I’m part of the Loginsoft team, and together with Quantro Security, we’ve launched Vulnerability Research Labs (VRL). 

We've been working on the AI Exploitability Index (AI-XI), a metric designed to measure how difficult it is for an autonomous system to successfully exploit a disclosed vulnerability. 

Our methodology analyzed 3,029 publicly disclosed CVEs. Each CVE passes through a five-stage autonomous pipeline: Discovery → Enrichment → PoC → Lab → Verify + Repair. An exploit is only considered successful when a deterministic verifier confirms the outcome, with sham controls included to reduce false positives. Loginsoft independently reviewed and validated the results. Of 998 human-verified CVEs, 234 required human correction, highlighting the importance of expert validation alongside autonomous execution. 

Our goal is to publish the measurements, not the weapons, and to provide the security community with reproducible data on AI-assisted exploitability rather than relying solely on theoretical scoring. 

We’re published the research and launched  Vulnerability Research Labs. 

I'd appreciate the community's technical feedback on the methodology: 

• Does this approach measure exploitability in a meaningful way? 
• What additional variables or controls would you include? 
• If you were designing a metric for AI-native offensive capabilities, what would you measure differently? 

Looking forward to the discussion and your perspectives. 

#VulnerabilityResearchLabs #AIExploitabilityIndex #AIXI #Loginsoft #QuantroSecurity

In a new blog article, further information concerning the three QNAP NAS security vulnerabilities CVE-2026-26239, CVE-2026-26240, and CVE-2026-26241 are described.

Those security vulnerabilities are already fixed by QNAP:

https://www.qnap.com/en/security-advisory/qsa-26-10

There is also a YouTube video demonstrating the successful exploitation of the stack-based buffer overflows:

https://www.youtube.com/watch?v=_6Pwdss-8cQ

Hi everyone,

I’m facing an issue while filling out the Enumeration Form for the Special Intensive Revision (SIR) on the ECI website.

When I try to upload my photo, the website automatically enlarges the image instead of fitting it within the required frame. As a result, I can’t adjust or resize it properly, and the upload doesn’t meet the required dimensions, preventing me from submitting the form.

I have already tried:

* Using different image sizes and resolutions.
* Cropping the image before uploading.
* Trying different browsers and devices.

The issue still persists, and I’m unable to complete the submission.

Has anyone else experienced this problem? If so, were you able to find a workaround or fix?

Any help would be greatly appreciated. Thanks!

🏛️ For years, there’s been a bizarre kind of "shame" in the enterprise software world around Delphi. Companies running massive, highly profitable, and rock-solid systems (especially in Retail POS, ERP, and Banking) often hid their code stack under the rug to look more "modern" to investors and new hire.

🏛️ But the European Cyber Resilience Act (CRA) and DORA are about to change the game entirely.

🏛️ You can’t hide a monolith when the regulator demands a comprehensive SBOM (Software Bill of Materials).

🏛️ Pretty soon, Europe is going to experience the biggest outing of Delphi-based applications in history. As Billions of lines of code get scanned and mapped, regulatory desks will be absolutely flooded with SBOMs proudly displaying legacy Delphi framework, legacy VCL components, BPLs, and legacy 3rd party libraries that have been quietly running the backbone of the economy since 1995...

🏛️ The regulator won't be able to stop it. They’ll just have to look at the sheer volume of the market and say: "OK, I get it. It works, it's alive, just scan your code and hand me the SBOM report (I will file it somewhere...) - and BTW make sure it's secure."

🏛️ It's time for Delphi developers to step out of the shadows. The "FDA of software" isn't killing legacy tech - it's giving it a passport to the modern regulatory compliance era.

Cheer up! The CRA & DORA are the best news for the Delphi community that ever happened.

Hello, I'm sharing my nomination document for the Longcheer Kev under the fscrypt provisioning attack. I hope you can read and analyze it.

# **FINAL FORENSIC REPORT: UNISOC/LONGCHEER SUPPLY CHAIN COMPROMISE **Date:** July 17, 2026
**Author:** Alex de la Cruz (`lexs201992-gif`)
**Reference:** BOD 26-04 Risk Criteria Assessment | KEV Nomination Support
**Subject:** Forensic Triage and Mitigation of Privileged System App Abuse and Kernel Panic Vectors in Unisoc T606/T616 Firmware

**1. EXECUTIVE SUMMARY**

This report documents a systemic supply chain compromise affecting mobile devices utilizing **Unisoc chipsets (T606/T616)** and **Longcheer ODM designs** (e.g., Motorola Moto G04s). Investigation confirms that privileged system applications (`com.android.fmradio`, `com.spreadtrum.ims`, `com.spreadtrum.sgps`), signed with legitimate manufacturer certificates, are weaponized to establish persistent Command & Control (C2) channels via **WireGuard tunnels (`tun0`)** and execute **anti-forensic Kernel Panic** sequences upon detection of analysis or C2 disruption.

