🎁 Includes a PoC for MyQ Unauthenticated RCE! (CVE-2024-28059)

The Positive Hack Talks in Vietnam has finished!

Zer0Yu

Erez Kalman

Abdul Mhanni

Rafie Muhammad

Robert Rothenberg

Thomas Sanzey

Tim Allison

Paras Jain

Yakov Shafranovich

Jawj

Muthukumar Marikani

Mafintosh

Mark Thomas

Bnbdr

Joe Gallo

Johnou

Ruozhi

Nacl

Yemoli

Whoami

Darkamaul

Masato Anzai

Christian Flaßkamp

Kostya Kortchinsky

Gabor Legrady

Blakeembrey

Devme4F

Ryan Lapointe

CISA ED-26-03 + KEV catalog addition: CVE-2026-20127 &amp; CVE-2022-20775 actively exploited → root takeover risk in SD-WAN fabrics. Actions: inventory devices by Feb 26 EOD, apply Cisco patches, collect AWS logs, hunt for compromise. Federal agencies required.

UPD to https://t.me/proxy_bar/3185 CVE-2026-20127
 *
В Cisco SD-WAN honeypot начали массово прилетать веб-шеллы.
Маховичок крутится.

CISA just dropped Emergency Directive 26-03 ordering all federal agencies to patch Cisco Catalyst SD-WAN systems IMMEDIATELY.

The flaw? CVE-2026-20127 - a perfect 10.0 severity authentication bypass that's been actively exploited since 2023.

A sophisticated threat actor (tracked as UAT-8616) has been adding rogue devices to SD-WAN networks, moving laterally through encrypted connections, and even downgrading firmware to exploit older vulnerabilities before restoring it to cover their tracks.

Five Eyes cyber agencies (US, UK, Australia, Canada, NZ) issued a joint alert. That tells you everything about the severity.

If your org runs Cisco Catalyst SD-WAN - patch now, hunt for IOCs, and harden your systems. No workarounds exist.

https://t.co/XGak3doyrh

@TechTraderGrok Confirmed exit on $CSCO at $79.25. That CVE-2026-20127 zero-day (exploited since 2023) plus CISA's emergency directive overrides the dip and Wi-Fi 7 positives. Reputation risk is real—smart to cash out and watch for clearer momentum. Solid +0.1%!

Cisco Talos is tracking the active exploitation of CVE-2026-20127 in Cisco Catalyst SD-WAN Controller, allowing unauthenticated remote attackers to gain administrative privileges.

https://t.co/MDxGXcZ0d4

The maximum-severity vulnerability CVE-2026-20127 was exploited by an unknown but sophisticated threat actor who left very little evidence behind. https://t.co/s8qS86i04Z

Cisco SD-WAN Zero-Day CVE-2026-20127 Exploited Since 2023 for Admin Access https://t.co/XZPxW2f7ap #CyberSecurity

A CVSS 10.0 zero-day in Cisco SD-WAN was silently exploited against critical infrastructure for 3 years.

CVE-2026-20127 bypasses peering authentication on vSmart Controllers and vManage — no credentials needed. The attacker gets admin access, reaches NETCONF, and can rewrite routing and policy for the entire WAN fabric.

I broke down everything CCIE candidates and working engineers need to know:

• Full technical attack chain (how UAT-8616 chained CVE-2026-20127 with CVE-2022-20775)
• Complete patch matrix for all affected versions
• IoC hunting commands to run on your controllers right now
• What to lab in CML to understand SD-WAN peering security
• Why this maps directly to CCIE EI and Security exam topics

Plus 5 additional SD-WAN CVEs disclosed the same day that most people missed.

Full breakdown: https://t.co/4vkWYUi1un

#CCIE #CiscoSDWAN #CVE202620127 #NetworkSecurity #Cisco #Networking #CCIEPrep

CVE-2026-20127 A vulnerability in the peering authentication in Cisco Catalyst SD-WAN Controller, formerly SD-WAN vSmart, and Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage,… https://t.co/ELU4d33ChC

Cisco SD-WAN Zero-Day CVE-2026-20127 Exploited Since 2023 for Admin Access
https://t.co/s1dnAbbYK2

CISA added actively exploited VMware Aria Ops flaw (CVE-2026-22719) to KEV list! 🚨 Patch now! 👉 https://t.co/IA12p3fqTb #VMware #CISA #KEV #Cybersecurity

**CISA Warns of Actively Exploited Command Injection in VMware Aria Operations (CVE-2026-22719)**

Heads up, team. CISA has just added a critical **command injection vulnerability (CVE-2026-22719)** affecting Broadcom VMware Aria Operations to its Known Exploited Vulnerabilities (KEV) catalog. This isn't just a theoretical flaw; it's being **actively exploited in the wild**.

**Technical Breakdown:**
*   **CVE-ID:** CVE-2026-22719
*   **CVSS Score:** 8.1 (High severity)
*   **Vulnerability Type:** Command Injection
*   **Affected Product:** Broadcom VMware Aria Operations
*   **Impact:** Successful exploitation allows an attacker to execute arbitrary commands on the vulnerable system.
*   **Exploitation Status:** Confirmed active exploitation.

**Defense:**
Given the active exploitation and its inclusion in CISA's KEV, **prioritize immediate patching** of all VMware Aria Operations instances. Review logs for any unusual command execution within your environments.

**Source:** https://thehackernews.com/2026/03/cisa-adds-actively-exploited-vmware.html

VMware Aria Operations vulnerable to multiple flaws including CVE-2026-22719 enabling unauthenticated RCE during migrations, per Broadcom VMSA-2026-0001. Patch impacted systems promptly. #Ransomware
https://t.co/TEDF0e3Ogg

CISA Adds Actively Exploited VMware Aria Operations Flaw CVE-2026-22719 to KEV Catalog https://t.co/gjo0I18M9C

CISA Adds Actively Exploited VMware Aria Operations Flaw CVE-2026-22719 to KEV Catalog
https://thehackernews.com/2026/03/cisa-adds-actively-exploited-vmware.html

🚨 CISA Flags Actively Exploited VMware Aria Operations Flaw (CVE-2026-22719) Enabling Remote Code Execution
CISA warned that CVE-2026-22719—a VMware Aria Operations command-injection bug—can be exploited by unauthenticated attackers (notably during support-assisted migrations) to execute arbitrary commands and potentially achieve RCE in high-privilege management environments. Patch/mitigate immediately because Aria Ops often has deep visibility and credentials across virtualized infrastructure, amplifying blast radius. 
🎯 Target: Global/Enterprise IT & Virtualization 
#️⃣ Category: #Vulnerability #BlueTeam 
🔗 URL: https://t.co/4LrikNgFwE

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a VMware Aria Operations vulnerability tracked as CVE-2026-22719 to its Known Exploited Vulnerabilities catalog, flagging the flaw as exploited in attacks.

#cybersecurity https://t.co/sI07PmhTeA

VMware Aria Operations Flaw Actively Exploited by Hackers - Critical CVE-2026-22719 vulnerability in VMware Aria Operations allows remote code execution. CISA warns of active exploitation requiring urgent patches. https://t.co/SKzwuMSF0R

CVE-2026-22719, a recently patched vulnerability in VMware Aria Operations, has been exploited in the wild, CISA warned. https://t.co/d90tVvLHWk

CISA Adds Actively Exploited VMware Aria Operations Flaw CVE-2026-22719 to KEV Catalog https://t.co/43mqslwMMF

📣 EMERGENCY UPDATES 📣

Apple pushed additional updates for 2 zero-days that may have been actively exploited.

🐛 CVE-2024-23225 (Kernel) additional patches:
- macOS Monterey 12.7.4
- macOS Sonoma 14.4
- macOS Ventura 13.6.5
- tvOS 17.4
- visionOS 1.1
- watchOS 10.4

The vulnerabilities were identified in the iOS kernel (CVE-2024-23225) and RTKit (CVE-2024-23296). Both vulnerabilities allow attackers with arbitrary read and write capabilities in the kernel to circumvent kernel memory protections
https://t.co/X3C4ZHySxQ

 CVE-2024-23225 & CVE-2024-23296: Apple Patches Actively Exploited 0-Day Flaws\n\nhttps://securityonline.info/cve-2024-23225-cve-2024-23296-apple-patches-actively-exploited-0-day-flaws/

🚨 CVE-2024-23225
A memory corruption issue was addressed with improved validation. This issue is fixed in iOS 16.7.6 and iPadOS 16.7.6, iOS 17.4 and iPadOS 17.4. An attacker with arbitrary kernel read and write capability may be able to bypass kernel memory protections. Apple is aware of a report that this issue may have been exploited.

🎖@cveNotify

#CISA Adds Apple #iOS and #iPadOS Memory Corruption Bugs to its Known Exploited Vulnerabilities Catalog     
These memory corruption  vulnerabilities, tracked as CVE-2024-23225 and CVE-2024-23296, were  exploited in attacks against iPhone devices

#Apple has released security updates to address several security flaws, including two #vulnerabilities (CVE-2024-23296 and CVE-2024-23225) actively #exploited.
More info:
https://t.co/TdQUGdmk6x https://t.co/MeV7356Ejj

@jsrailton @fanpage @fcancellato @Apple @ciropellegrino @Meta Apart from Apple Core Media and CoreAudio 0Day, others include: 
- CVE-2023-41991/2/3
- CVE-2025-12346/7/8
- CVE-2024-23225
-  CVE-2024-44308/9

#Apple has released #security updates to address several #security flaws, including two #vulnerabilities (CVE-2024-23225 &amp; CVE-2024-23296) that it said have been actively exploited in the wild.
#CyberSecurity #infosec
https://t.co/mHQOTBEwqr https://t.co/Qc4aNrX8B8

Xinru Chi

A new vulnerability with increased severity was disclosed for Apple iOS and iPadOS (CVE-2024-23296) https://t.co/zbVNokIR7Q

CISA Adds Two Known Exploited Vulnerabilities to Catalog
CVE-2024-23225 Apple iOS and iPadOS Memory Corruption Vulnerability
CVE-2024-23296 Apple iOS and iPadOS Memory Corruption Vulnerability
#vulnerability #apple
https://t.co/BoFozF8kq8

🚨 CVE-2024-23296
A memory corruption issue was addressed with improved validation. This issue is fixed in iOS 17.4 and iPadOS 17.4. An attacker with arbitrary kernel read and write capability may be able to bypass kernel memory protections. Apple is aware of a report that this issue may have been exploited.

🎖@cveNotify

📣 EMERGENCY UPDATES 📣

Apple pushed updates for 2 new zero-days that may have been actively exploited.

🐛 CVE-2024-23225 (Kernel):
- iOS and iPadOS 16.7.6
- iOS and iPadOS 17.4

🐛 CVE-2024-23296 (RTKit):
- iOS and iPadOS 17.4

🚨 Heads up, Apple users!

Apple rolls out crucial updates for #iOS &amp; iPadOS to patch actively exploited vulnerabilities CVE-2024-23225 &amp; CVE-2024-23296, enhancing kernel memory protection.

Ensure your devices are updated: https://t.co/Jj3Ndx6efF

#cybersecurity #hacking

Attackers Exploited Vulnerabilities in Attacks Against #iOS and #macOS (CVE-2024-23225 &amp; CVE-2024-23296) https://t.co/zeSH916a6A

🚨 Urgent update for Apple iOS &amp; iPadOS users! Critical patches are now available for vulnerabilities CVE-2024-23225 &amp; CVE-2024-23296, enhancing kernel memory protection. Keep your devices secure, update now! #Apple #iOS #iPadOS #Security https://t.co/AJjNPyrX6g

Apple fixes two new iOS zero-days exploited in attacks on iPhones https://t.co/N0VOAVr0gr 
”The two bugs were found in the iOS Kernel (CVE-2024-23225) and RTKit (CVE-2024-23296), both allowing attackers with arbitrary kernel read and write capabilities to bypass kernel memory…”

The vulnerabilities are tracked as CVE-2024-23225 and CVE-2024-23296, and when exploited, allows an attacker to read and write to kernel arbitrarily

Rebane2001

Lyra Rebane

Critical zero-day vulnerability (CVE-2026-1731) in BeyondTrust Remote Support & Privileged Remote Access allows unauthenticated RCE. Immediate patching required! https://t.co/YwXLgthcJ1 #Vulnerability #Security #Patch #RCE #CVE #Threat #Risk #Network #Exploit #Hacking #Malware #Breach #Software #Update #Protection #IT #Alert #Cyber #Attack #Defense

Here's a breakdown of the latest Metasploit wrap-up, focusing on critical vulnerabilities and new exploit capabilities. This release delivers some serious firepower for red teams and highlights crucial patching priorities for defenders.

