News Archive
552 stories · page 23 of 23Every story we've published, newest first. Vulnerability records live in the CVE Tracker.
Welcoming the Bahamian Government to Have I Been Pwned
Today, we welcome the 44th government onboarded to Have I Been Pwned’s free gov service: The Bahamas. The National Computer Incident Response Team of The Bahamas, CIRT-BS, now has access to monitor government domains against the data in HIB
A 0-click exploit chain for the Pixel 10: When a Door Closes, a Window Opens
We recently published an exploit chain for the Google Pixel 9 that demonstrated it was possible to go from a zero-click context to root on Android in just two exploits. The Dolby 0-click vulnerability existed across all of Android, until it
Welcoming the Bangladesh Government to Have I Been Pwned
Today, we welcome the 43rd government onboarded to Have I Been Pwned's free gov service, Bangladesh. The BGD e-GOV CIRT department now has full access to query all their government domains via API, and monitor them against future breaches.
EtherRat and TukTuk Malware Campaigns Lead to The Gentleman Ransomware
The EtherRat malware, initially identified in late 2025 targeting Linux servers via a React2Shell vulnerability, has evolved. A Windows variant emerged in early 2026, with investigations revealing earlier activity. These campaigns, alongside the TukTuk C2, have now been linked to the deployment of The Gentleman ransomware.
Welcoming the Costa Rican Government to Have I Been Pwned
Today, we welcome the 42nd government onboarded to Have I Been Pwned’s free gov service: Costa Rica. The CSIRT of the Government of Costa Rica now has access to monitor government domains against the data in HIBP. This enables their nationa
Weekly Update 503
Well, it's the day before the Instructure "pay or leak" deadline (at least by my Aussie watch), and the company remains removed from the ShinyHunters website. In its place sits a press statement that amounts to "we're not making any stateme
Cloud Worm PCPJack Steals Credentials and Evicts TeamPCP Artifacts
A new credential theft framework dubbed PCPJack has been identified, capable of spreading across exposed cloud infrastructure. The tool not only harvests sensitive data from various cloud services but also actively removes artifacts associated with the threat actor group TeamPCP. PCPJack targets services like Docker, Kubernetes, and MongoDB, exfiltrating stolen information and seeking to infect additional systems.
Operation Road Trap: Fake toll and parking texts are spreading worldwide
Scammers are actively conducting a global smishing campaign, sending fake text messages that impersonate toll and parking authorities. These messages aim to trick drivers into clicking malicious links or providing sensitive information. The campaign has been ongoing since late 2025 and has already distributed tens of thousands of fraudulent texts across multiple countries.
AI threats in the wild: The current state of prompt injections on the web
Google's Threat Intelligence teams have analyzed the prevalence of indirect prompt injection (IPI) attacks on the public web. Their research indicates that while sophisticated IPI attacks are not yet widespread, there is a growing trend of experimentation by threat actors. The observed attacks range from harmless pranks and SEO manipulation to more concerning attempts at data exfiltration and system destruction, though current implementations are often simplistic.
Bringing Rust to the Pixel Baseband
Google is enhancing the security of its Pixel devices by integrating a memory-safe Rust-based DNS parser into the cellular modem firmware. This move aims to mitigate memory-safety vulnerabilities, a significant risk in the complex and remotely attackable modem code. The company hopes this initiative will encourage the wider adoption of memory-safe languages in low-level system programming.
Protecting Cookies with Device Bound Session Credentials
Google's Chrome browser is rolling out Device Bound Session Credentials (DBSC) to Windows users, with macOS support coming soon. This new feature aims to prevent session theft by cryptographically linking user sessions to a specific device. Previously, stolen session cookies could grant attackers access to accounts without needing passwords, but DBSC makes these exfiltrated cookies unusable, shifting defenses from reactive detection to proactive prevention.
Google Workspace’s continuous approach to mitigating indirect prompt injections
Google is detailing its ongoing efforts to combat indirect prompt injection attacks against its Workspace AI features, like Gemini. This type of attack manipulates AI behavior by inserting malicious instructions into the data or tools the AI uses, potentially without direct user interaction. Google employs a continuous improvement strategy, utilizing both human and automated red-teaming exercises to discover and defend against emerging threats.
VRP 2025 Year in Review
Google's Vulnerability Rewards Program (VRP) celebrated its 15th anniversary in 2025, awarding a record $17 million to over 700 researchers globally. The program saw significant growth, including the launch of a dedicated AI VRP and expanded reward categories for AI features within the Chrome VRP. Additionally, a new patch rewards program was introduced for the OSV-SCALIBR tool.
Security for the Quantum Era: Implementing Post-Quantum Cryptography in Android
Google is preparing Android for the advent of quantum computing by integrating post-quantum cryptography (PQC) standards into its operating system. This proactive, multi-year migration aims to protect sensitive data and transactions from being compromised by future quantum computers. The PQC enhancements will be tested starting with the Android 17 beta release and will be available in the production version, establishing a quantum-resistant chain of trust across the platform.
Windsurf IDE Extension Drops Malware via Solana Blockchain
Researchers have identified a malicious extension for the Windsurf IDE that utilizes the Solana blockchain to distribute a multi-stage malware. This stealer is designed to exfiltrate sensitive information.
On the Effectiveness of Mutational Grammar Fuzzing
Mutational grammar fuzzing is a fuzzing technique in which the fuzzer uses a predefined grammar that describes the structure of the samples. When a sample gets mutated, the mutations happen in such a way that any resulting samples still adh
A Deep Dive into the GetProcessHandleFromHwnd API
In my previous blog post I mentioned the GetProcessHandleFromHwnd API. This was an API I didn’t know existed until I found a publicly disclosed UAC bypass using the Quick Assist UI Access application. This API looked interesting so I though
Bypassing Administrator Protection by Abusing UI Access
In my last blog post I introduced the new Windows feature, Administrator Protection and how it aimed to create a secure boundary for UAC where one didn’t exist. I described one of the ways I was able to bypass the feature before it was rele
Breaking the Sound Barrier, Part II: Exploiting CVE-2024-54529
In the first part of this series, I detailed my journey into macOS security research, which led to the discovery of a type confusion vulnerability (CVE-2024-54529) and a double-free vulnerability (CVE-2025-31235) in the coreaudiod system da
Bypassing Windows Administrator Protection
A headline feature introduced in the latest release of Windows 11, 25H2 is Administrator Protection. The goal of this feature is to replace User Account Control (UAC) with a more robust and importantly, securable system to allow a local use
A 0-click exploit chain for the Pixel 9 Part 3: Where do we go from here?
While our previous two blog posts provided technical recommendations for increasing the effort required by attackers to develop 0-click exploit chains, our experience finding, reporting and exploiting these vulnerabilities highlighted some
A 0-click exploit chain for the Pixel 9 Part 2: Cracking the Sandbox with a Big Wave
With the advent of a potential Dolby Unified Decoder RCE exploit, it seemed prudent to see what kind of Linux kernel drivers might be accessible from the resulting userland context, the mediacodec context. As per the AOSP documentation, the
A 0-click exploit chain for the Pixel 9 Part 1: Decoding Dolby
Over the past few years, several AI-powered features have been added to mobile phones that allow users to better search and understand their messages. One effect of this change is increased 0-click attack surface, as efficient analysis ofte
Welcome to the new Project Zero Blog
While on Project Zero, we aim for our research to be leading-edge, our blog design was … not so much. We welcome readers to our shiny new blog! For the occasion, we asked members of Project Zero to dust off old blog posts that never quite s