20 articles · newest first
The JWT auth bypass we told you about two weeks ago just got its second half: a working RCE chain, two public PoCs, and active probing as of this week.
Priya Nair · 4d ago · 7 min
A bug that lets anyone with a free account plant a git hook is now CISA's problem — and it started with a cryptominer, not a headline.
Priya Nair · 5d ago · 6 min
CVE-2026-33696 needs zero exploits and zero admin rights — just permission to edit a workflow, which in most n8n setups is basically everyone.
Lena Fischer · 6d ago · 6 min
Two critical bugs let anyone overwrite Git hooks and run code on your server — and for once, the fix shipped before it turned into the usual Gogs mess.
Priya Nair · 6d ago · 6 min
CERT Polska is warning that attackers are actively exploiting an unauthenticated command-injection bug in Zimbra's SNMP monitoring component — one Zimbra quietly fixed five weeks ago, in version 10.1.20.
Priya Nair · Aug 22 · 6 min
A maximum-severity remote code execution bug in the identity system behind every Microsoft 365 login got tagged 'exploited in the wild' on Thursday morning — and un-tagged by evening, right after reporters started asking questions.
Priya Nair · Aug 22 · 6 min
A file-upload field and a dropdown, sitting on the same form, are all it takes for an unauthenticated attacker to plant PHP code on your site. The fix has existed since July 31 — most sites just haven't installed it.
Priya Nair · Aug 20 · 6 min
The flaw needs zero login to trigger — just a malicious webpage and a DNS trick — and it's already turning GPU clusters into crypto miners.
Lena Fischer · Aug 20 · 7 min
CVE-2026-58231 scores a maximum 10.0 — and honeypots caught real exploitation attempts before most companies even applied the fix.
Priya Nair · Aug 20 · 7 min
CVE-2026-62893 lets an unauthenticated attacker take over any exposed Windows Deployment Services box — and admins who patched it are now watching PXE boot and MDT deployments break instead.
Priya Nair · Aug 18 · 7 min
CVE-2026-48362, CVE-2026-71398 and CVE-2026-27302 all score a maximum 10.0 — unauthenticated, no clicks needed, full remote takeover. Here's exactly what's broken and what fixes it.
Priya Nair · Aug 18 · 7 min
GeoServer's jsonArrayContains function scored a 9.8, needed zero credentials, and WatchTowr watched the exploitation start within hours of the tweet that disclosed it.
Priya Nair · Aug 17 · 6 min
CVE-2026-62878 is a 9.8-severity, zero-click hole in Windows DNS Server. Microsoft rates it 'exploitation less likely.' The researchers who track these for a living aren't so sure.
Priya Nair · Aug 16 · 6 min
CVE-2026-8452 lets an attacker with zero credentials overflow a buffer inside NetScaler and run their own code — and Citrix's advisory was so thin that even the researchers had to guess the CVE number.
Ravi Malhotra · Aug 15 · 6 min
A 9.8-severity bug in vCenter's syslog server went from patch to active exploitation in five days, and attackers are planting permanent backdoors, not just stealing data.
Priya Nair · Aug 14 · 6 min
Rapid7 pointed an agentic AI at Microsoft's code for 120 hours across 24 days — and it built the same kind of exploit chain nation-state hackers used to spend months on.
Priya Nair · Aug 13 · 6 min
CVE-2026-9198 lets anyone run code on a default Langflow install with zero credentials — CISA gave federal agencies two days to patch it.
Lena Fischer · Aug 6 · 6 min
CVE-2026-66066 scores a 9.5 on CVSS 4.0 because Active Storage's image pipeline can be tricked into reading any file the app can read, no authentication required.
Priya Nair · Aug 5 · 7 min
A 9.8-severity flaw in TeamCity On-Premises lets anyone with network access run commands on your build server — no credentials, no phishing, just a crafted request.
Priya Nair · Aug 4 · 6 min
A patch, a diff, and a Git hook was all it took — no admin access required, and Gitea's own advisory shipped with working exploit code attached.
Priya Nair · Aug 3 · 6 min