Azmy

I built Weblyr (free, no credit card needed). Highlight text on any webpage. Leave threaded comments. Perfect for design reviews, QA feedback, client work, anything. Works on any site: Figma, staging servers, docs, designs. Try it: weblyr.com

A CVSS 2.7 ESXi bug was used as a zero-day by a China-linked group. It's a logging bypass. An admin can run certain commands and nothing gets logged. Broadcom rated it Low and lists no workaround. CrowdStrike says Warp Panda used it in early 2026, against US legal targets among others. Low score, high value. They didn't need it to get in. They needed it to leave no trace. Clean ESXi logs prove less than you think. thehackernews.com/2026/10/ch…

Answering a Telegram call on Android can run an attacker's code, says NebuSec. The bug is in the shared calling code. iOS got the fix in 12.7, desktop in 7.0.1, Android only in 12.10.4. Android 8.6.2 to 12.10.3 is affected. No CVE, no confirmed attacks. Check your version in Settings. thehackernews.com/2026/10/te…

Remote root bug in Linux TCP, there since kernel 4.4 (CVE-2026-98432). Fixed upstream Oct 5. Ubuntu 22.04, 24.04 and 26.04 still show vulnerable, fix in progress. Anthropic's exploit: 48 min to leak a kernel address, 5 more to run a command as root. Needs an MPTCP listener. ubuntu.com/security/CVE-2026…

Alpine Linux upgraded its GitLab twice and was still open to a CVSS 10. The fix for CVE-2026-97229 is in Ruby, not GitLab. Their image used stock Ruby, so 19.3.6 looked patched and wasn't. Attacker crashed workers 8 times on Oct 21. No sign it worked, but some logs are gone. Self-hosting GitLab? Check your Ruby version too. alpinelinux.org/posts/GitLab…

PHP2Shell alone only gave this attacker "nobody" on the firewalls. SELinux kept it boxed in. So they chained a Linux kernel bug (Fragnesia) to rewrite /etc/pam.d/su, then su'd to root. One unauthenticated HTTPS request, under 15 minutes. 25 servers rooted, 2 belonged to a US gov org. The sandbox only holds if the kernel under it is patched. dreamgroup.com/blog/chained-…

First real Node2Shell attack is out. It doesn't work yet. ELLIO caught a 23 MB Brotli body aimed at Node 24.22.0. In their tests it landed 0 shells in 50 tries. Broken last stage, looks like a first draft. Same IP was already hitting PHP2Shell, and the CVE is now in CISA KEV. Patch before v2 shows up. ellio.tech/en/blog/node2shel…

Google classed a zero-click bug that drops emergency calls as non-security. One malformed WAP Push SMS crashes the phone process on Android. Nothing shows in the inbox. Researcher Mark Blaszczyk says about 20 messages can leave a phone crash-looping, and a factory reset doesn't help because the carrier keeps resending. Won't Fix, no CVE. Nothing in your vuln feed will ever mention it. smsofdeath.com/

A 9.5 firmware bug runs before your OS loads, and there is no patched release yet. CVE-2026-97631 is in the edk2 PXE driver. One oversized ICMP error message during network boot overflows a 504 byte buffer. Some coverage says the attacker must be on your local network. The advisory says any distance, IPv4 or IPv6. No workaround listed. If you don't PXE boot, switch it off. github.com/tianocore/edk2/se…

Oracle patched a 9.8 Oracle E-Business Suite bug on Oct 20. A week later, decoys were already being probed for it. CVE-2026-101767: unauthenticated SQL injection that chains to RCE. Hits EBS 12.2.3 to 12.2.15. The endpoint, /OA_HTML/AppsTCFServer, is allowed by default in the URL firewall. If you can't patch today, remove it from the allowlist. horizon3.ai/attack-research/…

Apple was told about the eMudhra CA keys on Oct 17. Git, curl and python3 on macOS still trust them. macOS 27.2 shipped Oct 26 and undid the manual workaround people had applied. Safari is safe. Your terminal isn't. Someone on the network path could tamper with what git pulls. Check your macOS CI runners. emudhra.we-have-a-problem.co…

A Dahua camera can get hijacked with just its serial number. No IP, no password. Serials are guessable: fixed prefix plus a counter. One attacker reached 283 cameras this way through Dahua's cloud relay. The backdoor account also survives a password change, and on most firmware a factory reset. Turn P2P off. hunt.io/blog/operation-camer…

Tailscale SSH fix is out: update to v1.104.4. Four bulletins (TS-2026-014 to 017), no CVE IDs in the post. Don't wait for a scanner to tell you. An attacker needs a foothold on an allowed device first. So the real fix is also your SSH policy: only who needs it, and check mode on the sensitive boxes. tailscale.com/blog/tailscale…

Revoked a client cert on a GoAhead device? It may still get in. GoAhead loaded the CRL but never switched the check on. Versions 3.4.5 to 6.1.0, with mutual TLS and a CRL set up. Fixed in 6.1.1. It's an embedded web server, so the fix ships in device firmware. Ask your vendor which GoAhead they bundle. foxio.io/blog/choose-your-ba…

A hardware wallet company just lost the key that proves its devices are real. Keystone's attacker got in through a third-party monitoring tool on their website. The key is written into every device at the factory, so it can't be rotated. 18,835 units in stock are being destroyed. Got one after Oct 20? Passing the check no longer proves it's genuine. Keystone says so too. Seed phrases weren't touched. The trust anchor was. nitter.cf/KeystoneWallet/article…

Microsoft Authenticator on Android gave work account tokens to any app that asked. The app needed zero permissions. It just said "I'm Teams". Authenticator checked that against Teams' real signature. Teams is installed, so it always passed. It even saw who really called, and used that for bookkeeping only. A check that proves who you claim to be proves nothing. Fixed in 6.2606.4246. Microsoft says not exploited. enclave.ai/blog/authmask-we-…

OpenAI keeps its models' reasoning encrypted. Xint got it out in 3 API calls. They told the compaction endpoint to copy the encrypted reasoning into its output, spaces swapped for tabs. Then gpt-4.1 echoed it back as plain text. Any server step that decrypts something and follows your instructions is a decryption oracle. Fixed Oct 23. $6k bounty. xint.io/blog/compaction-smug…

Tailscale says its SSH bugs are serious, and there's no patch yet. No CVE, no version list. Fix is targeted within 24 hours. Until then: set TS_SSH_DISABLE_FORWARDING=1 on tailscaled and restart it. It blocks several of the worse ones, not all. tailscale.com/ssh-investigat…

HTTP 200, clean output, and it was another customer's prompt. Cloudflare's GLM-5.3 on Workers AI leaked other users' text in 155 responses. The context window was 1,048,576 tokens, the cache pool only 681,280. They knew before launch. Tests checked status codes, not output. Self-hosting SGLang? Get to v0.5.22. blog.cloudflare.com/kv-cache…

No CVE, no exploit, and it still ends in ransomware. Arctic Wolf: attackers mail-bomb you, then an "IT" account on Teams offers help and asks you to open Quick Assist. 30 to 40% of cases used default onmicrosoft.com tenants. Some never paste a link, so Safe Links has nothing to scan. Fix: set Teams external access to specific domains only. arcticwolf.com/resources/blo…

You can be on the latest PHP 8.4.27 for Windows and still have the Brotli bug. The fix shipped as a rebuild. Same PHP version, so php -v looks identical. Only the -1 suffix tells you (8.4.27-1). It matters if cURL auto-decompression is on. Some HTTP clients turn it on for you. php.net/archive/2026.php#202…