Producción betaLa plataforma está en fase de pruebas y transformación continua. Puedes subir cursos y usar el campus con normalidad; disculpa cualquier ajuste temporal mientras consolidamos la experiencia.
Bing Images Flaws Let Crafted SVGs Run Commands as SYSTEM on Microsoft's Servers
A crafted SVG submitted to Bing's image search ran commands as NT AUTHORITY\SYSTEM on Microsoft's production image-processing workers, and as root on the Linux machines in the same fleet. XBOW's testing got the same result on workers across different hosts and network ranges, so...
24/07/2026 13:45 publishedHN external sourceEN reading language
Translated VulnHunters briefingThe Hacker News
A crafted SVG submitted to Bing's image search ran commands as NT AUTHORITY\SYSTEM on Microsoft's production image-processing workers, and as root on the Linux machines in the same fleet. XBOW's testing got the same result on workers across different hosts and network ranges, so the problem sat in Bing's image tier, not on one bad machine. Microsoft issued two critical CVEs, CVE-2026-32194 and
We use technical cookies to keep sessions secure and, only with your permission, academy measurement and communications. You can accept all, keep only essentials, or configure each preference.
Cookie preference center
VulnHunters Academy uses cookies and local storage to keep sessions secure, remember preferences, and measure site performance. Non-essential cookies are enabled only after consent.
Strictly necessary cookies
Required for login, CSRF-protected forms, consent records, interface preferences such as light/dark mode, and misuse prevention.
Performance analytics cookies
Help us understand performance, navigation errors, most consulted sections, and technical quality. Data is handled in aggregate whenever possible and is not used for automated academic decisions.
Communication and campaign cookies
Measure the effectiveness of academy communications, admission notices, course updates, and internal campaigns. You can browse and buy courses with these disabled.
Consent management
You can change preferences at any time from the footer. Rejecting non-essential cookies does not limit basic content, registration, or required academic features.
Terms and conditions
1. Authorized use
All learning is oriented toward defense, authorized auditing, responsible research, and improvement of systems you own or have explicit permission to assess.
2. Ethical conduct
Using academy knowledge, labs, or materials to access third-party systems, bypass controls, or cause harm is prohibited.
3. Intellectual property
Materials, guides, challenges, and templates belong to VulnHunters Academy or their authors. Commercial redistribution is not allowed without permission.
4. Payments and access
Paid-course access is activated after transaction confirmation. Refund policies are communicated before enrollment is completed.
5. Privacy
We process personal data under GDPR/LOPD. Until an official mailbox is enabled, access, rectification, or deletion requests are handled through the internal contact form.
6. Responsibility
Students are legally responsible for any misuse outside environments authorized by the academy.
7. Certification
Certificates are issued after rubrics, minimum attendance, and deliverables are completed. The academy may revoke them in case of academic fraud.
Privacy policy
VulnHunters Academy collects registration data, preferences, academic activity, and payment information to provide the educational service. We do not sell personal data or disclose information to third parties except where legally required or necessary providers operate the platform.
Data is retained while an account remains active or during applicable legal periods. Until an official mailbox is enabled, rights requests are handled through the internal contact form.
We apply reasonable technical measures: HttpOnly session cookies, CSRF validation, activity logs, data minimization, and separation of sensitive folders.
Professional cookie policy
Last updated: May 2026.
This policy explains how VulnHunters Academy uses cookies, local storage, and equivalent technologies on the web platform. Its purpose is transparency, user control, and safe operation of courses, marketplace, chat, profiles, and private panels.
1. What cookies are
Cookies are small files or technical records stored by the browser when you visit a website. We may also use local browser storage to remember language, consent, or interface preferences.
2. Controller
The controller is VulnHunters Academy. For privacy, consent, or rights requests, use the internal contact form until an official mailbox is enabled.
3. Strictly necessary cookies
These cookies are essential to provide the requested service: session continuity, CSRF protection, basic preferences, security measures, consent state, and private-area navigation.
4. Performance analytics cookies
These cookies help measure stability, load times, technical errors, visited pages, and aggregated use of features. They are enabled only with consent.
5. Communication and campaign cookies
These cookies measure internal academy communications, admission forms, course promotions, marketplace updates, and informative campaigns. You may reject them without losing essential features.
6. Specific purposes
We use cookies for authentication, security, fraud prevention, user preferences, consent management, technical analytics, content improvement, campaign measurement, and interactive features such as chat and marketplace.
7. Legal basis
Technical cookies are based on the need to provide the requested service. Analytics and communication cookies are based on consent, which can be granted, rejected, or withdrawn at any time.
8. Retention and providers
Session cookies are normally deleted when the browser closes or the session expires. Where payment, security, analytics, email, or hosting providers are involved, access is limited to the contracted purpose.
9. Withdrawing consent
You can change preferences from the Cookie settings link in the footer. You can also remove or block cookies from your browser settings.
10. Policy changes
We may update this policy to reflect legal, technical, or functional changes. When a change is relevant, the platform may request consent again.
VulnHunters AssistantAvailable now
Hello. I am the VulnHunters Academy assistant. Select an option and I will direct you to the right resource.
