Difficulty: Easy

The Call for Speakers (CFS) for CVE/FIRST VulnCon 2026 closes on December 22, 2025. VulnCon 2026 will be held on April 13–16, 2026, at the…

CVE-2025–55182 and CVE-2025–66478

The final outcome of most penetration tests is the report, and it is often the part dreaded most by the consultants carrying out the test…

Autor: Santiago Habib
 Fecha: Diciembre 2025

The scariest cyber threats aren’t always hackers — sometimes they’re one careless keystroke away.

Category: Web | Difficulty: Easy (But I think it should be a Medium Difficulty :) )

Discover how to access and benefit from the latest x reward program.

Koi Security exposed ShadyPanda, which infected 4.3M+ users by weaponizing trusted browser extensions (WeTab, Clean Master) through auto-updates. The malware performs RCE and exfiltrates data to China.

Zscaler exposed Matanbuchus v3.0, a MaaS downloader pivoting to ransomware. The stealthy C++ malware uses Protobufs for C2, QuickAssist for access, and time-wasting loops to bypass sandboxes.

A 3-flaw chain (CRLF, Auth Bypass, SQLi) achieves root RCE on Synology BeeStation. The exploit uses a "Dirty File Write" SQLi to inject a malicious crontab entry, bypassing the lack of a PHP interpreter.

Trend Micro exposed Water Saci, a campaign using LLMs to convert malware from PowerShell to Python, accelerating its spread via a WhatsApp worm. The multi-stage attack deploys a trojan capable of VNC mirroring and overlay attacks.

A High-severity Vim for Windows flaw (CVE-2025-66476) allows arbitrary code execution. The editor executes malicious binaries in the current working directory instead of safe system paths when running commands like :grep.

AWS Nova Forge allows deep customization of Nova 2 models via open-training (pre-, mid-, post-training). This ensures reliable AI outputs aligned with enterprise operational constraints.

Android 16's second update brings AI notification summaries and anti-scam tools. Accessibility gains Gemini-powered TalkBack and Expressive Captions for enhanced user experience.

Raspberry Pi raised prices on Pi 4 and Pi 5 models by up to $25, citing AI-driven memory demand. It simultaneously launched a new $45, 1GB Pi 5 entry model.

AWS launched Frontier Agents, a new class of autonomous AI agents (Kiro, Security Agent, DevOps Agent) capable of long-running, independent software engineering tasks.

AWS launched the Nova 2 model family (Lite, Pro, Omni) and Nova Act, an agent platform achieving 90% reliability in web-browsing tasks, with Nova Forge for deep customization.

Now I want to share how I solved the vulnlab from vulnhub, namely dc3. Let’s go straight to the method.