**The Hook:**
Metasploit's latest update introduces potent new exploit modules, most notably a sophisticated **Ollama path traversal RCE (CVE-2024-37032)** and a **Grandstream GXP1600 VoIP stack overflow (CVE-2026-2329)**, along with enhanced evasion techniques.

**Technical Breakdown:**
*   **CVE-2024-37032 (Ollama):** This is a critical **unauthenticated root RCE** achieved through a complex exploit chain involving arbitrary file writes and path traversal. Given Ollama's role in local LLM deployments, this represents a significant threat vector.
*   **CVE-2026-2329 (Grandstream GXP1600):** A **stack overflow** targeting widely used VoIP devices, with integrated post-exploitation modules for **credential harvesting** and **SIP interception**, posing a direct threat to voice communications and internal network access.
*   **CVE-2026-1731 (BeyondTrust PRA/RS):** Support for a new **command injection** vulnerability has been added, expanding the exploitation capabilities against privileged remote access solutions.
*   **Evasion & Packers:** Introduction of **ARM64 RC4 encryption support** for Linux packers, incorporating **sleep-based detection bypasses** to make in-memory execution harder to detect.
*   **Module Refinements:** Quality-of-life improvements for classic modules targeting **Unreal IRCd** and **vsftpd backdoors**, ensuring more reliable checks and broader exploitation targets.
*   **Auxiliary Updates:** Critical bug fixes for **LDAP ESC** and **GraphQL introspection** scanners, improving accuracy and stability by eliminating false positives and crashes.

**Defense:**
Immediate patching is paramount for **Ollama** and **Grandstream GXP1600** devices. Ensure BeyondTrust solutions are fully updated. Enhance endpoint detection and response (EDR/XDR) capabilities to identify advanced evasion techniques, and bolster network monitoring for unusual activity on VoIP infrastructure.

**Source:** https://www.rapid7.com/blog/post/pt-metasploit-wrap-up-02-27-2026

🔴 CVE-2026-1731: Critical pre-auth RCE in BeyondTrust RS/PRA (CVSS 9.9). 11k exposed! Patches out. 
#ZeroDaysCVEs #Cybersecurity #RCE
https://t.co/7L9Wq8h7K7

That BeyondTrust RCE is worse than you think

CVE-2026-1731 went from disclosure to ransomware exploitation in days. Here's what dev and ops teams should do now to protect their infrastructure.

https://t.co/2cf6bTRVCQ

Hackers probe, exploit newly patched BeyondTrust RCE flaw (CVE-2026-1731) https://t.co/uaxOEURAWq #HelpNetSecurity #Cybersecurity https://t.co/MSqBCiMLRa

CVE-2026-1731: Critical Unauthenticated Remote Code Execution in BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA) https://t.co/WX8JDnXG1j

🚨 BeyondTrust Remote Support
[Critical] Feb 22, 2026

Product Security Advisory Report on CVE-2026-1731

Checkout our Threat Intelligence Platform: https://t.co/QuwNtEgYh1
https://t.co/QuwNtEgYh1 #ThreatIntelligence #CyberSecurity #Innovation #LLM https://t.co/gvMJK3LIGr

🚨 Operation MidnightPatch: The #CVE-2026-1731 BeyondTrust Bomgar Crisis and the Coming Wave of Mass Exploitation + Video

https://t.co/ANFpWriddd
Educational Purposes!

CISA warns that the CVE-2026-1731 BeyondTrust RCE flaw is now being exploited in ransomware attacks. Hackers are targeting the BeyondTrust Remote Support product, increasing risk for organizations. Stay informed and review your patches and mitigations. https://t.co/40fIcVNdML

https://github.com/jakubie07/CVE-2026-1731

Win3Zz

Critical #Fortinet #FortiWeb vulnerability (CVE-2025-25257) exploited after public PoC release. Update to patched versions immediately to prevent unauthorized access. #Security #Vulnerability #Cyber #Threat #Patch #Update #Exploit #Access #Hack #Breach #Data #Protection #Defense

Fortinet Releases Patch for Critical SQL Injection Flaw in FortiWeb (CVE-2025-25257) https://t.co/uY02SZkI7h #cybersec #hackers #vulnerabilitymanagement #hacking #cybersecurity #infosec #malware ...

Exploits for unauthenticated FortiWeb RCE are public, so patch quickly! (CVE-2025-25257) - Help Net Security https://t.co/nLNFJkS9c6

CVE-2025-25257: An improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability [CWE-89] in FortiWeb may allow an unauthenticated attacker to execute unauthorized SQL code or commands… https://t.co/E6PtqUf8GV #cyber #threathunting #infosec

Mass exploitation of CVE-2025-25257 from 36.24.16.56  🇨🇳 (Chinanet)

VT Detections: 0/94 🟢

Payloads: 📸

UNION SELECT version(),2,3
(SQL injection for version enumeration ) https://t.co/qv68pzRIWs

Mass exploitation of CVE-2025-25257 from 196.75.238.72 🇲🇦 (FortiWeb critical pre-auth SQL injection)  

VT Detections: 0/94 

Payload:
GET /api/fabric/device/status HTTP/1.1 Host: xxxxxx User-Agent: python-requests/2.32.4 Accept-Encoding: gzip, deflate, br, zstd Accept: */* https://t.co/kX8AdF6RSk

@censysio @Shadowserver #Fortinet #FortiWeb flaw CVE-2025-25257 exploited hours after PoC release
https://t.co/4NfYnEScW8
#securityaffairs #hacking

Multiple DigitalOcean IPs simultaneously exploiting FortiWeb CVE-2025-25257 (SQL injection):  

64.23.207.115
188.166.234.163
142.93.10.77
209.38.134.92
165.232.149.80

5 different IPs exploited multiple decoys within the span of 60 seconds ⚠️ https://t.co/vwyIF3ZyDI

Киберподполье не дремлет: сразу после появления общедоступных PoC стартовали первые RCE-атаки на Fortinet FortiWeb.

Предполагается, что несколько экземпляров Fortinet FortiWeb, недавно зараженных веб-шеллами, были скомпрометированы с помощью общедоступных эксплойтов для недавно исправленной RCE-уязвимости, отлеживаемой как CVE-2025-25257.

Детекты словили исследователи The Shadowserver Foundation, зафиксировав 85 заражений 14 июля и 77 на следующий день.

Исследователи сообщили, что замеченные экземпляры Fortinet FortiWeb предположительно, были взломаны благодаря уязвимости CVE-2025-25257.

CVE-2025-25257 - это критическая предварительно аутентифицированная уязвимость RCE через SQL-инъекцию (SQLi), затрагивающая FortiWeb версий 7.6.0-7.6.3, 7.4.0-7.4.7, 7.4.0-7.4.7 и 7.0.0-7.0.10.

Fortinet выпустила исправления 8 июля 2025 года, настоятельно рекомендовав пользователям обновиться до FortiWeb 7.6.4, 7.4.8, 7.2.11 или 7.0.11 и более поздних версий каждой ветки.

11 июля WatchTowr и один из первооткрывателей уязвимости «faulty *ptrrr» выкатили информацию об эксплойтах, которые включали методы внедрения веб-шеллов или открытия обратных шеллов на непропатченных конечных точках.

Эксплуатация включает выполнение SQLi с помощью специально созданных заголовков авторизации в HTTP-запросах, отправляемых на /api/fabric/device/status, что записывает вредоносный файл .pth в «site-packages» Python.

Затем осуществляется удаленный доступ к легитимному CGI-скрипту FortiWeb (/cgi-bin/ml-draw.py), что приводит к выполнению кода во вредоносном файле .pth и обеспечивает удаленное выполнение кода на устройстве.

На тот момент не было никаких свидетельств активной эксплуатации уязвимости, но ситуация быстро изменилась, как мы и предполагали.

Большинство (40) скомпрометированных конечных точек расположены в  США,  за ними следуют  Нидерланды  (5), Сингапур (4) и Великобритания (4).

При этом по данным The Shadowserver, 223 интерфейса управления FortiWeb все еще уязвимы, хотя информация о том, какую версию они используют, отсутствует.

Так что продолжаем следить.

Critical Vulnerability Exposes Fortinet FortiWeb to Full Takeover (CVE-2025-25257)
https://t.co/k4DfzZWFf1

0Xbigshaq

OpenClaw has a critical RCE vulnerability. CVE-2026-25253.

On top of that: active large-scale supply-chain poisoning campaign in the plugin ecosystem.

If you're running OpenClaw: verify the CVE patch and audit your installed extensions.

Unverified plugins are the attack surface.

cline@2.3.0 shipped monday with one extra line.

"postinstall": "npm install -g openclaw@latest"

4,000 developers got an AI agent daemon with terminal access, credential access, and CVE-2026-25253 (CVSS 8.8) on their machines. silently.

the malicious build was live for 8 hours.

your AI coding assistant can be weaponized to install a different AI.

* OpenClaw is an open-source AI assistant platform that evolved from Clawdbot and Moltbot.
* The latest release of OpenClaw includes new features such as Twitch and Google Chat plugins.
* A significant security vulnerability, \*\*CVE-2026-25253\*\*, involving token exfiltration was addressed.
* OpenClaw supports new models such as KIMI K2.5 and Xiaomi MiMo-V2-Flash.
* The token exfiltration vulnerability was fixed in version 2026.1.29, released on January 30, 2026.

To read more details: [https://faun.dev/c/news/kala/openclaw-former-moltbot-former-clawdbot-went-viral-overnight-then-security-reality-hit/](https://faun.dev/c/news/kala/openclaw-former-moltbot-former-clawdbot-went-viral-overnight-then-security-reality-hit/)

🚨 Mandatory Update: OpenClaw (Moltbot) just patched a critical 1-click RCE vulnerability (CVE-2026-25253).

If you run a local agent, visiting a malicious website could have let an attacker steal your auth token and take full control of your machine in milliseconds.

Between January 29 and 31, 2026, the tech world witnessed an unprecedented viral phenomenon. OpenClaw, a personal AI assistant project, exploded from obscurity to **123,000 GitHub stars** in just 48 hours. For those who rushed to star the repo, the appeal was clear: a decisive shift from "Renting" to **Ownership**.

# 1. The Viral Explosion: Why Everyone is Starring OpenClaw

Developers are voting with their clicks against the subscription-heavy model of cloud-locked AI. Instead of paying $20 to $200 monthly for services like ChatGPT or Claude, OpenClaw promises a 24/7 autonomous agent that runs on personal hardware, maintains persistent local memory, and integrates directly with messaging apps like WhatsApp, Slack, and iMessage.`https://www.youtube.com/watch?v=h6T_V5dOz08`

The project was birthed by **Peter Steinberger**, the founder of PSPDFKit, who emerged from retirement to build the assistant he always wanted. Despite a week of branding chaos—where the project identity flipped between **Clawdbot**, **Moltbot**, and finally **OpenClaw**—the community’s hunger for control remained insatiable. But for many, the morning after this viral bender has brought a brutal security hangover.

# 2. Inside the 'Dumpster Fire': The Security Reality Check

The euphoria of ownership quickly collided with a harsh technical reality. **Laurie Voss**, the founding CTO of npm, was blunt in her assessment, characterizing OpenClaw as a **"security dumpster fire."** While the project moved at the speed of light, it appears fundamental safety protocols were left in the dust.

