elttam released a universal gadget chain that turns one Marshal.load into command execution on Ruby 4.0.6, working unchanged back to 3.3. Prior public chains died at 3.4-rc after RubyGems patched their gadgets, so this one builds on new sources and repurposed old gadgets, standard library only.
watchTowr walks a heap overflow in Citrix NetScaler ADC/Gateway SAML parsing to unauthenticated RCE, tied to CVE-2026-8452. Reachable on builds before 13.1-63.18 and 14.1-72.61 when SAML is configured as SP or IdP. It's the first public NetScaler RCE writeup in three years, so patch now.
A user-supplied schema name in n8n's GSuiteAdmin node lands as a bare object key, so `__proto__` pollutes Object.prototype. Chained through the Git node's GIT_SSH_COMMAND, one webhook request yields a shell. Any editor-accessible n8n instance is exposed.
A researcher turned a memory-corruption flaw in PostGIS, the ubiquitous Postgres geospatial extension, into privilege escalation and code execution across managed-Postgres providers NeonDB, Supabase, Xata, and others. Part one of a series documenting 40+ extension vulnerabilities and systemic extension-supply-chain risk in the managed Postgres industry.
A password field in Zyxel's PKCS#12 certificate export lets an authenticated admin break into a shell command and execute as root across 18 enterprise AP models (CVE-2026-6837, CVSS 7.2). The write-up pairs a full AArch64 emulation rehost with an in-band exploit proof, and the fix lands in WAX650S 7.12(ABRM.0)C0.
Jamf Threat Labs has uncovered AmnesiaStealer, a Rust-based macOS infostealer spread via ClickFix fake GitHub pages. It copies Chromium profiles into a hidden headless browser and streams the session back, letting attackers click through bank, email and wallet portals using the victim's live logins from anywhere.
An exposed staging server tied to The Gentlemen ransomware cluster surfaced EtherRAT, a Node.js implant that reads its C2 domains from a public Ethereum smart contract instead of hardcoding them. Since every rotation is permanent on-chain, defenders get the full historical C2 set, here five domains. Operators layered it with Sliver and Go shells for full domain takeover.
Actor "TheHatman" is selling employee directories from at least nine Fortune 500 firms, allegedly pulled from Azure/Entra tenants via compromised credentials. McDonald's tops the list at 1.7M+ records, followed by TCS, Vodafone, HCL, IHG, and Kyndryl. The attack vector is unconfirmed, but leaked Global Admin and service accounts map out follow-on phishing and privilege-escalation targets.
Filippo Valsorda dismantles the myth that Grover's algorithm halves symmetric key security, showing AES-128 resists quantum attacks because sequential oracle calls and parallelization costs erase the speedup. AES-128, SHA-256 and SHA-3 stay safe; no symmetric key sizes must change in the post-quantum transition.
You’re caught up.
That was all 9 stories in the 16 August issue.