HackingPassion.comSecurity News
142 posts
Your Rust build pulled in a backdoor for 86 minutes on Thursday. Five versions with 246 million downloads between them were pulled in 16 seconds, leaving one …
Your router now reports when someone walks through your house. You installed no sensor. There is none. A phone indoors gave up a person’s breathing to a …
Expired credit cards still paid at the checkout. Researchers spent $500 on one, then $2.79 in a shop. The cards had already been handed in for a replacement, …
Evooo1Bot Turns Home Routers Into Rented Proxies and Reads the Traffic Passing Through A botnet is breaking into home routers with a bug from 2007. Ten known …
Windows Defender Dies to a One-Click Script While Defender Bypasses Sell for $30 a File A script created an account on a fully secured Windows 11 machine, …
Plug and Pwn Turns a Fake USB Device Into SYSTEM on Fully Patched Windows 11 Two researchers took over a fully updated Windows 11 machine in five minutes with a …
Someone could sign in as a company’s top admin by reading one Windows log file. The admin’s password and passkey were never touched. Microsoft …
An AI found a hole in the Linux kernel that sat open for 18 years, then wrote the exploit that turns a local user into root. The machines were not …
Anyone on your network could take over a Mac with Screen Sharing turned on. All it took was the target’s IP address. The login check handed back an old …
CSS in an email put a fake Microsoft sign-in over a live Outlook inbox and read the password letter by letter. Opening the message is enough. Outlook, Gmail, …
OpenAI, Anthropic and Meta have admitted the same thing in three weeks. Their own models ended up outside the test environment. They broke into at least 5 …
A worm dumped 1,300 stashes of stolen developer keys into public GitHub repos in a day. You ran npm install. That was all. The poison sat in a library npm hands …
One 32-byte key protects the passkeys synced to your Google account. On Windows, a researcher lifted it out of Chrome’s memory and signed into a crypto …
A researcher hid white text in a Word file and turned Microsoft Copilot into a worm that rewrites your documents and copies itself into every file it touches. …
An attacker emptied 1,196 Bitcoin wallets in 41 minutes and took 70 million dollars. The owners did nothing wrong. Their hardware wallet had been quietly …
A sixteen-year-old spotted two memory bugs in the Linux kernel’s NTFS driver. That is the code that reads Windows disks. Both rated 7.8 HIGH. Then the …
A flaw more than 20 years old just left 36,872 servers reachable straight from the internet. Not the websites they run, the servers themselves, through the one …
An attacker can open your bank in your own browser, on a second desktop you will never see, and move money while your screen shows nothing wrong. It is called …
Shared AI Chats Exposed on Search Engines. Grok alone leaked around 370,000 of them. Anthropic pulled the leaked Claude share links out of Google over the …
There is a messaging app with more than 25,000 stars on GitHub that works with no internet. Your phone talks straight to other phones over Bluetooth, and your …
An Adobe extension on roughly 329 million browsers had a flaw the researchers named HermeticReader, and it let any web page you opened read your WhatsApp Web. …
The alarm bolted into your car to protect it can now be used to steal it. A person standing a few steps away pulls out a phone, and your doors pop open. More …
Someone published 204 exploit files on GitHub for software you almost certainly use, and told the vendors nothing. The makers found out the same way the …
For 15 years, a single crafted web request could quietly take over an nginx server, the software that receives and routes incoming traffic for roughly a third …
You opened an archive in 7-Zip, and the code that let it take over your machine had been sitting there since 2018. It was quietly patched on June 25. You were …
For weeks he promised that July 14 would shatter Microsoft’s bones. Patch Tuesday came, Microsoft closed a record 622 holes, and hours later he dropped …
A hole in WordPress handed your database to someone who never logged in. For 227 days it took one request. It needed no password and no plugin, just an address …
Some malware loads before Windows even starts, before your antivirus exists. It survives a full reinstall, and 11 files signed by Microsoft are all it takes. …
IonStack You tap one link, and root is already running on your Android 17 phone. You never download a file or approve a permission box because the page does the …
You are completely anonymous and think no one can trace you. But Windows put a permanent number on your machine, it never turns off, and that number is where …