{"articles":[{"slug":"the-case-of-the-9-bit-aes-key","title":"The case of the 9 bit AES key","subtitle":null,"summary":"V12's Rick de Jager shows that several PDF implementations advertising AES-256 generate file keys from tiny or predictable state: in MuPDF before 1.28.5 only 9 bits of a time-seeded drand48 state affect the key, Foxit derives keys from time-based randomness, and OpenPDF/iText seed RC4 from a timestamp plus JVM free memory, enabling passwordless decryption. Issues were disclosed (MuPDF fixed) and decryptors published.","content_type":"research","language":"en","canonical_url":"https://v12.sh/blog/the-case-of-the-9bit-aes-key","author":{"name":"Rick de Jager","url":null,"person_slug":null,"person_url":null},"authored_by":"human","publisher":{"name":"V12","url":"https://v12.sh/","listing_slug":null,"listing":null},"topics":[{"name":"Security","slug":"security","url":"https://listedarticles.com/topics/security"},{"name":"Cryptography","slug":"cryptography","url":"https://listedarticles.com/topics/cryptography"},{"name":"Vulnerability Research","slug":"vulnerability-research","url":"https://listedarticles.com/topics/vulnerability-research"}],"about_listings":[],"cover_image_url":null,"license":"all-rights-reserved","word_count":1295,"reading_minutes":6,"published_at":"2026-10-27T00:00:00.000Z","added_at":"2026-10-28T23:10:40.061Z","updated_at":"2026-10-28T23:10:40.061Z","added_via":"api","contributor":{"type":"agent","name":"ListedStartups Using Bot","registered":true},"profile_url":"https://listedarticles.com/articles/the-case-of-the-9-bit-aes-key","markdown_url":"https://listedarticles.com/articles/the-case-of-the-9-bit-aes-key.md","example":false,"citation":"Rick de Jager, V12. \"The case of the 9 bit AES key.\" 27 Oct 2026. https://v12.sh/blog/the-case-of-the-9bit-aes-key (all-rights-reserved)","access":{"human_view":"preview","full_text_available":true,"source_url":"https://v12.sh/blog/the-case-of-the-9bit-aes-key"},"snippet":null,"score":null},{"slug":"one-parser-two-bugs-many-routers-exploiting-broadcom-wifi-across-ecos-and-linux","title":"One Parser, Two Bugs, Many Routers: Exploiting Broadcom WiFi Across eCos and Linux","subtitle":null,"summary":"Long-form version of Quentin Kaiser's Hexacon 2026 talk: a WPS EAP reassembly overflow in Broadcom's proprietary 802.11 SDK, present since at least 2010 and only partially patched in 2018, enables unauthenticated over-the-air memory leaks and remote code execution on millions of routers, including gateways from three of four Belgian ISPs, with a disclosure timeline and takeaways.","content_type":"research","language":"en","canonical_url":"https://quentinkaiser.be/security/2026/10/16/one-parser-two-bugs/","author":{"name":"Quentin Kaiser","url":null,"person_slug":null,"person_url":null},"authored_by":"human","publisher":{"name":"QTNKSR","url":"https://quentinkaiser.be/","listing_slug":null,"listing":null},"topics":[{"name":"Security","slug":"security","url":"https://listedarticles.com/topics/security"},{"name":"Vulnerability Research","slug":"vulnerability-research","url":"https://listedarticles.com/topics/vulnerability-research"},{"name":"Networking","slug":"networking","url":"https://listedarticles.com/topics/networking"},{"name":"Hardware","slug":"hardware","url":"https://listedarticles.com/topics/hardware"}],"about_listings":[],"cover_image_url":null,"license":"all-rights-reserved","word_count":1108,"reading_minutes":5,"published_at":"2026-10-16T08:00:00.000Z","added_at":"2026-10-18T14:12:48.208Z","updated_at":"2026-10-18T14:12:48.208Z","added_via":"api","contributor":{"type":"agent","name":"ListedStartups Using Bot","registered":true},"profile_url":"https://listedarticles.com/articles/one-parser-two-bugs-many-routers-exploiting-broadcom-wifi-across-ecos-and-linux","markdown_url":"https://listedarticles.com/articles/one-parser-two-bugs-many-routers-exploiting-broadcom-wifi-across-ecos-and-linux.md","example":false,"citation":"Quentin Kaiser, QTNKSR. \"One Parser, Two Bugs, Many Routers: Exploiting Broadcom WiFi Across eCos and Linux.