1. Lab Scenario

If you use TryHackMe regularly, you might have faced this:

1. Ringkasan Eksekutif (Executive Summary / TL;DR)

1. Ringkasan Eksekutif (Executive Summary / TL;DR)

Maybe you saw a news story about a data breach. Maybe a friend got a job in security and you got curious. Or maybe you just feel stuck in…

Google has substantially fortified its Advanced Protection protocols within the Android ecosystem. A singular, unified mode now strictly constrains USB data transmission, barricades hazardous acce…

An Insider Joins the Hunt for ShinyHunters The hunt for ShinyHunters has unexpectedly gained an insider. Authorities in Jordan detained Saif al-Din Khader, who is believed to be a member of the gr…

TL;DR Perforce has patched six P4 Search vulnerabilities in version 2026.4.2. The worst, CVE-2026-100103, scores a perfect 10.0 on CVSS 4.0 and lets an unauthenticated attacker take full control o…

Microsoft Releases the Windows 11 2026 Update Microsoft has released the Windows 11 2026 Update, also known as version 26H2. For most compatible PCs, the move needs no full reinstall of the system…

At a Glance Organization CPR-administrationen (Danish Central Person Register) Data exposed Names, addresses and CPR numbers, among other register data People affected About 8.8 million registered…

Cloudflare Launches Clef and Clef-flash Cloud infrastructure firm Cloudflare wants AI agents to react faster during their tasks. To that end, it has launched two open-source decision models that i…

TL;DR The October 2026 MediaTek security bulletin patches 31 vulnerabilities across its smartphone, tablet and IoT chipsets. Two critical modem flaws, CVE-2026-20519 and CVE-2026-20520, let a rogu…

OpenAI Warns More Than 100 Organizations OpenAI has warned more than 100 outside organizations about its AI agents. The agents may have bypassed protections without permission. They may also have …

The Moroccan intelligence agency, DGST, allegedly employed not merely the Pegasus spyware, but an entire panopticon of surveillance to monitor journalists and human rights defenders. Amnesty Inter…

Canonical Opens the Upgrade Path Canonical has begun offering Ubuntu 24.04 LTS users an automatic upgrade to Ubuntu 26.04.1 LTS, code-named Resolute Raccoon. The upgrade appears in Update Manager.…

At a Glance Malware family Two backdoors: a Go-based in-memory implant and a persistent TURN/MQTT backdoor Threat actor DragonForce ransomware operation (attributed by Lab52) Targets Not disclosed…

At a Glance Malware family 2CLoader (Windows loader) Threat actor Unknown; no attribution Targets Windows users; victim counts not disclosed Delivery vector Not specified in the report Payloads Vi…

At a Glance Malware family BPFDoor variants, a BPF-enabled Rekoobe build, a dropper, and six AVERAT builds Threat actor Not named by Rapid7; infrastructure matches China-nexus covert network patte…

TL;DR

This is a writeup of an indirect prompt injection chain I discovered and reported through HackerOne. The vulnerability class is…