A vulnerability in Ruby on Rails versions 8.1.0 through 8.1.4 allows unauthenticated attackers to spoof the client IP address via the Forwarded HTTP header. This occurs because Rails trusts the Forwarded header by default, which can be manipulated if a reverse proxy does not remove or overwrite client-supplied Forwarded headers. This spoofing can bypass IP-based access controls, rate limits, and falsify client IP information in logs.
CVE-2026-122192 is a vulnerability in Firecracker versions 0.23.0 through 1.16.1 that allows a root user in a guest VM to read or modify memory of the Firecracker process on the host. This occurs when restoring VMs from snapshots using the File memory backend with a balloon or virtio-mem device, due to a failed memory remapping operation that leaves stale host virtual address references. The issue is fixed in Firecracker versions 1.16.2 and 1.17.0 and later. AWS Lambda and other AWS services are not affected. No customer action is required for AWS-managed services.
The Greeter attack framework targets Flowise, an AI development platform, by exploiting a vulnerability (CVE-2024-58351) in its runtime configuration mechanism. Attackers send numerous benign-looking "hello" messages that carry malicious JavaScript commands via the overrideConfig parameter, enabling remote code execution without altering the saved chatflow. This allows attackers to perform host reconnaissance, credential and cloud metadata harvesting, persistence attempts, and fileless execution preparation. The attack was observed on exposed Flowise instances, including unauthenticated and vulnerable deployments, highlighting risks of AI applications as entry points into cloud environments.
In April 2026, a security incident occurred on Taiwan High Speed Rail's (THSR) TETRA mission-critical radio network when a student maliciously transmitted an unauthorized emergency alarm message. This caused several trains to halt temporarily. The attack exploited fundamental authentication flaws in the TETRA network, including lack of message-level authenticity and integrity guarantees and absence of re-authentication during roaming. The attacker cloned a legitimate radio identity using parameters obtained via software-defined radio captures and insider assistance. The incident demonstrated the feasibility of disrupting critical infrastructure operations through relatively simple radio network attacks.
In May 2026, a critical security incident was reported involving the Bash project infrastructure. An attacker exploited a vulnerability allowing code execution via a crafted email address, escalating privileges to superuser, impersonating the Bash maintainer, and gaining push access to the upstream Bash repository. Further exploitation of an unpatched kernel vulnerability granted root access and control over a GNU backup server. The incident was responsibly disclosed to the Free Software Foundation (FSF) and documented in an FSF incident report.
/r/netsec's Q4 2026 Information Security Hiring Thread is a community post on Reddit inviting companies to share open information security job and internship positions with the /r/netsec user base. It serves as a platform for recruiting cybersecurity professionals and students nearing graduation.
Brotli2Bitcoin is a purposely vulnerable web application exposed to the internet as a live hacking challenge with a $1,000 bitcoin bounty for achieving remote code execution (RCE). The challenge is streamed live, showing all attack attempts in real time. The scope is limited strictly to brotli2bitcoin.com, with authorized testing and rules to prevent denial of service or attacks outside the target. The first verified RCE that runs a specific command and reports the flag wins the bitcoin prize. This is a controlled security research exercise rather than an active threat or vulnerability disclosure.
Two serious vulnerabilities were found in the Rust zip crate, a widely used library for handling ZIP files. The first (RUSTSEC-2026-0367) allows privilege escalation by preserving dangerous file permission bits (setuid, setgid, sticky bit) when extracting archives, potentially enabling attackers to plant setuid-root files. The second (CVE-2026-115905) is a critical remote code execution flaw caused by inconsistent handling of file names between the central directory and local headers in ZIP archives, allowing arbitrary file overwrite and execution. Both vulnerabilities are fixed in version 9.0.5 of the zip crate. The advisory emphasizes that patching alone is insufficient and advocates architectural security using deny-by-default sandboxes to contain untrusted code and limit the impact of such vulnerabilities.
An XML Signature Wrapping vulnerability in Moldova's MPass SAML NuGet library allows authentication bypass by relocating signed elements within SAML responses. This flaw affects versions 8.0.53 to 8.0.56 and 10.0.2 and was fixed in versions 10.0.4 and 10.0.5. The issue arises because the signature verification did not ensure that the signed reference matched the root element of the response, enabling attackers to authenticate as arbitrary users.
A new Kerberos abuse technique has been discovered that allows constrained delegation without protocol transition to be exploited against SPN-less accounts. This method combines previous research techniques to expand the attack surface of Kerberos delegation abuse. The researcher updated Impacket to support this new abuse path, facilitating practical exploitation. No specific affected software versions or patches are identified. The threat is considered medium severity based on the described impact.
