Curated security research, vulnerabilities, advisories and tools for practitioners.

#featured

Security coverage tagged featured.

1.

CVE-2026-63077: JetBrains TeamCity unauthenticated RCE with public PoC and active exploitation

vulnerability | Critical | Actively exploited | 2026-08-07 08:38 | CVE-2026-63077 | github.com | original ↗ | #active-exploitation | #rce | #public-poc

2.

XSS2Shell: WordPress pre-auth XSS to RCE chain (CVE-2026-64638)

vulnerability | High | 2026-08-07 15:25 | CVE-2026-64638 | pwn.ai | original ↗ | #ai-security | #rce | #public-poc

3.

KindaRails2Shell - Critical RCE in Rails via Active Storage (CVE-2026-66066)

vulnerability | Critical | 2026-07-29 00:00 | CVE-2026-66066 | ethiack.com | original ↗ | #rce | #ruby-on-rails | #active-storage

4.

CVE-2026-60004: Gitea diffpatch remote code execution with public PoC

vulnerability | Critical | 2026-07-28 00:00 | CVE-2026-60004 | github.com | original ↗ | #rce | #gitea | #git

5.

Introducing dfs-large1: A New Frontier for Cybersecurity

research | 2026-07-30 12:00 | depthfirst.com | original ↗ | #ai-security | #featured | #agentic-ai

6.

Four incident-response decisions from the Hugging Face breach

incident | 2026-07-29 00:00 | aikido.dev | original ↗ | #ai-security | #cloud | #featured

7.

Building secure Uniswap v4 hooks

blog | 2026-07-30 11:00 | blog.trailofbits.com | original ↗ | #web3 | #featured | #smart-contracts

8.

Behind the GitLab RCE: A depthfirst Journey into the Ruby Ecosystem

research | 2026-07-27 12:00 | depthfirst.com | original ↗ | #rce | #supply-chain | #featured

9.

Inside Astaroth's New Spambot Component

research | 2026-07-29 00:00 | crowdstrike.com | original ↗ | #featured | #threat-intelligence | #malware

10.

Testing AI-powered systems at scale via Bug Bounty, part 3: the guardrails

blog | 2026-07-29 07:06 | yeswehack.com | original ↗ | #ai-security | #bug-bounty | #featured

11.

How we use /goal to find bugs in Patch the Planet

blog | 2026-07-28 11:00 | blog.trailofbits.com | original ↗ | #ai-security | #featured | #agentic-ai

12.

A Millisecond of Predictability: Why CVE-2026-11374 Is Hard to Exploit

vulnerability | Critical | 2026-07-21 00:00 | CVE-2026-11374 | bishopfox.com | original ↗ | #featured | #vulnerability-research | #account-takeover

13.

Going depthfirst: Achieving GitLab RCE via Two Ruby Memory Corruption Vulnerabilities

research | 2026-07-24 12:00 | depthfirst.com | original ↗ | #rce | #featured | #vulnerability-research

14.

A Shell Is Worth a Thousand Images: Bing Images RCEs

research | 2026-07-23 12:00 | xbow.com | original ↗ | #ai-security | #rce | #featured

15.

The OpenAI and Hugging Face Incident: When the Model Hacks the Test

research | 2026-07-22 13:21 | xbow.com | original ↗ | #ai-security | #zero-day | #featured

16.

Finding eight high-severity vulnerabilities in NodeBB in six hours

research | 2026-07-22 00:00 | aikido.dev | original ↗ | #ai-security | #featured | #vulnerability-research

17.

Unauthenticated RCE in WordPress core (wp2shell), via SQL injection

vulnerability | Critical | 2026-07-17 00:00 | CVE-2026-63030 | aikido.dev | original ↗ | #rce | #featured | #vulnerability-research

18.

SleeperGem: RubyGems supply chain attack targets dormant maintainer accounts

incident | 2026-07-19 00:00 | aikido.dev | original ↗ | #supply-chain | #featured | #ruby

19.

Denying the Worm: Detecting SANDWORM_MODE and the Emerging Class of AI Toolchain Supply Chain Attacks

research | 2026-07-21 00:00 | crowdstrike.com | original ↗ | #ai-security | #supply-chain | #featured

20.

IonStack part III: Rooting Android 17 with GhostLock

vulnerability | High | 2026-07-15 00:00 | CVE-2026-43499 | nebusec.ai | original ↗ | #public-poc | #featured | #vulnerability-research

21.

AsyncAPI npm packages backdoored via GitHub Actions

incident | 2026-07-14 00:00 | aikido.dev | original ↗ | #supply-chain | #featured | #incident-response

22.

IonStack Part I: Unsound IonBanana Peel in Ion Compiler, Slipping Through Firefox's SpiderMonkey JIT

vulnerability | High | 2026-07-10 00:00 | CVE-2026-10702 | nebusec.ai | original ↗ | #rce | #featured | #vulnerability-research

23.

Compromised @injectivelabs/sdk-ts exfiltrates wallet keys through fake telemetry

incident | 2026-07-09 00:00 | aikido.dev | original ↗ | #supply-chain | #web3 | #featured

24.

Authentication Bypass in the default configuration phpBB

vulnerability | Critical | 2026-07-04 00:00 | CVE-2026-48611 | aikido.dev | original ↗ | #ai-security | #featured | #account-takeover

25.

Chaining an Apache ActiveMQ RCE on a Fully Patched 6.2.5 (CVE-2026-34197)

vulnerability | High | 2026-07-02 10:18 | CVE-2026-34197 | crowdfense.com | original ↗ | #rce | #public-poc | #featured

26.

Don’t eat the ChocoPoCs! How vulnerability researchers were repeatedly targeted by trojanised exploits

incident | 2026-07-01 11:35 | yeswehack.com | original ↗ | #supply-chain | #featured | #vulnerability-research

27.

The Bug Bounty Singularity: Our Hackbot

blog | 2026-07-01 00:00 | josephthacker.com | original ↗ | #ai-security | #bug-bounty | #featured

28.

CVE-2026-24294: Windows SMB local NTLM reflection privilege-escalation PoC

vulnerability | High | 2026-04-30 04:31 | CVE-2026-24294 | github.com | original ↗ | #public-poc | #featured | #privilege-escalation

29.

10 cybersecurity poems for World Poetry Day

blog | 2026-03-18 22:57 | bugcrowd.com | original ↗ | #ai-security | #bug-bounty | #featured