CVE Tools
Track your stack

Risky Bulletin: Pwnie Awards 2026 winners

Risky Business NewsBy Catalin Cimpanu

Research

Our summary

A delayed release of the Pwnie Awards 2026 results has finally surfaced, thanks to a leaked stream link shared by TechCrunch, resolving weeks of uncertainty about the Black Hat & DEFCON ceremony outcomes. The awards recognized critical security research such as ITScape's KVM/arm64 guest-to-host escape (CVE-2026-46316) for Best RCE and CopyFail for Best Privilege Escalation Bug. Microsoft received the Lamest Vendor Response award for its handling of the Nightmare Eclipse disclosure, while Meta faced criticism for an Instagram account takeover enabled by AI prompt injection.

Read at Risky Business News

Risky Business News publishes this story on its own site; we link to it rather than reprint it.

  1. The Hacker NewsNew Zapscape KVM Flaw Could Let Privileged L1 Guest Code Escape to Linux HostsCVE-2026-46316, CVE-2026-53359
  2. The Hacker News16-Year-Old Linux KVM Flaw Lets Guest VMs Escape to Host on Intel and AMD x86 SystemsCVE-2026-46316, CVE-2026-53359
  3. BleepingComputerCritical Langflow flaw exploited to steal OpenAI and AWS keysCVE-2026-33017
  4. Rapid7 BlogMetasploit Wrap Up: Lot of summer shells and fit http profilesCVE-2026-33017
  5. The Hacker NewsCISA Flags Langflow RCE, Tomcat, and N-central Flaws as Actively ExploitedCVE-2026-33017
  6. Хакер (xakep.ru)Китайский хакер использовал DeepSeek для проведения автономных атакCVE-2026-33017
  7. Help Net SecurityChinese hacker used DeepSeek to launch autonomous cyberattacks on vulnerable serversCVE-2026-33017
  8. BleepingComputerHacker uses DeepSeek AI to autonomously attack vulnerable serversCVE-2026-33017
  9. The Hacker NewsChinese Hacker Commands DeepSeek via Telegram to Launch Autonomous AttacksCVE-2026-33017
  10. The Hacker NewsThreatsDay: AI-Powered Hacking, 370 Chrome Flaws, SonicWall Attacks, DNS Hijacking + 22 More StoriesCVE-2026-33017

Worried this affects your company?

Discuss a security assessment of your internet-facing systems. Scope agreed before testing.

Check my exposure

We use analytics cookies to see which pages and articles actually help people. Decline and none of them run — the site works the same. What we store