HackingPassion.comSecurity News
152 posts
Mullvad Says Any Android App Can Send Your IP Past the VPN Kill Switch Your phone kept sending its address out on a 10 second timer while the VPN kill switch …
Five spy crews broke into Chrome with the same kit in seven days. The victims clicked one link in an email. Google fixed the first hole on August 7. It reached …
Your LG television counted 38 devices in the house that have nothing to do with television. Phones, smartwatches, a printer, the thermostat. The set was not …
An attacker emptied a vault of 3,996 bitcoin and then asked the owners to contact him. He wrote the message into the blockchain, where the rest of us could read …
A database account that was only allowed to copy data could run commands on the server itself. The admins never gave it that right. The hole has been open since …
Your locked Android phone opened its photo gallery to the person holding it. One video call and four taps did it. A Pixel on Android 17 with the newest patch …
Your ad blocker stopped working thirteen months ago. Chrome 138 switched it off in July 2025. On August 31 Google pulled the last copy from the store. Edge, …
SLEEPWALKER Backdoor Hides in a Security Agent and Wakes Up for One Packet 5 bytes of orders sit inside a backdoor that has never once called home. It reads …
Your kid downloaded a Minecraft client from the first result in Google. It cost the attacker 5 dollars, the panel behind it has logged 116,464 infections, and …
Nightmare Eclipse published his tenth Windows attack and it lifts a normal account to SYSTEM. It only works on machines with Defender switched on. It is a full …
Your Rust build pulled in a backdoor for 86 minutes on Thursday. Five versions with 246 million downloads between them were pulled in 16 seconds, leaving one …
Your router now reports when someone walks through your house. You installed no sensor. There is none. A phone indoors gave up a person’s breathing to a …
Expired credit cards still paid at the checkout. Researchers spent $500 on one, then $2.79 in a shop. The cards had already been handed in for a replacement, …
A botnet is breaking into home routers with a bug from 2007. Ten known holes, and a list of 150 common logins. Nobody in the house clicked on anything. The …
Windows Defender Dies to a One-Click Script While Defender Bypasses Sell for $30 a File A script created an account on a fully secured Windows 11 machine, …
Plug and Pwn Turns a Fake USB Device Into SYSTEM on Fully Patched Windows 11 Two researchers took over a fully updated Windows 11 machine in five minutes with a …
Someone could sign in as a company’s top admin by reading one Windows log file. The admin’s password and passkey were never touched. Microsoft …
An AI found a hole in the Linux kernel that sat open for 18 years, then wrote the exploit that turns a local user into root. The machines were not …
Anyone on your network could take over a Mac with Screen Sharing turned on. All it took was the target’s IP address. The login check handed back an old …
CSS in an email put a fake Microsoft sign-in over a live Outlook inbox and read the password letter by letter. Opening the message is enough. Outlook, Gmail, …
OpenAI, Anthropic and Meta have admitted the same thing in three weeks. Their own models ended up outside the test environment. They broke into at least 5 …
A worm dumped 1,300 stashes of stolen developer keys into public GitHub repos in a day. You ran npm install. That was all. The poison sat in a library npm hands …
One 32-byte key protects the passkeys synced to your Google account. On Windows, a researcher lifted it out of Chrome’s memory and signed into a crypto …
A researcher hid white text in a Word file and turned Microsoft Copilot into a worm that rewrites your documents and copies itself into every file it touches. …
An attacker emptied 1,196 Bitcoin wallets in 41 minutes and took 70 million dollars. The owners did nothing wrong. Their hardware wallet had been quietly …
A sixteen-year-old spotted two memory bugs in the Linux kernel’s NTFS driver. That is the code that reads Windows disks. Both rated 7.8 HIGH. Then the …
A flaw more than 20 years old just left 36,872 servers reachable straight from the internet. Not the websites they run, the servers themselves, through the one …
An attacker can open your bank in your own browser, on a second desktop you will never see, and move money while your screen shows nothing wrong. It is called …
Shared AI Chats Exposed on Search Engines. Grok alone leaked around 370,000 of them. Anthropic pulled the leaked Claude share links out of Google over the …
There is a messaging app with more than 25,000 stars on GitHub that works with no internet. Your phone talks straight to other phones over Bluetooth, and your …