Ethical Hacking Mission Control
This live lab is a safe space for defenders, red teamers, and curious hackers to sharpen their tradecraft using real tooling and real telemetry. Every article, lab module, and intel briefing is curated to help you practice responsible disclosure, grow your skill set, and support the security community.
New ChocoPoC RAT Targets Vulnerability Researchers via Fake PoC Exploit Repos
SharePoint RCE CVE-2026-45659 Added to CISA KEV After Active Exploitation
AI Agent Exploits Langflow RCE to Automate Database Ransomware Attack
FortiBleed Credential Theft Linked to INC and Lynx Ransomware Operations
Unpatched Argo CD Repo-Server Flaw Could Let Attackers Take Over Kubernetes Clusters
19-Year-Old Scattered Spider Suspect Extradited to Face U.S. Hacking Charges
SEO-Poisoned Software Sites Abuse ScreenConnect to Deploy AsyncRAT
VEIL#DROP Malware Chain Uses Blogger Platform to Deliver PureLogs Stealer
Ousaban Banking Trojan Targets Iberian Bank Users with Fake PDF Lures
Adobe Patches 7 CVSS 10.0 Flaws in ColdFusion and Campaign Classic
Critical Cursor Flaws Could Let Prompt Injection Escape Sandbox and Run Commands
Progress Kemp LoadMaster Pre-Auth RCE Flaw Faces Active Exploitation Attempts
AI-Generated Browser Ransomware Abuses Chromium API on Windows and Android
2026 Cybersecurity Assessment: The Gap Between Awareness and Resilience
Microsoft Accelerates Post-Quantum Cryptography Shift to 2029
Phantom Squatting Uses AI-Hallucinated Domains for Phishing and Malware
Anthropic Restores Claude Fable 5 After U.S. Lifts Jailbreak-Linked Export Controls
Azure CLI Password Spray Hits at Least 78 Microsoft Accounts in 81M+ Attempts
Researcher Analyzes 3,000 Live ClickFix Payloads, Exposing API-Driven Malware Delivery
Citrix Patches Six NetScaler Flaws Allowing File Read and Denial-of-Service
Silent Swap Crypto Clipper Uses Fake Google Notes Extension to Replace Wallet Addresses
Microsoft Warns Poisoned MCP Tool Descriptions Can Make AI Agents Leak Data
RustDuck Botnet Rebuilds in Rust to Hijack Routers and Servers for DDoS
Langflow RCE Exploited to Deploy Monero Miner on Exposed AI App Endpoints
GuardFall Exposes Open-Source AI Coding Agents to Decades-Old Shell Injection Risks
282 iOS AI Apps Leak API Keys and Open AI Proxy Access in Network Traffic Study
What the Numbers Say About FIFA 2026 Cyber Risk
Attackers Exploit SimpleHelp CVE-2026-48558 to Deploy TaskWeaver and Djinn Stealer
AirDrop and Quick Share Flaws Let Nearby Attackers Trigger Crashes and Bypass Checks
New BioShocking Attack Tricks AI Browsers Into Leaking User Credentials
Progress Kemp LoadMaster Flaw Could Let Attackers Run Root Commands Pre-Auth
Apple Patches 30+ iOS, macOS, Safari Flaws, Including AI-Discovered WebKit Bugs
Oracle E-Business Suite Flaw CVE-2026-46817 Actively Exploited in the Wild
Malicious Perplexity Chrome Extension Intercepted Searches and Address Bar Input
236,000 DCloud Uni-App Sites Used in Crypto Scams, Phishing, and Wallet Drainers
WhatsApp is Finally Getting Usernames to Help Keep Phone Numbers Private
Mustang Panda Uses Zoho WorkDrive as Command Channel in Indian Government Attacks
⚡ Weekly Recap: Linux Kernel Flaws, AI Malware Tricks, Turla Backdoor, Infostealers and More
