REPLICANT: Learning Policies for Evading and Hardening Malware Detectors

To determine the real-world effectiveness of machine learning based malware detection, it is vital to evaluate its robustness against highly capable adversaries. However, state-of-the-art attacks do not effectively model realistic adversaries, as they often assume access to privileged information...

EUVD-2026-67771

filepicker aka flutterfilepicker for Flutter, all versions through 10.3.10, is vulnerable to path traversal CWE-22 in its Android implementation. The openFileStream method in FileUtils.kt uses the DISPLAYNAME obtained from ContentResolver.query directly in file path construction without...

Moirae: A Multimodal Agent Collaborative Framework for Dynamic Android Malware Detection

The Android ecosystem faces persistent and rapidly evolving malware threats. Existing machine learning detectors are vulnerable to concept drift because they rely on implementation-specific features whose distributions change over time. Large language models LLMs offer strong semantic understandi...

PT-2026-82869

The wallabag aka fr.gaulupeau.apps.InThePoche application through 2.6.0 for Android allows XSS because /api/entries data is loaded into a WebView...

CVE-2026-38093

filepicker aka flutterfilepicker for Flutter, all versions through 10.3.10, is vulnerable to path traversal CWE-22 in its Android implementation. The openFileStream method in FileUtils.kt uses the DISPLAYNAME obtained from ContentResolver.query directly in file path construction without...

KLA91246 Multiple vulnerabilities in Microsoft Browser

Multiple vulnerabilities were found in Microsoft Browser. Malicious users can exploit these vulnerabilities to bypass security restrictions, cause denial of service, execute arbitrary code, obtain sensitive information, spoof user interface. Below is a complete list of vulnerabilities: 1. An...

CVE-2026-38093

filepicker aka flutterfilepicker for Flutter, all versions through 10.3.10, is vulnerable to path traversal CWE-22 in its Android implementation. The openFileStream method in FileUtils.kt uses the DISPLAYNAME obtained from ContentResolver.query directly in file path construction without...

PT-2026-82870

Pocket through 8.33.0.0 allows XSS because "Save to Pocket" injects external HTML into the DOM. JavaScript code can alter the application state via native bridge methods...

CVE-2026-38093

filepicker aka flutterfilepicker for Flutter, all versions through 10.3.10, is vulnerable to path traversal CWE-22 in its Android implementation. The openFileStream method in FileUtils.kt uses the DISPLAYNAME obtained from ContentResolver.query directly in file path construction without...

Exploit for Out-of-bounds Write in Adobe Dng_Software_Development_Kit

Out-of-bounds write in dngrendertask::ProcessArea Adobe D...

Exploit for Use After Free in Linux Linux_Kernel

GhostLock — PFEM10 CVE-2026-43499 IonStack exploit for OP...

CVE-2026-30612

An issue in Time4 Popcorn for Windows = 6.2.1.18 and Time4Popcorn for MacOS = 6.2.1.17 and Time4Popcorn for Android = 3.5.0.173 allows a remote attacker to execute arbitrary code via the updater.exe for windows, PT.updd on MacOS components...

“Sorry, I can’t help with that”: How your guardrails might become the attacker’s best friend

Welcome to this week's edition of the Threat Source newsletter. Hello, everyone. Long time reader, first time writer here at the Threat Source newsletter! I wanted to start out by introducing myself. My colleague and friend Mick Baccio set the bar pretty high last week, so I was planning to tell...

CVE-2026-26897

An issue in EcoOnline EHS com.airsweb.v10 application for Android, version 0.2.499 allows a remote attacker to obtain sensitive information and execute arbitrary code via the AndroidManifest.xml component...

ThreatsDay: 296K IoT Botnet, 100+ Water Systems Targeted, SharePoint RCE Chain + 27 New Stories

A fake login page. A fake security scan. A fake productivity app. Apparently, pretending to be useful is still one of the easier ways into a machine. The rest of the week gets stranger: botnets borrowing AI, command traffic hiding in public infrastructure, malicious tools waiting before showing...

Fake listings can turn trusted platforms into scam springboards

Recently, we found a listing on BuzzFeed from someone pretending to be Malwarebytes Support. It reminded us why we need to be cautious about content on platforms where anyone can create an entry. Based on the phone number, we suspect the people behind this listing are trying to draw callers into ...

msf-commander

⚔️ MSF Commander v4.0 Complete Offensive Security Arsenal...

Fake Apple Pay charge brings the classic tech support scam to your phone

iPhone users are being targeted in a new tech support scam, using a fake Apple Pay notification to trick users. Tech support scams that use fake warnings to push victims into calling a phone number have been around for years, but this page has been designed specifically for phones. Instead of a...

droidground v1.0.14

DroidGround Website | Demo In traditional CTF challenges , it's common to hide flags in files on a system, requiring attackers to exploit vulnerabilities to retrieve them. However, in the Android world, this approach doesn't work well. APK files are easily downloadable and reversible, so placing ...

DakshSCRA v0.38-beta

Daksh SCRA Source Code Review Assist root@kitploit: Author: - Debasis Mohanty [email protected] - Twitter / X: @coffeensecurity - www.coffeeandsecurity.com About Daksh SCRA Daksh SCRA Source Code Review Assist tool is built to enhance the efficiency of the source code review process, providi...