4 casos · pág. 1/1
On July 25, 2026, Hacktron researchers chained a heap buffer overflow in libheif (reached through ImageMagick in Discourse's image-upload pipeline) with an OpenAI SSO weakness. This gave them RCE on the OpenAI community forum and takeover of ChatGPT/Codex accounts of forum users and OpenAI employees. To prove impact without reading sensit…
eMudhra, an India-based certificate authority trusted by major root programs, generated the private keys of eight intermediate CA certificates (issued April 2025) so poorly that each key is below 256, and one is the number 4. A researcher known as Wayne reported the compromise to the root programs on 17 October 2026, proving it by signing…
A critical Linux kernel networking flaw, CVE-2026-99999 (nicknamed PwnEscape, CVSS 9.3), lets code inside a guest VM read host memory, crash the host and, in lab conditions, run code on it. Researcher Paulos Yibelo of pwn.ai demonstrated the memory leak against Vercel's production sandboxes, which Vercel confirmed. The flaw was found in a…
The PHP security team released emergency fixes on October 21, 2026 for two critical core flaws, CVE-2026-109618 and CVE-2026-109619, nicknamed PHP2Shell. Both are rated CVSS v4.0 9.2 and allow unauthenticated remote code execution (RCE) as the web worker account. They can also expose process memory that may hold credentials and API keys (…
