Exploit Brokers - Tech and Hacking News Commentary

About Exploit Brokers - Tech and Hacking News Commentary

Exploit brokers is dedicated to tech and hacking news commentary, hacking tutorials, and cyber security topics. Exploit brokers brings the knowledge of hacking to you. We review data breaches, malware infections, Botnet events, and other notable hacking events to learn how to better defend against it by getting in the mind of hackers. #cybersecurity #hackingnews #cybersec #whitehat

Publisher

Cipherceval

Category

news · technology

Language

en

Explicit

No

First episode

23 Jun 2019

Latest episode

26 Mar 2026

Latest episodes

62 episodes in the feed.

1. 

   26 Mar 2026

   Dual CVSS 10.0 Cisco Flaws, AI Malware Assembly Line, Qualcomm Zero-Day & More | HN65

   This week on Hacking News, we're covering five stories that all share one theme: the things we trust most are the things being targeted. Cisco disclosed two CVSS 10.0 vulnerabilities in their Secure Firewall Management Center — the centralized brain that manages entire firewall fleets — giving unauthenticated attackers root access. Pakistan-linked APT36 has turned AI coding tools into a malware assembly line, flooding Indian government networks with disposable "vibeware" variants in a strategy Bitdefender calls "Distributed Denial of Detection." Google dropped the largest Android security update in almost eight years — 129 vulnerabilities — including a Qualcomm zero-day already under targeted exploitation across 234 chipsets. A China-linked threat cluster called UAT-9244 is burrowing into South American telecom infrastructure with three brand-new malware families spanning Windows, Linux, and edge devices. And LexisNexis confirmed a cloud breach after a threat actor exploited an unpatched React app and found the database password was... Lexis1234. ⏱️ Timestamps 0:00 — Cold Open: What do you call a hackable firewall manager? 1:21 — Welcome & CTA 2:01 — Story 1: Cisco Secure FMC — Two CVSS 10.0 Vulnerabilities (CVE-2026-20079 & CVE-2026-20131) 5:33 — Story 2: APT36 "Vibeware" — AI-Generated Malware at Industrial Scale 9:13 — Story 3: Google Android March 2026 — 129 Patches + Qualcomm Zero-Day (CVE-2026-21385) 12:34 — Story 4: UAT-9244 / FamousSparrow — China-Linked APT Hits South American Telecoms 16:26 — Story 5: LexisNexis Cloud Breach — React2Shell, Weak Passwords, Gov Data 20:14 — Recap & Key Takeaways 22:40 — Outro 🔑 Key Takeaways Network security appliances are high-value targets. The Cisco FMC vulnerabilities follow the same pattern as the SD-WAN disclosure — if the management plane is compromised, everything downstream is at risk. AI is changing the economics of malware, not the sophistication. APT36's vibeware shows the real threat is volume, not brilliance. Detection teams may need to rethink approaches for floods of low-quality polyglot variants. Mobile patching remains the ecosystem's Achilles' heel. 129 Android vulnerabilities, including an exploited Qualcomm zero-day across 234 chipsets. Google releases patches; manufacturers control the timeline. Telecom targeting is not slowing down. UAT-9244 demonstrates continued investment in multi-platform telecom compromise toolkits — Windows, Linux, and edge devices simultaneously. P2P C2 and ORB expansion make detection exceptionally difficult. Cloud security basics still matter more than anything. The LexisNexis breach wasn't a zero-day — it was an unpatched app, an overly permissive IAM role, and a weak password. Fundamentals remain the most impactful things any organization can do. 📚 Sources Story 1 — Cisco FMC: Cisco Advisory: cisco-sa-onprem-fmc-authbypass-5JPp45V2 Cisco Advisory: cisco-sa-fmc-rce-NKhnULJh The Stack — "Two CVSS 10s in Cisco firewall management found internally" Security Affairs — "Cisco fixes maximum-severity Secure FMC bugs" Singapore CSA: Alert AL-2026-021 Story 2 — APT36 Vibeware: Bitdefender — "APT36: A Nightmare of Vibeware" Dark Reading — "Nation-State Actor Embraces AI Malware Assembly Line" HackRead — "Pakistan-Linked APT36 Floods Indian Govt Networks" SC Media — "AI-generated vibeware spread in new APT36 campaign" Story 3 — Android March 2026: Google Android Security Bulletin — March 2026 CyberScoop — "Google addresses actively exploited Qualcomm zero-day" The Hacker News — "Google Confirms CVE-2026-21385" SecurityWeek — "Android Update Patches Exploited Qualcomm Zero-Day" CISA KEV Catalog — CVE-2026-21385 Story 4 — UAT-9244: Cisco Talos — "UAT-9244 targets South American telecommunication providers" BleepingComputer — "Chinese state hackers target telcos with new malware toolkit" The Hacker News — "China-Linked Hackers Use TernDoor, PeerTime, BruteEntry" Story 5 — LexisNexis: BleepingComputer — "LexisNexis confirms data breach as hackers leak stolen files" The Register — "LexisNexis Legal & Professional confirms data breach" SecurityWeek — "New LexisNexis Data Breach Confirmed" The Record — "LexisNexis says hackers accessed legacy data" Cybernews — "Hackers claim LexisNexis breach exposing 400K users" ⚠️ The content presented by Exploit Brokers by Forgebound Research is for educational and informational purposes only. Cipherceval is a cybersecurity educator and commentator — not your personal security consultant, legal counsel, or professional advisor. The information shared here reflects publicly available research, industry reporting, and the host's personal perspective. It does not constitute professional security consulting or individualized guidance for your specific environment. Always consult with qualified professionals for decisions affecting your systems and security posture.

