Cyber Guardians

ThreatFabric

Hirudo: From Fake Updates to Patched Banking Apps

Hirudo replaces Indonesian banking apps with patched copies that blind their defences. We break down its patching, distribution, targeting and fraud.

blog.cykor.kr

LEAD: LLM-Based Static Analysis of Session Hijacking Vulnerabilities in Android Deep Links - Your site

By Hyunseo Shin · October 2026 · Korean version

Medium

How I Took Down a ₹1.2 Crore Android Banking Fraud- (mparivahan, Netflix, pmkisan, sexytalk, wedding, desitales)

A complete technical write-up of an engagement against an active Android banking-fraud operation — recon, malware internals, platform…

GitHub

GitHub - murrez/CVE-2026-107806: CVE-2026-107806 — nginx-ui 2.3.8–2.4.x auth RCE via forged backup restore (TestConfigCmd). PoCbit…

CVE-2026-107806 — nginx-ui 2.3.8–2.4.x auth RCE via forged backup restore (TestConfigCmd). PoCbit PoC: GET /api/backup, tamper app.ini, POST /api/restore, POST /api/nginx/test. check/exploit, batch...

beaksec

Telegram Desktop: one-click account takeover via IPC injection

An unescaped separator in Telegram Desktop’s single-instance IPC lets one clicked link read arbitrary files off the disk and send them to the attacker, session files included.

AISLE

One AISLE curl Audit Produced 24 CVEs. 18 Ship Today

Learn what happened when curl co-founder Daniel Stenberg requested an AI-powered security audit by AISLE.

XBOW

XBOW Built a Chrome Full-Chain Exploit Affecting a Billion Users in Six Days | XBOW

XBOW recently discovered and built a Chrome full-chain exploit affecting an estimated billion users globally.

Remedio

Integer Overflow Vulnerability in Adobe Acrobat | CVE-2026-81983

CVE-2026-81983: an Adobe Acrobat integer overflow vulnerability that corrupts memory when a malicious PDF is opened.

Claroty

Freeze the Controller, Defrost the Food: Uncovering Vulnerabilities in Danfoss Refrigeration Controllers

Team82 researched the attack surface of the Danfoss AK-SM 800A refrigeration controller platform and identified multiple vulnerabilities affecting the embedded web management interface. Team82 disclosed the vulnerabilities to Danfoss, which addressed them…

GitHub

GitHub - horizon3ai/AhsayCBS-Auth-Bypass-RCE: A proof of concept exploit for CVE-2026-105133 and CVE-2026-105134 affecting AhsayCBS

A proof of concept exploit for CVE-2026-105133 and CVE-2026-105134 affecting AhsayCBS - horizon3ai/AhsayCBS-Auth-Bypass-RCE

GitHub

GitHub - S12cybersecurity/LogonStealer: Abuses the Credential Provider interface to steal plaintext passwords from logonui.exe…

Abuses the Credential Provider interface to steal plaintext passwords from logonui.exe via CredProvDataModel.dll hooks - S12cybersecurity/LogonStealer

GitHub

GitHub - ivancabrera02/SrHollow

Contribute to ivancabrera02/SrHollow development by creating an account on GitHub.

GitHub

GitHub - Kavan00/Android-Projector-C2-Malware: Breakdown of a c2-network of chinese beamers - SilentSDK-Analysis

Breakdown of a c2-network of chinese beamers - SilentSDK-Analysis - Kavan00/Android-Projector-C2-Malware

FORTBRIDGE

WordPress libheif RCE - FORTBRIDGE

How a WordPress libheif RCE uses returned pixels to bypass ASLR, trigger a heap overflow and execute commands on exact Ubuntu and Debian stacks.

www.virlabs.ai

knock-outd: an undetected port-knocking backdoor in the wild | VirLabs

An undetected Linux launcher uses libpcap to bind to the nerwork interface, and waits for three packets before executing a missing companion.

Quarkslab

Cato VPN Client: Split-Tunnel and Privilege Escalation (CVE-2026-10739) - Quarkslab's blog

Local privilege escalation in the Cato VPN Client through the split-tunnel upload flow, from named pipe to SYSTEM delete and Windows Installer rollback.

protonmail-sender-spoofing

Sender spoofing in Proton Mail via display-name homograph

Proton Mail’s web interface can be made to present a forged sender identity that is visually indistinguishable from a legitimate one.

foxio.io

Introducing JA4Scan: Active Server Fingerprinting for TLS and QUIC - FoxIO | Cyber Innovation

We solve the world’s toughest cyber challenges—creating breakthrough technology and embedding it into the systems that run everything.