HackingPassion.comSecurity News
147 posts
Your locked Android phone opened its photo gallery to the person holding it. One video call and four taps did it. A Pixel on Android 17 with the newest patch …
Your ad blocker stopped working thirteen months ago. Chrome 138 switched it off in July 2025. On August 31 Google pulled the last copy from the store. Edge, …
SLEEPWALKER Backdoor Hides in a Security Agent and Wakes Up for One Packet 5 bytes of orders sit inside a backdoor that has never once called home. It reads …
Your kid downloaded a Minecraft client from the first result in Google. It cost the attacker 5 dollars, the panel behind it has logged 116,464 infections, and …
Nightmare Eclipse published his tenth Windows attack and it lifts a normal account to SYSTEM. It only works on machines with Defender switched on. It is a full …
Your Rust build pulled in a backdoor for 86 minutes on Thursday. Five versions with 246 million downloads between them were pulled in 16 seconds, leaving one …
Your router now reports when someone walks through your house. You installed no sensor. There is none. A phone indoors gave up a person’s breathing to a …
Expired credit cards still paid at the checkout. Researchers spent $500 on one, then $2.79 in a shop. The cards had already been handed in for a replacement, …
A botnet is breaking into home routers with a bug from 2007. Ten known holes, and a list of 150 common logins. Nobody in the house clicked on anything. The …
Windows Defender Dies to a One-Click Script While Defender Bypasses Sell for $30 a File A script created an account on a fully secured Windows 11 machine, …
Plug and Pwn Turns a Fake USB Device Into SYSTEM on Fully Patched Windows 11 Two researchers took over a fully updated Windows 11 machine in five minutes with a …
Someone could sign in as a company’s top admin by reading one Windows log file. The admin’s password and passkey were never touched. Microsoft …
An AI found a hole in the Linux kernel that sat open for 18 years, then wrote the exploit that turns a local user into root. The machines were not …
Anyone on your network could take over a Mac with Screen Sharing turned on. All it took was the target’s IP address. The login check handed back an old …
CSS in an email put a fake Microsoft sign-in over a live Outlook inbox and read the password letter by letter. Opening the message is enough. Outlook, Gmail, …
OpenAI, Anthropic and Meta have admitted the same thing in three weeks. Their own models ended up outside the test environment. They broke into at least 5 …
A worm dumped 1,300 stashes of stolen developer keys into public GitHub repos in a day. You ran npm install. That was all. The poison sat in a library npm hands …
One 32-byte key protects the passkeys synced to your Google account. On Windows, a researcher lifted it out of Chrome’s memory and signed into a crypto …
A researcher hid white text in a Word file and turned Microsoft Copilot into a worm that rewrites your documents and copies itself into every file it touches. …
An attacker emptied 1,196 Bitcoin wallets in 41 minutes and took 70 million dollars. The owners did nothing wrong. Their hardware wallet had been quietly …
A sixteen-year-old spotted two memory bugs in the Linux kernel’s NTFS driver. That is the code that reads Windows disks. Both rated 7.8 HIGH. Then the …
A flaw more than 20 years old just left 36,872 servers reachable straight from the internet. Not the websites they run, the servers themselves, through the one …
An attacker can open your bank in your own browser, on a second desktop you will never see, and move money while your screen shows nothing wrong. It is called …
Shared AI Chats Exposed on Search Engines. Grok alone leaked around 370,000 of them. Anthropic pulled the leaked Claude share links out of Google over the …
There is a messaging app with more than 25,000 stars on GitHub that works with no internet. Your phone talks straight to other phones over Bluetooth, and your …
An Adobe extension on roughly 329 million browsers had a flaw the researchers named HermeticReader, and it let any web page you opened read your WhatsApp Web. …
The alarm bolted into your car to protect it can now be used to steal it. A person standing a few steps away pulls out a phone, and your doors pop open. More …
Someone published 204 exploit files on GitHub for software you almost certainly use, and told the vendors nothing. The makers found out the same way the …
For 15 years, a single crafted web request could quietly take over an nginx server, the software that receives and routes incoming traffic for roughly a third …
You opened an archive in 7-Zip, and the code that let it take over your machine had been sitting there since 2018. It was quietly patched on June 25. You were …