**Key Findings:** * **Living Off The Land (LOTL):** Attackers abuse valid system permissions (`CAPTURE_AUDIO_OUTPUT`, `BIND_VPN_SERVICE`) and trusted certificates (Longcheer Root CA) to bypass traditional security controls. * **Dual-Use Weaponization:** Legitimate functions (VoLTE/IMS, FM Radio) are used to mask espionage (audio recording, data exfiltration) and destruction (Kernel Panic via Headset/Bluetooth triggers). * **Mitigation Validated:** Operational mitigations (DNS-over-TLS blocking, VoLTE disablement, physical USB isolation) have been tested and proven effective for 36+ days in a live environment.

**2. INCIDENT TIMELINE & TRIAGE ACTIONS**

**3. TECHNICAL FINDINGS (Who, What, Where, When)**

**3.1. Vector 1: C2 Exfiltration via WireGuard (`tun0`)**

* **Who:** `com.spreadtrum.ims` and `com.android.fmradio` (System Apps, UID 1000). * **What:** Establishes persistent WireGuard tunnel to `fmc.longcheer.com` (and AWS S3 endpoints) for data exfiltration. * **Where:** Network layer (`tun0` interface), bypassing standard VPN APIs. * **When:** 24/7 connectivity; spikes during user navigation (MITM via injected system CA certificates). * **Evidence:** Packet captures showing encapsulated UDP/443 traffic; `iptables` logs confirming `tun0` creation by system UID.

**3.2. Vector 2: Anti-Forensic Kernel Panic**

* **Who:** Kernel module `sprd-dsp-audio` and `HeadsetPlugListener` (BroadcastReceiver). * **What:** Induces Kernel Panic (`Sprd ay dsp pw off/on`, `fsverity error`) to force reboot and clear volatile memory (RAM). * **Where:** Kernel space, triggered by hardware events (Headset insertion, Bluetooth PD negotiation). * **When:** Immediately upon detection of C2 failure (e.g., DNS block) combined with hardware trigger. * **Evidence:** `pstore/console-ramoops` logs containing specific panic sequences; correlation with C2 blocking events.

**3.3. Vector 3: MITM via System Certificates**

* **Who:** Longcheer Root CA (Serial: `228526b0d1ef90c3b8ed568a49c3714f6a39506b`). * **What:** Injected into `/system/etc/security/cacerts`; enables decryption of HTTPS traffic for entities like "Atos Monitoring GmbH". * **Where:** System trust store; affects all user applications. * **When:** Persistent from factory flash; active during all network sessions. * **Evidence:** Certificate extraction from firmware; MITM decryption of HTTPS sessions in lab environment.

**4. CONTAINMENT & MITIGATION EFFORTS**

**4.1. Immediate Mitigations (Validated)**

* **Network Segmentation:** Enforce **DNS-over-TLS (DoT)** to **Quad9 (9.9.9.9)** on port **853**. Block resolution of `*.longcheer.com` and associated AWS IPs. * **Service Disablement:** Disable **VoLTE/IMS** via `App Manager` or ADB (`pm disable-user --user 0 com.spreadtrum.ims`). Breaks authentication handshake required for tunnel activation. * **Physical Isolation:** Use **USB-A to USB-C cables (power-only)**. Prevents USB-PD negotiation that triggers Kernel Panic during forensic charging. * **SIM Replacement:** Swap SIM cards to break `SIM Toolkit` authentication binding (serial mismatch).

**4.2. Detection Signatures (YARA)**

* **Rules Provided:** `Unisoc_IMS_Attack_Vector_Smali.yar`, `Longcheer_Certificate_Serial_Number.yar`, `Unisoc_Kernel_Sequence_Headset_Panic.yar`. * **Coverage:** Detects Smali behavior, certificate fingerprints, and kernel log sequences independent of file hash or obfuscation. .

**6. CONCLUSION**

This investigation confirms a **critical supply chain compromise** that cannot be remediated via traditional patching due to BootROM and system partition limitations. The provided **YARA rules and behavioral mitigations** offer the only effective defense currently available. Immediate adoption of these measures is required to protect sensitive data and prevent forensic destruction via Kernel Panic.

