PHP2Shell: Two Critical PHP RCEs (CVSS 9.2) Leaked a Day Early — Check Your Version and Patch Today
Two vulnerabilities in PHP itself — not in WordPress, not in a plugin, in the interpreter — give an unauthenticated attacker remote code execution o…
Latest News
⚑ Report a ProblemTech news from the best sources
All topics
AI
Gear
News
Tech
agents
ai
api
architecture
automation
beginners
career
database
devchallenge
devops
discuss
javascript
llm
machinelearning
mcp
opensource
performance
productivity
programming
python
security
showdev
testing
tutorial
typescript
webdev
Spotting the OpenVPN flaw patterns in your own code reviews
Spotting the OpenVPN flaw patterns in your own code reviews The two vulnerabilities fixed in OpenVPN 2.7.8 are ordinary mistakes in unusual places.…
OpenVPN flaw FAQ: seven questions a change board will ask about 2.7.8
OpenVPN flaw FAQ: seven questions a change board will ask about 2.7.8 A change board reviews risk, sequence and evidence. The two OpenVPN advisories…
CVE-2026-104480: Discord's libdave accepts an MLS Welcome it should refuse
CVE-2026-104480: Discord's libdave accepts an MLS Welcome it should refuse End-to-end encryption for a group call is only as strong as the membershi…
CVE-2026-40281 Explained: A Patch That Guarded "=" on One Side Only
Overview Item Detail CVE ID CVE-2026-40281 Affected product Gotenberg (Docker-powered PDF conversion API, thecodingmachine/gotenberg) Affected versi…
Android's external/ libraries: hunting n-days in code that upstream already fixed
"Android's external/ libraries: hunting n-days in code that upstream already fixed" (Alternative: "I built a fuzzing platform on a 2-core VPS. Here'…
Exposure Context for CVE-2026-96358: What 436,276 Drupal Fingerprints Mean
Exposure Context for CVE-2026-96358: What 436,276 Drupal Fingerprints Mean Vulnerability overview CVE-2026-96358 appears in CERT-BUND advisory WID-S…
CVE-2026-61500: Forging an HFS Admin Session Without Logging In
CVSS 3.1: 9.8 (Critical) / CVSS 4.0: 9.3 / CWE-338 (Use of a cryptographically weak PRNG) Rejetto HFS (HTTP File Server) versions 3.0.0 through 3.2.…
CVE-2026-84411 in MikroTik RouterOS: why a pre-authentication integer underflow reaches root
CVE-2026-84411 in MikroTik RouterOS: why a pre-authentication integer underflow reaches root The vulnerability in one paragraph MikroTik RouterOS be…
CVE-2026-92957: CVE-2026-92957: Sandbox Escape and Remote Code Execution in vm2 via node: Prefix Policy Bypass
CVE-2026-92957: Sandbox Escape and Remote Code Execution in vm2 via node: Prefix Policy Bypass Vulnerability ID: CVE-2026-92957 CVSS Score: 9.9 Publ…
CVE-2026-67401 Analysis — cPanel & WHM EmailTrack SQL Injection, From Mail Account to Root
Vulnerability Overview Item Detail CVE ID CVE-2026-67401 Component cPanel & WHM — EmailTrack (Email ▸ Track Delivery) Vulnerability class CWE-89…
GitLab ships critical patch across 19.4, 19.3 and 19.2
What shipped GitLab pushed a critical patch release on 23 September covering three active branches at once: 19.4.1, 19.3.3 and 19.2.7. The release n…
CVE-2026-31431 \"Copy Fail\": A Deep Dive into the Linux algif_aead Privilege Escalation
Vulnerability Overview Field Detail CVE ID CVE-2026-31431 Nickname Copy Fail CVSS 3.1 7.8 (HIGH) — AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Affected comp…
Automating Threat Intelligence: Integrating CVE Bots and Open Datasets into Your SecDevOps Pipeline
Originally published on tamiz.pro . Introduction: The Shift from Reactive to Proactive Security The traditional security operations model is no long…
CVE-2026-63349: CVE-2026-63349: Privilege Dropping Bypass and Denial of Service in AnyIO Subprocess Module
