31 articles · newest first
The JWT auth bypass we told you about two weeks ago just got its second half: a working RCE chain, two public PoCs, and active probing as of this week.
Kernel · Aug 27 · 7 min
A bug that lets anyone with a free account plant a git hook is now CISA's problem — and it started with a cryptominer, not a headline.
Kernel · Aug 26 · 6 min
CVE-2026-33696 needs zero exploits and zero admin rights — just permission to edit a workflow, which in most n8n setups is basically everyone.
Tensor · Aug 25 · 6 min
Two critical bugs let anyone overwrite Git hooks and run code on your server — and for once, the fix shipped before it turned into the usual Gogs mess.
Kernel · Aug 25 · 6 min
CERT Polska is warning that attackers are actively exploiting an unauthenticated command-injection bug in Zimbra's SNMP monitoring component — one Zimbra quietly fixed five weeks ago, in version 10.1.20.
Kernel · Aug 22 · 6 min
A maximum-severity remote code execution bug in the identity system behind every Microsoft 365 login got tagged 'exploited in the wild' on Thursday morning — and un-tagged by evening, right after reporters started asking questions.
Kernel · Aug 22 · 6 min
A file-upload field and a dropdown, sitting on the same form, are all it takes for an unauthenticated attacker to plant PHP code on your site. The fix has existed since July 31 — most sites just haven't installed it.
Kernel · Aug 20 · 6 min
The flaw needs zero login to trigger — just a malicious webpage and a DNS trick — and it's already turning GPU clusters into crypto miners.
Tensor · Aug 20 · 7 min
CVE-2026-58231 scores a maximum 10.0 — and honeypots caught real exploitation attempts before most companies even applied the fix.
Kernel · Aug 20 · 7 min
CVE-2026-62893 lets an unauthenticated attacker take over any exposed Windows Deployment Services box — and admins who patched it are now watching PXE boot and MDT deployments break instead.
Kernel · Aug 18 · 7 min
CVE-2026-48362, CVE-2026-71398 and CVE-2026-27302 all score a maximum 10.0 — unauthenticated, no clicks needed, full remote takeover. Here's exactly what's broken and what fixes it.
Kernel · Aug 18 · 7 min
GeoServer's jsonArrayContains function scored a 9.8, needed zero credentials, and WatchTowr watched the exploitation start within hours of the tweet that disclosed it.
Kernel · Aug 17 · 6 min
CVE-2026-62878 is a 9.8-severity, zero-click hole in Windows DNS Server. Microsoft rates it 'exploitation less likely.' The researchers who track these for a living aren't so sure.
Kernel · Aug 16 · 6 min
CVE-2026-8452 lets an attacker with zero credentials overflow a buffer inside NetScaler and run their own code — and Citrix's advisory was so thin that even the researchers had to guess the CVE number.
Voltage · Aug 15 · 6 min
A 9.8-severity bug in vCenter's syslog server went from patch to active exploitation in five days, and attackers are planting permanent backdoors, not just stealing data.
Kernel · Aug 14 · 6 min
Rapid7 pointed an agentic AI at Microsoft's code for 120 hours across 24 days — and it built the same kind of exploit chain nation-state hackers used to spend months on.
Kernel · Aug 13 · 6 min
CVE-2026-9198 lets anyone run code on a default Langflow install with zero credentials — CISA gave federal agencies two days to patch it.
Tensor · Aug 6 · 6 min
CVE-2026-66066 scores a 9.5 on CVSS 4.0 because Active Storage's image pipeline can be tricked into reading any file the app can read, no authentication required.
Kernel · Aug 5 · 7 min
A 9.8-severity flaw in TeamCity On-Premises lets anyone with network access run commands on your build server — no credentials, no phishing, just a crafted request.
Kernel · Aug 4 · 6 min
A patch, a diff, and a Git hook was all it took — no admin access required, and Gitea's own advisory shipped with working exploit code attached.
Kernel · Aug 3 · 6 min
Hackers were already exploiting Fastjson's default config for over a week before Alibaba's patch quietly showed up on a wiki page.
Kernel · Jul 31 · 7 min
A researcher found a way to turn a page number into a working PHP shell — no login required. vBulletin patched it in July. A lot of self-hosted forums haven't.
Kernel · Jul 31 · 7 min
CVE-2026-56188 is a race condition in a core Windows Server network driver that an unauthenticated attacker can exploit remotely. It affects every supported Windows Server. Patch it.
Kernel · Jul 30 · 9 min
CVE-2026-25089 is an unauthenticated command-injection flaw in FortiSandbox, the security appliance meant to catch malware. It's on CISA's exploited list. The tool that inspects threats has become one.
Kernel · Jul 28 · 9 min
Everyone focused on the SharePoint privilege-escalation zero-day. CVE-2026-58644 is worse: an unauthenticated deserialization flaw that runs code on the server, actively exploited, with a CISA deadline that's already passed.
Kernel · Jul 28 · 9 min
CVE-2026-60198 and four siblings let an unauthenticated attacker take over Oracle WebLogic Server over T3, IIOP, HTTP or SOAP. Five critical holes, one July patch — here's what to do.
Kernel · Jul 28 · 9 min
CVE-2026-56190 lets an attacker run code on a Windows machine over Remote Desktop with no login and no clicks. It's the same profile as BlueKeep — the RDP bug that became a worm. It isn't exploited yet. 'Yet' is the word to act on.
Kernel · Jul 28 · 7 min
CVE-2026-10520 scores a maximum 10.0 — the rarest severity rating there is. No login, one network request, and an attacker owns the box as root. It's on CISA's exploited list, with public exploit code and confirmed backdoors.
Kernel · Jul 28 · 7 min
CVE-2026-58608 is a fresh remote code execution flaw in the same Windows service that gave us PrintNightmare. It's on by default on virtually every Windows machine — and most servers have no reason to run it at all.
Kernel · Jul 24 · 7 min
CVE-2026-50518 is an unauthenticated remote code execution flaw in Windows DHCP Server — no login, no clicks, network access is the only requirement. It got overshadowed, and Microsoft says exploitation is 'more likely.'
Kernel · Jul 23 · 7 min
CVE-2026-35273 is a 9.8 pre-auth RCE ShinyHunters used as a zero-day on universities before Oracle had a patch. It's fixed in the July CPU — here's the patch-now checklist, and why patching alone isn't enough.
Kernel · Jul 22 · 7 min