ENDLESSDOORS Is Phoning Home. Pick Up.
Twenty router models sold on Amazon, AliExpress, and Alibaba ship with a remote-control implant enabled by default. It runs as root, it uses no encryption, and it authenticates nobody. Whoever answers the phone owns the device.
Aimy Captcha-Less Form Guard: The Anti-Bot Plugin That Hands Bots the Keys
VulnCheck's Initial Access Intelligence team details an unauthenticated PHP object injection in the Aimy Captcha-Less Form Guard plugin for Joomla, where a repeating-key XOR published alongside its own ciphertext turns every protected form into an unserialize() sink and, on Joomla 3.9 through 5.2.1, into remote code execution.
VulnCheck State of Exploitation 1H-2026
Key Trends and Findings from Known Exploited Vulnerabilities, AI discovered vulnerabilities, and AI targeted technologies from the first half of 2026