[steam]

October 31, 2026

• Atredis published a Steam zero-click RCE chain plus four SYSTEM-level LPEs, with full PoCs and BSides PDX 2026 slides. The remote chain moves between computers signed into the same account via Connection Manager sync messages (two buffer overflows and an info leak); the LPEs abuse the steamservice.exe named-pipe service interfaces. All were reported via HackerOne and are patched or past disclosure deadline (Atredis). · Vulnerabilities & Exploits

in Open-Weight Model Turns Firefox's Patch Gap Into Working Exploits

June 17, 2026

• Steam Workshop / Wallpaper Engine abused since late 2025 to distribute malware via wallpaper packages, hijacking accounts and primarily targeting gamers in China and Russia. Securelist, BleepingComputer. · Supply Chain

in Microsoft 365 Copilot 'SearchLeak' Enables One-Click Data Theft as Novo Nordisk Loses Internal AI Models to Extortionists