[CVE-2026-8461] PixelSmash – Critical FFmpeg Vulnerability Turns Media Files into Weapons

JFrog discovered a typosquatted NuGet package, Newtonsoftt.Json.Net, that shipped a trojanized Newtonsoft.Json fork to rig results on the Digitain betting platform and exfiltrate them.

depthfirst's autonomous agent discovered 21 zero-day vulnerabilities in FFmpeg and produced reproducible PoC inputs at a fraction of typical cost; several bugs had lain latent for 15-20 years.

A decade-long history of Ruby Marshal deserialization exploits shows researchers repeatedly bypassing patches, arguing for fundamental ecosystem changes rather than a patch-and-hope approach.

Post-auth RCE in Cisco Smart Software Manager (CSSM): command injection in nginx certificate upload, where openssl checks run via childProcess.execSync. Cisco silently patched it in 10-202608.

Using HacktronAI's OpenAI Discourse hack disclosure, this article covers sandboxing, runtime protection, and AI-assisted defense to shrink the blast radius of RCE across interconnected apps.

Provides verifiable, transparent evidence of advanced LLMs performing complex, multi-step binary and browser exploitation autonomously under strict ASLR and memory randomization defenses.