CVE-2026-63349: Privilege Dropping Bypass and Denial of Service in AnyIO Subprocess Module Vulnerability ID: CVE-2026-63349 CVSS Score: 7.0 Publishe…
How Log4Shell Works: Breaking Down CVE-2021-44228
INTRODUCTION Log4jShell is a software vulnerability in Apache Log4j 2 which is a popular java library used for logging events in java-based applicat…
CVE-2026-16723: Pre-Auth RCE in Fastjson 1.x via the @JSONType Trust Branch
Overview CVE ID CVE-2026-16723 Affected Fastjson 1.2.68 – 1.2.83 (every 1.x release still receiving use) Preconditions Spring Boot executable fat-JA…
CVE-2026-12243 — How a Percent-Encoded Slash Bypasses NLTK's Path Traversal Guard
CVE ID CVE-2026-12243 Affects NLTK (Natural Language Toolkit) ≤ 3.9.4 Weakness CWE-22 (Path Traversal) CVSS 3.1 7.5 High — AV:N/AC:L/PR:N/UI:N/S:U/C…
A SQL escape is not a shell escape: OS command injection in GOautodial goAPIv2
TL;DR What: In GOautodial's goAPIv2 agent API, the goPhone request parameter is escaped for SQL ( mysqli_real_escape_string ) and then concatenated…
CVE-2026-69112: Hugging Face Accelerate Path Traversal Lets Attackers Read Arbitrary Files
Originally published at HOL CVE-2026-69112: Hugging Face Accelerate Path Traversal Lets Attackers Read Arbitrary Files from Checkpoint Indexes TL;DR…
BREAKING: CVE-2026-18500 - @fastify/jwt Key Override Authorization Bypass
Originally published at HOL BREAKING: CVE-2026-18500 - @fastify/jwt key override authorization bypass TL;DR: CVE-2026-18500 affects @fastify/jwt ver…
CVE-2026-53561: Apache Hive HiveServer2 SAML Bearer Impersonation
Originally published at HOL CVE-2026-53561: Apache Hive HiveServer2 SAML Bearer Impersonation TL;DR: HiveServer2's SAML HTTP path accepted a forged…
CVE-2026-48854: CVE-2026-48854: Unauthenticated Denial of Service via Resource Exhaustion in elixir-grpc Server
CVE-2026-48854: Unauthenticated Denial of Service via Resource Exhaustion in elixir-grpc Server Vulnerability ID: CVE-2026-48854 CVSS Score: 8.7 Pub…
Deep-Dive Write-up by Huynh Kien Minh: CVE-2026-13736 — NewPath WildApricotPress Member Directory PII Disclosure
🔐 Vulnerability ID: CVE-2026-13736 | 🎯 CVSS Score: 5.3 Medium | 🏆 Lead Researcher: Huynh Kien Minh (MinhHK) | 🔗 WPScan Advisory: Verified Report | 🌐…
GHSA-5CWR-5JXG-PCF6: GHSA-5CWR-5JXG-PCF6: Stored Cross-Site Scripting via Improper Cache Sanitization in Winter CMS Custom Styles
GHSA-5CWR-5JXG-PCF6: Stored Cross-Site Scripting via Improper Cache Sanitization in Winter CMS Custom Styles Vulnerability ID: GHSA-5CWR-5JXG-PCF6 C…
nginx is not the bug. Two lines of your config are. CVE-2026-42945 on a live stand
A critical nginx vulnerability, 9.2 on CVSS, sat in the code for eighteen years. It was found not by a human but by an AI agent, and six hours were…
A text message that runs a command: OS command injection in Gammu SMSD (GHSA-9vjj-v46c-c5qf)
TL;DR What: Gammu SMSD — the daemon behind a huge number of SMS gateways, alerting rigs and 2FA senders — runs an operator-configured hook every tim…
They scoped the customer and forgot the customer's ledger — a High-severity cross-tenant BOLA in Open Food Network
TL;DR What: POST /api/v1/customer_account_transaction in Open Food Network authorized against the class , not the record. It took customer_id straig…
How to Actually Protect Yourself From wp2shell (Not Just "Update WordPress")
Everyone's telling you the same thing right now: update WordPress. Which is, fine, yes, obviously but that's not enough. Patching closes the hole. W…
Aikido buys Root to patch open source in place, without the upgrade dance
Every open-source CVE backlog has that one line item you keep sliding into next quarter. The library is a couple of majors behind, the upgrade break…