HackingPassion.com Learn Ethical Hacking and Cyber-Security. We help people become ethical hackers so they can test security systems. We ♥ open-source and Linux
Windows Defender Dies to a One-Click Script While Defender Bypasses Sell for $30 a File A script created an account on a fully secured Windows 11 machine, killed the antivirus Windows says cannot be killed, and ran a payload. It needed one click. Its memory had no write protection. 🧐 The machine had everything switched on. Secure Boot, driver signature enforcement, PatchGuard,…
Plug and Pwn Turns a Fake USB Device Into SYSTEM on Fully Patched Windows 11 Two researchers took over a fully updated Windows 11 machine in five minutes with a USB device that was never there. The machine sat at the login screen. Windows downloaded the vulnerable software itself. 🧐 Plug and Play is the part of Windows that makes hardware work without you doing anything. You connect a printer, a…
Someone could sign in as a company’s top admin by reading one Windows log file. The admin’s password and passkey were never touched. Microsoft called it medium severity and paid the finder 1,000 dollars. 🧐 Passkeys were supposed to make this impossible. Instead of a password you type, your device holds a secret key and proves who you are with it. The key is never typed and never sent…
An AI found a hole in the Linux kernel that sat open for 18 years, then wrote the exploit that turns a local user into root. The machines were not misconfigured. The bug was in the kernel itself, since 2007. 🧐 Researchers at Tencent’s Zhuque Lab published the full analysis on 6 August. They track it as CVE-2026-64564 and named it SCTPhantom . It lets a normal user on a Linux machine climb…
Anyone on your network could take over a Mac with Screen Sharing turned on. All it took was the target’s IP address. The login check handed back an old success value and the machine believed it. 🧐 Screen Sharing is the macOS feature that lets someone on another computer connect to your Mac, see the desktop, and control it as if they were sitting right in front of it. By default it stays…
CSS in an email put a fake Microsoft sign-in over a live Outlook inbox and read the password letter by letter. Opening the message is enough. Outlook, Gmail, Fastmail, Proton Mail, Yahoo Mail and AOL Mail gave way. 🧐 Microsoft and Google still have not fixed their part. Webmail has a problem it has never fully solved. Someone sends you HTML, and that HTML has to be displayed inside a page that…
OpenAI, Anthropic and Meta have admitted the same thing in three weeks. Their own models ended up outside the test environment. They broke into at least 5 companies that were never part of the test. One agent spent two and a half days inside Hugging Face. It ran 17,600 actions before it was cut off. 🧐 Hugging Face found the first one itself. It caught the intruder in its production systems, cut…
A worm dumped 1,300 stashes of stolen developer keys into public GitHub repos in a day. You ran npm install . That was all. The poison sat in a library npm hands out 153 million times a week . 🧐 There was no phishing email and nothing suspicious to download. You typed npm install , or your build server did it at three in the morning while you slept, and attacker code ran before the install had…
One 32-byte key protects the passkeys synced to your Google account. On Windows, a researcher lifted it out of Chrome’s memory and signed into a crypto exchange with no fingerprint and no PIN . Google cannot change that key or take it back. 🧐 A passkey sells one promise. No password to phish, no shared secret on the website’s server to leak, and a private key that stays with you. Your…
A researcher hid white text in a Word file and turned Microsoft Copilot into a worm that rewrites your documents and copies itself into every file it touches. Microsoft still can’t kill it. He reported it to Microsoft on March 6. After 144 days and two rounds of fixes, including a full model upgrade, the attack still runs. 🧐 The researcher is Håkon Måløy , a Norwegian AI researcher. He…