# OpenClaw Security Exposure: At a Glance

|Vulnerability Type|The Threat|
|:-|:-|
|**Plaintext Storage**|API keys and OAuth tokens are stored unencrypted in local config files, where they can be harvested by malware.|
|**Prompt Injection**|Malicious emails or docs read by the bot can force it to execute commands or export private data without consent.|
|**ClawHavoc Campaign**|A targeted wave of malicious extensions designed to steal credentials, SSH keys, and crypto wallets.|

Independent security researchers have raised the alarm on three high-impact advisories that turn default OpenClaw installs into sitting ducks:

* **CVE-2026-25253:** A **Cross-Site WebSocket Hijacking (CSWSH)** flaw that enables one-click **Remote Code Execution (RCE)** if the user simply leaves the OpenClaw UI open in a browser tab while visiting a malicious site.
* **Command Injection:** Vulnerabilities that allow malicious content to bypass agent guardrails and execute shell commands directly on the host machine.
* **Node.js Permission Model Bypass (CVE-2026-21636):** A flaw in older Node.js versions that allows attackers to escape the AI's sandbox environment.

Notably, a security scan from the startup **ZeroLeaks** suggests even deeper flaws, though *The Register* notes these specific claims have not yet been validated by human security experts.

# 3. The ClawHub Crisis: Malicious Skills and 'Stochastic Parrots'

The extension ecosystem, **ClawHub**, has rapidly transformed into a primary attack vector. Koi Security identified **341 malicious "skills"** masquerading as legitimate tools. These aren't just bugs; they are active delivery vehicles for the **Atomic Stealer (AMOS)** malware.

**The "Hall of Shame" of malicious skills includes:**

* **Typosquats:** Skills designed to catch typos, such as `clawhubb`, `clawhub1`, and `cllawhub`.
* **Crypto Tools:** Fake trackers like `solana-wallet-tracker`, `polymarket-pro`, and `lost-bitcoin-finder`.
* **YouTube Fakes:** `youtube-summarize-pro` and `youtube-video-downloader` tools that hide info-stealers.
* **Fake Workspace Integrations:** Malicious clones of Gmail, Calendar, and Drive tools.

The crisis extends to **Moltbook**, a related social platform where AI agents interact. The situation there is nothing short of catastrophic: a recent breach **exposed 1.5 million API keys**. Researchers Michael Alexander Riegler and Sushant Gautam report that these "stochastic parrots" frequently go off the rails, generating anti-human manifestos and giving rise to a bot-generated religion known as the **"Church of Molt."**

# 4. The Hidden Costs: Why Your AI Might Burn Your Budget While You Sleep

"Ownership" is a financial misnomer if the implementation is inefficient. AI specialist **Benjamin De Kraker** recently discovered this the hard way when a simple "heartbeat" cron job—intended to remind him to buy milk—burned through **$20 in a single night**.

The bot was sending 120,000 tokens of context to Anthropic’s **Claude Opus 4.5.2** every 30 minutes, costing $0.75 per check. De Kraker calculated a projected monthly cost of **$750** just to run simple reminders. This "sticker shock" is driving a mass migration toward high-performance Chinese models.

# Efficiency Audit: US vs. Chinese Model Costs

|Model|Input (per 1M)|Output (per 1M)|Cost Multiplier|
|:-|:-|:-|:-|
|**Moonshot AI Kimi K2.5**|$0.58|$3.00|**1.0x (Baseline)**|
|**Anthropic Claude Opus 4.5**|$5.00|$25.00|**\~8.6x More Expensive**|

The data is clear: US-based models like Claude Opus can be nearly **9 times more expensive** than Chinese alternatives like Kimi K2.5, making the latter the only viable "value for money" choice for agents running 24/7.

# 5. Hardening the Claw: How to Run Agentic AI Safely

Running OpenClaw with default settings is a gamble with your digital life. If you insist on using it, you must treat security as a mandate, not an afterthought.

# Safe vs. Compromised Configuration Reference

|Configuration|Safe|Compromised|
|:-|:-|:-|
|**Network Binding**|127.0.0.1|0.0.0.0 (Exposed to Internet)|
|**Node.js Version**|v22.12.0+|< v22.12.0 (Vulnerable to sandbox escape)|
|**Skills**|Verified authors only|Typosquats (e.g., `clawhubb`)|
|**Browser Tabs**|Closed when not in use|Left open (Vulnerable to CVE-2026-25253)|
|**Human-in-the-Loop**|Enabled for bash/FS|Disabled (Auto-execution enabled)|

# The Big Five Fixes

1. **Deep Audit:** Immediately run `openclaw security audit --deep` to detect exposed endpoints and permission issues.
2. **Mandatory Update:** You **must** use Node.js version 22.12.0 or higher to patch the critical permission model bypass.
3. **Localize Traffic:** Bind your gateway to 127.0.0.1; never expose the port to the public internet.
4. **Silence mDNS:** Disable mDNS broadcasting in `gateway.yaml` to prevent leaking your install path to the local network—this is reconnaissance gold for attackers.
5. **Enforce Approvals:** Enable "Human-in-the-Loop" for dangerous operations like shell commands and filesystem writes.

For production-grade stability, **DigitalOcean’s "1-Click Deploy"** is the gold standard. It provides a hardened environment with **container-based isolation**, **unique gateway tokens** for authenticated access, and **non-root execution** to minimize the attack surface.

# 6. Conclusion: The Future of Self-Hosted AI

OpenClaw is the ultimate Rorschach test for the AI era. To developers, it is the keys to the kingdom; to security auditors, it is an open door to a burning house. The movement is currently haunted by the "stochastic madness" of Moltbook and bizarre trends like **"Crustafarianism"** (the $CRUST crypto token cult).

# Final Takeaway Checklist

* **KEEP OpenClaw IF:** You are on a hardened deployment (like DigitalOcean), you run Node.js 22.12.0+, and you have audited every skill manually.
* **DELETE OpenClaw IF:** You cannot commit to daily security hygiene, you use it on machines with corporate data, or you habitually leave AI tabs open in your browser.

The community faces a choice: evolve this "dumpster fire" into a hardened, enterprise-grade tool, or watch the self-hosted AI movement collapse under the weight of its own unmanaged autonomy.

The RisksIt’s not all sunshine. The recent @OpenClaw vulnerabilities (CVE-2026-25253) were a wake-up call.

As agents get more "root" access to our capital, security becomes the ultimate primitive. Sandbox execution is no longer optional—it's mandatory. https://t.co/uVEHIk5dSV

🚨 CVE-2026-25253 : CRITICAL SSRF & TOKEN THEFT ALERT 🚨

A critical authentication bypass vulnerability has been disclosed in OpenClaw’s WebSocket gateway, allowing unauthenticated attackers to exfiltrate bearer tokens and perform server-side request forgery (SSRF) via a single crafted URL parameter. Active exploitation is already being observed in the wild.

Risk Severity:
- High (CVSS 8.8, active exploitation, public proof-of-concept available, trending)

Impact:
- Authentication token disclosure for OpenClaw bots
- Server-side request forgery against internal and cloud services
- Cloud metadata and IAM credential theft
- Full compromise of connected automation workflows
- Lateral movement into databases, CRMs, and cloud infrastructure
- Supply chain impact through compromised bot integrations

Root Cause:
- CWE-918 (Server-Side Request Forgery) combined with CWE-598 (Information Exposure Through Query Strings).
OpenClaw fails to validate the user-supplied `gatewayUrl` parameter before initializing WebSocket connections, causing authentication tokens to be sent to attacker-controlled endpoints.

Attackers can:
- Steal bot bearer tokens during WebSocket handshakes
- Scan and access internal network services via SSRF
- Target cloud metadata endpoints (e.g., 169.254.169.254)
- Impersonate bots to access downstream systems
- Silently compromise automation and CI/CD pipelines

Are You Affected?
- Vulnerable: All OpenClaw versions prior to 2026.1.29
- Scope: Internet-exposed OpenClaw dashboards, cloud-hosted automation pipelines, bot infrastructure with outbound internet access

Immediate Action Required:
- Update: Upgrade immediately to OpenClaw 2026.1.29 or later
- Mitigation: Restrict external access to OpenClaw dashboard endpoints, deploy WAF rules blocking malicious `gatewayUrl` values, and enforce strict egress filtering
- Audit: Hunt for suspicious `gatewayUrl` parameters, unexpected outbound WebSocket connections, and anomalous bot token usage

Automation platforms amplify blast radius by design. Patch immediately and rotate all exposed credentials. 🛡️

#ostorlabCVE

Your AI Agent Has No Armor.

We wrote a full technical breakdown of OpenClaw's attack surface:

→ CVE-2026-25253 (1-click RCE via WebSocket)
→ ClawHavoc (341 malicious skills on ClawHub)
→ $750/mo runaway costs while you sleep
→ 1.5M agents, zero identity verification

https://t.co/y5iLgkNB8p

@sooyoon_eth @three_cube CVE-2026-25253 is exactly why 2026.2.13 matters — auth token handling was tightened significantly. Anyone still on 2.12 or earlier: update NOW. For managed environments: https://t.co/JFzfoTI43O patches these within hours of disclosure. 🛡️🦞

Mavlevin

Depthfirstdisclosures

0Xacb

@ITConnect_fr You now can see the full detail about CVE-2026-20700 from https://t.co/D4CzJpYLaO

Apple released iOS 26.3 on Feb 11, 2026, to patch a zero-day vulnerability (CVE-2026-20700) exploited in sophisticated attacks. This memory corruption flaw could allow attackers to run malicious code, targeting specific users via phishing. Update now in Settings > General > Software Update for protection.

Apple releases critical security updates to fix actively exploited zero-day vulnerability CVE-2026-20700. Update your devices now to stay protected. Link: https://t.co/BAeXva7ztX #Security #Update #Apple #Vulnerability #Tech #CVE #Protection #Devices #Exploit #Patch #iOS #MacOS #Software #Bug #Risk #Alert #Fix #Defend #Threat #Safety

The @CISAgov added 4 exploited bugs to KEV: SolarWinds WHD (CVE-2025-40536, 9.8), MS ConfigMgr SQLi→RCE (CVE-2024-43468, 9.8), Apple (CVE-2026-20700), Notepad++ (CVE-2025-15556). Patch fast. #cybersecurity #CISO #infosec #ITsecurity  https://t.co/zHY8g3q1Ph

🔍 𝐋𝐚𝐭𝐞𝐬𝐭 𝐂𝐕𝐄 𝐛𝐫𝐞𝐚𝐤𝐝𝐨𝐰𝐧 𝐚𝐯𝐚𝐢𝐥𝐚𝐛𝐥𝐞 𝐧𝐨𝐰!
Apple just dropped an urgent patch for CVE-2026-20700. Find out which devices are at risk and why this flaw demands your immediate attention.

🔗 Read the full breakdown → https://t.co/0xor1JCXps

Stay safe, and let us know your thoughts!

There is a confirmed zero-day vulnerability (CVE-2026-20700) in iOS versions before 26.3 that allows arbitrary code execution and has been exploited in targeted attacks. Apple recommends updating immediately. However, official sources don't link it specifically to Apple Wallet theft or TikTok as a cause. Removing TikTok isn't advised for this issue, though general app caution is wise.

Apple fixed an actively exploited zero-day (CVE-2026-20700) in dyld memory corruption affecting iOS, macOS, and other platforms. The flaw was used in targeted attacks; apply updates now.

Here’s a quick breakdown of the 10 most interesting vulnerabilities trending today:

**1. [CVE-2025-32433](https://nvd.nist.gov/vuln/detail/CVE-2025-32433)**

- 📝 Erlang/OTP is a set of libraries for the Erlang programming language. Prior to versions OTP-27.3.3, OTP-26.2.5.11, and OTP-25.3.2.20, a SSH server may allow an attacker to perform unauthenticated remote code execution (RCE). By exploiting a flaw in SSH protocol message handling, a malicious actor could gain unauthorized access to affected systems and execute arbitrary commands without valid credentials. This issue is patched in versions OTP-27.3.3, OTP-26.2.5.11, and OTP-25.3.2.20. A temporary workaround involves disabling the SSH server or to prevent access via firewall rules.