Why Post-Quantum Cryptography Starts With Credentials
Gamaredon Expands Ukraine Attacks with New Malware and Cloud Service Abuse
Hijacked npm and Go Packages Use VS Code Tasks to Deploy Python Infostealer
Microsoft Removes 119 Edge Extensions That Hid Malware in Images and Fonts
Public PoC Released for Critical libssh2 CVE-2026-55200 Client-Side SSH Flaw
OpenAI Previews GPT-5.6 Sol With Restricted Access and Stronger Cyber Safeguards
Ukraine Says Russian Intelligence Used Fake Support Texts to Steal Messaging Credentials
Chinese-Speaking APT Deploys New TinyRCT Backdoor in Southeast Asia Campaign
CISA Adds Exploited PTC Windchill RCE Flaw to KEV as Web Shell Attacks Continue
FBI Warns Russian Intelligence Hackers Target Signal Backup Recovery Keys
Unpatchable 'usbliter8' Exploit Breaks Apple A12 and A13 SecureROM Boot Chain
New SharkLoader Malware Deploys Cobalt Strike in StrikeShark Cyberattacks
Microsoft Warns of Photo ZIP Phishing Campaign Targeting Hotels with Node.js Implant
Amazon Q Developer Flaw Could Let Malicious Repos Run Code via MCP Configs
New Linux pedit COW Exploit Enables Root Access by Poisoning Cached Binaries
Google Details Turla's New STOCKSTAY Backdoor Used in Ukraine Espionage Attacks
New DirtyClone Linux Kernel Flaw Lets Local Users Gain Root via Cloned Packets
Guardian Agents: The Next Layer of Identity Governance
Miasma Malware Targets npm Packages and GitHub Actions in Supply Chain Attack
Russia Used Cellebrite on Jailed Activist's iPhone Months After Sales Cutoff
Surviving the Mythos Era: Richard Bejtlich on the Case for NDR
Chrome Ad Blocker with 10M+ Installs Found with Dormant Script Injection Capability
New Gaslight macOS Malware Uses Prompt Injection to Disrupt AI-Assisted Analysis
New Mistic Backdoor Linked to KongTuke in ClickFix and ModeloRAT Campaigns
Cisco Catalyst SD-WAN Zero-Day CVE-2026-20245 Exploited to Gain Root Access
ThreatsDay Bulletin: Smart TV Proxyware, 24-Year curl Bug, AI Crime Forums + 13 More Stories
Amadey and StealC Malware Network Disrupted, 27M Stolen Credentials Recovered
CISA Warns Critical Lantronix EDS5000 Flaw Is Being Actively Exploited
DoJ Seizes Huione Cloud Account Tied to Cyber Scam Money Laundering
Cordyceps CI/CD Flaws Expose 300+ GitHub Repositories to Supply-Chain Attacks
Researchers Detail DifyTap Flaws in Dify That Could Expose AI Chats Across Tenants
Google Sets Sept. 30 Deadline for Android Developer Verification in Four Countries
AutoJack Attack Lets One Web Page Hijack AI Agent for Host Code Execution
Orphaned AI Agents: How to Find Hidden Access Risks Inside Your Network
Junior Hacker Used Tailscale and OpenSSH to Keep Access After His C2 Went Offline
Cisco Unified CM Flaw Exploited After PoC Reveals File-Write Path to Root
Dawn of the Apex Agentic Adversary
FortiBleed Targeted FortiGate Firewalls in 110 Million-Credential Harvesting Operation
OpenAI Expands Daybreak With GPT-5.5-Cyber to Help Defenders Patch Security Flaws
Hackers Exploit Gravity SMTP WordPress Plugin Bug to Expose API Keys
Operation Endgame Disrupts SocGholish Servers, Cleans 14,971 WordPress Sites
CISA Warns Fortinet Customers as FortiBleed Hits 86,644 FortiGate Devices
Microsoft Confirms RoguePlanet Defender Zero-Day, Says Patch is in Development