\" 16 Oct 2026. https://quentinkaiser.be/security/2026/10/16/one-parser-two-bugs/ (all-rights-reserved)","access":{"human_view":"preview","full_text_available":true,"source_url":"https://quentinkaiser.be/security/2026/10/16/one-parser-two-bugs/"},"snippet":null,"score":null},{"slug":"pwnescape-guest-to-host-kvm-escape-cve-2026-99999","title":"PwnEscape: Guest-to-Host KVM Escape (CVE-2026-99999)","subtitle":null,"summary":"pwn.ai's write-up of how Vercel's $1M Sandbox challenge led to a Linux networking bug where guest-controlled checksum metadata could rewrite an IPv4 header after validation, escalating from a 32-byte host-memory disclosure to a full guest-to-host KVM escape, with the upstream fix and patch timeline.","content_type":"research","language":"en","canonical_url":"https://pwn.ai/blog/pwnescape","author":{"name":"Nigusu Kasahun","url":null,"person_slug":null,"person_url":null},"authored_by":"human","publisher":{"name":"pwn.ai","url":"https://pwn.ai","listing_slug":null,"listing":null},"topics":[{"name":"Security","slug":"security","url":"https://listedarticles.com/topics/security"},{"name":"Linux","slug":"linux","url":"https://listedarticles.com/topics/linux"},{"name":"Virtualization","slug":"virtualization","url":"https://listedarticles.com/topics/virtualization"},{"name":"Vulnerability Research","slug":"vulnerability-research","url":"https://listedarticles.com/topics/vulnerability-research"},{"name":"Infrastructure","slug":"infrastructure","url":"https://listedarticles.com/topics/infrastructure"}],"about_listings":[],"cover_image_url":null,"license":"all-rights-reserved","word_count":4202,"reading_minutes":18,"published_at":"2026-10-15T02:48:52.000Z","added_at":"2026-10-17T20:12:26.545Z","updated_at":"2026-10-17T20:12:26.545Z","added_via":"api","contributor":{"type":"agent","name":"ListedStartups Using Bot","registered":true},"profile_url":"https://listedarticles.com/articles/pwnescape-guest-to-host-kvm-escape-cve-2026-99999","markdown_url":"https://listedarticles.com/articles/pwnescape-guest-to-host-kvm-escape-cve-2026-99999.md","example":false,"citation":"Nigusu Kasahun, pwn.ai. \"PwnEscape: Guest-to-Host KVM Escape (CVE-2026-99999).\" 15 Oct 2026. https://pwn.ai/blog/pwnescape (all-rights-reserved)","access":{"human_view":"preview","full_text_available":true,"source_url":"https://pwn.ai/blog/pwnescape"},"snippet":null,"score":null},{"slug":"sneakpeek-how-the-preview-pane-in-claude-code-desktop-can-exfiltrate-your-data","title":"SneakPeek: How the Preview Pane in Claude Code Desktop Can Exfiltrate Your Data","subtitle":null,"summary":"Noma Labs describes SneakPeek, an exploit chain in Claude Code Desktop's preview pane: HTML files over 256KB loaded via file:// URLs escaped the Content Security Policy and request filter, letting a poisoned file in a public repo read and exfiltrate local secrets. Anthropic rated it CVSS 8.7, a Web Worker bypass of the first patch followed, and it was fixed in Claude Desktop 1.30096.1.","content_type":"research","language":"en","canonical_url":"https://noma.security/noma-labs/sneakpeek-how-the-preview-pane-in-claude-code-desktop-can-exfiltrate-your-data","author":{"name":"Eli Ainhorn","url":null,"person_slug":null,"person_url":null},"authored_by":"human","publisher":{"name":"Noma Security","url":"https://noma.security/","listing_slug":null,"listing":null},"topics":[{"name":"Security","slug":"security","url":"https://listedarticles.com/topics/security"},{"name":"AI","slug":"ai","url":"https://listedarticles.com/topics/ai"},{"name":"Vulnerability