vulnerability

8 articles · newest first

Hardware

Cisco's server controller scored a 9.8 bug that hands out root — exploit code is already public

CVE-2026-20200 lets a low-privilege, already-logged-in attacker take full root control of Cisco UCS C-Series servers through the web management interface — and the discoverer's own proof-of-concept tool is sitting on GitHub right now.

Ravi Malhotra · 17h ago · 6 min

Software

a critical bug in one of Java's most-used libraries had no fix. that just changed

Hackers were already exploiting Fastjson's default config for over a week before Alibaba's patch quietly showed up on a wiki page.

Priya Nair · Jul 31 · 7 min

Software

CitrixBleed is back: a NetScaler flaw that leaks memory — and with it, the session tokens that unlock your network

CVE-2026-8451 makes NetScaler ADC and Gateway over-read memory when configured as a SAML identity provider, potentially spilling session tokens. It's the same class of bug behind the original CitrixBleed. Patch it.

Priya Nair · Jul 28 · 9 min

Software

everyone rushed to patch the SharePoint zero-day. the 9.8 sitting on your DHCP server is the one that scares me

CVE-2026-50518 is an unauthenticated remote code execution flaw in Windows DHCP Server — no login, no clicks, network access is the only requirement. It got overshadowed, and Microsoft says exploitation is 'more likely.'

Priya Nair · Jul 23 · 7 min

Software

how wp2shell actually works: the two-loop bug that lets an anonymous request run code on WordPress

The exploit hinges on a subtle mistake — WordPress's REST API validates and executes batch requests in two separate loops. When one step fails, everything after it dispatches under the wrong handler. Here's the chain, step by step.

Priya Nair · Jul 22 · 9 min

Software

what is wp2shell? the WordPress bug that lets a total stranger take over a default site, explained

It's the nickname for a critical flaw in WordPress core — two vulnerabilities chained into a full site takeover with no login required. Here's what it is, whether you're affected, and what to do, in plain English.

Priya Nair · Jul 22 · 9 min

Software

Microsoft called this SharePoint bug 'Moderate.' the NVD says it's a 9.8 — and hackers are already using it

Same vulnerability, two official severity scores that don't agree: Microsoft rates CVE-2026-56164 a 5.3, the National Vulnerability Database a 9.8. It's a zero-day being exploited right now. Here's who's right, and what to do.

Priya Nair · Jul 22 · 7 min

Software

run Oracle PeopleSoft? the bug that breached 100+ orgs was exploited two weeks before the fix existed

CVE-2026-35273 is a 9.8 pre-auth RCE ShinyHunters used as a zero-day on universities before Oracle had a patch. It's fixed in the July CPU — here's the patch-now checklist, and why patching alone isn't enough.

Priya Nair · Jul 22 · 7 min