PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

August 2026 Security Vulnerability: What happened?

metabase.com | advisory | #cloud | #zero-day | #incident-response | #security-audit | #vulnerability | #metabase | #advisory | #postmortem
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Metabase postmortem: a zero-day chain via /reset-password — unclosed type checks, a body-forwarding refactor, ORM lookups — let attackers mint sessions; patched Aug 6; under 3% of cloud customers hit.

Why it matters

This advisory helps Metabase administrators evaluate impact and complete recommended upgrade procedures.
Vendor
Metabase
Product
Metabase
Published
Collected

Related coverage

Critical · vulnerability · github.com
php2shell-zeros: Unpatched 0-Day RCE Flaws and Weaponized Exploit Chains in PHP and NativePHP
These surviving flaws bypass earlier patches and demonstrate that core PHP deserialization and memory management remain fundamentally fragile, posing critical unauthenticated RCE risks to WordPress and production PHP services.
blog · wiz.io
LiteLLM Compromised, Steals Credentials
# LiteLLM Compromised, Steals Credentials In a new incident, a malicious version (1.107.0) of the LiteLLM package was uploaded to PyPI and Docker on October 21. The malicious version includes a...
blog · wiz.io
Supply Chain Zero Days: Closing the Gap Between Publication and Detection
Attackers use compromised npm packages to spread malware in minutes. Discover how Wiz detects malicious packages at publication using AI and dynamic analysis.
vulnerability · volexity.com
[CVE-2026-85046] Mind the (Patch) Gap , Part 3: Analysis with Volexity Volcano, Threat Intel, and MCP
# Mind the (Patch) Gap , Part 3: Analysis with Volexity Volcano, Threat Intel, and MCP October 16, 2026 Volexity Volcano Team Last month, Volexity published two blog posts in its _Mind the (Patch)...
vulnerability · volexity.com
[CVE-2026-104935] A Series of Unauthenticated Events: Chained Exploitation of Ivanti Connect Secure Zero-Days
# A Series of Unauthenticated Events: Chained Exploitation of Ivanti Connect Secure Zero-Days October 13, 2026 Charlie Gardner, Sean Koessel, Steven Adair, and Volexity Volcano Team **_Volexity...
vulnerability · volexity.com
Mind the (Patch) Gap, Part 2: Fake Websites Used to Deploy Chrome & Windows 0-Day Exploits
On September 9, 2026, Volexity published a blog post detailing the simultaneous use of multiple chained zero-day exploits in Google Chrome (CVE-2026-85046, CVE-2026-87491) and Microsoft Windows (CVE-2026-85880) by two different Chinese advanced persistent threat (APT) actors. Shortly after that blog post was published, Volexity discovered additional campaigns—this time from a third Chinese threat actor, tracked by Volexity under the alias UTA0565—that used the same chained exploits on September 3-4, 2026, while the vulnerabilities were still unpatched. Notably, this threat actor’s campaigns differed from previously documented attacks by using multiple fake websites to deceive victims.
Back