Hi hackers, Welcome to the latest edition of Bug Bytes! In this month’s issue, we’ll be featuring:  Finding an RCE using AI in GitHub  CORS exploitation cheat sheet  Scanning codebases with AI  Bypass...

Follow us on Bluesky, Twitter (X), Mastodon and Facebook at @Hackread

ASEC exposed a VPN supply chain attack deploying NKNShell, a Go-based backdoor that uses P2P NKN and MQTT for stealthy C2. The installer bypasses AMSI using AI-generated code and grants full remote access (MeshAgent, gs-netcat).

SonicWall patched a critical flaw (CVE-2025-40604) in its Email Security appliances. The bug allows persistent RCE by exploiting a lack of integrity checks when loading the root filesystem image from the VM datastore.

Follow us on Bluesky, Twitter (X), Mastodon and Facebook at @Hackread

"LdrShuffle" is a stealthy code execution technique that abuses the Windows Loader by overwriting a DLL's EntryPoint, enabling injection without creating new threads.

The X-integrated Grok chatbot has gone viral for attributing absurd, fantastical abilities to Elon Musk. The bias appears confined to the public version of the model.

The TamperedChef malware campaign is actively distributing payloads via fake software installers and forged digital certificates, primarily targeting users searching for utilities.

The Tsundere botnet targets gamers via fake MSI installers, using a unique method: fetching its Command-and-Control server address from an Ethereum smart contract.

GreyNoise recorded a 40x spike in automated requests hitting Palo Alto GlobalProtect portals, a pattern that historically precedes the disclosure or exploitation of new vulnerabilities.

Google integrated a new image verification tool into Gemini, using the invisible SynthID watermark to detect content created by Google's AI models, though limitations exist.

Google's Nano Banana Pro, powered by Gemini 3, delivers stunning 4K images with perfect text rendering and deep control over lighting and objects. Now available via API/services.

Palo Alto CEO Nikesh Arora forecasts quantum systems cracking crypto by 2029. The company is preparing solutions, launching a secure browser, and acquired Chronosphere for $3.5B.

The Cl0p group exploited a zero-day RCE flaw (CVE-2025-61882) in Oracle E-Business Suite since July, leading to the compromise of major organizations like the NHS and Harvard.

Google uncovered a 3-year APT24 espionage campaign using BadAudio, a stealthy malware delivered via supply chain attacks and fake Windows updates to collect data.

Samourai Wallet founders were sentenced to 4 and 5 years in prison for running an unlicensed business that laundered $237M in crypto proceeds from darknet crimes.

X is now letting Premium+ subscribers request dormant usernames, dividing them into 'Priority' and 'Rare' categories with ambiguous rules and rumored costs up to millions.