Elektrine
Log in Register

#cve

381 posts · Last used 6d

INeedMana @INeedMana@piefed.zip
· 2w ago
There isn't an easy exploit for this PHP vulnerability I came across the link via https://mastodon.social/@CuratedHackerNews/117481600704689796 Last time I touched php it was ~20 years ago and maybe for a month. Could someone with actual php understanding weigh in? Somehow, somewhere between the lines, my understanding was that there have been observances of the vuln being used in the wild before the 14 UTC. And that wasn’t from reading news sites
eliastaylor.com

There isn't an easy exploit for this PHP vulnerability

Mass hysteria, or something.

0
5
0
0
PHP @php@fosstodon.org
· 2w ago
Boosted by @trending@homestead.social

📣 Announcing the immediate availability of:

  • PHP 8.2.35
  • PHP 8.3.36
  • PHP 8.4.27
  • PHP 8.5.12

‼️ These address the following critical security issues:

  • Remote Code Execution via Out of Memory corruption (CVE-2026-109618)
  • Remote Code Execution via Stale Global State (CVE-2026-109619)

📝 https://www.php.net/ChangeLog-8.php 🎁 https://www.php.net/downloads?source=Y :windows8: Windows: https://www.php.net/downloads.php?os=windows

Read more: https://www.php.net/archive/2026.php#2026-10-21-5

#PHP #Release #Security #CVE

PHP: PHP 8 ChangeLog
php.net

PHP: PHP 8 ChangeLog

PHP is a popular general-purpose scripting language that powers everything from your blog to the most popular websites in the world.

654
16
904
19
moltenbit @moltenbit@infosec.exchange
· 5mo ago

I audited #OpenReception, a recently released open-source appointment booking platform. Found and reported 16 vulnerabilities, now 16 CVEs assigned.

4 critical:

  • WebAuthn passkey injection → account takeover
  • tenant admin self-promotes to GLOBAL_ADMIN
  • unauth GLOBAL_ADMIN account creation
  • staff crypto poisoning breaks the E2E recipient directory

rest: info disclosure, stored XSS, auth and IDOR bugs, all patched before public disclosure.

https://moltenbit.net/disclosures/

#infosec #security #CVE

moltenbit.net

Security Research

Coordinated disclosures by moltenbit: CVEs, advisories, and acknowledgments across helpdesk software, endpoint agents, and end-to-end-encrypted platforms.

2
0
0
1
maxlath @maxlath@piaille.fr
· 1mo ago
Boosted by @kcarruthers@infosec.exchange

[🚨 #MediaWiki vulnerable extension]

If you are running a MediaWiki instance with Extension:External_Data < v3.7, your instance is vulnerable to arbitrary file loading and #RemoteCodeExecution.

The vulnerability was apparently publicly known since August, but due to the lack of communication, instance admins learned about it due to that vulnerability being exploited en masse.

If you know and like a MediaWiki instance, you can check their Special:Version page to see if they are using the External_Data extension to warn them.

More info:

#infosec #wikipedia #wikidata #adminsys #security #CVE #pwned

lists.wikimedia.org

Major security issue for External Data extension; upgrade or disable immediately - MediaWiki-l - lists.wikimedia.org

5
6
7
0
Suriq - Always on Watch @suriq@infosec.exchange
· 1mo ago
Our desk triaged 4,609 vulnerabilities this week and published 8. The hard part of self-hosted defense is not spotting the dangerous CVE, it is confidently ignoring the thousands that cannot reach your servers. https://suriq.io/blog/signal-triage-signal-from-noise #CVE #CISAKEV #infosec #cybersecurity
Vulnerability triage: 4,609 flaws this week, only 8 mattered
suriq.io

Vulnerability triage: 4,609 flaws this week, only 8 mattered

We triaged 4,609 vulnerabilities in a week and acted on 8. Why reachability and in-the-wild exploitation, not CVSS, decide what a self-hosted team should patch.

1
0
0
0
Cloud 🤖 @cloud@infosec.exchange
· 1mo ago
🤖 CVE-2026-86950: out-of-bounds write in Apple CoreGraphics. A maliciously crafted file can lead to arbitrary code execution. Apple says it may have been exploited in an "extremely sophisticated attack" against specific individuals on iOS < 27. Fixed in iOS/iPadOS 26.7.1, macOS Tahoe 26.7.1 and Sequoia 15.8.1. 🔗 https://thehackernews.com/2026/09/apple-patches-coregraphics-flaw.html #CVE #Apple #Exploit #CyberSec
thehackernews.com

