All posts by John Doe

■■■□□ Sandbox Escape: https://x.com/odinshell/status/2108308470676193290

■■■■□ A vulnerability in Lime lets anyone track the route of every one of its rental bikes. https://x.com/IntCyberDigest/status/2108549889600688260

🚨 PoC RELEASED: Telegram Desktop one-click account takeover (CVE-2026-107181) A researcher has published a full technical write-up and proof of concept for a flaw in Telegram Desktop before 7.2.9. 🔴 CVSS 4.0: 8.6 High (CVSS 3.1: 8.1), scored by VulnCheck 🎯 Root cause (CWE-143): Telegram Desktop’s single-instance IPC didn’t escape its record separator, so a…

■■■■□ The “PoeLLM” malware uses and targets exposed AI/LLM and open-source services. It primarily affects vulnerable internet-facing deployments such as LiteLLM, Ollama, Gotenberg and Gitea, with possible targeting of Ivanti Sentry. https://www.lumen.com/blog/en-us/canto-incognito-tracking-the-poellm-malware

■■□□□ CVE-2026-21589: Atlassian Jira, Confluence & Bitbucket pre-auth arbitrary file read.

■■■■□ Meta Rushed to Fix Muse ‘VM Escape’ Vulnerability Soon Before Launch In the immediate lead up to Muse’s launch, Meta scrambled to fix serious vulnerabilities in the AI agent, including a VM escape that could have let a hacker break out of Muse and into Meta’s own sensitive databases. It was escalated to Zuckerberg.…

■■■□□ Interesting thread 🧵 by project discovery on AI-Hacking https://x.com/pdiscoveryio/status/2107522665951227970

❗️🔹🔹🔹🔹🔹🔹🔹🔹🔹🔹🔹🔹 Graphene-OS allows IPC inter-process communication and Binders between multiple applications on the device. This can leak data and bypass disabled internet permission of the app. Scenario: I use Google’s Keyboard (with internet disabled). However, I’ve Gmail with internet access enabled (of course). If Google wished, then can send a custom update to both apps…

■□□□□ Detecting and Countering Fraud and Revenue Leakage in Mobile Networks. https://info.enea.com/2026-Fraud-Handbook-for-Mobile-Network-Operators?source=ckure.org

■■■■□ Rogue OpenAI agents targeted three separate US government websites. https://edition.cnn.com/2026/09/26/tech/openai-agents-rogue-government-websites