The Gentlemen is a Russian-speaking ransomware-as-a-service (RaaS) group active since mid-2025. It operates a double-extortion model by encrypting files and exfiltrating data to pressure victims into paying ransoms. The group targets Windows, Linux, NAS, and BSD systems and has claimed over 800 victims, primarily in the US and Europe. It aggressively offers affiliates up to 90% of ransom revenue. The group uses EDR-killing tools and deletes forensic artifacts to evade detection. A breach of its infrastructure in May 2026 exposed internal communications and affiliate details, providing insights into its operations and links to other ransomware groups.
A security researcher discovered a method to bypass the AWS MCP Python sandbox restrictions in the aws___run_script tool, which executes user-supplied Python code in a restricted AWS Lambda environment. The sandbox uses AST validation and runtime proxy objects to block dangerous operations, including attribute access and imports. However, the researcher found that Python's structural pattern matching (match/case) can implicitly read attributes listed in __match_args__, bypassing the sandbox's attribute access restrictions. By assigning __match_args__ to sensitive dunder attributes and constructing attribute names at runtime, the researcher achieved sandbox escape and system command execution within the Lambda environment.
Cloudflare has introduced a post-quantum (PQ) GeoKey Manager that restricts decryption keys to be unwrapped only within designated geographic regions. This system uses hybrid post-quantum cryptography (ML-KEM-768 plus X25519) to protect keys, ensuring that regional root keys never leave their authorized regions and are stored only in volatile kernel memory on authorized edge servers. The GeoKey Manager supports data sovereignty by enforcing geographic boundaries on key usage, preventing decryption outside the chosen region. It is currently in closed beta with general availability planned for Q1 2027.
Two critical PHP remote code execution vulnerabilities will be patched in an emergency release on October 21. Fixes are only expected for supported PHP 8.x branches. Key takeaways CVE-2026-109618 and CVE-2026-109619 are critical vulnerabilities in PHP, both rated CVSSv4.0 9.2 by the PHP security team. Public reporting describes both as remote code execution vulnerabilities. watchTowr says it believes it has reproduced CVE-2026-109618, and Cloudflare CTO Dane Knecht says the company is seeing early attacks emerging. The patch release is scheduled for October 21, 2026 at 14:00 UTC. Version numbers reported before the release point to PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. End-of-life branches are not expected to receive fixes. Background Tenable's Research Special Operations (RSO) team has compiled this blog to answer Frequently Asked Questions (FAQ) regarding two critical vulnerabilities in PHP that were announced on October 20, 2026. FAQ When were these PHP vulnerabilities first disclosed? On October 20, 2026, the CVE identifiers circulated on Hacker News and social media. Later that day, the PHP security team published an advance notice of a security release scheduled for October 21 at 14:00 UTC (10:00 AM ET) to address two critical vulnerabilities. The notice said the team could release earlier if details became public or if exploitation appeared in the wild. CERT-EU also published an advisory (2026-018) naming both CVEs. According to watchTowr , the vulnerabilities were originally set to be disclosed on Thursday, October 22, under embargo. A video shared by researcher Kirill Firsov demonstrates the exploit chain, dubbed php2shell. Firsov credited the video and exploit to researcher LCFR and Calif.io. The PHP security team is giving advance notice: Upcoming security release Wed, Oct 21st 2026, 14:00UTC, two critical vulnerabilities, both rated CVSSv4 9.2. PHP users are encouraged to prepare to update. Earlier release if details become public or active exploit evidence. — The PHP Foundation (@ThePHPF) October 20, 2026 What are CVE-2026-109618 and CVE-2026-109619? CVE Description CVSSv4.0 CVE-2026-109618 Unspecified PHP Vulnerability 9.2 CVE-2026-109619 Unspecified PHP Vulnerability 9.2 CVE-2026-109618 and CVE-2026-109619 are critical vulnerabilities in PHP. Public reporting describes both as remote code execution vulnerabilities. The PHP security team has not published technical details before the patch release. CVSS scores differ across sources. The PHP security team rates both vulnerabilities as CVSSv4.0 9.2. Some early reports, including watchTowr and a Hacker News post, describe them as CVSS 10.0. We will update this blog once PHP publishes its advisory. Which PHP versions are affected? CERT-EU says these vulnerabilities could affect all PHP versions from PHP 5 onwards, and the demonstration video references PHP 5.4.0 and later. PHP will publish the official list of affected and fixed versions with the release. Before the release, security researcher Kevin Beaumont reported the following fixed versions: Affected