A UAF turned RCE
In the curl 8.23.0 release we shipped a fix for one of the worst vulnerabilities in curl in a long time. We grade it severity HIGH. It is known as CVE-2026-92392 with the title HTTP/2 upload Use-After-Free.
Lobsters6 min read
rce
15 stories
BREAKING: New no-login code execution bug in Magento and Adobe Commerce (CVE-2026-103849)
How to fix CVE-2026-103849: upgrade Adobe Commerce or Magento Open Source to the October 2026 build (APSB26-153). No-login code execution, CVSS 10.
HCS (Hashgraph Consensus Service) Blog5 min readBREAKING: GitLab critical patch fixes no-login code execution on self-managed servers (CVE-2026-97229)
How to fix CVE-2026-97229: upgrade GitLab to 19.4.2, 19.3.5 or 19.2.8. No-login code execution via CI/CD regex on self-managed GitLab, plus 23 other fixes.
HCS (Hashgraph Consensus Service) Blog6 min readFinding a $90,000 Remote Code Execution Vulnerability in Google
A Flask cookie on developers.google.com was signed with a secret it was also carrying inside itself. Pulling that secret out turned a forged session into code execution across seven Google domains.
Lobsters5 min readOpening a LibreOffice spreadsheet can run remote Java code (CVE-2026-63277)
How to fix CVE-2026-63277: upgrade LibreOffice to 26.2.5 or 26.8.0. A Calc file could load a remote Java driver on open. Five sibling bugs fixed too.
HCS (Hashgraph Consensus Service) Blog6 min readZammad session fixation to root hits CISA KEV
How to fix CVE-2026-102489: upgrade Zammad to 7.2.0. Same-day CISA KEV on Zammad session fixation RCE chained with local privilege escalation CVE-2026-102490. Due 2026-10-05.
HCS (Hashgraph Consensus Service) Blog5 min readUnsloth RCE: malicious Hugging Face model config.json injects code
How to fix CVE-2026-93348: upgrade unsloth-zoo to 2026.8.14+ and unsloth to 2026.8.20+. Malicious Hugging Face model config.json model_type injects code into Unsloth exec path.
HCS (Hashgraph Consensus Service) Blog4 min readBREAKING: Unauthenticated NetScaler RCE hits every appliance (CVE-2026-88771)
How to fix CVE-2026-88771: upgrade NetScaler ADC/Gateway to 14.1-73.37 or 13.1-64.23
HCS (Hashgraph Consensus Service) Blog6 min readWordPress page template include hits CISA KEV
How to fix CVE-2026-87902: upgrade WordPress to 7.1.2 (or your branch patch). Same-day CISA KEV on WordPress Core page-template LFI with conditional RCE.
HCS (Hashgraph Consensus Service) Blog4 min readSharePoint code injection hits CISA KEV
How to fix CVE-2026-65660: upgrade SharePoint Server to the August 2026 fixed builds (SE 16.0.19725.20522 / 2019 16.0.10417.20198 / 2016 16.0.5565.1001). Same-day CISA KEV on SharePoint code injection RCE.
HCS (Hashgraph Consensus Service) Blog4 min readF5 BIG-IP APM OAuth RCE hits CISA KEV
CVE-2026-94127 affects BIG-IP APM when configured as an OAuth Authorization Server. OAuth Client-only and Resource Server-only deployments are not affected.
HCS (Hashgraph Consensus Service) Blog2 min readBREAKING: CVE-2026-94545 Next.js next/og ImageResponse RCE (GHSA-vcvr-r3jv-pc5j)
How to fix CVE-2026-94545: upgrade next to 16.3.6 (15.5.26 hardening if you stay on 15.x)
HCS (Hashgraph Consensus Service) Blog5 min readTemporal write access can run shell on your Worker Service host
How to fix CVE-2026-89139: upgrade Temporal Server to 1.31.3 or 1.30.7
HCS (Hashgraph Consensus Service) Blog5 min readBREAKING: Unbound DNSKEY digest overflow can RCE your resolver (1.26.1)
How to fix CVE-2026-81642: upgrade Unbound to 1.26.1. Same-day NLnet Labs release also patches CNAME heap corruption, DoH UAF, ReTrap DoS, and related resolver bugs.
HCS (Hashgraph Consensus Service) Blog5 min readBREAKING: CVE-2026-0310 PAN-OS XML overflow gives unauth root on PA-Series
How to fix CVE-2026-0310: upgrade PAN-OS to the vendor fixed hotfix. Urgency HIGHEST. Unauth root on PA-Series via XML on mgmt or dataplane.
HCS (Hashgraph Consensus Service) Blog5 min read
Showing 15 of 15 stories
You're all caught up.
AiByts Weekly Brief
Get the top AI news and tools straight to your inbox every week.
Weekly · AI news
Join 15,000+ AI enthusiasts