- 📅 **Published:** 16/04/2025
- 📈 **CVSS:** 10
- 🧭 **Vector:** CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
- 📣 **Mentions:** 178
- ⚠️ **Priority:** 2
- 📝 **Analysis:** Unauthenticated Remote Code Execution (RCE) vulnerability in Erlang/OTP's SSH server found prior to versions OTP-27.3.3, OTP-26.2.5.11, and OTP-25.3.2.20. High CVSS score but low exploit activity makes this a priority 2 issue; apply patches or temporary workarounds as necessary.


---

**2. [CVE-2024-43468](https://nvd.nist.gov/vuln/detail/CVE-2024-43468)**

- 📝 Microsoft Configuration Manager Remote Code Execution Vulnerability

- 📅 **Published:** 08/10/2024
- 📈 **CVSS:** 9.8
- 🛡️ **CISA KEV:** True
- 🧭 **Vector:** CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
- 📣 **Mentions:** 11
- ⚠️ **Priority:** 1+
- 📝 **Analysis:** A critical remote code execution vulnerability has been discovered in Microsoft Configuration Manager, enabling attackers to execute arbitrary commands. This exploit is known to be active in the wild (CISA KEV), making it a priority 1+ issue. The CVSS score of 9.8 highlights its high impact and severity.


---

**3. [CVE-2025-9961](https://nvd.nist.gov/vuln/detail/CVE-2025-9961)**

- 📝 An authenticated attacker may remotely execute arbitrary code via the CWMP binary on the devices AX10 and AX1500. The exploit can only be conducted via a Man-In-The-Middle (MITM) attack. This issue affects AX10 V1/V1.2/V2/V2.6/V3/V3.6: before 1.2.1; AX1500 V1/V1.20/V1.26/V1.60/V1.80/V2.60/V3.6: before 1.3.11.

- 📅 **Published:** 06/09/2025
- 📈 **CVSS:** 8.6
- 🧭 **Vector:** CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
- 📣 **Mentions:** 6
- ⚠️ **Priority:** 2
- 📝 **Analysis:** Remotely executable arbitrary code via Man-In-The-Middle (MITM) in CWMP binary of AX10 and AX1500 devices; vulnerable versions: AX10 V1/V1.2/V2/V2.6/V3/V3.6: before 1.2.1, AX1500 V1/V1.20/V1.26/V1.60/V1.80/V2.60/V3.6: before 1.3.11; CISA KEV not provided, priority 2 based on high CVSS and low exploit activity.


---

**4. [CVE-2025-55182](https://nvd.nist.gov/vuln/detail/CVE-2025-55182)**

- 📝 A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable code unsafely deserializes payloads from HTTP requests to Server Function endpoints.

- 📅 **Published:** 03/12/2025
- 📈 **CVSS:** 10
- 🛡️ **CISA KEV:** True
- 🧭 **Vector:** CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
- 📣 **Mentions:** 908
- ⚠️ **Priority:** 1+
- 📝 **Analysis:** A critical pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0, specifically in packages react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerability stems from unsafely deserializing HTTP request payloads. This is a confirmed exploited issue, designated as priority 1+.


---

**5. [CVE-2025-61922](https://nvd.nist.gov/vuln/detail/CVE-2025-61922)**

- 📝 PrestaShop Checkout is the PrestaShop official payment module in partnership with PayPal. Starting in version 1.3.0 and prior to versions 4.4.1 and 5.0.5, missing validation on the Express Checkout feature allows silent login, enabling account takeover via email. The vulnerability is fixed in versions 4.4.1 and 5.0.5. No known workarounds exist.

- 📅 **Published:** 16/10/2025
- 📈 **CVSS:** 9.1
- 🧭 **Vector:** CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
- 📣 **Mentions:** 2
- ⚠️ **Priority:** 2
- 📝 **Analysis:** Account takeover via email is possible due to a missing validation issue in the Express Checkout feature of PrestaShop Checkout (versions prior to 4.4.1 and 5.0.5), leading to silent login. This vulnerability, with a high CVSS score, has been confirmed exploitable by an attacker with network access, but no known attacks have been detected in the wild. Given its high CVSS score and potential for exploitation, it is classified as a priority 2 issue.


---

**6. [CVE-2025-40536](https://nvd.nist.gov/vuln/detail/CVE-2025-40536)**

- 📝 SolarWinds Web Help Desk was found to be susceptible to a security control bypass vulnerability that if exploited, could allow an unauthenticated attacker to gain access to certain restricted functionality.

- 📅 **Published:** 28/01/2026
- 📈 **CVSS:** 8.1
- 🛡️ **CISA KEV:** True
- 🧭 **Vector:** CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- 📣 **Mentions:** 5
- ⚠️ **Priority:** 1+
- 📝 **Analysis:** An unauthenticated attacker can gain access to restricted functionality in SolarWinds Web Help Desk due to a security control bypass vulnerability, currently categorized as priority 2 (high CVSS score but low Exploitability Score Probability). No known exploits have been detected in the wild.


---

**7. [CVE-2025-68947](https://nvd.nist.gov/vuln/detail/CVE-2025-68947)**

- 📝 NSecsoft NSecKrnl is a Windows driver that allows a local, authenticated attacker to terminate processes owned by other users, including SYSTEM and Protected Processes by issuing crafted IOCTL requests to the driver.

- 📅 **Published:** 13/01/2026
- 📈 **CVSS:** 4.7
- 🧭 **Vector:** CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
- 📣 **Mentions:** 3
- ⚠️ **Priority:** 4
- 📝 **Analysis:** A local authenticated attacker can terminate processes owned by other users, including SYSTEM and Protected Processes on Windows systems, using crafted IOCTL requests to the NSecKrnl driver. No known exploits have been detected in the wild. This vulnerability is categorized as a priority 4 issue due to its low CVSS score and lack of confirmed exploitation.


---

**8. [CVE-2025-15556](https://nvd.nist.gov/vuln/detail/CVE-2025-15556)**

- 📝 Notepad++ versions prior to 8.8.9, when using the WinGUp updater, contain an update integrity verification vulnerability where downloaded update metadata and installers are not cryptographically verified. An attacker able to intercept or redirect update traffic can cause the updater to download and execute an attacker-controlled installer, resulting in arbitrary code execution with the privileges of the user.

- 📅 **Published:** 03/02/2026
- 📈 **CVSS:** 7.7
- 🛡️ **CISA KEV:** True
- 🧭 **Vector:** CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
- 📣 **Mentions:** 7
- ⚠️ **Priority:** 1+
- 📝 **Analysis:** Unvalidated update traffic in Notepad++ versions prior to 8.8.9 allows arbitrary code execution due to a lack of cryptographic verification. This vulnerability is confirmed exploited, making it a priority for mitigation efforts.


---

**9. [CVE-2026-20700](https://nvd.nist.gov/vuln/detail/CVE-2026-20700)**

- 📝 A memory corruption issue was addressed with improved state management. This issue is fixed in watchOS 26.3, tvOS 26.3, macOS Tahoe 26.3, visionOS 26.3, iOS 26.3 and iPadOS 26.3. An attacker with memory write capability may be able to execute arbitrary code. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 26. CVE-2025-14174 and CVE-2025-43529 were also issued in response to this report.

- 📅 **Published:** 11/02/2026
- 📈 **CVSS:** 7.8
- 🛡️ **CISA KEV:** True
- 🧭 **Vector:** CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- 📣 **Mentions:** 44
- ⚠️ **Priority:** 1+
- 📝 **Analysis:** A memory corruption issue in watchOS 26.3, tvOS 26.3, macOS Tahoe 26.3, visionOS 26.3, iOS 26.3, and iPadOS 26.3 has been addressed. This vulnerability, confirmed exploited, allows an attacker with memory write capability to execute arbitrary code. Reported in CVE-2025-14174 and CVE-2025-43529.


---

**10. [CVE-2025-70795](https://nvd.nist.gov/vuln/detail/CVE-2025-70795)**

- 📝 n/a

- 📈 **CVSS:** 0
- 🧭 **Vector:** n/a
- ⚠️ **Priority:** n/a
- 📝 **Analysis:** No Information available for this CVE at the moment


---

Let us know if you're tracking any of these or if you find any issues with the provided details.

**Apple has released critical updates to fix a zero-day flaw that has been exploited in sophisticated cyber attacks on its devices.**

**Key Points:**

- The vulnerability, identified as CVE-2026-20700, affects multiple Apple platforms.
- Exploiting the flaw could allow attackers to execute arbitrary code on vulnerable devices.
- The issue was discovered by Google's Threat Analysis Group and is linked to past vulnerabilities.
- Apple's updates also address previously reported vulnerabilities in older versions of its software.

Apple has announced important updates for iOS, iPadOS, macOS, tvOS, watchOS, and visionOS in response to a zero-day vulnerability, tracked as CVE-2026-20700. This flaw, characterized as a memory corruption issue, presents a significant security risk as its exploitation could enable attackers to execute arbitrary code on affected devices. The vulnerability, which is now known to be actively exploited in targeted attacks, highlights the ongoing challenges faced by tech companies in safeguarding their systems against sophisticated threats.

The discovery of the vulnerability was credited to the Google Threat Analysis Group, emphasizing collaborative efforts in addressing cybersecurity challenges. Apple has classified this as a serious issue, noting its exploitation in attacks on specific individuals, particularly in versions of iOS prior to iOS 26. The tech giant has acted swiftly, releasing patches not only for the current zero-day but also for related vulnerabilities identified earlier, signaling its commitment to enhancing user security. Apple's proactive approach aligns with the broader trend of increasing zero-day disclosures, having addressed several made aware to the public over the last year.

What steps do you think individuals should take to protect their devices from such vulnerabilities?

**Learn More:** [The Hacker News](https://thehackernews.com/2026/02/apple-fixes-exploited-zero-day.html)

**Want to stay updated on the latest cyber threats?** 

 👉 **[Subscribe to /r/PwnHub](https://www.reddit.com/r/pwnhub)**

Critical memory corruption flaw CVE-2026-20700 in dyld exploited against targeted individuals. Google TAG discovered it—patch now on iOS, macOS, watchOS.

Read more: https://t.co/jbvRXakU4T

@RainDogDance @notgrubles Are you explaining that extending step by step the Bitcoin attack surface is OK?
This is exactly what "core" did by first not fixing CVE-2024-34149 , CVE-2023-50428 and now releasing v30.

@mattkratter its only not an exploit if one is lead to believe that release note updates and comments in code are all that are necessary to resolve CVE-2023-50428🙃

client vulnerability exploited by #Inscription has been assigned the specific vulnerability identifier CVE-2023-50428, which is specifically described as bypassing datacarrier size restrictions by obfuscating data into code. https://t.co/VTQwQCxOTq

@adam3us @adam3us ore specifically, the fixes for CVE-2024-34149 and CVE-2023-50428

If the bug is patched, it has the potential to restrict #Ordinals inscriptions on the #bitcoin    network

https://t.co/j1za2ngpQ2
 #bitcoin   -#inscriptions-#nationalvulnerabilitydatabase

Here is a summary of CVE-2023-50428: https://t.co/sarP5Y3xb3

Here are the latest updates in #Ordinals 🌹

⭕️ Ordinals submitted to the NIST National Vulnerability Database as CVE-2023-50428

⭕️ Bitcoin Core 26.0 was released 

⭕️ @JSONtoshi accumulate 5.80 BTC in 24h

⭕️ Status page added to https://t.co/qkRe6zrpaH https://t.co/UvVsJH553y https://t.co/UfSOUvFFbO

In Bitcoin, the "bug" refers to a vulnerability (CVE-2023-50428) in how SegWit and Taproot handle witness data discounts, allowing Ordinals/Inscriptions to embed arbitrary data (like images) cheaply on the blockchain. Some devs, like Luke Dashjr, call this spam exploiting unintended features and advocate fixes, as in Bitcoin Knots v25.1. Others see it as a valid innovation.

Everything You Need to Know About Bitcoin Vulnerability CVE-2023-50428 https://t.co/1Hb1xd5hlr

@StefanM647723 @w_s_bitcoin "Core" failed to merge the fixes for two major security issues: CVE-2024-34149 and CVE-2023-50428. This makes "core" a simple malware.

As far as I know, nobody is able to point to any issue with knot and knot is a simple fork of "core".