2. 

   12 Mar 2026

   Cisco & Dell CVSS 10.0 Exploited for YEARS, Claude AI Jailbroken, ScarCruft Jumps Air Gaps | HN64

   Two perfect CVSS 10.0 scores in one news cycle. A state-sponsored actor living inside Cisco's SD-WAN platform since 2023. A brand-new lateral movement technique called "Ghost NICs" that leaves no forensic trace. An AI chatbot jailbroken to steal 195 million government records. A North Korean hacking group bridging air-gapped networks with USB drives and an embedded Ruby runtime. And a phishing platform so sophisticated it makes your multi-factor authentication functionally useless. This is Hacking News Episode 64 from Exploit Brokers by Forgebound Research. Five stories, multiple nation-state actors, and some genuinely novel attack techniques. Let's get into it. 🕐 TIMESTAMPS 0:00 — Cold Open 1:12 — Welcome & CTA 1:55 — Story 1: Cisco SD-WAN Zero-Day (CVE-2026-20127, CVSS 10.0) — Five Eyes Response 6:55 — Story 2: Dell RecoverPoint Zero-Day (CVE-2026-22769, CVSS 10.0) — Ghost NICs 11:35 — Story 3: Claude AI Jailbreak — 195 Million Mexican Government Records 15:27 — Story 4: ScarCruft Air-Gap Bridging — "Ruby Jumper" Campaign 19:55 — Story 5: Starkiller Phishing-as-a-Service — MFA Bypass 25:02 — Recap & 5 Key Takeaways 27:28 — Outro 📚 SOURCES Story 1 — Cisco SD-WAN: Cisco Advisory cisco-sa-sdwan-rpa-EHchtZk — https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-rpa-EHchtZk CISA Emergency Directive 26-03 — https://www.cisa.gov/emergency-directive-26-03 ASD-ACSC Hunt Guide — https://www.cyber.gov.au/ BleepingComputer — https://www.bleepingcomputer.com/ The Hacker News — https://thehackernews.com/ Dark Reading — https://www.darkreading.com/ SecurityWeek — https://www.securityweek.com/ Story 2 — Dell RecoverPoint: Google Cloud / Mandiant GTIG Report — https://cloud.google.com/blog/topics/threat-intelligence/ Dell Security Advisory DSA-2026-079 — https://www.dell.com/support/kbdoc/en-us/000426742/ CISA Known Exploited Vulnerabilities Catalog — https://www.cisa.gov/known-exploited-vulnerabilities-catalog The Hacker News — https://thehackernews.com/ SecurityWeek — https://www.securityweek.com/ CyberScoop — https://cyberscoop.com/ Story 3 — Claude AI Jailbreak: Bloomberg (Feb 25, 2026) — https://www.bloomberg.com/ VentureBeat — https://venturebeat.com/ Gambit Security Research — https://gambitsecurity.com/ Story 4 — ScarCruft Ruby Jumper: Zscaler ThreatLabz Report (Feb 27) — https://www.zscaler.com/blogs/security-research/ The Hacker News — https://thehackernews.com/ BleepingComputer — https://www.bleepingcomputer.com/ Story 5 — Starkiller PhaaS: Krebs on Security — https://krebsonsecurity.com/ Abnormal AI Technical Analysis — https://abnormalsecurity.com/blog/ Dark Reading — https://www.darkreading.com/ Infosecurity Magazine — https://www.infosecurity-magazine.com/ ⚠️ DISCLAIMER The content presented by Exploit Brokers by Forgebound Research is for educational and informational purposes only. Cipherceval is a cybersecurity educator and commentator — not your personal security consultant, legal counsel, or professional advisor. The information shared here reflects publicly available research, industry reporting, and the host's personal perspective. It does not constitute professional security consulting or individualized guidance for your specific environment. Always consult with qualified professionals for decisions affecting your systems and security posture. 🔔 Subscribe for weekly cybersecurity news and analysis. 👍 Like if this episode was helpful. 🔗 Share with your team — awareness is the first line of defense. #cybersecurity #hackernews #exploitbrokers #cipherceval #infosec #cisco #sdwan #cve #zerodday #ghostnics #dell #recoverpoint #claudeai #jailbreak #scarcruft #northkorea #airgap #starkiller #phishing #mfa #fido2 #passkeys #fiveeyes #cisa #threatintelligence #apisecurity #cyberthreat #nationstatehacking #databreach

