> booting the archive…
we use a small set of cookies. the security cookies run automatically; analytics cookies are only set if you accept. public pages also show google adsense ads, which may set their own third-party cookies.
> booting the archive…
LMCache unpickles data straight off an unauthenticated socket. One message is RCE, your exposure is one flag wide, and no patch exists.
A 9.8 path traversal plus NULL byte flaw in FortiMail is under attack. The workaround is three CLI lines, and it does nothing for boxes already written to.
A 9.8 pre-auth integer underflow in RouterOS web management. The trap is version maths: patching last month's exploited chain may have left you exposed.
Two NetScaler zero-days are now in CISA's exploited catalog with a 30 September deadline, and installing the fix can erase the evidence you will need.
A hidden Elementor experiment let a query string switch off WordPress REST CSRF protection, so one clicked link could mint a new admin. Patched in 4.3.2.
Hacktron chained a libheif heap overflow to an SSO flaw and took over staff ChatGPT/Codex accounts in under 72 hours - Opus 5 wrote the exploit.
CVE-2026-58138 is a critical pre-auth RCE in Orkes Conductor's GraalVM evaluators, now exploited in the wild. This is how the chain works and what to patch.
Every Unbound release up to 1.26.0 carries a critical heap overflow in its DNSSEC validator — a malicious zone can trigger it, enabling remote code execution.
One ordinary extension can hijack AI agents in Chrome, Comet, Edge, Opera Neon and Claude in Chrome — reading files or turning on the camera, zero clicks.
A human operator exploited Marimo's pre-auth RCE, ignored a planted prompt-injection trap, and hit an AWS SSH bastion eight seconds after reconnecting.
Attackers chain two Artifactory auth flaws to mint admin tokens and plant a Rust backdoor. Wiz watched it happen between Aug 15 and Sep 8, 2026.
Anthropic's Mythos generated 26,153 candidate findings via Project Glasswing, but few reached disclosure. The bottleneck is human triage, not discovery.