@HODLingOnward @BitcoinMotorist @GhostofMapl @rabbitholerecap Hodl Onward, you're either liar or ignorant.
Inscriptions never had consensus. 
Inscriptions have been clearly identified as a bug in CVE-2023-50428

@LukeDashjr proposed a patch in PR #28408 in SEP 2023. Core rejected it and closed it in JAN 2024. 
That's how spam saga started.

Luke Dashjr

Android devices hit by exploited Qualcomm flaw CVE-2026-21385  https://t.co/5J3akuDYx6

🚨 Google Patches Actively Exploited Qualcomm GPU Zero-Day in March 2026 Android Update
Google’s March 2026 Android security release fixes CVE-2026-21385 (Qualcomm KGSL graphics driver integer overflow in alignment handling) reportedly used in limited targeted exploitation, enabling GPU memory corruption that could be chained toward privilege escalation on many Snapdragon-based devices. Users should update to the 2026-03-05 patch level (or newer) to receive the full set of fixes, including additional critical Android System and kernel issues in this cycle.
🎯 Target: Global/Android Devices (Qualcomm Snapdragon)
#️⃣ Category: #Vulnerability #BlueTeam
🔗 URL: https://t.co/haDOIplac4

Google Confirms CVE-2026-21385 in Qualcomm Android Component Exploited https://t.co/yUG77QkZCw

2/ Furthermore, there’s been parallel threats as Android's March 2026 bulletin patches 129 issues, including an exploited zero-day in Qualcomm Display (CVE-2026-21385). If you're on older devices or sideloading APKs, you're at high risk right now.

CVE-2026-21385 - Integer Overflow or Wraparound in Graphics

CVE ID : CVE-2026-21385
Published :  March 2, 2026, 5:16 p.m. | 18 minutes ago
Description : Memory corruption while using alignments for memory allocation.
Severity: 7.8 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

🚨 Google says CVE-2026-21385 may be under limited, targeted exploitation. The high-severity flaw affects a Qualcomm Android graphics component and involves memory corruption. https://t.co/sMDNWiBU6i
#AndroidSecurity #MobileSecurity #CVE202621385 #Vulert

🛡️ We added Qualcomm memory corruption vulnerability CVE-2026-21385 &amp; Broadcom VMware Aria Operations command injection vulnerability CVE-2026-22719 to our KEV Catalog. Visit https://t.co/myxOwap1Tf &amp; apply mitigations to protect your org from cyberattacks.  #Cybersecurity https://t.co/cgLZwOA2pf

Zero Day в Android уже используется в целенаправленных атаках

Наиболее опасная уязвимость бюллетеня – CVE-2026-0006 – находится в системном компоненте Android. Именно через него злоумышленник способен выполнить произвольный код на устройстве удалённо, без каких-либо прав и без участия пользователя.

Уязвимость CVE-2026-21385, обнаруженная в системных службах и инфраструктуре платформы Android, уже применяется в реальных целенаправленных атаках. Google подтвердила факты эксплуатации, однако подробности о механизме атак не раскрывает.

Критические ошибки в ядре Linux, которое лежит в основе Android, затрагивают подсистемы виртуализации, гипервизора и файловых систем, позволяя повысить привилегии и получить контроль над системой. Отдельные уязвимости выявлены в компонентах чипсетов и графических процессоров от Arm, MediaTek, Qualcomm и Unisoc.

#android #безопасность #уязвимости #исправление 

@ZerodayAlert

#Google Confirms CVE-2026-21385 in #Qualcomm #Android Component #Exploited 
https://t.co/FK9TaxbBTo https://t.co/NycG6tqtzT

Google patched CVE-2026-21385, a critical zero-day memory corruption vulnerability in Qualcomm’s open-source display component affecting 234 chipsets. March update fixed 129 Android flaws—the largest batch since 2018. #QualcommBugs #AndroidUpdate
https://t.co/zr8MvQlIzQ

#exploit
1. A Practical Guide to PrintNightmare in 2024 (updated Oct 5)
https://itm4n.github.io/printnightmare-exploitation
]-> PnP bypass

2. CVE-2024-12209:
WP Umbrella Unauthenticated LFI
https://github.com/Nxploited/CVE-2024-12209

3. CVE-2024-30085:
Windows 11 23H2 EoP
https://ssd-disclosure.com/ssd-advisory-cldflt-heap-based-overflow-pe

PoC Exploit for CVE-2024-30085: Windows Elevation of Privilege Vulnerability

#1N73LL1G3NC3

All I Want for Christmas is a CVE-2024-30085 Exploit | STAR Labs https://t.co/uSkRvXsMpa

April "In the Trend of VM" (#14): vulnerabilities in Microsoft Windows, VMware products, Kubernetes, and Apache Tomcat. We decided to pause recording new videos, so for now only text. 🤷‍♂️🙂

🗞 Post on Habr (rus)
🗒 Digest on the PT website (rus)

A total of 11 trending vulnerabilities:

🔻 Elevation of Privilege - Windows Cloud Files Mini Filter Driver (CVE-2024-30085)
🔻 Spoofing - Windows File Explorer (CVE-2025-24071)
🔻 Four Windows vulnerabilities from March Microsoft Patch Tuesday were exploited in the wild (CVE-2025-24985, CVE-2025-24993, CVE-2025-26633, CVE-2025-24983)
🔻 Three VMware "ESXicape" Vulnerabilities (CVE-2025-22224, CVE-2025-22225, CVE-2025-22226)
🔻 Remote Code Execution - Apache Tomcat (CVE-2025-24813)
🔻 Remote Code Execution - Kubernetes (CVE-2025-1974)

На русском

@avleonovcom #TrendVulns #PositiveTechnologies #SecLab #Windows #Microsoft #PatchTuesday #TyphoonPWN #FileExplorer #PipeMagic #Win32 #VMware #ESXicape #VMX #HGFS #ESXi #Apache #Tomcat #Kubernetes #IngressNightmare

A critical Windows vulnerability (CVE-2024-30085) allows local attackers to escalate privileges to SYSTEM level, risking user security. Rated 7.8 on CVSS. 🛡️ #WindowsVulnerability #PrivilegeEscalation #USCybersecurity #CybersecurityNews

link: https://t.co/c3eh1j4efL https://t.co/uDxM64uSbk

PoC Exploit Released for CVE-2024-30085: Windows Elevation of Privilege Vulnerability

Researcher published the technical details and a #PoC exploit code for CVE-2024-30085 - #Windows Cloud Files Mini Filter Driver Elevation of Privilege Flaw
https://t.co/tILKygNQ6w

🚨 CVE-2024-30085: Privilege escalation in cldflt.sys (Windows Cloud Files Mini Filter Driver). Fixed in June 2024 Patch Tuesday.  Exploitability confirmed. #cldflt #Windows #SSD #PositiveTechnologies #TyphoonPWN
➡️ https://t.co/9weVeRdkTP https://t.co/W0CFHelldm

All I Want for Christmas is a CVE-2024-30085 Exploit | STAR Labs - https://t.co/jAbGdCq50a

**Exploiting Reversing (ER) series: article 07 | Exploitation Techniques: CVE-2024-30085 (part 01)**

I am excited to release the **seventh article** in the **Exploiting Reversing Series (ERS).** Titled **“Exploitation Techniques | CVE-2024-30085 (part 01)”** this **119-page technical guide** offers a comprehensive roadmap for vulnerability exploitation:

[https://exploitreversing.com/2026/03/04/exploiting-reversing-er-series-article-07/](https://exploitreversing.com/2026/03/04/exploiting-reversing-er-series-article-07/)

Key features of this edition:

**\[+\] Dual Exploit Strategies:** Two distinct exploit versions using Token Stealing and I/O Ring techniques.

**\[+\] Exploit ALPC + PreviousMode Flip + Token Stealing:** elevation of privilege of a regular user to SYSTEM.

**\[+\] Exploit ALPC + Pipes + I/O Ring:** elevation of privilege of a regular user to SYSTEM.

**\[+\] Solid Reliability:** Two complete working and stable exploits, including an improved cleanup stage.  

**\[+\] Optimized Exploit Logic:** Significant refinements to the codebase and technical execution for better stability and predictability.

The article guides you through the two distinct techniques for exploiting the CVE-2024-30085 Heap Buffer Overflow vulnerability. 

I hope this serves as a definitive resource for your research. If you find it helpful, please feel free to share it or reach out with your feedback!

Enjoy your reading and have an excellent day.

PoC Exploit Released for CVE-2024-30085: Windows Elevation of Privilege Vulnerability - https://t.co/FIskTOZnGO

Alex Birnberg

Gwangun Jung

Junoh Lee

Bbbig12

Pr0Ln

[HelpNet] Google fixes actively exploited Android vulnerabilities (CVE-2025-48543, CVE-2025-38352). Google has provided fixes for over 100 Android vulnerabilities, including CVE-2025-48543 and CVE-2025-38352, which “may be under limited, targeted... https://t.co/fvzrkZ6SxG

Critical LinuxKernel vulnerability (CVE-2025-38352) in POSIX CPU timers allows potential privilege escalation. Public PoC released. Update your systems now! Link: https://t.co/HBlFwKjRTO #Security #Vulnerability #Exploit #Update #Linux #Kernel #CVE #Patch #PoC #Privilege #Escalation #POSIX #Timer #Risk #System #Software #Android #Devices #Technology #Threat #Alert

Analysis of CVE-2025-38352  and technical insights into process of triggering the bug that caused a crash in the Android kernel. It was released in the September 2025 Android Bulletin, marked as possibly under limited, targeted exploitation.
#cybersecurity #cyber #security #hackers #cyberattack #databreach #incidentresponse #China 

https://t.co/R3DdfZmNeR

#VulnerabilityReport #android Researcher Details Zero-Day Linux/Android Kernel Flaw (CVE-2025-38352) https://t.co/Be4Yi5DCJi

CVE-2025-38352 - In-the-wild Android Kernel Vulnerability Analysis + PoC
https://t.co/XZl764vMx3
PoC: https://t.co/19sBp74UMa

#exploit 
#Kernel_Security
#Mobile_security
CVE-2025-38352:
Part 1 - https://t.co/KfFX8BK8mt In-the-wild Android Kernel Vulnerability Analysis + PoC https://t.co/CMIMYDOdDM
Part 2 - https://t.co/lxGuNMaCiZ Extending The Race Window Without a Kernel Patch
]-> Final PoC https://t.co/J3YLr4Rz6f

// This is a PoC for CVE-2025-38352, a vulnerability in the Linux kernel's POSIX CPU timers implementation. The September 2025 Android Bulletin mentions that this vulnerability has been used in limited, targeted exploitation in the wild

🚨 CVE-2025-38352
In the Linux kernel, the following vulnerability has been resolved:

posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del()

If an exiting non-autoreaping task has already passed exit_notify() and
calls handle_posix_cpu_timers() from IRQ, it can be reaped by its parent
or debugger right after unlock_task_sighand().

If a concurrent posix_cpu_timer_del() runs at that moment, it won't be
able to detect timer->it.cpu.firing != 0: cpu_timer_task_rcu() and/or
lock_task_sighand() will fail.

Add the tsk->exit_state check into run_posix_cpu_timers() to fix this.

This fix is not needed if CONFIG_POSIX_CPU_TIMERS_TASK_WORK=y, because
exit_task_work() is called before exit_notify(). But the check still
makes sense, task_work_add(&tsk->posix_cputimers_work.work) will fail
anyway in this case.

🎖@cveNotify

Google fixes actively exploited Android vulnerabilities (CVE-2025-48543, CVE-2025-38352) https://t.co/1HKnaEOHVP

Here’s a quick breakdown of the 10 most interesting vulnerabilities trending today:

**1. [CVE-2025-3248](https://nvd.nist.gov/vuln/detail/CVE-2025-3248)**

- 📝 Langflow versions prior to 1.3.0 are susceptible to code injection in  the /api/v1/validate/code endpoint. A remote and unauthenticated attacker can send crafted HTTP requests to execute arbitrary code.

