ThreatsDay Bulletin: Smart TV Proxyware, 24-Year curl Bug, AI Crime Forums + 13 More Stories
ThreatsDay Bulletin: Smart TV Proxyware, 24-Year curl Bug, AI Crime Forums + 13 More Stories
https://thehackernews.com/2026/06/threatsday-bulletin-smart-tv-proxyware.html
Publish Date: 2026-06-25 08:24:00
Source Domain: thehackernews.com
It’s dumb out there again.
This week has the usual smell of prod on fire and nobody wanting to admit who left the door open — old creds still working, trusted apps doing sketchy crap, browser tricks jumping the fence, and “normal” workflows turning into phishing pipes because apparently email was not enough hell already.
The worst part is how cheap some of it feels. Not elite. Not cinematic. Just stale secrets, fake updates, lazy trust, and random boxes quietly becoming someone else’s infrastructure. Same internet, fresh headache. Let’s get into it.
-
Privacy-first bot defense
Cloudflare has teamed up with Google Chrome, Microsoft Edge, and Mozilla Firefox to create a privacy-preserving protocol that websites can use to separate desirable web traffic from undesirable network requests. This involves the use of Private Access Control Tokens (PACT), which allow websites to issue anonymous tokens that assert a given browsing session is being run by a human. “A user’s browser can then provide these tokens to other sites to prove that a human is in the loop, reducing the need for annoying and clunky captchas or invasive tracking,” Cloudflare said. “PACT is designed so that sites cannot leverage it to track or identify users or their browsing history.”
-
Six curl CVEs
AISLE said it discovered six vulnerabilities in curl, which range from “classic memory-lifetime issues to logic bugs in how libcurl decides whether a connection, credential, or host identity is still valid.” One of the notable vulnerabilities is CVE-2026-8932, which allows the library to “reuse a previously created connection even when some mTLS config-related option had been changed that should have prohibited reuse.” AISLE described it as the oldest curl vulnerability reported so far, adding that it has been shipped in releases since curl version…
