5 casos · pág. 1/1
Bright Security announced the launch of STAR Fuzzer, an agentic fuzzer in its Bright STAR platform. It uses AI to select security-critical functions and generate harnesses, then runs an evolutionary search engine to find faults and delivers byte-exact reproducing payloads. In pre-release testing, 45% of the open-source projects tested had…
Researcher Quentin Kaiser (QTNKSR) disclosed a memory corruption flaw in Broadcom's Wi-Fi Protected Setup (WPS) implementation. It allows an unauthenticated attacker within wireless range to disclose memory and execute code, including as root, on vulnerable routers. The attacker does not need the Wi-Fi password, network membership or a co…
Researcher Quentin Kaiser disclosed on October 16 an unauthenticated memory-corruption flaw in Broadcom's Wi-Fi Protected Setup (WPS) implementation. It lets an attacker within radio range execute code as root on affected routers, with no Wi-Fi password or pairing step. Kaiser demonstrated working exploits against Belgian ISP gateways: th…
On July 25, 2026, Hacktron researchers chained a heap buffer overflow in libheif (reached through ImageMagick in Discourse's image-upload pipeline) with an OpenAI SSO weakness. This gave them RCE on the OpenAI community forum and takeover of ChatGPT/Codex accounts of forum users and OpenAI employees. To prove impact without reading sensit…
NGINX released versions 1.30.6 (stable) and 1.31.7 (mainline) on October 14 to fix five vulnerabilities, one of which has been present in every release since May 2005. Three are memory-corruption bugs that F5 says could crash a worker process or possibly allow code execution. A fourth is a TLS session-ticket flaw that may let a forged ses…