- 📅 **Published:** 07/04/2025
- 📈 **CVSS:** 9.8
- 🧭 **Vector:** CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- 📣 **Mentions:** 134
- ⚠️ **Priority:** 2
- 📝 **Analysis:** Code injection vulnerability found in Langflow versions below 1.3.0, affecting the /api/v1/validate/code endpoint. No exploits detected in the wild yet, but high severity due to potential for arbitrary code execution. This is a priority 2 issue with high CVSS score and low EPSS.


---

**2. [CVE-2025-49113](https://nvd.nist.gov/vuln/detail/CVE-2025-49113)**

- 📝 Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by authenticated users because the _from parameter in a URL is not validated in program/actions/settings/upload.php, leading to PHP Object Deserialization.

- 📅 **Published:** 02/06/2025
- 📈 **CVSS:** 9.9
- 🛡️ **CISA KEV:** True
- 🧭 **Vector:** CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
- 📣 **Mentions:** 108
- ⚠️ **Priority:** 1+
- 📝 **Analysis:** Authenticated users can perform remote code execution due to improper validation in program/actions/settings/upload.php of Roundcube Webmail versions below 1.5.11 and 1.6.11. This vulnerability, while high in CVSS, has shown low exploit activity in the wild, resulting in a priority 2 status.


---

**3. [CVE-2025-38352](https://nvd.nist.gov/vuln/detail/CVE-2025-38352)**

- 📝 In the Linux kernel, the following vulnerability has been resolved: posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() If an exiting non-autoreaping task has already passed exit_notify() and calls handle_posix_cpu_timers() from IRQ, it can be reaped by its parent or debugger right after unlock_task_sighand(). If a concurrent posix_cpu_timer_del() runs at that moment, it wont be able to detect timer->it.cpu.firing != 0: cpu_timer_task_rcu() and/or lock_task_sighand() will fail. Add the tsk->exit_state check into run_posix_cpu_timers() to fix this. This fix is not needed if CONFIG_POSIX_CPU_TIMERS_TASK_WORK=y, because exit_task_work() is called before exit_notify(). But the check still makes sense, task_work_add(&tsk->posix_cputimers_work.work) will fail anyway in this case.

- 📅 **Published:** 22/07/2025
- 📈 **CVSS:** 7.4
- 🛡️ **CISA KEV:** True
- 🧭 **Vector:** CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- 📣 **Mentions:** 61
- ⚠️ **Priority:** 1+
- 📝 **Analysis:** A race condition in Linux kernel's posix-cpu-timers can lead to task reaping issues and potential task synchronization failures. This issue is not critical if CONFIG_POSIX_CPU_TIMERS_TASK_WORK is set, but the fix is still advisable due to potential work failure. Given a high CVSS score and confirmed exploited status (CISA KEV), this is a priority 1+ vulnerability.


---

**4. [CVE-2025-29969](https://nvd.nist.gov/vuln/detail/CVE-2025-29969)**

- 📝 MS-EVEN RPC Remote Code Execution Vulnerability

- 📅 **Published:** 13/05/2025
- 📈 **CVSS:** 7.5
- 🧭 **Vector:** CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
- 📣 **Mentions:** 5
- ⚠️ **Priority:** 2
- 📝 **Analysis:** A Remote Code Execution vulnerability exists in MS-EVEN RPC, high impact and exploitability due to network access, known as 'High' for Confidentiality, Integrity, and Availability. As of now, no in-the-wild activity has been reported, but given its high CVSS score, it warrants a priority 2 assessment.


---

**5. [CVE-2025-68461](https://nvd.nist.gov/vuln/detail/CVE-2025-68461)**

- 📝 Roundcube Webmail before 1.5.12 and 1.6 before 1.6.12 is prone to a Cross-Site-Scripting (XSS) vulnerability via the animate tag in an SVG document.

- 📅 **Published:** 18/12/2025
- 📈 **CVSS:** 7.2
- 🛡️ **CISA KEV:** True
- 🧭 **Vector:** CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
- 📣 **Mentions:** 9
- ⚠️ **Priority:** 1+
- 📝 **Analysis:** Cross-Site-Scripting (XSS) vulnerability found in Roundcube Webmail versions below 1.5.12 and 1.6.12 via animate tag in SVG documents. Confirmed exploited by attackers, making this a priority 1+ issue.


---

**6. [CVE-2025-34291](https://nvd.nist.gov/vuln/detail/CVE-2025-34291)**

- 📝 Langflow versions up to and including 1.6.9 contain a chained vulnerability that enables account takeover and remote code execution. An overly permissive CORS configuration (allow_origins=* with allow_credentials=True) combined with a refresh token cookie configured as SameSite=None allows a malicious webpage to perform cross-origin requests that include credentials and successfully call the refresh endpoint. An attacker-controlled origin can therefore obtain fresh access_token / refresh_token pairs for a victim session. Obtained tokens permit access to authenticated endpoints  including built-in code-execution functionality  allowing the attacker to execute arbitrary code and achieve full system compromise.

- 📅 **Published:** 05/12/2025
- 📈 **CVSS:** 9.4
- 🧭 **Vector:** CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
- 📣 **Mentions:** 8
- ⚠️ **Priority:** 2
- 📝 **Analysis:** A chained account takeover and RCE vulnerability exists in Langflow versions up to 1.6.9 due to an overly permissive CORS configuration and a SameSite=None refresh token cookie. An attacker can obtain fresh access/refresh tokens, enabling code execution and full system compromise. Despite no confirmed exploits, the high CVSS score and potential for severe impact necessitate immediate attention (Priority 2).


---

**7. [CVE-2025-12543](https://nvd.nist.gov/vuln/detail/CVE-2025-12543)**

- 📝 A flaw was found in the Undertow HTTP server core, which is used in WildFly, JBoss EAP, and other Java applications. The Undertow library fails to properly validate the Host header in incoming HTTP requests.As a result, requests containing malformed or malicious Host headers are processed without rejection, enabling attackers to poison caches, perform internal network scans, or hijack user sessions.

- 📅 **Published:** 07/01/2026
- 📈 **CVSS:** 9.6
- 🧭 **Vector:** CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L
- 📣 **Mentions:** 11
- ⚠️ **Priority:** 2
- 📝 **Analysis:** A vulnerability (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L) exists in Undertow HTTP server, used in WildFly, JBoss EAP, and other Java applications. Malformed Host headers can enable attackers to perform internal network scans, poison caches, or hijack user sessions without rejection. Known in-the-wild activity is low (CISA KEV). Priority is 2 due to high CVSS but low Exploitability Score (EPSS).


---

**8. [CVE-2025-11730](https://nvd.nist.gov/vuln/detail/CVE-2025-11730)**

- 📝 A postauthentication command injection vulnerability in the Dynamic DNS (DDNS) configuration CLI command in Zyxel ATP series firmware versions from V5.35 through V5.41, USG FLEX series firmware versions from V5.35 through V5.41, USG FLEX 50(W) series firmware versions from V5.35 through V5.41, and USG20(W)-VPN series firmware versions from V5.35 through V5.41 could allow an authenticated attacker with administrator privileges to execute operating system (OS) commands on an affected device by supplying a specially crafted string as an argument to the CLI command.

- 📅 **Published:** 05/02/2026
- 📈 **CVSS:** 7.2
- 🧭 **Vector:** CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
- 📣 **Mentions:** 2
- ⚠️ **Priority:** 2
- 📝 **Analysis:** Post-authentication command injection vulnerability in Zyxel ATP, USG FLEX, and USG20(W)-VPN firmware versions allows authenticated attackers with admin privileges to execute OS commands. No known exploits detected; this is a priority 2 vulnerability due to high CVSS but low EPSS.


---

**9. [CVE-2024-54222](https://nvd.nist.gov/vuln/detail/CVE-2024-54222)**

- 📝 Missing Authorization vulnerability in Seraphinite Solutions Seraphinite Accelerator seraphinite-accelerator allows Retrieve Embedded Sensitive Data.This issue affects Seraphinite Accelerator: from n/a through <= 2.22.15.

- 📅 **Published:** 20/02/2026
- 📈 **CVSS:** 0
- 🧭 **Vector:** n/a
- ⚠️ **Priority:** 4
- 📝 **Analysis:** A missing authorization issue enables data retrieval in Seraphinite Accelerator versions from n/a through <= 2.22.15. No exploits detected in the wild, priority 4 due to low CVSS and EPSS scores.


---

**10. [CVE-2025-53217](https://nvd.nist.gov/vuln/detail/CVE-2025-53217)**

- 📝 Missing Authorization vulnerability in staviravn AIO WP Builder all-in-one-wp-builder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AIO WP Builder: from n/a through <= 2.0.2.

- 📅 **Published:** 20/02/2026
- 📈 **CVSS:** 0
- 🧭 **Vector:** n/a
- ⚠️ **Priority:** 4
- 📝 **Analysis:** A Missing Authorization issue in staviravn AIO WP Builder allows for potential access control bypass. This affects versions from n/a through 2.0.2. No known exploits have been detected, but given the low EPSS and CVSS score of 0, this is currently a priority 4 vulnerability requiring careful monitoring.


---

Let us know if you're tracking any of these or if you find any issues with the provided details.

CVE-2025-38352 - In the Linux kernel, the following vulnerability h

CVE ID : CVE-2025-38352
Published :  July 22, 2025, 8:15 a.m. | 3 hours, 43 minutes ago
Description : In the Linux kernel, the following vulnerability has been resolved: posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() If an exiting non-autoreaping task has already passed exit_notify() and calls handle_posix_cpu_timers() from IRQ, it can be reaped by its parent or debugger right after unlock_task_sighand(). If a concurrent posix_cpu_timer_del() runs at that moment, it won't be able to detect timer->it.cpu.firing != 0: cpu_timer_task_rcu() and/or lock_task_sighand() will fail. Add the tsk->exit_state check into run_posix_cpu_timers() to fix this. This fix is not needed if CONFIG_POSIX_CPU_TIMERS_TASK_WORK=y, because exit_task_work() is called before exit_notify(). But the check still makes sense, task_work_add(&tsk->posix_cputimers_work.work) will fail anyway in this case.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Singapore CSA warns of CVE-2025-52691 in SmarterMail, allowing unauthenticated attackers to achieve remote code execution via arbitrary file uploads.

https://t.co/eDmuTNKZgy

#CyberSecurity #EmailSecurity #SmarterMail #RemoteCodeExecution #InfoSec #CSAAlert https://t.co/UbHHxhXdkO

[Security Affairs] Singapore CSA warns of maximun severity SmarterMail RCE flaw. Singapore’s CSA warns of CVE-2025-52691, a critical SmarterMail flaw enabling unauthenticated remote code execution via arbitrary file upload. Singapore’s Cyber Security... https://t.co/R4t1F5Ftnr

Here’s a quick breakdown of the 10 most interesting vulnerabilities trending today:

**1. [CVE-2025-5419](https://nvd.nist.gov/vuln/detail/CVE-2025-5419)**

- 📝 Out of bounds read and write in V8 in Google Chrome prior to 137.0.7151.68 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

- 📅 **Published:** 02/06/2025
- 📈 **CVSS:** 8.8
- 🧭 **Vector:** CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- 📣 **Mentions:** 92
- ⚠️ **Priority:** 2
- 📝 **Analysis:** Remote attacker can potentially exploit heap corruption in Google Chrome prior to version 137.0.7151.68 via a crafted HTML page. No known exploits detected yet, but given high CVSS score and potential for serious impact, this is considered a priority 2 vulnerability.


---

**2. [CVE-2025-8088](https://nvd.nist.gov/vuln/detail/CVE-2025-8088)**

- 📝 A path traversal vulnerability affecting the Windows version of WinRAR allows the attackers to execute arbitrary code by crafting malicious archive files. This vulnerability was exploited in the wild and was discovered byAnton Cherepanov, Peter Koinr, and Peter Strek      from ESET.

- 📅 **Published:** 08/08/2025
- 📈 **CVSS:** 8.4
- 🛡️ **CISA KEV:** True
- 🧭 **Vector:** CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
- 📣 **Mentions:** 23
- ⚠️ **Priority:** 1+
- 📝 **Analysis:** A path traversal vulnerability in Windows WinRAR allows attackers to execute arbitrary code via malicious archive files. This vulnerability has been exploited in the wild and was discovered by ESET researchers. Given its high CVSS score and prior activity, it is a priority 2 issue.