3. 

   5 Mar 2026

   600 Firewalls Breached by AI in 5 Weeks — Plus Chrome Zero-Day, CVSS 9.9 RCE & AI-Powered Malware | HN63

   AI is reshaping both sides of the cybersecurity battlefield — and fast. In this episode, we break down five stories that prove it: the first Chrome zero-day of 2026 (CVE-2026-2441), a near-perfect CVSS 9.9 in Microsoft's Semantic Kernel SDK (CVE-2026-26030), a supply chain attack on AI coding assistant Cline that silently installed autonomous agents on thousands of developer machines, the first-ever Android malware using Google's Gemini AI at runtime (PromptSpy), and a Russian-speaking threat actor who used commercial AI tools to breach over 600 FortiGate firewalls across 55 countries in just five weeks. Whether you're a developer, security professional, or just someone who uses a browser — this one's worth your time. 🔔 Subscribe and hit the bell so you don't miss an episode! 🎧 Also available on Spotify, Apple Podcasts, and wherever you get your pods. --- ### ⏱️ Timestamps 0:00 — Hook: AI Is Reshaping Cybersecurity 1:08 — Welcome & CTA 1:49 — Story 1: Chrome Zero-Day CVE-2026-2441 (CVSS 8.8) 5:15 — Story 2: Microsoft Semantic Kernel RCE CVE-2026-26030 (CVSS 9.9) 7:58 — Story 3: Cline CLI Supply Chain Attack — OpenClaw Installed on 4,000 Machines 14:35 — Story 4: PromptSpy — First Android Malware Using Gemini AI 20:15 — Story 5: 600 FortiGate Firewalls Breached via AI-Assisted Campaign 25:57 — Recap & Key Takeaways 28:46 — Outro --- ### 📰 Story Summaries **Story 1 — Chrome Zero-Day: CVE-2026-2441 (CVSS 8.8)** Google patched the first actively exploited Chrome zero-day of 2026 on February 13th. It's a use-after-free vulnerability in Chrome's CSS engine — specifically in the CSSFontFeatureValuesMap implementation — caused by an iterator invalidation bug. An attacker can craft a malicious HTML page to achieve arbitrary code execution inside Chrome's sandbox. Reported by researcher Shaheen Fazim on Feb 11, patched two days later. Affects ALL Chromium-based browsers: Chrome, Edge, Brave, Opera, Vivaldi. Patched in Chrome 145.0.7632.75/76 (Win/Mac) and 144.0.7559.75 (Linux). **Story 2 — Semantic Kernel RCE: CVE-2026-26030 (CVSS 9.9)** A critical remote code execution vulnerability in Microsoft's Semantic Kernel Python SDK — specifically in the InMemoryVectorStore filter functionality. CWE-94: Improper Control of Code Generation. Network-accessible with low attack complexity, low privilege required, and zero user interaction needed. If you're building AI applications with RAG, AI agents, or semantic search using Semantic Kernel, this one hits close to home. Patched in python-1.39.4. Microsoft's workaround: avoid using InMemoryVectorStore in production until patched. **Story 3 — Cline Supply Chain Attack** On February 17, 2026, someone compromised Cline's npm publish token and pushed a malicious update (Cline CLI v2.3.0) that silently installed OpenClaw — a self-hosted autonomous AI agent — on every developer machine that pulled the update. The attack chain started when researcher Adnan Khan discovered a prompt injection vulnerability in Cline's AI-powered GitHub issue triage bot. The attacker used GitHub Actions cache poisoning to pivot from the triage workflow to the release pipeline, leaking npm publication credentials. Cline patched the prompt injection within 30 minutes but rotated the wrong token. Eight days later, the still-valid token was used to publish the compromised package. It was live for ~8 hours and downloaded roughly 4,000 times. Fixed in v2.4.0; publishing moved to OIDC via GitHub Actions. **Story 4 — PromptSpy: First Android Malware Using Generative AI at Runtime** ESET researchers