HAIJA INTEL REPORT

Adversaries are exploiting cloud services and open-source supply chains to launch large-scale attacks. ‍ How do you defend? We're diving deeper with @wiz_io during the final session of our M-Trends 2026 Virtual Series. Register: https:// goo.gle/4qdw4kF

some of the craziest shit ive seen while also simultaneously being the simplest shit ive ever seen New exploit: “xor dword [0xf80c2094], 1<<22” Unlocks CPU microcode, the platform security processor, system management mode, and every internal processor register, all at once, on 1

Not every vulnerability arrives with a CVE. Zero-days, emerging supply chain issues, and proprietary software risks can demand validation before standardized detection content exists. Custom Sensor Scanning in Falcon Exposure Management gives organizations the

Your browser is a C2 agent waiting to happen. @KingOfTheNOPs shows how to silently sideload a Chromium extension, no prompts or GUI, and turn Chrome/Edge into a persistent implant with SOCKS, cookie theft, and OS access. Read more

New advisory: CVE-2026-12003 Bishop Fox found a Windows-specific Python vulnerability affecting versions 3.11 - 3.15 that can allow local privilege escalation under the right conditions.

Cybersecurity is a team sport, and the best solutions often come from a mix of perspectives. Check out the latest Threat Source newsletter to hear William reflect on making Hazel a hacker: https:// cs.co/6017B1Oskx

This week on Hacktics and Telemetry, @fulmetalpackets & @_CryptoCat are joined by @stephenfewer to take you behind the scenes of Pwn2Own - the world's premier 0-day competition. Video on YouTube: https:// r-7.co/3TUAot6 Audio on Spotify: https:// r-7.co/4cBHMQo

Every organization has debt. Unpatched code. Governance that never caught up. Skills pipelines quietly hollowed out. For years, that debt was manageable. Exploitation was expensive. But not anymore. AI made exploitation cheap and the bills are due. https:// okt.to/8pArLt

Agents don't know what's out of scope. They just know they haven't hit the goal yet. @ehrishiraj joined Application Security Weekly to talk about what keeps AI pentesters on task prompts help, but environmental boundaries, classifiers, and step limits do the real work. If