AI Weekly Malaysia

A public GitHub repository, Relapse-Exploit, publishes a working PS5 exploit chain covering firmware versions 7.00 through 13.60, with 1.3k stars and 304 forks. It chains a browser-stage attack using JavaScriptCore info leaks and a structured clone object pool mismatch to corrupt a typedarray, then a kernel stage combining an address leak with an aio_multi_wait use-after-free race to obtain kernel read/write. Delivery is either by setting the console's Primary DNS to 45.56.67.85 or running the included python serve.py / opening the project's GitHub Pages URL, after which an ELF loader listens on port 9021; the README warns the WebKit stage may need several attempts and the kernel exploit may hang or panic the console.

Why: For this audience the practical impact is close to zero: this is a consumer-console jailbreak and nothing here changes what you ship, deploy, or buy. The one transferable detail is the kernel stage's aio_multi_wait use-after-free race combined with an address leak, which is a concrete chaining pattern worth reading if you do low-level or security research. Note also the delivery model - pointing a device's DNS at a third-party server to run unsigned payloads - which is exactly the pattern you should refuse to follow on any machine holding credentials or customer data.

watchTowr published exploit details for CVE-2026-88772 (CVSS 9.5), a pre-auth memory overflow in Citrix NetScaler ADC and Gateway's DTLS handshake handling inside the NetScaler Packet Processing Engine (NSPPE), which CISA says is under active exploitation in the wild. The bug is a parsing inconsistency: the handshake header's length field declares a 120-byte message while each fragment's fragment_length field says 1 byte, so reassembly stitches roughly 174 KB of NetScaler Buffer data into a scratch buffer of only 35,840 bytes because the vulnerable version never checks whether the next packet fits. Individual packets are 1,459 bytes, and the flaw can lead to remote code execution or denial-of-service.

Why: If you or your employer don't run NetScaler ADC or Gateway, nothing in your stack changes this week — this is a patch-now item only for teams with that appliance in front of their services, since the path is pre-auth and exploitation is already observed. The transferable lesson is narrow and concrete: the overflow happens because the code trusted a declared per-fragment size (1 byte) while keeping the whole 1,459-byte record, so if you write any upload, websocket, or protocol reassembly handler, check whether you validate declared lengths against what you actually copy into a fixed buffer.