ThreatsDay: Gogs 10.0 RCE, n8n Workflow-to-RCE, $10M Reward, GLM-5.3 AI Exploit, and More

Key Highlights

• 6 million (then $116 million) in December 2025 by Italy's antitrust authority after finding that ATT restricted App Store competition.
• 3, a new AI model that it said is better suited for complex coding and long-horizon tasks.
• 99/month and go all the way to $99.
• 3, alongside patches for CVE-2026-52810 (a logic bug to write on read-only repositories) and GHSA-6vxv-wg6j-5qwp (an XSS flaw in the outdated version of "jsvine/notebookjs" used to render Jupyter notebook files).
• , %%Creator:) appears somewhere in the first 4000 bytes, and (3) The bytes following the keyword, up to byte 4000, contain no control characters.

A lot of this week’s trouble starts with something trusted doing exactly what it was allowed to do.

Signed drivers get turned against defenses.

Legitimate apps help malware blend in.

A weak header check opens a path to code execution.

Elsewhere, exposed systems, old bugs, odd hiding tricks, and AI-assisted exploit research keep lowering the effort needed to cause damage.

Nothing here needs much decoration.

The small gaps are doing enough work already.

The threats change every week.

Subscribe, and we’ll alert you when each new ThreatsDay Bulletin is out.

Signed driver abuse In new research, Check Point has reverse engineered Microsoft Defender's Defender Boot-Time Removal driver ("BTR.

sys") and demonstrated that it's possible to repurpose the signed remediation driver as a universal kernel operation engine to bypass endpoint security solutions by exploiting a "golden window" between system start and user mode initialization without having to rely on the bring your own vulnerable driver (BYOVD) method.

"Because BTR.

sys is a legitimate Microsoft-signed component, signature-based blocking is ineffective," security researcher Jiří Vinopal said.

"Furthermore, a well-crafted weaponization tool (like BTR_CLI) intentionally mimics the operational footprint of the legitimate Windows Defender remediation process.

" $10 million reward The U.

S.

Department of Justice (DoJ) has charged 17 members of the Mabna Institute, an Iran-based company that, since at least 2013, has conducted a coordinated campaign of cyber intrusions into computer systems for 144 U.

S.

-based universities, 178 foreign universities, at least 42 U.

S.

-based private sector companies, at least 11 foreign private sector companies, at least five U.

S.

federal and state government agencies, and at least two non-governmental organizations (NGOs).

The Mabna Institute has been accused of stealing more than 31 TB of academic data and intellectual property from these universities, as well as the email accounts of employees at the private sector companies, government agencies, and NGOs.

In all, the Mabna Institute targeted more than 100,000 accounts of professors around the world, successfully compromising approximately 8,000 of them.

The defendants carried out these intrusions on behalf of Iran's Islamic Revolutionary Guard Corps (IRGC).

The Mabna Institute was founded by Gholamreza Rafatnejad and Ehsan Mohammadi around 2013.

The useful part of weeks like this is that the attacks rarely begin with magic. They begin with trust, exposure, weak assumptions, and things nobody thought worth abusing.

That leaves plenty to fix. Tighten what gets trusted, question the defaults, and keep looking at the boring edges. Attackers clearly are.

Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.

Originally reported by The Hacker News. TechVeb news desk.