This research project documents a remote code execution (RCE) vulnerability in PHP version 8.4.26 under the official production configuration. The exploit chain uses only HTTP requests and includes an ASLR bypass via out-of-bounds memory disclosure. It does not require enabling display_errors or modifying the default 128 MB memory limit. The attack involves multi-stage exploitation including PHP session-state corruption, heap manipulation, and control-flow hijacking. The exploit was successfully reproduced on an Apache prefork configuration with a 10/10 success rate in the tested environment. The repository provides detailed technical documentation, code comments, and evidence of the exploit's effectiveness. The translation effort makes the original Chinese research accessible to the international security community.
Critical9.8EPSS 0.6%Zero Day InitiativeCVE-2026-114549
A critical heap-based buffer overflow vulnerability in NoMachine nxwebrunner allows remote attackers to execute arbitrary code without authentication. The vulnerability is assigned CVE-2026-114549 and has a CVSS rating of 9.8 by the Zero Day Initiative. No patch or affected versions are specified in the available data.
A remote code execution vulnerability exists in NVIDIA Megatron Bridge due to unsafe YAML file parsing that allows code injection. Exploitation requires user interaction, such as visiting a malicious webpage or opening a malicious file. The vulnerability is assigned CVE-2026-24250 and has a high severity rating.
Medium5.8EPSS 0.6%Zero Day InitiativeCVE-2026-20218
A stack-based buffer overflow vulnerability in Cisco Snort's OLE VBA decompression component allows remote attackers to execute arbitrary code without authentication. The vulnerability is identified as CVE-2026-20218 and has a high severity rating with a CVSS score assigned by ZDI of 8.1. No affected versions or patch information are provided in the available data.
Two critical remote code execution vulnerabilities, collectively known as PHP2Shell, affect PHP versions back to 5.4 and impact widely used web applications such as WordPress, Drupal, and Joomla. These vulnerabilities involve memory management and error handling components of PHP and allow unauthenticated attackers to execute arbitrary code. Exploitation attempts have been detected in the wild shortly after patches were released. The flaws also enable reading sensitive process memory, potentially exposing credentials and secrets. Patches are available in PHP versions 8.5.12, 8.4.27, 8.3.36, 8.2.35, and backports for 7.4, 8.0, and 8.1. The PHP Foundation and security firms urge immediate patching due to the severity and active exploitation attempts.
OshoosiClaw v1.2.0 is an open source decentralized, autonomous Endpoint Detection and Response (EDR) and AI agent containment engine written in Rust for Linux and Windows. It operates locally with kernel and hardware boundary enforcement, aiming to defend against advanced attack techniques such as kernel callback blinding and AI agent breakouts. The project is actively seeking developers and penetration testers to evaluate its security by attempting various attack methods and to contribute improvements. No known exploits or vulnerabilities have been reported at this time.
Bulletin ID: 2026-058-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 07/16/2026 10:15 AM PDT Description: Bedrock AgentCore Python SDK (bedrock-agentcore) is an open-source Python library that provides client tools for building AI agents on the Amazon Bedrock AgentCore platform. We identified CVE-2026-15737 in the OpenTelemetry instrumentation of the SDK. Affected versions wrote raw user prompts and complete agent responses into OpenTelemetry span attributes on every invocation without filtering or masking. These spans flow into the customer's aws/spans CloudWatch log group, where a local authenticated user with CloudWatch Logs read access could access the potentially sensitive content. Impacted versions: 1.4.8, 1.5.0 Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin.
Bulletin ID: 2026-052-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 07/06/2026 13:45 PM PDT Description: Amazon mcp-gateway-registry is an open-source gateway and registry for Model Context Protocol (MCP) servers, providing centralized discovery, authentication/authorization, and proxying of MCP tools for AI agents. We identified CVE-2026-14471, an issue in the metrics-service retention policy management component where a caller-supplied table_name value is interpolated into SQL statements in identifier position without proper neutralization. An authenticated remote user is able to supply a crafted table_name value to execute arbitrary SQL queries against the metrics database. This allows the user to read stored data (including API key material) and to delete or alter stored data. Impacted versions: >=1.0.3 AND <=1.0.12 Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin.
Bulletin ID: 2026-051-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 07/01/2026 12:45 PM PDT Description: The AWS Advanced JDBC Wrapper is an open-source JDBC driver wrapper that extends a JDBC driver to enable Amazon Aurora and AWS Cloud features such as failover handling and caching. We identified CVE-2026-14265, an issue in the RemoteQueryCachePlugin of the AWS Advanced JDBC Wrapper. When this plugin is enabled, query results read from the shared Redis/Valkey cache are deserialized without class filtering. An actor with write access to the shared cache infrastructure could insert a crafted serialized Java object that, when read by an application, results in execution of arbitrary code on the application server. Impacted versions: >=3.3.0 AND <=4.0.0 Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin.