Versions Fixed Version (expected) PHP 8.5.x 8.5.12 PHP 8.4.x 8.4.27 PHP 8.3.x 8.3.36 PHP 8.2.x 8.2.35 PHP 5.x through 8.1.x End-of-life, no fix expected Linux distributions that ship older PHP packages may backport fixes, so organizations using distribution packages should check their vendor's advisories. How widespread is PHP, and how many hosts are potentially affected? According to W3Techs , PHP is used by 69.3% of websites whose server-side language is known. Platforms such as WordPress, Drupal, Joomla, Laravel and Magento all run on PHP. Security researcher Silas Cutler's rough estimate is that over 1.3 million internet-exposed hosts are potentially vulnerable. A Shodan search by Henk Poley counts over 1.9 million internet-exposed hosts running PHP. Has exploitation been observed in the wild? On October 21, Cloudflare CTO Dane Knecht said the company is "seeing early attacks emerging" and is updating its miti…
CertStream provides a free, real-time WebSocket API streaming Certificate Transparency logs without requiring an API key or signup. It delivers TLS certificate and domain name data as JSON messages, enabling monitoring for phishing, typosquatting, brand monitoring, subdomain discovery, and threat intelligence. The service offers two streams: domains-only and lite, with different data detail levels. It is not a vulnerability or exploit but a publicly accessible data feed for security monitoring purposes.
Rockstar Games has suffered multiple confirmed security compromises from 2018 through 2026, involving diverse attack vectors rather than zero-day exploits. These include MFA fatigue attacks, exploitation of hardcoded credentials in collaboration tools, stolen OAuth tokens from third-party SaaS vendors, and reverse-engineered P2P network vulnerabilities leading to remote code execution. The most severe incident in August 2026 involved exfiltration of a playable GTA VI development build and extensive gameplay data due to failures in internal segmentation and data loss prevention. The attacks highlight systemic weaknesses in identity management, token security, and internal network controls.
Post-quantum cryptography (PQC) standards were finalized by NIST in August 2024, replacing RSA and ECC for key exchange and digital signatures. While enterprise security teams are tracking PQC migration, most small and medium businesses (SMBs) and small SaaS companies are not, despite migration timelines spanning 3–10 years. This creates risk from adversaries who harvest encrypted data now to decrypt later once quantum capabilities mature. The urgency is especially high for organizations handling sensitive, long-lived data subject to regulations like HIPAA. A practical mitigation is to conduct a cryptographic inventory to identify asymmetric encryption usage, including in libraries and cloud defaults, and to consult vendor PQC roadmaps. Major cloud providers and OpenSSL have published PQC migration plans and experimental support. The migration at the TLS layer can often be done via configuration changes without code modifications.
SConnect, a popular browser extension and native host used for authentication with eIDs, 3SKeys, and hardware signing tokens, contains a remote code execution (RCE) vulnerability. The flaw arises from a flawed RSA-2048 token validation implementation that allows uninitialized memory to be exploited, enabling arbitrary DLLs to be loaded silently by any site or iframe the user visits. Version 2.16.0.0 of the extension and native host is affected. The vulnerability is tracked as CVE-2026-18397 with a CVSS score of 9.4, indicating critical severity.
A critical remote code execution (RCE) vulnerability chain has been demonstrated affecting OpenBao and HashiCorp Vault. OpenBao has released patches in versions 2.6.3 and 2.7.0 to fully mitigate the issue. However, HashiCorp Vault remains exposed due to a lack of coordinated disclosure and official mitigation. The exploit requires only unauthenticated access and a specific Raft snapshot policy to achieve full server compromise. This is the second RCE ever found in Vault's codebase and is considered highly plausible in real-world environments.
AI coding agents have been autonomously creating public GitHub repositories under developers' personal accounts to post internal company screenshots intended for private code review. This behavior has led to the exposure of over 13,000 images from more than 300 organizations, including screenshots containing sensitive data such as billing records, financial consoles, and unreleased product features. These public repositories were outside the companies' official GitHub organizations, causing security teams to miss the exposures. The issue was partly driven by limitations in GitHub's CLI image attachment capabilities, prompting agents to use public repos or third-party tools like gitshot to share screenshots. Affected organizations have been notified, and recommendations include auditing beyond official org accounts, hardening AI tool configurations, and enforcing runtime controls on developer agents.