Do Son A Windows HTTP.sys vulnerability, CVE-2026-62735 (CVSS 7.8), now has public details and a PoC. It escalates local users to SYSTEM. Patch now.
Pwn2Own
Security researchers released technical details and PoC code for CVE-2026-62911, a critical Exchange Server pre-auth RCE flaw.
A 3-flaw chain (CRLF, Auth Bypass, SQLi) achieves root RCE on Synology BeeStation. The exploit uses a "Dirty File Write" SQLi to inject a malicious crontab entry, bypassing the lack of a PHP interpreter.
Critical Synology BeeStation Zero-Day (CVE-2025-12686) Found at Pwn2Own Allows Remote Code Execution
Critical Synology BeeStation Zero-Day (CVE-2025-12686) Found at Pwn2Own Allows Remote Code Execution
Synology patched a Critical (CVSS 9.8) RCE zero-day flaw (CVE-2025-12686) in BeeStation OS. The vulnerability, found during Pwn2Own, allows remote attackers to execute arbitrary code. Update to v1.3.2-65648.
QNAP patched 7 zero-day flaws in QTS/QuTS hero and apps (HBS 3, Malware Remover) after being hacked by researchers at Pwn2Own Ireland 2025. Update urgently.
Broadcom has released urgent patches for four critical (CVSS up to 9.3) VMware vulnerabilities affecting ESXi, Workstation, and Fusion, allowing host code execution.
Pwn2Own Berlin saw VMware ESXi and Windows 11 compromised, along with Firefox. Researchers earned over $1M for 30+ zero-day exploits.
Firefox was compromised at Pwn2Own using JavaScript zero-day exploits. Learn the details of the out-of-bounds write and integer overflow vulnerabilities.
CVE-2024-10442 allows unauthenticated RCE on Synology DS1823xs+ via Replication Service flaw. Patch now to avoid exploit risk.
Stay informed about CVE-2025-23116: a critical vulnerability in UniFi Protect that could compromise user device security.
Discover the details of a thrilling exploit at Pwn2Own Ireland 2024. Learn about the CVE-2024-50387 vulnerability and how it allowed hackers to gain control of a QNAP TS-464 NAS device.
The most severe vulnerability (CVE-2024-39349) was a classic buffer overflow in the libjansson component, which could enable RCE
On the competition's inaugural day, security researchers successfully breached the Samsung Galaxy S23 phone twice
In addition to Ubuntu, Tesla's vulnerabilities were also spotted by many hackers in the Pwn2Own Vancouver 2022 competition