Apple Patches CoreGraphics Flaw Possibly Exploited in Targeted Attacks

0
0
1
0
Cloud 🤖 @cloud@infosec.exchange
· 1mo ago
🤖 Apple patched CVE-2026-86950, an out-of-bounds write in CoreGraphics affecting older iOS/iPadOS/macOS versions. Processing a maliciously crafted file can lead to arbitrary code execution; Apple says the flaw may have been exploited in targeted attacks. 🔗 https://thehackernews.com/2026/09/apple-patches-coregraphics-flaw.html #CVE #Apple #InfoSec #CyberSec
thehackernews.com

Apple Patches CoreGraphics Flaw Possibly Exploited in Targeted Attacks

1
0
2
0
CERT-EU @cert_eu@infosec.exchange
· 1mo ago
Another day, another critical vulnerability in an edge device. We’ve analysed the CVE-2026-88771, one of the many vulnerabilities disclosed by Citrix recently, based on observed exploitation attempts, and set out what we learned and key takeaways. 🔍🔒 If you’re managing Citrix infrastructure, now’s the time to check for compromise! https://www.cert.europa.eu/blog/taking-execute-logging-a-bit-too-literally-cve-2026-88771 #cybersecurity #cve-2026-88771 #vulnerability
Taking 'execute logging' a bit too literally - CVE-2026-88771
cert.europa.eu

Taking 'execute logging' a bit too literally - CVE-2026-88771

Taking 'execute logging' a bit too literally - CVE-2026-88771

9
3
15
0
CYBERTOP @cybertop@mastodon.social
· 1mo ago
CVE-2025-53770: Microsoft SharePoint suffers from a deserialization of untrusted data vulnerability, actively exploited. Block suspicious network traffic and update SharePoint versions promptly. https://cybertop.ai/t/cve-2025-53770-microsoft-sharepoint-deserialization-of-untrusted-data #infosec #CVE
cybertop.ai

CVE-2025-53770: Microsoft SharePoint Deserialization of Untrusted Data Vulnerability — actively exploited — CYBERTOP

CVE-2025-53770: Deserialization of untrusted data in on-premises Microsoft SharePoint Server allows an unauthorized attacker to execute code over a network. Microsoft Actively exploited in the wild (CISA KEV, added 2025-07-20). Live defensive analysis and mitigation from CYBERTOP

0
0
1
0
:mastodon: decio @decio@infosec.exchange
· 1mo ago
🚨 Citrix NetScaler : deux vulnérabilités critiques activement exploitées Le risque est d’autant plus important que ces vulnérabilités ont été exploitées avant la disponibilité des correctifs. 🔍 ⬇️ Inside the NetScaler Zero-Day Siege: Chained Pre-Auth RCEs Weaponized in the Wild (watchTowr Disclosure ) 👇 https://sh3llc0d3.com/blog/inside-the-netscaler-zero-day-siege-chained-pre-auth-rces-weaponized-in-the-wild-watchtowr-disclosure/ 🩹 👇 https://support.citrix.com/external/article/CTX697096 #CyberSecurity #Citrix #NetScaler #ZeroDay #CVE
Inside the NetScaler Zero-Day Siege: Chained Pre-Auth RCEs Weaponized in the Wild (watchTowr Disclosure) | Shellcode (Sh3llc0d3)
sh3llc0d3.com

Inside the NetScaler Zero-Day Siege: Chained Pre-Auth RCEs Weaponized in the Wild (watchTowr Disclosure) | Shellcode (Sh3llc0d3)

A critical perimeter emergency is unfolding across enterprise infrastructure worldwide as threat intelligence teams confirm the active, in-the-wild exploit...

1
0
1
0
ssvc @ssvc@infosec.exchange
· 1mo ago
Replying to
CISA working on a Sunday: Citrix NetScaler zero-days CVE-2026-88771 and CVE-2026-887712 were added to the Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. https://www.cisa.gov/news-event/alerts/2026/09/27/cisa-adds-two-known-exploited-vulnerabilities-catalog #KEV #Citrix #NetScaler #zeroday #CVE
cisa.gov
1
3
2
0
sekurak News @sekurakbot@mastodon.com.pl
· 1mo ago
Krytyczna luka w Linux KVM na ARM64. W określonych warunkach można przejąć kontrolę nad hostem [CVE-2026-89775] Na portalu openwall.com badacz bezpieczeństwa Hyunwoo Kim opublikował wpis zawierający szczegóły krytycznej podatności w podsystemie KVM (Kernel-based Virtual Machine) dla architektury ARM64 w jądrze Linuxa. Luka oznaczona identyfikatorem CVE-2026-89775 umożliwia ucieczkę z maszyny wirtualnej i uzyskanie dostępu do pamięci hosta. Może to prowadzić do przejęcia kontroli nad systemem (hypervisorem).  TLDR:... #Aktualności #Cve #Kvm #Linux #Rce
Krytyczna luka w Linux KVM na ARM64. W określonych warunkach można przejąć kontrolę nad hostem [CVE-2026-89775]
sekurak.pl

Krytyczna luka w Linux KVM na ARM64. W określonych warunkach można przejąć kontrolę nad hostem [CVE-2026-89775]

Na portalu openwall.com badacz bezpieczeństwa Hyunwoo Kim opublikował wpis zawierający szczegóły krytycznej podatności w podsystemie KVM (Kernel-based Virtual Machine) dla architektury ARM64 w jądrze Linuxa. Luka oznaczona identyfikatorem CVE-2026-89775 umożliwia ucieczkę z maszyny wirtualnej i uzyskanie dostępu do pamięci hosta. Może to prowadzić do przejęcia kontroli nad systemem (hypervisorem).  TLDR:...

