Researcher Wins $2,000 Bug-Bounty Challenge by Chaining Critical PHP Flaws, Publishes New PoC
A security researcher known as 'killa' claimed the prize on a public bitcoin-themed hacking challenge by exploiting two critical PHP vulnerabilities — tracked as the PHP2Shell flaws, CVSS...
GitLab Patches Maximum-Severity RCE Flaw as Exploit Code Goes Public
A public proof-of-concept now exists for CVE-2026-97229, a maximum-severity (CVSS 10.0) GitLab vulnerability that chains a CI/CD regex integer overflow into remote command execution. Self-managed GitLab instances on...
Nine-Day Scanning Surge Targets Unpatched Hikvision Cameras Across Ukraine
GreyNoise logged a sharp nine-day spike in scanning and exploitation attempts against internet-exposed Hikvision cameras in Ukraine, almost all aimed at the four-year-old, maximum-severity CVE-2021-36260 command injection flaw....
AI Gateways Under Fire: Attackers Chain LiteLLM and MCP Flaws for Remote Code Execution
A 90-day honeypot study shows attackers systematically probing AI proxies, MCP servers, and agent frameworks like LangChain and Langflow, chaining authentication bypass and command-injection bugs into remote code...
Unauthenticated File Upload Flaw in Elementor Pro Opens Door to Remote Code Execution
A critical vulnerability tracked as CVE-2026-32475 lets unauthenticated attackers upload malicious PHP files through the Elementor Pro Forms widget, potentially leading to full remote code execution on affected...
Four Chained Flaws in Microsoft SCCM Let Any Domain User Seize Full Server Control
A newly disclosed exploit chain in Microsoft System Center Configuration Manager, tracked as CVE-2026-47301, lets a standard Active Directory user achieve remote code execution as SYSTEM on the...
Roundcube Patches Eleven Flaws, Including Remote Code Execution Reachable Through Spam-Learning Plugin
Roundcube 1.6.18 and 1.7.3 close eleven vulnerabilities, headlined by a remote code execution bug in the markasjunk plugin and two SSRF filter bypasses. No in-the-wild exploitation has been...
Zoom Patches ‘Zoomsday’ Flaw That Let Meeting Guests Hijack Devices Without a Single Click
Zoom has fixed four vulnerabilities in its meeting clients, including a high-severity bug dubbed 'Zoomsday' that let any meeting participant execute code on another attendee's device with zero...