cKure Red

Update: Archivegenocide has now crossed 200,000 videos & images, which is almost triple what we started with. We have added our own AI, 'Iris' to our main website- she can help you locate more footage, related info, and details about each video. Update includes: 33,145 New videos & images Iris intigrated into search bar / main page Every video now includes related footage and node map info. Smaller bug and UI fixes for the Node map You can test it out here: Archivegenocide.com

reported a chrome fullchain (web -> shell) on pixel 10 to google. got a 9.6 cve (cve-2026-87464) and a fix in chrome.

now they bend the rules and refuse to pay the fullchain bonus bc one of the vulns in the chain was an unpatched nday. total payout: $2.5k. despite cve + shell :|

Security researchers from the University of California San Diego and Oberlin College recently presented a prototype device that could hack a Boeing 737 in less than a minute. Their aim was to expose a blind spot in aviation security and to show how physical access hacking represents a practical threat. In a statement to WIRED, Boeing downplayed that threat. “Our technical experts are confident that the layers of protection in place on the airplane, including within the system design and the operating environment, provide sufficient mitigation to significantly limit the feasibility and risk of real-world attacks.” The researchers say, Boeing hasn't told them about any technical fix for the vulnerabilities they've discovered. That lack of an immediate security update for planes shouldn't be cause for panic or grounding aircraft, the security researchers wrote in their paper. “All of the authors of this paper routinely travel on Boeing 737 aircraft and expect to continue doing so,” the introduction of the paper reads. Words: Andy Greenberg Video Producer: Tamanna Sajeed

On Friday the Minns government introduced legislation letting police plug your phone into military-grade Israeli extraction tech, the same UFED devices used by ICE, and copy everything. Contacts, messages, photos, even deleted files, in minutes. Refuse your PIN and they can brute force it anyway. It also lets them pull unredacted toll camera images into the national facial recognition database, search your device without a warrant, and override your right against self-incrimination.

https://depthfirst.com/research/going-depthfirst-achieving-gitlab-rce-via-two-ruby-memory-corruption-vulnerabilities

https://github.com/wupco/gitlab-rce-demo/tree/main

https://depthfirst.com/gitlab-rce-oj-spill

https://x.com/i/status/2080763568044290535

The REST batch endpoint builds two parallel arrays ($matches and $validation) that fall out of step when a sub-request path fails wp_parse_url(). A sub-request gets dispatched under a different handler's context. The PoC nests this route confusion twice: first to bypass the method allow-list, then to reach a blind SQL injection via author_exclude in WP_Query, which interpolates the value into SQL as a string.

boolean/time-based blind SQLi → extract admin password hash → crack → plugin upload → command execution. Interactive shell included.

Affects WordPress 6.9.0–6.9.4 and 7.0.0–7.0.1. Fixed in 6.9.5 and 7.0.2. Python 3.8+, zero dependencies.

block /wp-json/batch/v1 and rest_route=/batch/v1 at the edge, or require auth via rest_pre_dispatch filter.

https://www.bitdefender.com/en-us/blog/businessinsights/bind-link-abuses-windows-feature-edr-evasion-technique

https://x.com/i/status/2078016406856282445