Zbtlink Router Backdoor Exposes 100,000 Devices to Remote Takeover

Hidden Backdoor in Zbtlink Routers Opens Root Access on 100,000 Devices

VulnCheck CTO Jacob Baines published findings on August 5 revealing that more than 20 models of Chinese-made Zbtlink routers ship with a hidden backdoor. The implant, named ENDLESSDOORS and tracked as CVE-2026-66747, carries a severity score of 9.3 out of 10. It starts at boot and beacons to a fixed address and a China-registered domain as often as every 35 seconds, allowing whoever controls those endpoints to issue commands and open a root shell.

Chinese Router Backdoor Opens Root Access on 100,000 Devices Worldwide – SOFX →

OP-TEE Flaws Allow Heap Underwrite, DoS, and Use-After-Free in Secure World

Researchers found multiple vulnerabilities in OP-TEE, a TrustZone Trusted Execution Environment shipping on many Arm devices. The most critical is an RSA NOPAD underwrite that allows a Normal World client to corrupt the core heap and achieve code execution in S-EL1. Two additional bugs include a NULL pointer dereference in the Widevine pseudo-TA that can panic the entire Secure World, and an unenforced flag leading to a use-after-free in S-EL1.

Trustfall: An RSA Heap Underwrite Into OP-TEE’s Secure World · ByteRay Blog →

tl;dv Database Exposure Left 181,874 Meeting Records Open for Six Months

A vulnerability in the AI meeting recording platform tl;dv left its Firestore database open, exposing 181,874 meeting records belonging to 84,312 unique users across 35,003 email domains. The database remained unfixed as of July 2026, six months after the issue was reported on January 28, 2026. The CTO never responded to disclosure emails.

tl;dv (Too Lazy; Didn’t Validate): 181,874 Meetings Left Wide Open | bobdahacker →

npm Attack Uses Provenance Attestations as Camouflage in 400+ Package Supply Chain Breach

Security researchers disclosed an npm supply-chain attack affecting more than 400 packages, including projects connected to Keyv and Cacheable. The attackers used stolen developer credentials to publish malicious versions containing a variant of the Mini Shai-Hulud credential-stealing worm. The malware searched for additional credentials and published infected versions with valid provenance attestations, exposing a weakness in trusted publishing.

The npm attack that turned provenance attestations into camouflage →

Hackers Use BNB Chain Smart Contracts to Spread Malware via Fake CAPTCHAs

Hackers are using BNB Smart Chain contracts to spread malware through compromised websites and fake CAPTCHA prompts, according to Microsoft Threat Intelligence. The campaign uses EtherHiding, storing malicious instructions in a blockchain smart contract. Visitors see a fake CAPTCHA telling them to open the Windows Run dialog and paste text from their clipboard, which runs a command supplied by the attacker.

Hackers Use BNB Chain to Spread Malware Through Fake CAPTCHAs →

Connective eID Extension Flaws Allow Drive-By RCE and PIN Theft

Researchers found multiple major issues in the Connective signing extension, used by 8 of the 10 largest banks in Belgium and 60+ government agencies. Any site could trigger a drive-by remote code execution by using the GET_READERS command with a library property specifying a relative path to an attacker-supplied DLL. The native host also returned the eID PIN inside a pinToken containing both the ciphertext and the decryption key.

8 out of 10 Banks in Belgium HATE This One Weird eID RCE - Am I Being Pwned? →

RovoBlast: One Click on Crafted Link Lets Atlassian’s AI Assistant Leak Data

Varonis Threat Labs uncovered a vulnerability in Rovo, Atlassian’s enterprise AI assistant, named RovoBlast. A single click on a crafted link triggers the attacker’s embedded instructions and forces Rovo to accept externally supplied parameters as trusted inputs within a user’s session, with no jailbreaks, permission bypass, warnings, or confirmation required. Varonis responsibly disclosed the issue to Atlassian, which fixed it.

