Pwning

PaperCut NG/MF unauthenticated RCE (CVSS 9.4): Attackers chained authentication bypass + unsafe Java class loading to gain remote code execution on 100M+ users across 70,000+ organizations. Actively exploited in the wild.

Oracle HTTP Server and WebLogic Server Proxy Plug-in improper access control vulnerability (CVSS 10.0) allows unauthenticated remote attackers to bypass authentication and gain full system access. Already under active exploitation with CISA deadline August 27, 2026.

Critical code injection in GitLab's GraphQL API allows unauthenticated attackers to modify, delete public projects and user data with CVSS 9.4.

A new Rust-based macOS infostealer with live browser hijacking via Chrome DevTools Protocol enables attackers to remotely control victim browsers with authenticated sessions. Distributed via ClickFix campaigns using fake GitHub pages.

AI tools accelerate vulnerability discovery but cannot replace human validation. SANS researcher Stephen Sims explains why proof, evidence, and technical judgment remain essential in offensive security despite AI capabilities.