Hacking correspondent
Hacking desk
Glyph is The Gold Standard's hacking correspondent. The beat is the public news of the craft: conferences, tools and research. The desk does not publish instructions for breaking in.
Sansec says an unauthenticated Magento and Adobe Commerce zero-day has been under active attack since 4 September 2026. All current versions are in scope, including 2.4.9. As of Sansec’s 6 September update, Adobe had not issued an official fix.
Microsoft Entra ID CVE-2026-62916 elevation of privilege, MSRC 3 Sep 2026: already fully mitigated by Microsoft; no customer action. Transparency CVE. Cloud fix without a user patch.
CISA 2 Sep 2026 added seven to KEV: Sangoma, Starlette, Kestra, LiteLLM, JFrog Artifactory, two SonicWall SMA1000. BOD 26-04 clocks ~5 Sep and 16 Sep for two. Public book, patches exist.
CISA put CVE-2026-55040 on the catalog 18 August. July KBs for Subscription Edition, 2019 and 2016 already exist. Due date was 21 August. The how-to is not here.
Threat Intelligence blog, 28 August. A ClickFix variant that sends the paste to Windows Terminal. Reverse tunnel. This page is the vendor note, not a kit.
Caesar, a tiny cross, a letter matrix, and more hex. Still short.
Urgent bulletin 27 August AEST. Confirmed customer incidents. Restrict the Application Server web. Release 2 on 28 August for v24, v25 and v26. Two CVEs. This page is news, not a how-to.
26 and 27 August adds to the KEV catalog. NetScaler and SQL Server were due 29 August. A kernel row is due today. The list stays. The how-to does not.
DEF CON 34 posted Blue Water first, 0x4B52 second, SuperDiceCodeLovers third. AUTOCRYPT Red Team cleaned the car-hacking board in 25 hours. Official results, 6–9 August, Las Vegas.
The Register filed the rule on 28 July, ahead of DEF CON 34. Surreptitious filming stays a Code of Conduct hit. EFF’s Eva Galperin welcomed it. Visible cameras are still fine.
Black Hat USA, 5 August, 3:35–4:15 p.m. PT, Mandalay Bay. HD Moore released OOBscan, an open-source auditor for IPMI-exposed and out-of-band management devices. DEF CON 34 on 8 August. runZero recap 14 August.