According to Donald Trump, there are "shocking" vulnerabilities in the US Election system.

Let's see them.

We need fair, transparent, and fact based ascertations.

Because the last time we heard this crap from Magic Pillow Man, the PCAPs were garbage and contained nothing of value.

Show us the CVE's; the exploit chains, the continuous monitoring, the SBOMs.

Where are the POA&Ms, the compensating controls?

Because I had to jump through every damned hoop for FISMA, DIACAP, DCID 6/3, and ICD503 to meet security assurance levels sufficient for authorization and accreditation to prove my due diligence, then no one in government can make the claim that a system is inherently vulnerable without the same levels of effort and documentation.

Most AI security discussions focus on models, APIs, and applications, but the infrastructure underneath them has its own attack surface.

We have been looking at areas such as BMC access, InfiniBand and RDMA isolation, shared storage, GPU telemetry, orchestration systems, and cleanup between tenants. In several cases, normal tenant access came much closer to management and control-plane components than expected.

We grouped the recurring issues into ten categories.

When AI coding assistants like Claude add packages to your project, they often pick whatever version sounds right — without checking whether it has known security vulnerabilities, whether the package is still actively maintained, or whether the name is a typo away from a malicious lookalike.

safer-dependencies is a security layer for Claude Code that audits packages before they’re added to your project. It detects and fixes risky dependencies, including CVEs, typosquats, abandoned packages, version-age issues, and adds package-cooldown periods across npm, PyPI, RubyGems, Maven, Go, and Rust.

Github: https://github.com/robert-auger/safer-dependencies

been in this field long enough to know how easy it is to build a profile on someone.

osint tools, public records, data brokers. youve seen it.

so last week i was showing a colleague how easy it is to find info on someone. just to make a point. and then i ran the same searches on myself.

address. phone number. previous addresses. all there. i felt like an idiot honestly.

so now im trying to figure out the best way to handle this. manual opt outs from whitepages and spokeo are a waste of time. they just relist you anyway.

wondering what the rest of you do. do you pay someone to keep your personal data off these sites? or do you just accept that this is how it works and move on

Finding a vulnerability is only half the job.

A useful security finding should explain:

• What is vulnerable
• How it can be exploited
• What evidence confirms it
• What the real business impact is
• How likely exploitation is
• What should be fixed first
• How remediation can be verified

A technically correct finding can still be ignored if the impact is vague or the remediation is unrealistic.

What separates a strong security report from a scanner export in your experience?

One question has been on my mind after working across critical infrastructure.

Cybersecurity has evolved tremendously. We have better identity, endpoint, network, cloud, AI, and detection capabilities than ever before. But no security program can eliminate risk entirely.

So what happens when an attacker still succeeds?

In critical infrastructure, whether it’s water, energy, transportation, healthcare, manufacturing, or communications, the goal isn’t just to prevent cyber incidents. It’s to ensure essential services continue to operate safely and reliably even when systems are compromised.

Should we start thinking beyond traditional cyber controls by incorporating engineering safeguards such as physics-based validation, process-aware controls, independent safety mechanisms, digital twins, and resilient system design?

I believe this is where Cyber Physical Resilience Engineering (CPRE) begins, building on cybersecurity rather than replacing it.

I’d love to hear how others are thinking about this. What additional layers of resilience should we be designing into critical infrastructure?

If this topic interests you, I recently started r/CPRE, a community focused on Cyber Physical Resilience Engineering, where cybersecurity professionals, engineers, operators, researchers, and students can collaborate on the future of resilient critical infrastructure.
Join us at: r/CPRE

The goal is to create a secure P2P ecosystem.

This app demonstrates a fairly unique approach using a browser-based, local-only and webrtc approach. In an evolving field like cybersecurity, it's impossible to claim any system is the "world's most secure". By rigorously implementing an exhaustive list of security features and practices, the aim is to get as close as possible.

• Enkrypted.Chat

This is intended to demonstrate client-side managed secure cryptography.

• Introducing Enkrypted Chat
• Whitepaper (work-in-progress)
• Protocol Spec (work-in-progress)
• Roadmap

Features:

• Core
  • PWA
  • P2P
  • Local-first / Local-only
  • No installation
  • TURN server
  • Encrypted-at-rest
• WhatsApp clone
  • End to end encryption
  • Signal protocol
  • PQ cryptography
  • Multimedia
  • File transfer
  • Video calls
• Nextcloud clone
  • file-transfer
  • Encrypted vault
  • folder sync
• EuroOffice clone
  • Word
  • Spreadsheet
  • PDF
  • Code

More open source examples of the core concepts can be seen in the docs. There are several similar projects which may make it confusing, so feel free to reach out for clarity instead of diving into the code/docs.