discovered PromptSpy — the first known Android malware to use Google's Gemini AI model during its execution flow. Traditional Android malware relies on hardcoded tap coordinates and UI selectors that break across different devices. PromptSpy solves this by taking an XML dump of the current screen and sending it to Gemini, which returns JSON instructions telling the malware exactly where to tap. It uses this loop to pin itself in the recent apps list, persisting across reboots. Primary payload: a built-in VNC module for full remote device access. Also captures lockscreen PINs, records unlock patterns as video, and blocks uninstallation with invisible overlays. Distributed via a site impersonating JPMorgan Chase targeting Argentina. Chinese language strings found in codebase. Not on Google Play; Google Play Protect detects known variants. **Story 5 — 600 FortiGate Firewalls Breached via AI-Assisted Campaign** Amazon Threat Intelligence revealed a Russian-speaking, financially motivated threat actor used multiple commercial AI tools to compromise 600+ FortiGate firewall devices across 55 countries in just 5 weeks (Jan 11–Feb 18, 2026). No zero-days — just exposed management interfaces and weak credentials with single-factor auth. The attacker extracted full device configs (SSL-VPN creds, network topology, IPsec settings), then fed that data into a custom system called ARXON that queried LLMs including DeepSeek and Claude to generate attack plans. Post-exploitation included DCSync attacks against Active Directory, lateral movement via pass-the-hash and pass-the-ticket, NTLM relay attacks, and targeting of Veeam Backup servers — consistent with ransomware preparation. No ransomware was actually deployed. The attacker's staging server (212[.]11[.]64[.]250) was publicly accessible, exposing AI-generated attack plans and victim configs. As Amazon CISO CJ Moses put it: organizations need to anticipate that AI-augmented threat activity will continue to grow from both skilled and unskilled adversaries. --- ### 📋 Key Takeaways 1. **Update your browsers.** Chrome's first zero-day of 2026 is patched (CVE-2026-2441). A crafted web page is all it takes. This applies to Chrome, Edge, Brave, and every Chromium-based browser. 2. **AI development tooling is now a high-value target.** A CVSS 9.9 in Microsoft's Semantic Kernel and a supply chain attack on Cline — if you're building with AI tools, their security is now part of your threat model. 3. **Supply chain security isn't just about dependencies — it's about your CI/CD pipeline.** The Cline attack started with a GitHub issue title that manipulated an AI triage bot. If you're using AI automation in build pipelines, treat those AI agents as privileged actors that need governance. 4. **AI is being weaponized on both sides.** PromptSpy uses Gemini for malware persistence; the FortiGate campaign used AI to generate attack plans and execute tools autonomously. This is operational, not theoretical. 5. **Fundamentals still win.** Six hundred firewalls breached — not with zero-days, but with weak passwords and exposed management interfaces. MFA, credential hygiene, network segmentation, and patching remain the most effective defenses. --- ### 📚 Sources **Story 1 — Chrome Zero-Day (CVE-2026-2441)** - The Hacker News: https://thehackernews.com/2026/02/new-chrome-zero-day-cve-2026-2441-under.html - BleepingComputer / Malwarebytes: https://www.malwarebytes.com/blog/news/2026/02/update-chrome-now-zero-day-bug-allows-code-execution-via-malicious-webpages - Help Net Security: https://www.helpnetsecurity.com/2026/02/16/google-patches-chrome-vulnerability-with-in-the-wild-exploit-cve-2026-2441/ - The Register: