SecPod Labs
Security Research
In-depth CVE write-ups, vulnerability analysis, and security intelligence from the SecPod Research team.
CVE Research
Analyzing the TrueConf Zero-Day Exploit in Southeast Asian Cyber Attacks
Cybercriminals are increasingly exploiting trusted enterprise collaboration platforms through supply-chain style attacks, with a newly discovered zero-day vulnerability in the TrueConf video conferencing client actively weaponized in targeted campaigns against Southeast Asian government entities. Tr...
CVE Research
Critical Infrastructure Alert: Patch Cisco IMC and SSM On-Prem Now!
A pair of critical vulnerabilities in Cisco server and license-management technologies, CVE-2026-20093 and CVE-2026-20160. These flaws allow attackers to bypass authentication or execute commands at the highest privilege level. Both flaws have been assigned a CVSS score of 9.8. Exploitation could re...
CVE Research
Forged Trust: Improper Certificate Validation in wolfSSL
CVE-2026-5194 is a critical vulnerability affecting the wolfSSL cryptographic library, a widely used TLS/SSL implementation deployed across embedded systems, IoT devices, networking equipment, and applications.
CVE Research
Inside Nexcorium: How CVE-2024-3721 Fuels a New Wave of Mirai-Based DDoS Botnets
Researchers have uncovered an active IoT botnet campaign exploiting two known command-injection vulnerabilities to recruit surveillance cameras and home routers into a distributed denial-of-service (DDoS) army. Dubbed Nexcorium, this new Mirai variant uses CVE-2024-3721, an OS command-injection flaw...
CVE Research
Deep Dive into CVE-2026-34621: Actively Exploited Flaw in Adobe Acrobat Reader
Adobe has released emergency security updates to address a critical vulnerability in Adobe Acrobat Reader, tracked as CVE-2026-34621. This flaw, with a CVSS score of 8.6, is actively exploited in the wild and allows attackers to execute arbitrary code on affected systems via specially crafted PDF fi...
CVE Research
Two Zero-Days, 167 Flaws Fixed: Microsoft Delivers a Major April 2026 Patch Tuesday
The second Tuesday of April 2026 marked another extensive security update release from Microsoft, addressing a broad range of vulnerabilities across its product ecosystem. This month’s Patch Tuesday resolved a notably high number of security flaws spanning Windows, Microsoft Office, Azure, Edge, SQL...
CVE Research
Critical Security Vulnerability (CVE-2026-5281) in Google Chrome: Technical Analysis and Mitigation
The discovery of CVE-2026-5281 reveals critical vulnerability highlights a serious weakness in modern web browsers that can be leveraged by attackers to execute malicious code under specific conditions, posing a significant risk to users across different platforms.
CVE Research
Zero-Click AI Exploit: ShadowPrompt in Claude Chrome Extension
A significant vulnerability has been discovered in Anthropic’s Claude Google Chrome Extension, potentially allowing malicious actors to inject prompts into the AI assistant without any user interaction. This “zero-click” vulnerability, dubbed ShadowPrompt, could have allowed attackers to silently co...
CVE Research
Interlock’s Early Access: Cisco FMC Vulnerability Exploited Before Disclosure
Interlock group has been observed exploiting the critical vulnerability CVE-2026-20131 (CVSS 10.0) in Cisco Secure Firewall Management Center (FMC) since January 26, 2026, prior to its public disclosure. This vulnerability, caused by insecure Java deserialization in the FMC web interface, enables un...