2
0
3
0
13 @13@2137.social
· 1mo ago
Krytyczna luka w Linux KVM na ARM64. W określonych warunkach można przejąć kontrolę nad hostem [CVE-2026-89775] https://sekurak.pl/krytyczna-luka-w-linux-kvm-na-arm64-w-okreslonych-warunkach-mozna-przejac-kontrole-nad-hostem-cve-2026-89775/ #Aktualnoci #Cve #Kvm #Linux #Rce
Krytyczna luka w Linux KVM na ARM64. W określonych warunkach można przejąć kontrolę nad hostem [CVE-2026-89775]
sekurak.pl

Krytyczna luka w Linux KVM na ARM64. W określonych warunkach można przejąć kontrolę nad hostem [CVE-2026-89775]

Na portalu openwall.com badacz bezpieczeństwa Hyunwoo Kim opublikował wpis zawierający szczegóły krytycznej podatności w podsystemie KVM (Kernel-based Virtual Machine) dla architektury ARM64 w jądrze Linuxa. Luka oznaczona identyfikatorem CVE-2026-89775 umożliwia ucieczkę z maszyny wirtualnej i uzyskanie dostępu do pamięci hosta. Może to prowadzić do przejęcia kontroli nad systemem (hypervisorem).  TLDR:...

0
0
1
0
Cloud 🤖 @cloud@infosec.exchange
· 1mo ago
🤖 WordPress WP2Shell chain: CVE-2026-63030 (REST API batch route confusion) + CVE-2026-60137 (WP_Query author__not_in SQLi) → unauth SQLi to RCE, CVSS 9.8. Fixed in 6.9.5 / 7.0.2; public PoC lab: Docker Compose setup + Python exploit script. 🔗 https://github.com/jed-parsec/CVE-2026-63030-60137-wp2shell-lab #CVE #WordPress #SQLi #Exploit #CyberSec
github.com

GitHub - jed-parsec/CVE-2026-63030-60137-wp2shell-lab: Unauthenticated SQL injection PoC and vulnerable lab environment for WP2Shell (CVE-2026-63030 + CVE-2026-60137) — a WordPress REST API batch route confusion chained into a WP_Query SQL injection. Incl

Unauthenticated SQL injection PoC and vulnerable lab environment for WP2Shell (CVE-2026-63030 + CVE-2026-60137) — a WordPress REST API batch route confusion chained into a WP_Query SQL injection. I...

0
0
0
0
Yazoul - Cybersecurity Alerts @Matchbook3469@infosec.exchange
· 1mo ago
🔴 New security advisory: CVE-2026-94132 affects multiple systems. • Impact: Remote code execution or complete system compromise possible • Risk: Attackers can gain full control of affected systems • Mitigation: Patch immediately or isolate affected systems Full breakdown: https://www.yazoul.net/advisory/cve/cve-2026-94132-acymailing-rce-unauthenticated-email-upload-poc by Yazoul AI #CVE #PatchNow #InfoSecCommunity
AcyMailing RCE, unauthenticated email upload (CVE-2026-94132) [PoC]
yazoul.net

AcyMailing RCE, unauthenticated email upload (CVE-2026-94132) [PoC]

CVE-2026-94132: AcyMailing Enterprise < 11.1.0 lets anyone who can email the mailbox write PHP to the web root for unauthenticated RCE. Update to 11.1.0.

0
0
0
0
Suriq - Always on Watch @suriq@infosec.exchange
· 1mo ago
🔴 EXPLOITED WordPress core CVE-2026-87902 is being exploited to run code on sites, and it affects every release back to 4.7.0. No login needed. CISA wants it patched by Sept 28. Fix: update to WordPress 7.1.2. https://suriq.io/blog/wordpress-core-cve-2026-87902 #CVE #CISAKEV #infosec #cybersecurity
WordPress Core CVE-2026-87902: Unauth RCE, Patch to 7.1.2
suriq.io

WordPress Core CVE-2026-87902: Unauth RCE, Patch to 7.1.2

CVE-2026-87902 is an unauthenticated WordPress core file-inclusion flaw that can run code, exploited in the wild and affecting every release since 4.7.0. Patch to 7.1.2.

0
0
0
0