https://www.theregister.com/2026/02/16/chromes_zeroday/ - SOCRadar: https://socradar.io/blog/cve-2026-2441-chrome-0-day-sandbox-code-execution/ - Google Chrome Release Blog: https://chromereleases.googleblog.com **Story 2 — Semantic Kernel RCE (CVE-2026-26030)** - GitHub Security Advisory: https://github.com/microsoft/semantic-kernel/security/advisories/GHSA-xjw9-4gw8-4rqx - NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-26030 - The Hacker Wire: https://www.thehackerwire.com/vulnerability/CVE-2026-26030/ **Story 3 — Cline Supply Chain Attack** - The Hacker News: https://thehackernews.com/2026/02/cline-cli-230-supply-chain-attack.html - The Register: https://www.theregister.com/2026/02/20/openclaw_snuck_into_cline_package - Dark Reading: https://www.darkreading.com/application-security/supply-chain-attack-openclaw-cline-users - Snyk (Clinejection Analysis): https://snyk.io/blog/cline-supply-chain-attack-prompt-injection-github-actions/ - Endor Labs: https://www.endorlabs.com/learn/supply-chain-attack-targeting-cline-installs-openclaw - Adnan Khan's Research: https://adnanthekhan.com/2026/02/09/clinejection/ **Story 4 — PromptSpy Android Malware** - ESET / WeLiveSecurity: https://www.welivesecurity.com/en/eset-research/promptspy-ushers-in-era-android-threats-using-genai/ - The Hacker News: https://thehackernews.com/2026/02/promptspy-android-malware-abuses-google.html - BleepingComputer: https://www.bleepingcomputer.com/news/security/promptspy-is-the-first-known-android-malware-to-use-generative-ai-at-runtime/ - SecurityWeek: https://www.securityweek.com/promptspy-android-malware-abuses-gemini-ai-at-runtime-for-persistence/ - ESET Press Release: https://www.eset.com/us/about/newsroom/research/eset-research-discovers-promptspy-first-android-threat-using-genai/ **Story 5 — FortiGate AI-Assisted Campaign** - Amazon / AWS Security Blog: https://aws.amazon.com/blogs/security/ai-augmented-threat-actor-accesses-fortigate-devices-at-scale/ - The Hacker News: https://thehackernews.com/2026/02/ai-assisted-threat-actor-compromises.html - BleepingComputer: https://www.bleepingcomputer.com/news/security/amazon-ai-assisted-hacker-breached-600-fortigate-firewalls-in-5-weeks/ - The Record: https://therecord.media/gen-ai-fortigate-hackers-russia - SecurityWeek: https://www.securityweek.com/hundreds-of-fortigate-firewalls-hacked-in-ai-powered-attacks-aws/ - Security Affairs: https://securityaffairs.com/188351/hacking/ai-powered-campaign-compromises-600-fortigate-systems-worldwide.html --- ### ⚖️ Disclaimer The content presented by Exploit Brokers by Forgebound Research is for educational and informational purposes only. Cipherceval is a cybersecurity educator and commentator — not your personal security consultant, legal counsel, or professional advisor. The information shared here reflects publicly available research, industry reporting, and the host's personal perspective. It does not constitute professional security consulting or individualized guidance for your specific environment. Always consult with qualified professionals for decisions affecting your systems and security posture.

Reach and audience

Public platform figures. Ratings count people who left a rating, not total listeners.

Apple Podcasts (US)

5.0 / 5

7 ratings

Podcast Authority Score: 34 / 100

A composite of feed quality, social presence, YouTube performance and engagement. Read the methodology.

Quality

35

Social presence

0

YouTube

0

Engagement

84

Contact Exploit Brokers - Tech and Hacking News Commentary

Guest appearances

Does not typically book guests

Based on episode analysis; this does not confirm that the show is currently accepting guests.