Aggregator

AI×Cybersecurity Challenge线上初赛re方向wp

A vulnerability classified as very critical has been found in Linux Kernel up to 7.0.11. This issue affects the function dma_handle_rx of the component pch_uart. This manipulation causes null pointer dereference. The identification of this vulnerability is CVE-2026-64234. It is possible to initiate the attack remotely. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability described as very critical has been identified in Linux Kernel up to 6.1.174/6.6.141/6.12.91/6.18.33/7.0.10. This vulnerability affects the function msm_disp_snapshot_add_block of the file drivers/gpu/drm/msm/dsi of the component DSI. The manipulation of the argument io_offset results in out-of-bounds read. This vulnerability was named CVE-2026-64231. The attack may be performed from remote. There is no available exploit. Upgrading the affected component is recommended.

A vulnerability marked as problematic has been reported in Linux Kernel. This affects the function ethnl_req_get_phydev of the component PHY. The manipulation leads to null pointer dereference. This vulnerability is uniquely identified as CVE-2026-64228. The attack is possible to be carried out remotely. No exploit exists.

A vulnerability labeled as problematic has been found in Linux Kernel up to 6.12.92/6.18.34/7.0.11. Affected by this issue is the function text_poke_apply_relocation of the file ftrace_64.S of the component ftrace. Executing a manipulation of the argument rip can lead to memory corruption. This vulnerability is handled as CVE-2026-64235. It is possible to launch the attack on the local host. There is not any exploit available. The affected component should be upgraded.

A vulnerability identified as critical has been detected in Linux Kernel up to 6.12.91/6.18.33/7.0.10. Affected by this vulnerability is the function blk_insert_cloned_request of the file blk-mq.c of the component block. Performing a manipulation results in stack-based buffer overflow. This vulnerability is known as CVE-2026-64232. Remote exploitation of the attack is possible. No exploit is available. You should upgrade the affected component.

A vulnerability categorized as very critical has been discovered in Linux Kernel up to 6.18.33/7.0.10. Affected is the function tps65219_regulator_irq_handler of the component regulator. Such manipulation leads to missing initialization of a variable. This vulnerability is traded as CVE-2026-64230. An attack has to be approached locally. There is no exploit available. It is advisable to upgrade the affected component.

A vulnerability was found in Linux Kernel up to 6.18.34/7.0.10. It has been rated as very critical. This impacts the function broadcast_tlb_flush of the component x86 mm. This manipulation causes null pointer dereference. This vulnerability appears as CVE-2026-64229. The attack may be initiated remotely. There is no available exploit. Upgrading the affected component is advised.

A vulnerability was found in Linux Kernel up to 6.6.144/6.12.96/6.18.39/7.0.10. It has been declared as critical. This affects the function probe of the component ACPI thermal zone driver. The manipulation results in null pointer dereference. This vulnerability is reported as CVE-2026-64227. The attack can be launched remotely. No exploit exists. It is recommended to upgrade the affected component.

732 字节 Python 脚本利用 Linux 内核页缓存污染漏洞，不碰磁盘直接拿 root。

A vulnerability was found in Linux Kernel up to 6.6.142/6.12.92/6.18.34/7.0.11. It has been classified as critical. The impacted element is the function uvc_function_bind of the file drivers/usb/gadget/function/uvc_configfs.c of the component UVC Gadget. The manipulation leads to null pointer dereference. This vulnerability is documented as CVE-2026-64233. The attack needs to be performed locally. There is not any exploit available. Upgrading the affected component is recommended.

项目地址：https://github.com/0x4D31/airt 从信息泄露、提示词注入到RAG投毒、多智能体劫持，再到供应链反序列化和自动化红队工具，六个靶场实验完整还原了大模型安全的真实攻击面。本文记录打靶过程与源码分析

2008年至今，一个`?`让nginx rewrite模块躺着一个CVSS 9.2的堆溢出漏洞。脚本引擎「两遍扫描」中，算长度的引擎和执行拷贝的引擎状态不一致——一个认为「不需要escape」，另一个认为「需要」，导致按原始长度分配buffer却写入了escape展开后的内容。本文通过GDB调试验证了RCE的真实障碍，并开源了一套5模块自动化检测框架，从根因出发检测同类漏洞，而非依赖已知CVE签名

HotSpot 的 Attach API 在 Linux 平台上以 /tmp/.java_pid 这个 Unix Domain Socket（UDS）作为唯一接入点。com.sun.tools.attach.VirtualMachine.attach()、jcmd、jstack、jmap 最终都落到这条 socket 上。

CVE-2026-42530 是 Nginx HTTP/3 组件未授权 Use-After-Free 远程代码执行漏洞，高危可直接远程接管服务器。本文深度剖析漏洞底层内存破坏原理，完整进行分析与利用

本文记录了 HackTheBox Spooktrol 靶机的一次完整渗透过程。攻击从 Web 服务中的目录穿越漏洞开始，通过任意文件读取获取 implant 可执行文件，并结合流量分析、Caido 代理劫持、Match & Replace 自动替换、Ghidra 静态逆向与 GDB 动态调试，逐步还原 implant 与 C2 Server 之间的任务通信机制。随后，利用文件上传能力写入 SSH

A vulnerability was found in Linux Kernel up to 7.0.10 and classified as very critical. The affected element is the function otx2_pool_aq_init of the component octeontx2-pf. Executing a manipulation of the argument stack can lead to double free. This vulnerability is registered as CVE-2026-64222. The attack needs to be launched locally. No exploit is available. It is suggested to upgrade the affected component.

A vulnerability has been found in Linux Kernel up to 7.0.10 and classified as very critical. Impacted is an unknown function of the component octeontx2-af. Performing a manipulation results in out-of-bounds read. This vulnerability is cataloged as CVE-2026-64225. It is possible to initiate the attack remotely. There is no exploit available. The affected component should be upgraded.

A vulnerability, which was classified as critical, was found in Linux Kernel up to 6.12.91/6.18.33/7.0.10. This issue affects the function ieee80211_parse_neg_ttlm/ieee80211_tid_to_link_map_size_ok of the component mac80211. Such manipulation leads to out-of-bounds read. This vulnerability is listed as CVE-2026-64223. The attack may be performed from remote. There is no available exploit. You should upgrade the affected component.

在企业环境中，大多数使用的都是域环境，在后渗透中就需要进行域环境的权限维持来造成持续危害。