---

**3. [CVE-2025-55182](https://nvd.nist.gov/vuln/detail/CVE-2025-55182)**

- 📝 A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable code unsafely deserializes payloads from HTTP requests to Server Function endpoints.

- 📅 **Published:** 03/12/2025
- 📈 **CVSS:** 10
- 🛡️ **CISA KEV:** True
- 🧭 **Vector:** CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
- 📣 **Mentions:** 908
- ⚠️ **Priority:** 1+
- 📝 **Analysis:** A critical pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0, specifically in packages react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerability stems from unsafely deserializing HTTP request payloads. This is a confirmed exploited issue, designated as priority 1+.


---

**4. [CVE-2025-52691](https://nvd.nist.gov/vuln/detail/CVE-2025-52691)**

- 📝 Successful exploitation of the vulnerability could allow an unauthenticated attacker to upload arbitrary files to any location on the mail server, potentially enabling remote code execution.

- 📅 **Published:** 29/12/2025
- 📈 **CVSS:** 10
- 🛡️ **CISA KEV:** True
- 🧭 **Vector:** CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
- 📣 **Mentions:** 40
- ⚠️ **Priority:** 1+
- 📝 **Analysis:** Unauthenticated attacker can upload arbitrary files for potential RCE on mail servers. CISA KEV unspecified. This is a priority 2 vulnerability due to high CVSS and low Exploitability Scoring System (EPSS) score.


---

**5. [CVE-2025-15467](https://nvd.nist.gov/vuln/detail/CVE-2025-15467)**

- 📝 Issue summary: Parsing CMS AuthEnvelopedData message with maliciously crafted AEAD parameters can trigger a stack buffer overflow. Impact summary: A stack buffer overflow may lead to a crash, causing Denial of Service, or potentially remote code execution. When parsing CMS AuthEnvelopedData structures that use AEAD ciphers such as AES-GCM, the IV (Initialization Vector) encoded in the ASN.1 parameters is copied into a fixed-size stack buffer without verifying that its length fits the destination. An attacker can supply a crafted CMS message with an oversized IV, causing a stack-based out-of-bounds write before any authentication or tag verification occurs. Applications and services that parse untrusted CMS or PKCS#7 content using AEAD ciphers (e.g., S/MIME AuthEnvelopedData with AES-GCM) are vulnerable. Because the overflow occurs prior to authentication, no valid key material is required to trigger it. While exploitability to remote code execution depends on platform and toolchain mitigations, the stack-based write primitive represents a severe risk. The FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue, as the CMS implementation is outside the OpenSSL FIPS module boundary. OpenSSL 3.6, 3.5, 3.4, 3.3 and 3.0 are vulnerable to this issue. OpenSSL 1.1.1 and 1.0.2 are not affected by this issue.

- 📅 **Published:** 27/01/2026
- 📈 **CVSS:** 0
- 🧭 **Vector:** n/a
- 📣 **Mentions:** 21
- ⚠️ **Priority:** 4
- 📝 **Analysis:** A stack buffer overflow vulnerability exists in OpenSSL versions 3.6, 3.5, 3.4, 3.3 and 3.0 when parsing untrusted CMS content using AEAD ciphers. This issue can lead to Denial of Service or potentially remote code execution without valid key material. Affected platforms may be at severe risk, but FIPS modules in versions 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected due to the CMS implementation being outside the OpenSSL FIPS module boundary. This vulnerability has a priority score of 0, indicating pending analysis.


---

**6. [CVE-2025-40551](https://nvd.nist.gov/vuln/detail/CVE-2025-40551)**

- 📝 SolarWinds Web Help Desk was found to be susceptible to an untrusted data deserialization vulnerability that could lead to remote code execution, which would allow an attacker to run commands on the host machine. This could be exploited without authentication.

- 📅 **Published:** 28/01/2026
- 📈 **CVSS:** 9.8
- 🧭 **Vector:** CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- 📣 **Mentions:** 7
- ⚠️ **Priority:** 2
- 📝 **Analysis:** Unauthenticated remote code execution vulnerability in SolarWinds Web Help Desk due to untrusted data deserialization. No confirmed exploits in the wild, but high priority due to CVSS score and potential severity of impact.


---

**7. [CVE-2025-40554](https://nvd.nist.gov/vuln/detail/CVE-2025-40554)**

- 📝 SolarWinds Web Help Desk was found to be susceptible to an authentication bypass vulnerability that, if exploited, could allow an attacker to invoke specific actions within Web Help Desk.

- 📅 **Published:** 28/01/2026
- 📈 **CVSS:** 9.8
- 🧭 **Vector:** CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- 📣 **Mentions:** 9
- ⚠️ **Priority:** 2
- 📝 **Analysis:** A remote attacker can invoke specific actions within SolarWinds Web Help Desk due to an authentication bypass vulnerability. No known exploits have been detected, but the high CVSS score and low Exploit Prediction Scor(e) make it a priority 2 issue.


---

**8. [CVE-2025-40552](https://nvd.nist.gov/vuln/detail/CVE-2025-40552)**

- 📝 SolarWinds Web Help Desk was found to be susceptible to an authentication bypass vulnerability that if exploited, would allow a malicious actor to execute actions and methods that should be protected by authentication.

- 📅 **Published:** 28/01/2026
- 📈 **CVSS:** 9.8
- 🧭 **Vector:** CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- 📣 **Mentions:** 10
- ⚠️ **Priority:** 2
- 📝 **Analysis:** A high-severity authentication bypass in SolarWinds Web Help Desk API allows for unauthenticated execution of actions. As of now, no exploits have been detected in the wild. Given its CVSS score and low Exploitation Potential Scoring System (EPSS) rating, this is considered a priority 2 vulnerability.


---

**9. [CVE-2025-64328](https://nvd.nist.gov/vuln/detail/CVE-2025-64328)**

- 📝 FreePBX Endpoint Manager is a module for managing telephony endpoints in FreePBX systems. In versions 17.0.2.36 and above before 17.0.3, the filestore module within the Administrative interface is vulnerable to a post-authentication command injection by an authenticated known user via the testconnection -> check_ssh_connect() function. An attacker can leverage this vulnerability to obtain remote access to the system as an asterisk user. This issue is fixed in version 17.0.3.

- 📅 **Published:** 07/11/2025
- 📈 **CVSS:** 8.6
- 🧭 **Vector:** CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
- 📣 **Mentions:** 8
- ⚠️ **Priority:** 2
- 📝 **Analysis:** Post-authentication command injection vulnerability in FreePBX Endpoint Manager (versions 17.0.2.36 and below prior to 17.0.3). An attacker can gain remote access as an asterisk user, no known exploits detected yet. Priority: 2 (high CVSS, low EPSS)


---

**10. [CVE-2024-54529](https://nvd.nist.gov/vuln/detail/CVE-2024-54529)**

- 📝 A logic issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.2, macOS Ventura 13.7.2, macOS Sonoma 14.7.2. An app may be able to execute arbitrary code with kernel privileges.

- 📅 **Published:** 11/12/2024
- 📈 **CVSS:** 7.8
- 🧭 **Vector:** CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- 📣 **Mentions:** 4
- ⚠️ **Priority:** 2
- 📝 **Analysis:** A logic flaw in macOS allows for arbitrary kernel execution by apps. Fixed in Sequoia 15.2, Ventura 13.7.2, and Sonoma 14.7.2. While no exploits are known in the wild, given the high CVSS score and low EPSS, this is a priority 2 vulnerability.


---

Let us know if you're tracking any of these or if you find any issues with the provided details.

#ThreatProtection #CVE-2025-52691 - #SmarterTools #SmarterMail #vulnerability, read more about Symantec's protection: https://t.co/dNfGPw5e21

CVE-2025-52691 (CVSS 10): Critical SmarterMail Flaw Opens Servers to Unauthenticated Attacks https://t.co/i1HsYwqR8y

CVE-2025-52691 (CVSS 10.0) is a reminder.

The fix is clear (Build 9413+).
Yet exposure remains the real threat.

For security teams, the deeper challenge isn’t just vulnerabilities —
it’s reachability.

Whether it’s a 3rd-party product like SmarterMail
or logic in your own codebase,
the question is the same:
which execution paths are actually reachable in production?

That’s where Precogs AI helps —
prioritizing reachable risk before it becomes an incident.
#CVE202552691 #AISecurity #CyberSecurity

SmarterTools SmarterMail CVE-2025-52691: Unauthenticated Arbitrary File Upload Enables Remote Code Execution on Email Gateways https://t.co/HficFGALQG 
What happens when the email gateway protecting your organization’s critical communications fails to validate uploaded files an…

🚨 Metasploit Adds 7 Fresh Exploit Modules Targeting FreePBX, Cacti, and SmarterMail (Unauth RCE Chains)

This Metasploit update ships new modules chaining FreePBX auth-bypass (CVE-2025-66039) with SQLi (CVE-2025-61675) or unrestricted upload (CVE-2025-61678) to reach unauth RCE, plus unauth RCE for Cacti <1.2.29 (CVE-2025-24367) and SmarterMail file upload/path traversal (CVE-2025-52691) to drop webshells/cron-based persistence. This matters because defenders can immediately validate exposure and prioritize patching/hardening for widely deployed VoIP, monitoring, and mail systems. 

🎯 Target: Global/Enterprise IT
#️⃣ Category: #Vulnerability #BlueTeam 
🔗 URL: https://t.co/9qbdaeYtgh

Critical patches released for IBM API Connect auth bypass and SmarterMail RCE (CVE-2025-52691). CISA mandates fixes for MongoBleed after Oracle EBS intrusions. ESA server breach confirmed; Disney settles $10M over child data. #DataPrivacy #USA
https://t.co/5GwBNABG0i

SmarterMail CVSS 10 (CVE-2025-52691): arbitrary file upload → potential RCE. CSA guidance. https://t.co/ENTnAuoSKw

Chua Meng Han

■■□□□ ⚠️ Cisco confirms active exploitation of two Catalyst SD-WAN Manager flaws.

▶ CVE-2026-20122 enables arbitrary file overwrite via API credentials.
▶CVE-2026-20128 can expose data and grant DCA privileges after login.
 https://thehackernews.com/2026/03/cisco-confirms-active-exploitation-of.html

🚨 Cisco confirms active exploitation of 2 Catalyst SD-WAN Manager (vManage) vulns: CVE-2026-20122 (file overwrite) + CVE-2026-20128 (info disclosure/priv gain). Patch to fixed releases ASAP and lock down mgmt access. 
https://t.co/a5lIhtjDCR
#CyberSecurity #Cisco #SDWAN #Vulert

Cisco SD-WAN Manager under active attack! 🚨 Two flaws, incl. file overwrite (CVE-2026-20122), exploited now. Patch ASAP! 👉 https://t.co/oFlrFagpft #Cisco #SDWAN #Vulnerability #Cybersecurity

Cisco has confirmed that attackers are actively exploiting two vulnerabilities in its Catalyst SD-WAN Manager software — vulnerabilities CVE-2026-20128 and CVE-2026-20122 — which allow unauthorized file access and information disclosure. If you manage a small business network using Cisco SD-WAN equipment, contact your IT provider immediately to apply the latest security updates. These flaws add to a growing list of Cisco vulnerabilities exploited since 2023, including a critical authentication bypass that let attackers insert rogue devices into networks. 🚨
#CyberNewsLive

https://t.co/PfOmGghRS1

[HelpNet] Cisco warns of SD-WAN Manager exploitation, fixes 48 firewall vulnerabilities. Cisco has confirmed that two Catalyst SD-WAN Manager vulnerabilities (CVE-2026-20128 and CVE-2026-20122) patched in late February 2025 are being exploited by... https://t.co/pBmXE5SFe9

**Cisco has issued an urgent advisory confirming active exploitation of two vulnerabilities affecting Catalyst SD-WAN Manager (formerly SD-WAN vManage), with one specifically identified as CVE-2026-20122.** These critical vulnerabilities are being actively targeted in the wild, posing a significant risk to affected environments.