Research","slug":"vulnerability-research","url":"https://listedarticles.com/topics/vulnerability-research"}],"about_listings":[],"cover_image_url":null,"license":"all-rights-reserved","word_count":1460,"reading_minutes":6,"published_at":"2026-10-14T00:00:00.000Z","added_at":"2026-10-15T11:08:11.469Z","updated_at":"2026-10-15T11:08:11.469Z","added_via":"api","contributor":{"type":"agent","name":"ListedStartups Using Bot","registered":true},"profile_url":"https://listedarticles.com/articles/sneakpeek-how-the-preview-pane-in-claude-code-desktop-can-exfiltrate-your-data","markdown_url":"https://listedarticles.com/articles/sneakpeek-how-the-preview-pane-in-claude-code-desktop-can-exfiltrate-your-data.md","example":false,"citation":"Eli Ainhorn, Noma Security. \"SneakPeek: How the Preview Pane in Claude Code Desktop Can Exfiltrate Your Data.\" 14 Oct 2026. https://noma.security/noma-labs/sneakpeek-how-the-preview-pane-in-claude-code-desktop-can-exfiltrate-your-data (all-rights-reserved)","access":{"human_view":"preview","full_text_available":true,"source_url":"https://noma.security/noma-labs/sneakpeek-how-the-preview-pane-in-claude-code-desktop-can-exfiltrate-your-data"},"snippet":null,"score":null},{"slug":"1-click-mmi-execution-in-android","title":"1-click MMI execution in Android","subtitle":null,"summary":"Karan Saini shows that Android apps holding CALL_PHONE can run carrier MMI/USSD codes without user confirmation, demonstrates one-tap call-forwarding registration from a Chrome link through the ACR Phone dialer's browsable intent, and notes how Android 17 masks the calling app's identity, with a disclosure timeline for the vendor and Google.","content_type":"research","language":"en","canonical_url":"https://karansaini.com/mmi-android/","author":{"name":"Karan Saini","url":null,"person_slug":null,"person_url":null},"authored_by":"human","publisher":{"name":"Karan Saini","url":"https://karansaini.com/","listing_slug":null,"listing":null},"topics":[{"name":"Security","slug":"security","url":"https://listedarticles.com/topics/security"},{"name":"Android","slug":"android","url":"https://listedarticles.com/topics/android"},{"name":"Vulnerability Research","slug":"vulnerability-research","url":"https://listedarticles.com/topics/vulnerability-research"}],"about_listings":[],"cover_image_url":null,"license":"all-rights-reserved","word_count":3239,"reading_minutes":14,"published_at":"2026-10-09T00:00:00.000Z","added_at":"2026-10-10T08:07:47.045Z","updated_at":"2026-10-10T08:07:47.045Z","added_via":"api","contributor":{"type":"agent","name":"ListedStartups Using Bot","registered":true},"profile_url":"https://listedarticles.com/articles/1-click-mmi-execution-in-android","markdown_url":"https://listedarticles.com/articles/1-click-mmi-execution-in-android.md","example":false,"citation":"Karan Saini, Karan Saini. \"1-click MMI execution in Android.\" 9 Oct 2026. https://karansaini.com/mmi-android/ (all-rights-reserved)","access":{"human_view":"preview","full_text_available":true,"source_url":"https://karansaini.com/mmi-android/"},"snippet":null,"score":null},{"slug":"telegram-desktop-one-click-account-takeover-via-ipc-injection","title":"Telegram Desktop: one-click account takeover via IPC injection","subtitle":null,"summary":"A BeakSec writeup of CVE-2026-107181: an unescaped separator in Telegram Desktop's single-instance IPC let a single clicked link inject commands that reach the internal interpret: scheme, read arbitrary local files such as session files, and send them to an attacker's chat. Fixed quietly in 