PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Nginx/Apache Path Confusion to Auth Bypass in PAN-OS (CVE-2025-0108)

slcyber.io | vulnerability | CVE-2025-0108 | #zero-day | #vulnerability-research | #auth-bypass
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Assetnote researchers discover a zero-day authentication bypass in the PAN-OS management interface exploiting Nginx/Apache path confusion.
CVE
CVE-2025-0108
Published
Collected

Related coverage

vulnerability · volexity.com
[CVE-2026-104935] A Series of Unauthenticated Events: Chained Exploitation of Ivanti Connect Secure Zero-Days
# A Series of Unauthenticated Events: Chained Exploitation of Ivanti Connect Secure Zero-Days October 13, 2026 Charlie Gardner, Sean Koessel, Steven Adair, and Volexity Volcano Team **_Volexity...
vulnerability · vercel.com
Postmortem on Next.js Middleware bypass
Last week, we published CVE-2025-29927 and patched a critical severity vulnerability in Next.js. Here’s our post-incident analysis and next steps.
vulnerability · slcyber.io
High Fidelity Detection Mechanism for php2shell (CVE-2026-109618 and CVE-2026-109619)
The research team releases an open source tool php2shell-scanner which contains a high fidelity scanning mechanism to check for CVE-2026-109618 and CVE-2026-109619 across hosts.
vulnerability · slcyber.io
High Fidelity Check for the cPanel Authentication Bypass (CVE-2026-41940)
Assetnote develops a high-fidelity detection check for the cPanel authentication bypass vulnerability — CVE-2026-41940.
Critical · vulnerability · github.com
php2shell-zeros: Unpatched 0-Day RCE Flaws and Weaponized Exploit Chains in PHP and NativePHP
These surviving flaws bypass earlier patches and demonstrate that core PHP deserialization and memory management remain fundamentally fragile, posing critical unauthenticated RCE risks to WordPress and production PHP services.
vulnerability · volexity.com
[CVE-2026-85046] Mind the (Patch) Gap , Part 3: Analysis with Volexity Volcano, Threat Intel, and MCP
# Mind the (Patch) Gap , Part 3: Analysis with Volexity Volcano, Threat Intel, and MCP October 16, 2026 Volexity Volcano Team Last month, Volexity published two blog posts in its _Mind the (Patch)...
Back