Hacker News with Generative AI: Exploits

Critical hardcoded SolarWinds credential now exploited in the wild (theregister.com)
A critical, hardcoded login credential in SolarWinds' Web Help Desk line has been exploited in the wild by criminals, according to the US Cybersecurity and Infrastructure Security Agency, which has added the security blunder to its Known Exploited Vulnerabilities (KEV) Catalog.
Firefox and Tor hit with 9.8 critical level exploit (youtube.com)
Attacking UNIX Systems via CUPS (evilsocket.net)
Hello friends, this is the first of two, possibly three (if and when I have time to finish the Windows research) writeups. We will start with targeting GNU/Linux systems with an RCE. As someone who’s directly involved in the CUPS project said:
Jailbreak Your Enemies with a Link: Remote Execution on iOS (jacobbartlett.substack.com)
This is the story of the Trident exploit chain: 3 zero-day vulnerabilities in iOS that enabled the first remote jailbreak. Part #1 dives into the internals of the JavaScriptCore runtime: where a vulnerability lurks in WebKit which would crack your iPhone wide open.
CVE-2024-29510 – Exploiting Ghostscript using format strings (codeanlabs.com)
Iconv, set the charset to RCE: Exploiting the glibc to hack the PHP engine (ambionics.io)
Unauthenticated, RCE vulnerability in Palo Alto firewalls, exploits in the wild (paloaltonetworks.com)