LIVE · cybersecurity feed
Live wire
zero-day

Welcome to the new Project Zero Blog

While on Project Zero, we aim for our research to be leading-edge, our blog design was … not so much. We welcome readers to our shiny new blog! For the occasion, we asked members of Project Zero to dust off old blog posts that never quite s

zeroday.news · 228d ago

Project Zero has launched a revamped blog, an initiative that also saw previously unpublished research from its team being released. The new platform aims to provide readers with insights into the evolving landscape of cybersecurity threats and the ongoing efforts to safeguard users.

The project's team members were encouraged to revisit and publish older research that had not yet been made public. This effort highlights the persistent relevance of certain security vulnerabilities and the continuous need for advancements in user protection against zero-day exploits.

Among the newly published posts is research from 2016 by James Forshaw, detailing "Windows Exploitation Techniques: Race conditions with path lookups." This work delves into specific methods attackers might employ within the Windows operating system by exploiting race conditions related to path lookups.

Additionally, a 2017 post titled "Thinking Outside The Box" by Jann Horn has been released. While the specific technical details of this post are not elaborated upon in the announcement, its title suggests an exploration of unconventional or creative approaches to security challenges.

The Project Zero team stated that the new blog will continue its mission to illuminate the capabilities of malicious actors and identify areas where security measures can be strengthened. The focus remains on shedding light on potential attack vectors and the corresponding opportunities for defense.

The initiative to publish older, unpublished research underscores the enduring nature of many security issues. Despite the passage of time since these pieces were originally drafted, the underlying techniques and vulnerabilities remain areas requiring ongoing attention and mitigation efforts.

The launch of the new blog signifies Project Zero's commitment to transparency and knowledge sharing within the cybersecurity community. By making this research accessible, the team aims to contribute to a broader understanding of security risks and promote proactive defense strategies.

The project emphasizes that while the blog design has been modernized, the core mission of producing leading-edge research and informing the public about security threats remains paramount. The new platform is intended to facilitate this mission more effectively.

zero-day
ShareXLinkedInWhatsAppFacebook

More News

view all →
phishing

Phishing Campaigns Targeting AI Solutions Providers, (Sat, Aug 1st)

Most phishing campaigns rely on the fact that the victim is afraid to loose "something": money, access to information, ... Many brands have been impersonated by campaigns but I spotted some phishing emails that focus on AI services like ChatGPT.

CVE-2026-48449

Adobe Campaign Classic CVSS 10.0 Flaw Could Run Code Without User Interaction

Adobe has released security updates to address a maximum-severity security flaw in Campaign Classic (ACC), its enterprise-focused marketing automation platform, that could result in arbitrary code execution. The vulnerability, tracked as CVE-2026-48449, carries a severity score of 10.0 on the CVSS scoring system. It has been described as a case of incorrect authorization that could result in

vulnerability

Elastic goes all-in on Hacker Summer Camp at Black Hat and DEF CON in Las Vegas

Attack Discovery turns raw alerts into validated threats and Elastic Defend closes vulnerable driver gaps as fast as they're disclosed. Watch it all run against real attacks at the booth.

breach

Hermes AI agent used to automate attack on Thai Finance Ministry

A threat actor used the open-source Hermes AI agent in unattended "YOLO" mode to automate post-exploitation activity during an alleged breach of Thailand's Ministry of Finance. [...]

security

Hackers hijack hotel Wi-Fi DNS to steal Microsoft 365 accounts

Hackers are changing the DNS settings on Wi-Fi devices at hotels and conference centers to redirect users to fake Microsoft 365 login pages. [...]

security

BGP ORIGIN attribute manipulation and its impact on the Internet

By doing in-depth testing, we found nearly 70% of BGP paths experience ORIGIN attribute rewrites by transit providers seeking traffic advantages. We examine the global impact of this practice and argue for deprecating ORIGIN in route selection.