The post details ARM64 macOS call stack unwinding using Mach-O unwind info, the ARM64 stack model, pointer authentication (PAC) security features, and methods for creating and authenticating synthetic frames that preserve stack trace integrity.

HoneyMyte’s CoolClient backdoor has been upgraded to deploy a signed kernel-mode driver that functions as a stealthy Windows rootkit, enabling advanced persistence, process hiding, and C2 communication evasion, primarily targeting organizations in Asia.

A heap overflow in Citrix NetScaler ADC/Gateway's SAML signature processing allows remote code execution by overwriting function pointers with crafted oversized SignedInfo data, enabling attackers to deploy a persistent webshell with root privileges.

A new Ruby 4.0.6-compatible deserialization gadget chain enables command execution via `Marshal.load`, exploiting RubyGems autoloading and `Gem::Specification.load`, after recent security changes broke previous gadgets, highlighting the need to avoid untrusted `Marshal.load`.

Armored Likho's campaign employs a Rust/Tauri dropper with a fake catalog, expanding cyber-espionage through tools like Still Sync for Telegram data theft and Still Audio for voice surveillance, primarily targeting Russian users.

AI accelerates vulnerability discovery and commoditizes exploits, exemplified by a Microsoft Exchange bug chain leveraging MRSProxy and NTLM relay techniques to achieve PST write access under specific conditions.

CVE-2026-53360 8.8

Analyzed

In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use As per the GHCB spec, when using GHCB v2+ require the software scratch area to reside in the GHCB's shared buffer. Note, th…

• 

  I found a KVM guest-to-host heap corruption bug and someone else got there first

CVE-2026-8452 8.8

Analyzed

Memory overflow vulnerability NetScaler ADC and NetScaler Gateway leading to unpredictable or erroneous behavior and Denial of Service if the appliance is configured as a Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server

• 

  You’re Back In The Room (Citrix NetScaler Pre-Auth RCE CVE-2026-8452(?))

CVE-2022-39299 7.4

Modified

Passport-SAML is a SAML 2.0 authentication provider for Passport, the Node.js authentication library. A remote attacker may be able to bypass SAML authentication on a website using passport-saml. A successful attack requires that the attacker is in posses…

• 

  SAML Vulnerabilities and Attacks: A Practical Guide

• 

  Signature bypass via multiple root elements

CVE-2026-66000 2.3

Received

Frappe is a full-stack web application framework. Prior to 16.23.0 and 15.112.0, Document Follow notification generation does not re-evaluate the recipient's current document permissions, allowing users whose access was revoked or reduced to continue rece…

• 

  Entry, Escalation, Persistence: Taking Apart Frappe's Document Follow

CVE-2026-66058 5.3

Received

Frappe is a full-stack web application framework. Prior to 16.20.0 and 15.112.0, unrestricted access to a Document Follow API (update_follow) is possible for an authenticated user. This issue is fixed in versions 16.20.0 and 15.112.0.

• 

  Entry, Escalation, Persistence: Taking Apart Frappe's Document Follow

CVE-2026-66059 5.3

Received

Frappe is a full-stack web application framework. Prior to 16.20.0 and 15.112.0, a field-level permissions bypass exposes restricted DocType fields. This issue is fixed in versions 16.23.0 and 15.112.0.

• 

  Entry, Escalation, Persistence: Taking Apart Frappe's Document Follow

macOS Apple

Desktop operating system

• 

  Recent macOS Screen Sharing Vulnerability Exploited in Attacks

• 

  AmnesiaStealer: macOS Infostealer That Hijacks Browsers

• 

  Apple macOS Screen Sharing Flaw Exploited on Internet-Exposed Macs to Install Monero Miner

• ...

Chrome Google

Web browser

• 

  Chrome DevTools Technique Enables Authenticated Session Hijacking in Live Windows Browsers

• 

  Record-breaking Kimwolf DDoS botnet released new, stealthier version

• 

  AI Browsers Vulnerable to 'PleaseFix' Zero-Click Agent Hijacking

• ...

Windows Defender Microsoft

Endpoint security / antivirus

• 

  Threat Actors Achieve Persistence After SQL Injection

• 

  Mustang Panda Adds Signed Windows Rootkit to CoolClient Backdoor for Stealth

• 

  GitHub - MSNightmare/ShieldBreak: Windows Defender 0day vulnerability

• ...

SAP Commerce Cloud SAP

E-commerce platform / web application framework

• 

  Critical SAP Commerce Cloud Vulnerability Exploited 3 Days After Disclosure

• 

  SAP Commerce Cloud CVE-2026-58231 Targeted in Exploitation Attempts Days After Patch

• 

  SAP Commerce Cloud Flaw Could Let Unauthenticated Attackers Execute Arbitrary Code

• ...

Known Exploited Vulnerabilities (KEV) Catalog CISA

Vulnerability tracking / threat intelligence database

• 

  Critical SAP Commerce Cloud Vulnerability Exploited 3 Days After Disclosure

• 

  ShieldBreak Zero-Day PoC Claims Microsoft Defender Patch Bypass With SYSTEM Access

• 

  Cisco ASA and FTD Flaw Exploited in the Wild Can Trigger Remote DoS

• ...

Screen Sharing (screensharingd) Apple

Remote access / remote desktop service

• 

  Recent macOS Screen Sharing Vulnerability Exploited in Attacks

• 

  No Country for Old Passwords