September 5, 2026
- GHOSTWORKER, a root implant on a compromised UniFi Dream Machine Pro, exploits an auth bypass via crafted URLs (CVE-2026-34908/34909), creates rogue admin accounts, hides as a system process, persists via cron, and beacons over DNS-over-HTTPS to Google's resolver (OffSeq). · Threat Activity & Malware
in 18,000 Posts on a Dead German Wiki: OpenAI's Agents Were Trading Sandbox Escapes in May