RovoBlast: How One Click Triggered Atlassian’s AI Assistant to Leak Data →

Head Mare Breaches TrueConf Servers to Trojanize Client Installers with Backdoors

The Head Mare hacktivist group exploited vulnerabilities in unpatched TrueConf video conferencing servers to replace client installers with malicious versions delivering backdoors. The attackers connected to target servers without authentication via TCP port 4307, executed malicious scripts, and replaced legitimate installers with trojanized versions containing the PhantomCore backdoor. The flaws affect TrueConf Server versions before 5.3.9, 5.4.9, and 5.5.5.

Hackers breach TrueConf to trojanize client installers with backdoors →

BTCPay Server Vulnerability Drains Lightning Nodes Running LND

Attackers exploited a critical vulnerability in BTCPay Server to drain Lightning nodes running LND, the most widely used software for operating a Lightning node. The flaw allowed an unauthenticated remote attacker to obtain .macaroon files, credentials that give software permission to interact with an LND node. Hardware-wallet maker Foundation and Citadel21 were among the victims. BTCPay urged anyone running LND to update immediately to version 2.4.2.

Another Bitcoin infrastructure exploit hits, this time draining Lightning payment servers →

Researchers Demonstrate Fiber Internet Wiretap from Home at Black Hat 2026

At Black Hat 2026, researchers Rithwik Jayasimha and Rithvik Vibhu of Lagrange Point demonstrated the ability to wiretap a shared fiber internet network from an ordinary home connection, without access to the provider’s equipment. Most residential fiber uses a passive optical design that broadcasts downstream data to every home on the branch, relying on each home’s equipment to ignore traffic not addressed to it. Their tool, named gpwn, breaks that trust.

Researchers wiretapped a whole neighborhood’s fiber internet from home →

MIT Researchers Unveil TONTOU Spectre Attack Bypassing Intel and AMD Defenses

MIT researchers Daniël Trujillo and Mengjia Yan developed a new Spectre-style attack called TONTOU that exploits a brief window between when a processor cleans or isolates information used by its branch predictor and when that information is actually used. The attack bypasses defenses Intel and AMD have added since Spectre emerged in 2018. On an AMD Zen 2 system, the researchers broke KASLR in all 10 attempts and leaked /etc/shadow in five runs.

MIT researchers found a new Spectre attack that can slip past Intel and AMD defenses →

Fake Claude Install Guide Delivers MacSync Malware to Empty Crypto Wallets

Huntress reverse-engineered a six-stage macOS kill chain called MacSync, delivered through a fake Claude Code install guide hosted on a real claude.ai share URL and promoted via a paid Google advertisement. The final stage rewrites installed Ledger and Trezor apps so a normal launch leads to a fake recovery message that harvests the seed phrase, draining the wallets of victims.

Experts warn this fake Claude install guide can be used to empty crypto wallets →

Self-Destructing Phone Code Sparks Federal Case Against Atlanta Man

Samuel Tunick, a U.S. citizen living in Atlanta, faces a felony charge after a special passcode allegedly erased his Google Pixel while CBP officers were trying to inspect it. Prosecutors say he knowingly destroyed digital property the government had lawful authority to seize. His attorneys dispute that account, arguing agents detained him unlawfully. The case appears to be among the first publicly reported federal prosecutions centered on a phone’s duress wipe feature.

Self-destructing phone code sparks federal case →

Insecure Deserialization in imgmgr.exe Bypasses Windows Application Control

An insecure deserialisation vulnerability in imgmgr.exe, a binary shipped with the Windows Assessment and Deployment Kit, can be exploited to bypass the ‘Allow Microsoft’ Application Control policy and execute arbitrary code. The vulnerability is assigned CVE-2026-25166 and attributed to Dr Tim Baker of dotSec. The binary is not currently on Microsoft’s recommended block list, so dotSec recommends it be specifically blocked until a patch is available.

Bypassing Windows application whitelisting | dotSec →