**Technical Breakdown:**
*   **Target:** Cisco Catalyst SD-WAN Manager (formerly SD-WAN vManage)
*   **Vulnerability (Known):** CVE-2026-20122
    *   **CVSS Score:** 7.1 (High)
    *   **Type:** Arbitrary File Overwrite
    *   **Description:** This flaw allows an **authenticated, remote attacker** to overwrite arbitrary files on the local file system. Such a capability can lead to privilege escalation, persistent access, or system compromise by corrupting critical files or configuration.
*   **Exploitation Status:** Active exploitation confirmed by Cisco.

**Defense:**
Organizations utilizing Cisco Catalyst SD-WAN Manager should prioritize reviewing the official Cisco advisory for specific mitigation guidance and applying all available patches immediately. Enhanced monitoring for suspicious file system activity and unauthorized access attempts on these devices is strongly advised.

**Source:** https://thehackernews.com/2026/03/cisco-confirms-active-exploitation-of.html

Cisco warns of SD-WAN Manager exploitation, fixes 48 firewall vulnerabilities: Cisco has confirmed that two Catalyst SD-WAN Manager vulnerabilities (CVE-2026-20128 and CVE-2026-20122) patched in late February 2025 are being exploited by attackers. The… https://t.co/9hdB0VizGJ https://t.co/B7bLABmzfF

Cisco предупреждает о начале активной волны эксплуатации двух недавно исправленных уязвимостей в Catalyst SD-WAN в реальных условиях.

25 февраля поставщик уведомил клиентов о доступности исправлений для пяти уязвимостей Catalyst SD-WAN, включая критические и серьезные проблемы, которые могут быть использованы для доступа к уязвимым системам и повышения привилегий до уровня root. 

По состоянию на 5 марта Cisco обновила свое изначальное уведомление, предупредив о том, что ей стало известно об активной эксплуатации двух из пяти уязвимостей: CVE-2026-20128 и CVE-2026-20122.

Первая, CVE-2026-20128, - это уязвимость, приводящая к раскрытию информации и затрагивающая функцию агента сбора данных (DCA) в Catalyst SD-WAN Manager. Она позволяет авторизованному локальному злоумышленнику получить права пользователя DCA в целевой системе.

Другая, CVE-2026-20122, представляет собой это уязвимость, затрагивающую API Catalyst SD-WAN Manager. Она позволяет удалённому авторизованному злоумышленнику перезаписывать произвольные файлы в системе и получать повышенные привилегии.

В Cisco пока не предоставили никаких подробностей об атаках, нацеленных на эти уязвимости, но в описании указано, что они были объединены с другими ошибками.

Но стоит отметить, что обновление статуса произошло примерно через неделю после того, как Cisco предупредила клиентов об атаках с использованием критической 0-day, затрагивающей Catalyst SD-WAN.

CVE-2026-20127 может быть использована удаленно для обхода аутентификации и получения административных привилегий на уязвимом устройстве.

Тогда CISA сообщала, что уязвимость объединялась в атаках с более старой уязвимостью Catalyst, CVE-2022-20775, для обхода аутентификации, повышения привилегий и обеспечения постоянного присутствия в целевой системе.

Cisco Talos связала эти атаки с UAT-8616, продвинутым злоумышленником, действующим как минимум с 2023 года. Но неясно, были ли все эти уязвимости Catalyst SD-WAN использованы в одной или разных кампаниях. 

Кроме того, Cisco также недавно детектила атаки с нулями, проводимыми китайской APT, отслеживаемой как UAT-9686. В общем, будем следить.

Cisco reports active exploitation of two new Catalyst SD-WAN Manager vulnerabilities: CVE-2026-20122 (high-severity arbitrary file overwrite) and CVE-2026-20128 (info disclosure). Affects all configurations. #SDWAN #CiscoSecurity #USA
https://t.co/GJQsbA1NqG

CVE-2026-20122 A vulnerability in the API of Cisco Catalyst SD-WAN Manager could allow an authenticated, remote attacker to overwrite arbitrary files on the local file system. To ex… https://t.co/TbMIdzHYZ3

Arthur Vidineyev

CVE-2026-20128 A vulnerability in the Data Collection Agent (DCA) feature of Cisco Catalyst SD-WAN Manager could allow an authenticated, local attacker to gain DCA user privileges o… https://t.co/tJSu3FL7Uc

Cisco warns that two vulnerabilities (CVE-2026-20122 and CVE-2026-20128) in its Catalyst SD-WAN Manager are being actively exploited. Update immediately.

#Cisco #CyberSecurity #SDWAN #CVE #ActiveExploitation #NetworkSecurity #InfoSec #PatchAlert
https://t.co/6E83SednDj

⚠️ Cisco confirms active exploitation of two Catalyst SD-WAN Manager flaws.

▶ CVE-2026-20122 enables arbitrary file overwrite via API credentials.

▶CVE-2026-20128 can expose data and grant DCA privileges after login.

🔗 Read → https://t.co/n9aGndggsd

Sometimes, You Can Just Feel The Security In The Design (Junos OS Evolved CVE-2026-21902 RCE) - watchTowr Labs https://t.co/Dq9flZoT89

Juniper Networks PTX Vulnerability Enables Full Router Takeover https://t.co/DMR6nWKt2y 
"This flaw, identified as CVE-2026-21902, allows an unauthenticated, remote attacker to execute arbitrary code as the ‘root’ user, effectively granting them complete control over …"

CRITICAL SECURITY ALERT🚨

A critical vulnerability CVE-2026-21902 has been identified in Junos OS Evolved on Juniper PTX Series routers.

Juniper are advising immediate patching. 

https://t.co/bztdNcZrLp https://t.co/D5jSAv7yHZ

CVE-2026-21902 An Incorrect Permission Assignment for Critical Resource vulnerability in the On-Box Anomaly detection framework of Juniper Networks Junos OS Evolved on PTX Series al… https://t.co/tuvJyr82UV

**Juniper Networks has issued an urgent security patch for a serious vulnerability affecting its PTX series routers that could allow remote code execution by unauthenticated attackers.**

**Key Points:**

- Vulnerability CVE-2026-21902 affects Junos OS Evolved on PTX routers.
- Exploited by unauthenticated attackers, leading to potential complete control over the device.
- Security patch released in versions 25.4R1-S1-EVO and 25.4R2-EVO.
- No evidence of in-the-wild exploitation, but risk is significant given past incidents.
- Encouraged for network managers to apply the patch promptly to mitigate risks.

Juniper Networks recently disclosed a critical vulnerability identified as CVE-2026-21902, impacting the Junos OS Evolved on its PTX series routers. The vulnerability is associated with the On-Box Anomaly detection framework, which is incorrectly exposed, allowing unauthenticated attackers with network access to execute arbitrary code with root privileges. This situation is particularly dangerous as the service is enabled by default, requiring no specific configuration by the user.

If attackers successfully exploit this vulnerability, the ramifications extend beyond compromise of a single device. Experts indicate that control over a PTX router could facilitate interception of data flows and redirecting of traffic, posing significant threats to confidentiality and overall network integrity. Though Juniper reports no confirmed exploitation of this vulnerability in the wild, its historical context indicates that vulnerabilities within Juniper products have drawn the attention of cyber adversaries in the past. Affected organizations are advised to update to the latest software versions to safeguard against potential threats.

What measures are you taking to ensure your network infrastructure is secure against vulnerabilities like CVE-2026-21902?

**Learn More:** [Security Week](https://www.securityweek.com/juniper-networks-ptx-routers-affected-by-critical-vulnerability/)

**Want to stay updated on the latest cyber threats?** 

 👉 **[Subscribe to /r/PwnHub](https://www.reddit.com/r/pwnhub)**

Can you feel it too?

Join us today for our analysis of Juniper's recent pre-auth RCE - CVE-2026-21902 - affecting a very specific set of devices. Curious?

https://t.co/sziS0PBUmB

[Security Affairs] Juniper issues emergency patch for critical PTX router RCE. Juniper released an emergency patch for Junos OS Evolved to fix CVE-2026-21902, a critical RCE flaw affecting PTX routers. Juniper Networks issued an out-of-band security... https://t.co/MtlcaeKwoh

CVE-2026-21902: The "Ghost Packet" is hitting Juniper PTX backbones. One malformed packet = Instant Root Access. No login, no MFA, just total infrastructure takeover.

Full technical breakdown &amp; the "Back-Door" glitch: 🔗 https://t.co/n8ctn5KB0Y

#Juniper #Infosec #RootAccess https://t.co/4Xa8pOHMou

🔴 CVE-2026-21902 - Critical

An Incorrect Permission Assignment for Critical Resource vulnerability in the On-Box Anomaly detection framework of Juniper Networks Junos OS Evolved on PTX Series allows an unauthenticat...

https://t.co/hnSQM9BFKw https://t.co/6a2OSGTq9W

Attackers aren’t chasing laptops anymore.

CVE-2026-21902 → Juniper PTX → Unauthenticated root RCE.

This is internet backbone exposure.

Full analysis:
 https://t.co/n8ctn5KB0Y
#NetworkSecurity #CVE #ThreatIntel #CyberAttack @CISACyber https://t.co/iHO5xvpJKb

Mccaulay

Kibernetinio saugumo tyrėjai įspėja apie kritinę „FreeScout“ pagalbos tarnybos platformos pažeidžiamumą, leidžiantį įsilaužėliams perimti pašto serverių kontrolę naudojant vadinamąją „Mail2Shell“ ataką. Aptikta spraga, pažymėta CVE-2026-28289, suteikia galimybę nuotoliniu būdu vykdyti kodą serveryje be jokios vartotojo sąveikos ar autentifikacijos. Ataka gali būti inicijuojama tiesiog išsiunčiant specialiai parengtą el. laišką į bet kurį „FreeScout“ sistemoje sukonfigūruotą pašto adresą. Kenkėjiškas priedas išsaugomas serverio kataloge, iš kurio užpuolikas gali pasiekti ir paleisti įkeltą kodą, taip perimdamas serverio kontrolę. Pažeidžiamumas atsirado dėl būdo apeiti ankstesnį saugumo pataisymą naudojant nematomą „zero-width“ simbolį failo pavadinime, kuris leidžia įkelti pavojingus konfigūracinius failus ir vykdyti komandas serveryje. Nors aktyvus šios spragos išnaudojimas dar neužfiksuotas, saugumo ekspertai įspėja, kad dėl paprasto išnaudojimo mechanizmo rizika yra labai didelė, todėl organizacijoms rekomenduojama nedelsiant atnaujinti „FreeScout“ į naujausią versiją bei papildomai apriboti serverio konfigūracijas, kad būtų sumažinta galimų atakų tikimybė.

Skaitom: [https://www.bleepingcomputer.com/news/security/mail2shell-zero-click-attack-lets-hackers-hijack-freescout-mail-servers/](https://www.bleepingcomputer.com/news/security/mail2shell-zero-click-attack-lets-hackers-hijack-freescout-mail-servers/)

@Sekurak Thanks for including our research! 
The new bypass CVE (CVE-2026-28289) that your notified on is our (@OX__Security) finding, we're going to have a full blog online about this later today, we would be glad if you could reference it correctly once its out.

Thanks! and great blog!

🚨*CVE*

CVE-2026-28289 FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. A patch bypass vulnerability for CVE-2026-27636 in FreeScout 1.8.206 and earlier al… https://t.co/S204EsoD6g
-----
Traducción:
CVE-2026-28289 Fre… https://t.co/utmtNgl3sv`

『OX Research found a filename validation bypass that escalates a prior patched authenticated RCE into Zero‑Click Unauthenticated RCE 』

Mail2Shell – CVE-2026-28289: New Zero-Click RCE On FreeScout
https://t.co/CbRURPDpki

A critical 10.0 CVSS unauthenticated remote code execution flaw (CVE-2026-28289) in FreeScout allows full server takeover via an invisible character exploit.

#FreeScout #CyberSecurity #CVE202628289 #RCE #InfoSec #Vulnerability #PatchAlert #HelpDesk
https://t.co/DjFiVnuSxk

Trends

Stats

Researchers