Adversarial Exposure Validation Turns Security Visibility into Confident Prioritization
Agentic AI: The Weapon That No Longer Needs a Warrior
Malicious npm Packages Pose as PostCSS Tools to Deliver Windows RAT
New OXLOADER Loader Uses Malicious Google Ads to Deliver CastleStealer
Stop Your Legacy Infrastructure from Hijacking Your AI Agents
⚡ Weekly Recap: Browser Bugs, EDR Killers, TV Botnet, OpenBSD Flaw, Android Trojan, and More
Canada’s Spy Agency Used First-of-Its-Kind Warrant to Clean Botnet-Infected Devices
AryStinger Malware Infects 4,300 Legacy Routers to Build Reconnaissance Proxy Network
INTERPOL Warns Phishing, Ransomware, and AI Scams Are Rising Across Asia-Pacific
The Gentlemen RaaS Uses GentleKiller EDR Framework Targeting 400 Security Processes
Apple Patches Beats Studio Buds Flaw Letting Nearby Attackers Spy via Microphone
F5 Patches Two Critical NGINX Open Source Flaws Enabling Remote Code Execution
ThreatsDay Bulletin: Claude Chat Abuse, NastyC2 npm Packages, Device-Code Phishing + 25 More Stories
INC Ransomware Emerges as Major RaaS Threat in 2026 with 830+ Victims Since 2023
The Scripts on Your Checkout Page Are Now a PCI DSS Problem
The Top 10 Attack Surface Exposures in 2026
145 Mastra npm Packages Compromised via Hijacked Contributor Account
Google Vertex AI SDK Flaw Let Attackers Hijack Model Uploads via Bucket Squatting
Fake AI Agent Skill Passed Security Scans and Reportedly Reached 26,000 Agents
Trump Order Sets 2030 Deadline for Federal Post-Quantum Crypto Migration
GitHub Updates actions/checkout to Block Common Pwn Request Attack Patterns
WhatsApp VBScript Campaign Uses Fake Documents to Install ManageEngine RMM Tool
ShapedPlugin WordPress Pro Plugins Backdoored in Supply Chain Attack
29-Year-Old Squid Proxy Bug 'Squidbleed' Can Leak Cleartext HTTP Requests
From Assistive to Agentic: The AI Shift That's Redefining Threat Management
Forget Data Leakage: Shadow AI's Real Threat Is Access Control
Salesforce Disables Klue App Integration After OAuth Token Abuse Exposes Customer Data
Microsoft Details Windows Clipper Malware Campaign Using USB LNK Worm and Tor-Based C2
DragonForce Hackers Abuse Microsoft Teams Relays to Hide Backdoor.Turn C2 Traffic
Crypto Clipper Campaign Abuses Fake Reviews, AI Narrators, and VirusTotal Comments
Malicious JetBrains Plugins Steal AI API Keys as Chrome Extensions Capture Chatbot Chats
CISA Warns of Actively Exploited Joomla JCE Flaw Allowing PHP Code Execution
Bug Bounty Radar
Hand-picked programs with live scope and standout rewards to help you focus your next responsible disclosure run.
FastAPI Cloud
HackerOne • Updated 2024-05-18
Prototype pollution in async workers and GraphQL stitching flaws.
Scope: api.fastapicloud.com, *.fastapicloud.com
Program brief →Supply Chain Monitor
Bugcrowd • Updated 2024-05-22
Dependency confusion, pipeline breakout, and artifact poisoning.
Scope: *.scm.dev, api.scm.dev
Program brief →Secure Notes
Intigriti • Updated 2024-05-17
OAuth misconfigurations, storage isolation, and advanced XSS chains.
Scope: app.securenotes.io, api.securenotes.io
Program brief →OpenTelemetry Hub
YesWeHack • Updated 2024-05-20
Collector escapes, tenant isolation bugs, and SSRF via exporters.
Scope: *.otelhub.dev
Program brief →