Curated security research, vulnerabilities, advisories and tools for practitioners.

#vulnerability-research

Security coverage tagged vulnerability-research.

1.

Steal My Bitcoin Challenge Writeup: PHP 8.4.26 Session Upload Progress Memory Exhaustion Analysis

research | 2026-10-25 21:48 | github.com | Original ↗ | .md | #bug-bounty | #rce | #web3

2.

High Fidelity Detection Mechanism for php2shell (CVE-2026-109618 and CVE-2026-109619)

vulnerability | 2026-10-22 00:00 | CVE-2026-109618 | slcyber.io | Original ↗ | .md | #vulnerability-research | #detection | #slcyber

3.

State of Post-Quantum Cryptography implementations

research | 2026-10-21 22:00 | blog.quarkslab.com | Original ↗ | .md | #vulnerability-research | #threat-intelligence | #fuzzing

4.

MbedTLS Security Audit

vulnerability | 2026-10-19 22:00 | blog.quarkslab.com | Original ↗ | .md | #vulnerability-research | #cryptography | #vulnerability

5.

CVE-2026-106173 Deep-Dive: FortiSIEM gRPC Path Traversal File Write RCE

vulnerability | 2026-10-20 12:34 | CVE-2026-106173 | horizon3.ai | Original ↗ | .md | #rce | #vulnerability-research | #path-traversal

6.

PHP2Shell: finding and patching affected PHP

research | 2026-10-22 11:11 | projectdiscovery.io | Original ↗ | .md | #bug-bounty | #vulnerability-research | #php

7.

CrowdStrike Protects Customers from Threats Delivered via PHP2Shell

research | 2026-10-21 00:00 | crowdstrike.com | Original ↗ | .md | #rce | #vulnerability-research | #php

8.

How practical is 100k requests per second? Introducing h3fuzz

research | 2026-10-20 00:00 | slcyber.io | Original ↗ | .md | #vulnerability-research | #fuzzing | #tooling

9.

Ukraine’s State Data-Exchange System Targeted by Russian-Speaking Operator via Graylog Log4Shell

research | 2026-10-20 00:00 | hunt.io | Original ↗ | .md | #vulnerability-research | #threat-intelligence | #apt

10.

Security investigations for critical missions

research | 2026-10-19 12:36 | eshard.com | Original ↗ | .md | #vulnerability-research | #hardware-security | #investigation

11.

[CVE-2026-85046] Mind the (Patch) Gap , Part 3: Analysis with Volexity Volcano, Threat Intel, and MCP

vulnerability | 2026-10-16 18:27 | CVE-2026-85046 | volexity.com | Original ↗ | .md | #zero-day | #vulnerability-research | #threat-intelligence

12.

[CVE-2023-20938] Kernel UaF to Root #1: Freeing an Object That’s Still in Use

vulnerability | 2026-10-15 00:00 | CVE-2023-20938 | eshard.com | Original ↗ | .md | #vulnerability-research | #android | #kernel

13.

[CVE-2026-105133] AhsayCBS Deep-Dive: Auth Bypass to RCE

vulnerability | 2026-10-14 16:47 | CVE-2026-105133 | horizon3.ai | Original ↗ | .md | #rce | #vulnerability-research | #path-traversal

14.

MyReport Updater: From gRPC to SYSTEM

vulnerability | 2026-10-12 22:00 | CVE-2026-110632 | blog.quarkslab.com | Original ↗ | .md | #rce | #supply-chain | #git

15.

A Vulnerability Is a Hypothesis. An Exploit Is the Proof.

blog | 2026-10-16 13:06 | xbow.com | Original ↗ | .md | #ai-security | #vulnerability-research | #exploitation

16.

Client-Side Path Traversal na Prática: De Stored XSS à Exclusão de Conta

research | 2026-10-15 20:10 | yokai.hakaisecurity.io | Original ↗ | .md | #bug-bounty | #vulnerability-research | #account-takeover

17.

Client-Side Path Traversal in the Wild: From Stored XSS to Account Deletion

research | 2026-10-15 20:09 | yokai.hakaisecurity.io | Original ↗ | .md | #bug-bounty | #vulnerability-research | #account-takeover

18.

[CVE-2026-104935] A Series of Unauthenticated Events: Chained Exploitation of Ivanti Connect Secure Zero-Days

vulnerability | 2026-10-13 15:32 | CVE-2026-104935 | volexity.com | Original ↗ | .md | #rce | #zero-day | #vulnerability-research

19.

More Critical Bugs in Adobe Experience Manager: Pre-Auth RCE

research | 2026-10-15 00:00 | slcyber.io | Original ↗ | .md | #cloud | #rce | #vulnerability-research

20.

Internship Offers for the 2026-2027 Season

blog | 2026-10-14 22:00 | blog.quarkslab.com | Original ↗ | .md | #vulnerability-research | #fuzzing | #android

21.

Record Malware Execution in a Single Prompt with Epoch

research | 2026-10-14 00:00 | eshard.com | Original ↗ | .md | #ai-security | #vulnerability-research | #malware

22.

What Can an Adversary Extract From a Captured Autonomous System? | #3

research | 2026-10-13 00:00 | eshard.com | Original ↗ | .md | #vulnerability-research | #hardware-security | #fault-injection

23.

Evaluating Botan’s Resistance to Physical Attacks: An End-to-End Study

research | 2026-10-12 00:00 | eshard.com | Original ↗ | .md | #vulnerability-research | #hardware-security | #cryptography

24.

Zammad CVE-2026-102489: Session Leak to RCE

vulnerability | 2026-10-07 10:00 | CVE-2026-102489 | horizon3.ai | Original ↗ | .md | #rce | #vulnerability-research | #zammad

25.

Leaking the Keys to the Kingdom: How a Single Slip Handed Over a Darknet Empire

research | 2026-10-08 00:00 | slcyber.io | Original ↗ | .md | #vulnerability-research | #dark-web | #credential-leak

26.

Lite VM Studio builds your Windows VM, so you don't have to.

research | 2026-10-08 00:00 | eshard.com | Original ↗ | .md | #vulnerability-research | #windows | #software-security

27.

go2shell: Rooting Home Assistant through SSDP

research | 2026-10-07 22:05 | mccaulay.co.uk | Original ↗ | .md | #rce | #vulnerability-research | #privilege-escalation

28.

Out of Bounds, Out of Sandbox: RCE in Go JavaScript Engine

research | 2026-10-07 00:00 | slcyber.io | Original ↗ | .md | #rce | #vulnerability-research | #sandbox-escape

29.

A JPEG, a Race, and a Ghost: Breaking Discourse's Image Pipeline

research | 2026-10-07 00:00 | slcyber.io | Original ↗ | .md | #vulnerability-research | #exploitation | #image-parsing

30.

‍Designing autonomous systems for the reality of physical capture | #2

research | 2026-10-06 00:00 | eshard.com | Original ↗ | .md | #vulnerability-research | #hardware-security | #fault-injection