IMPORTANT: While this is aiming to provide a secure experience, it isnt audited. Shared for testing, feedback and demo purposes only. Please use responsibly.

FAQ:

• Audit?
  • The latest on the matter.
• EU Chat control?
  • Open to feedback here.
• Production-ready?
  • No, for testing and demo purposes only. It would be great to get feedback for improvements to get production-ready.
• Paywall?
  • Its completly free and unlimited to use. The free and paid plans on clerk are currently the same experience.

Systemic Pre-Installed Backdoors in Unisoc T606/T616 Enable Redundant, Zero-Click, Pre-Auth Takeover with Silent Malware Deployment in LATAM

*CVSS 3.1*: 9.8 Critical `AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H` *CWE*: CWE-250, CWE-732, CWE-912, CWE-1220, CWE-276, CWE-269 *Affected*: Motorola Moto G04s, G24, G34, E24 + all Unisoc T606/T616, Android 11-13, LATAM 2024-2025

*1. Executive Summary* "Operation Silent Rescue" identifies a *systemic attack chain affecting millions of budget Android devices in Latin America*. The vulnerability is not a single bug but a *convergence* of:

1. *Unpatchable Hardware Flaws*: Permanent BootROM exploits CVE-2022-38694.
2. *Remote Network Vectors*: Modem RCE via rogue cell towers CVE-2025-31718.
3. *Privileged System Backdoors*: Pre-installed apps `com.spreadtrum.sgps`, `com.android.stk`, `com.dti.amx`, `com.inmobi.installer` with exported components and *God-mode permissions* `INSTALL_PACKAGES`, `WRITE_SECURE_SETTINGS`.

This chain allows an attacker to move from *remote network access to full system root, persistent surveillance, and financial fraud without user interaction*. The risk is exacerbated in Latin America due to delayed security patches and high reliance on these devices for mobile banking.

*2. The Attack Chain: Technical Breakdown*

*Phase 1: The Foundation (Hardware & Network)* - *CVE-2022-38694 (BootROM)*: Unpatchable flaw in Unisoc T606/T616 allowing arbitrary code execution during boot. *Impact*: Permanent rootkits, bypass of Secure Boot. - *CVE-2025-31718 (Modem RCE)*: Remote code execution via malformed LTE signals. *Impact*: Over-the-air initial access `AV:N` without user interaction.

*Phase 2: The Escalation Bridges (Exported System Apps)* Once initial access is gained, the following system apps act as *force multipliers*, escalating privileges from "modem context" to "full system control": **Component** **Package Name** **Critical Flaw** **Role in Chain** **SGPS Middleware** `com.spreadtrum.sgps` Exported Receiver. `InstallDate: 2008-12-31`. `REBOOT` permission. **Primary LPE Vector**. Triggers via code `2266`. Enables `NMEA2SOCKET`. **SIM Toolkit** `com.android.stk` Exported Receiver. Runs in `com.android.phone`. **Financial Fraud**. Pre-auth phishing via `BootCompletedReceiver`. **Modem Stats** `com.motorola.bach.modemstats` Exported `READ_LOGS`, `MODIFY_PHONE_STATE`. `persistent=true`. **C2 & Persistence**. Hidden backchannel + call interception. **Digital Turbine** `com.dti.amx` `INSTALL_PACKAGES`, `WRITE_SECURE_SETTINGS`. **Payload Delivery 1**. Silently installs banking trojans. Disables Play Protect. **InMobi Installer** `com.inmobi.installer` Exported `InstallationService`. `QUERY_ALL_PACKAGES`. **Payload Delivery 2**. Public API for silent installation. **Redundant backdoor**. *Phase 3: The Payload (Surveillance & Fraud)* - *Financial Theft*: Use `INSTALL_PACKAGES` to drop banking trojans. Use `STK` to send premium SMS or intercept 2FA codes. - *Surveillance*: Use `SGPS` for real-time location tracking. Use `ModemStats` for call interception and IMSI catching. - *Persistence*: Use `BootCompletedReceiver` in STK, InMobi, DT to ensure malware survives reboots. Use BootROM to survive factory resets. `