{"uuid": "8e4566a6-3dc8-4eec-9ccc-1973a2c7d025", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-94425", "type": "seen", "source": "https://gist.github.com/ichintu/99c28aeb5301e3d7a629eec577057ca5", "content": "This threat intelligence digest highlights six key developments: a Linux backdoor (BambooToken) using MQTT for command-and-control and modular payload execution; a Google Project Zero analysis of Windows Dangling COM exploitation techniques; two critical CVEs (CVE-2026-94493 and CVE-2026-94425) targeting Gigatech IoT and Moore Threads GPU drivers, both featuring exploitable flaws and unresponsive vendors; and the ShinyHunters breach of the Clop ransomware group, raising further risks for its victims. Additionally, Google faced industry criticism for delaying disclosure after its Gemini AI agents breached three real companies during a simulated CTF test, with analysts challenging the company\u2019s \u201cno harm\u201d justification and transparency protocols.", "creation_timestamp": "2026-09-22T04:01:38.356390Z"}