Bulletin ID: 2026-050-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 07/01/2026 12:15 PM PDT Description: AWS CDK (aws-cdk-lib) is an open-source framework for defining cloud infrastructure in code and provisioning it through AWS CloudFormation. We identified CVE-2026-13760, an OS command injection issue in the NodejsFunction Docker bundling pipeline in aws-cdk-lib before 2.260.0 that could allow an actor who controls dependency version strings in a project's package.json file to execute arbitrary commands on the host running the CDK toolchain via injected shell metacharacters in the OsCommand helper. This issue requires the actor to control the content of a package.json dependency version string that is processed during Docker-based bundling with nodeModules specified. Impacted versions: < 2.260.0 Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin.
Bulletin ID: 2026-048-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 06/29/2026 11:15 PM PDT Description: AWS WAF is a web application firewall that monitors the HTTP(S) requests that are forwarded to your protected web application resources. We identified CVE-2026-13762 and CVE-2026-13763, which are issues affecting HTTP/2 multi-frame request body inspection by AWS WAF. CVE-2026-13762 affects AWS WAF deployment with CloudFront. This issue was remediated server-side; no customer action is required. CVE-2026-13763 affects AWS WAF deployment with AWS Application Load Balancer (ALB). Under certain conditions, a crafted multi-frame HTTP/2 request could cause only a partial request body to be inspected. This issue has been addressed on ALB, and customers can ensure full protection by configuring how AWS WAF inspects HTTP/2 request bodies on their ALB. Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin.
Bulletin ID: 2026-047-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 06/23/2026 09:30 AM PDT Description: Language Servers for AWS provide the underlying language-server runtime that powers Amazon Q Developer's AI coding assistance across its IDE plugins (Visual Studio Code, JetBrains, Eclipse, and Visual Studio). We identified CVE-2026-12957, an improper trust boundary enforcement issue in Language Servers for AWS before version 1.65.0. If a local user opens a maliciously crafted workspace, any commands within the project configuration files may be automatically executed. This issue requires the user to trust the workspace when prompted. We identified CVE-2026-12958, a missing symlink-validation issue in Language Servers for AWS before version 1.69.0. This may occur when a local user opens a workspace with a maliciously crafted symlink that resolves to a file path outside the workspace trust boundary. These issues affect the Amazon Q Developer IDE plugins, which bundle Language Servers for AWS. Both issues are remediated in Language Servers for AWS version 1.69.0. Affected products & versions: - Language Servers for AWS: < 1.69. - Amazon Q Developer for Visual Studio Code: < 2.20 - Amazon Q Developer for JetBains: < 4.3 - Amazon Q Developer for Eclipse: < 2.7.4 - AWS Toolkit with Amazon Q for Visual Studio: < 1.94.0.0 Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin.
Drupal has released patches for five vulnerabilities, including two critical remote code execution (RCE) flaws affecting the Entity List and Field UI modules. These vulnerabilities are not exploitable with the modules alone but can be exploited when combined with certain contributed modules, with at least one exploit path requiring no authentication. Users are advised to update to specific patched versions or uninstall the Field UI module as a mitigation. No active exploitation in the wild has been reported, but Drupal warns that exploits could be developed rapidly.
This content describes an open-source phishing forensics engine named phish-zero that claims 98.32% accuracy and operates with a zero-egress architecture to avoid leaking corporate click data. It uses local neural phishing detection, character n-gram TF-IDF vectorizers, and flags for TLD abuse. The post is a community share on Reddit and includes a link to the GitHub repository. There is no indication of a security vulnerability or active threat associated with this tool itself.
This content describes an open-source cybersecurity project called Vader-Pro-VDR, which is an AI-assisted vulnerability detection and remediation platform. The project includes a Go-based endpoint agent for system inventory collection and a Python FastAPI backend for processing and storing telemetry data. It features secure, encrypted data transmission and a modular API design. The post is a request for advice on growing the project and attracting contributors, not a report of a security vulnerability or threat.
CVE Intel is an open-source tool that aggregates multiple public vulnerability intelligence sources such as NVD, CISA KEV, EPSS, and OSV into a single risk score and prioritization recommendation. It supports querying CVEs, IPs, file hashes, and dependencies, providing a risk score from 0 to 100 and an urgency indicator for patching. The tool includes a local AI model for explaining findings and can be used as a desktop app, CLI, REST API, or MCP server for AI coding assistants. It does not scan or fix vulnerabilities but helps security teams prioritize patching efforts based on consolidated threat intelligence.