New Project Zero issue:

Adobe DNG SDK: Heap memory disclosure via LZW-compressed semantic masks rendered through MaskedRGBTables

https://project-zero.issues.chromium.org/issues/514643907

CVE-2026-47963

New Project Zero issue:

Adobe DNG SDK: Heap memory disclosure via uninitialized MCU buffer in Hasselblad 3FR lossless JPEG decode path

https://project-zero.issues.chromium.org/issues/514249399

CVE-2026-47934

New Project Zero issue:

Adobe DNG SDK: Heap memory disclosure in ReorderSubTileBlocks due to truncated row block count for clipped strips

https://project-zero.issues.chromium.org/issues/514247216

CVE-2026-47927

New Project Zero issue:

Adobe DNG SDK: heap buffer overflow in DecodeFPDelta due to missing pixel format validation and non-fatal error handling for semantic mask IFDs

https://project-zero.issues.chromium.org/issues/509923792

CVE-2026-47964

[RSS] Some interesting findings in Windows Defender

https://blog.projectnightcrawler.dev/posts/2026-07-09-some-interesting-findings-in-windows-defender/

Client-side DoS via ADS :)

Spent my childhood optimizing CONFIG.SYS and AUTOEXEC.BAT to fit everything into 640 KB.

Now one browser tab needs 2 GB of RAM so 17 analytics companies can find out I looked at socks.

Meta faces $1.4 trillion in damages for hooking kids on purpose. The company's market cap is $1.5 trillion. They're arguing the number is unprecedented in consumer protection history, which is technically true. It's also the first time anyone built a $1 trillion business on deliberately addicting children.

https://gizmodo.com/metas-teen-safety-case-just-became-a-1-4-trillion-existential-threat-2000782306

If you're just now hearing about GhostLock and looking to fix it, make sure you don't introduce two unpriv-reachable DoSes associated with its fixes. The fix the Linux CNA lists for CVE-2026-43499 introduces a NULL deref, which caused CVE-2026-53166 to be issued. Unfortunately...

https://kb.cert.org/vuls/id/213560

The web server binary /bin/httpd contains an undocumented backdoor authentication mechanism in the login() function. Initially, the function follows a normal authentication path using MD5-based password verification. However, if authentication fails, the function invokes GetValue("sys.rzadmin.password") to retrieve an alternate password value from the device configuration. It then performs a direct strcmp() comparison in plaintext between the user-supplied password and the configuration-stored value. A successful match grants role=2 admin-level access and creates a valid session.

The associated username is not validated, so any provided username will succeed when paired with the backdoor password. This backdoor authentication mechanism is not documented or visible through any administrative interface.

@zencoffeebreak ghost in the fish

@nyanbinary @cR0w
OK, after a little digging, there are indeed some Tenda firmwares that contain the rzadmin backdoor account in httpd. The problem? Out of the firmware versions that CERT lists, none of them contain this backdoor. Oops. 😂

For example if we look at the httpd from a Tenda G300, we can indeed see a login() function with a GetValue("sys.rzadmin.password") and a subsequent strcmp() to compare.

Maybe I'm simply being pedantic, but I think that when an organization publishes about a vulnerability and creates a CVE for it, the affected products should perhaps be accurate? 🤷‍♂️

@cR0w @infoseclogger Deregulate tapioca!

Me reading literally any tech news article.

Operating across 140 million km of space, the control team for ESA’s Hera mission have succeeded in upgrading the software running the spacecraft, leaving it ready to explore the distant Dimorphos and Didymos asteroids this autumn.
Deep space software upgrade for Hera’s asteroid visit

CFP for #OffensiveCon26 Tokyo edition is STILL open.
We're looking for real, original work: cutting-edge security research, novel exploit techniques and deep technical investigations that actually move the field forward.
And yes, AI it's also in the game.

Shared by my Daughter
"I need privacy, not because my actions are questionable, but because your judgement and intentions are"

In response to "if you have nothing to hide you have nothing to fear"

“you couldn’t tell it was slop if I lied” said the same fried brain that thinks “Key Takeaways 🚀” is a feature of a readme any fucking human wrote

IDA 9.4 Beta 1 has been published (with some features of my own on it):

https://docs.hex-rays.com/release-notes/9_4beta

#hexrays

we're hiring one iOS human on my team https://nowsecure.applytojob.com/apply/BXcVGTgFyb/Research-Engineer?source=Our%20Career%20Page%20Widget

Won 80k via kCTF, unpriv userns-reachable vuln: https://lore.kernel.org/linux-cve-announce/2026050859-CVE-2026-43456-ae60@gregkh/ We fixed in March, upstream 6.6 still unfixed 4 months later.