PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

[CVE-2026-34908] Popping Root on UniFi OS Server: Unauthenticated RCE Chain Detection & Analysis

bishopfox.com | blog | CVE-2026-34908 | #rce | #vulnerability-research | #command-injection | #unifi | #ubiquiti | #cve-2026-34908
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Bishop Fox confirms an unauthenticated chain across UniFi OS flaws — CVE-2026-34908/34909 plus a package-update command injection — yielding root in one request; patch UOS 5.0.8+ and rotate secrets.
CVE
CVE-2026-34908
Published
Collected

Related coverage

research · github.com
Steal My Bitcoin Challenge Writeup: PHP 8.4.26 Session Upload Progress Memory Exhaustion Analysis
Provides a detailed binary-level case study on PHP Zend memory manager behavior and worker state persistence after fatal out-of-memory errors.
research · crowdstrike.com
CrowdStrike Protects Customers from Threats Delivered via PHP2Shell
The Falcon platform provides out-of-the-box visibility and detection coverage for post-exploitation activities of CVE-2026-109618 and CVE-2026-109619.
research · slcyber.io
More Critical Bugs in Adobe Experience Manager: Pre-Auth RCE
Chaining an unauthenticated bulk import, an in-band XXE, leaked IMS credentials and Groovy execution into full pre-auth RCE on Adobe Experience Manager Cloud.
vulnerability · vercel.com
Reproducing, disclosing, and fixing the libheif vulnerability with Hacktron and the maintainers
How Vercel and Hacktron coordinated a fix for a remote code execution vulnerability that reached Next.js image optimization through sharp, libvips, and libheif.
blog · yeswehack.com
Dojo challenge #43 CCTV Manager winners & writeup
Dojo #43 'CCTV Manager' writeup: predicting a pseudo-random auth token to gain access, then exploiting YAML deserialization for OS command injection and RCE; winners mayaar, stealthcopter, Pr1nc3ss.
blog · yeswehack.com
Dojo challenge #41 - Ruby treasure winners & writeup
Winners and writeups for Dojo challenge #41 'Ruby treasure', where participants bypassed a regex filter and exploited a command injection in Ruby's IO.read function to capture the flag.
Back