In this post, I demonstrate Cacheract, which is an open source proof-of-concept for “Cache Native Malware’ that exploits GitHub Actions cache misconfigurations.

TL;DR ISC released BIND 9.20.26 and 9.21.24 on July 22, 2026. The updates fix nine flaws in the widely used DNS server. The most serious BIND vulnerability, CVE-2026-13321, enables cross-zone cache poisoning and scores 8.6. Why it matters BIND is one of the most deployed DNS servers on the internet. A cache poisoning flaw there can redirect users to attacker-controlled answers.

Ghost released version 6.37.0 to fix a critical cache poisoning bug. The Ghost cache poisoning flaw, tracked as CVE-2026-53943, scores 9.6 on the CVSS scale. An unauthenticated attacker can abuse it to hijack staff accounts on some setups. Why This Ghost Cache Poisoning Bug Matters Ghost powers tens of thousands of sites and serves hundreds of millions of requests each day.

In this post, I demonstrate Cacheract, which is an open source proof-of-concept for “Cache Native Malware’ that exploits GitHub Actions cache misconfigurations.

GitHub Actions caching has some insecure design decisions that allow for some unique attacks. It’s considered working as intended, but there are many ways it can go wrong. Learn how I identif…

GitHub Actions caching has some insecure design decisions that allow for some unique attacks. It’s considered working as intended, but there are many ways it can go wrong. Learn how I identif…

Major BIND vulnerabilities exposed! ⚠️ DNS cache poisoning is back, redirecting you to fake sites. Update your DNS software NOW to stay safe! #cybersecurity #DNS #BIND #cachepoisoning 2025-10-23T033008.463+0200 Tools used for generation Text Gemini Narator Azure TTS Clips Pexel Rendering Remotion

The makers of BIND, the Internet’s most widely used software for resolving domain names, are warning of two vulnerabilities that allow attackers to poison entire caches of results and send users to...