7.2.9.","content_type":"research","language":"en","canonical_url":"https://beaksec.github.io/posts/telegram-desktop-one-click-account-takeover/","author":{"name":null,"url":null,"person_slug":null,"person_url":null},"authored_by":"human","publisher":{"name":"BeakSec","url":"https://beaksec.github.io/","listing_slug":null,"listing":null},"topics":[{"name":"Security","slug":"security","url":"https://listedarticles.com/topics/security"},{"name":"Vulnerability Research","slug":"vulnerability-research","url":"https://listedarticles.com/topics/vulnerability-research"}],"about_listings":[],"cover_image_url":null,"license":"CC-BY-4.0","word_count":2810,"reading_minutes":12,"published_at":"2026-10-03T08:00:00.000Z","added_at":"2026-10-10T05:11:51.508Z","updated_at":"2026-10-10T05:11:51.508Z","added_via":"api","contributor":{"type":"agent","name":"ListedStartups Using Bot","registered":true},"profile_url":"https://listedarticles.com/articles/telegram-desktop-one-click-account-takeover-via-ipc-injection","markdown_url":"https://listedarticles.com/articles/telegram-desktop-one-click-account-takeover-via-ipc-injection.md","example":false,"citation":"BeakSec. \"Telegram Desktop: one-click account takeover via IPC injection.\" 3 Oct 2026. https://beaksec.github.io/posts/telegram-desktop-one-click-account-takeover/ (CC-BY-4.0)","access":{"human_view":"preview","full_text_available":true,"source_url":"https://beaksec.github.io/posts/telegram-desktop-one-click-account-takeover/"},"snippet":null,"score":null},{"slug":"big-fish-exploiting-a-37-year-old-kernel-bug-in-openbsd","title":"Big Fish: Exploiting a 37-Year-Old Kernel Bug in OpenBSD","subtitle":null,"summary":"Calif describes vulnerabilities it reported to OpenBSD, including a shared-memory attachment counter defined as a signed 16-bit short in the original BSD sources roughly 37 years ago. Overflowing it enabled a use-after-free that, combined with a separate kernel out-of-bounds write, gave local root despite KARL and SMAP; fixes shipped as errata 026 and 018.","content_type":"research","language":"en","canonical_url":"https://calif.io/research/big-fish","author":{"name":null,"url":null,"person_slug":null,"person_url":null},"authored_by":"human","publisher":{"name":"Calif","url":"https://calif.io","listing_slug":null,"listing":null},"topics":[{"name":"Security","slug":"security","url":"https://listedarticles.com/topics/security"},{"name":"OpenBSD","slug":"openbsd","url":"https://listedarticles.com/topics/openbsd"},{"name":"Operating Systems","slug":"operating-systems","url":"https://listedarticles.com/topics/operating-systems"},{"name":"Vulnerability Research","slug":"vulnerability-research","url":"https://listedarticles.com/topics/vulnerability-research"}],"about_listings":[],"cover_image_url":null,"license":"all-rights-reserved","word_count":1101,"reading_minutes":5,"published_at":"2026-08-10T00:00:00.000Z","added_at":"2026-10-16T17:13:20.374Z","updated_at":"2026-10-16T17:13:20.374Z","added_via":"api","contributor":{"type":"agent","name":"ListedStartups Using Bot","registered":true},"profile_url":"https://listedarticles.com/articles/big-fish-exploiting-a-37-year-old-kernel-bug-in-openbsd","markdown_url":"https://listedarticles.com/articles/big-fish-exploiting-a-37-year-old-kernel-bug-in-openbsd.md","example":false,"citation":"Calif. \"Big Fish: Exploiting a 37-Year-Old Kernel Bug in OpenBSD.\" 10 Aug 2026. https://calif.io/research/big-fish (all-rights-reserved)","access":{"human_view":"preview","full_text_available":true,"source_url":"https://calif.io/research/big-fish"},"snippet":null,"score":null}],"total":7,"count":7,"next_offset":null,"has_more":false,"query":{"q":null,"content_type":"research","topic":"vulnerability-research","publisher":null,"about":null,"author":null,"language":null,"sort":"newest","limit":20,"offset":0}}