Administrators need a manual upgrade and a tested backup.
A Botnet Seller Is Offering to Drain Your AI Budget
A botnet seller advertises direct-to-provider AI credit draining using a valid API key. The research does not establish scale or measured performance.
Renfe’s Compromised Connection
Availability, data exposure and partner access are separate questions. Here is how to test a connected service.