Sansec discovered StyleSmuggler, an unpatched Magento and Adobe Commerce zero-day that gives unauthenticated attackers remote code execution. All current ver...

You can outsource the hacking, but not the understanding

Vulnerability intelligence that predicts avenues of attack with speed and accuracy.

Summary A vulnerability in vBulletin has been identified, the vulnerability allows an unauthenticated user to cause the vBulletin to execute arbitrary code (PHP) on the remote server. Vendor Response The vendor has issued a fix available at: https://forum.vbulletin.com/forum/vbulletin-announcements/vbulletin-announcements_aa/4509404-vbulletin-6-2-2-is-available and https://forum.vbulletin.com/forum/vbulletin-announcements/vbulletin-announcements_aa/4509358-security-patch-released-for-vbulletin-6-2-1-6-2-0-and-6-1-6 CVE CVE-2026-61511 Credit An independent security researcher working with SSD Secure Disclosure. Affected Versions Root … vBulletin Runtime Template runMaths Preauth RCE Read More »

### Summary The FastCGI transport's `splitPos()` in [`modules/caddyhttp/reverseproxy/fastcgi/fastcgi.go`](https://github.com/caddyserver/caddy/blob/master/modules/caddyhttp/reverseproxy/fastcgi/...

When this bug shipped, the dinosaurs had just gone extinct, only 64.999979 million years prior.

Hello! Yes, it's all a disaster again! Let's get this party started: 0:00 /0:12 1× No comments today, so imagine this: * We wrote something that we find very funny, * Nobody else gets it, * But everyone humors us Just like a typical watchTowr Labs blog introduction. As with all

Post SMTP Plugin (= 3.2.0) Privilege Escalation Vulnerability Walkthrough Vulnerability Report CVE ID: CVE-2025-24000 Plugin: Post SMTP Type: Privilege Escalation via Broken Authentication Vulnerable Version: = 3.2.0 Fixed Version: 3.3.0 Patch Priority: High CVSS Score: 8.8 (High) OWASP Classification: A7: Identification and Authentication Failures Discovered by: Denver Jackson Published: July 21, 2025 Overview The WordPress plugin "Post SMTP"

How pwn.ai turned a routine client pentest into multiple ImageMagick zero-days. By autonomously researching the product’s internals for days, it found a path from a single image upload to file leaks, security policy bypasses, and remote code execution across a wide range of default and real-world configurations.

This is the personal website of Egidio Romano, a very curious guy from Sicily, Italy. He's a computer security enthusiast, particularly addicted to webapp security.

CVE-2026-22200 impacts osTicket and lets anonymous attackers read arbitrary files and, in some cases, achieve RCE. Patched in osTicket 1.18.3 / 1.17.7.

Unauthenticated privilege escalation vulnerability discovered in the Modular DS plugin. 🚨 Learn how attackers gain wp-admin access, active exploitation details, and how to stay protected.

In June, 2025, Shubs Shah and I discovered a vulnerability in the online poker website ClubWPT Gold which would have allowed an attacker to fully access the core back office application that is used for all administrative site functionality.

breakpoint of no return

🚨 A critical unpatched vulnerability in the TI WooCommerce Wishlist plugin allows unauthenticated file uploads and potential RCE. Over 100K sites affected. As usual, Patchstack users are protected. 🛡️

Summary A vulnerability in PHP’s extract() function allows attackers to trigger a double-free in version 5.x or a user-after-free in versions 7.x, 8.x, which in turn allows arbitrary code execution (native code). Credit An independent security researcher, LCFR, working with SSD Secure Disclosure. Vendor Response The vendor (Zend) has addressed the issue: https://github.com/php/php-src/security/advisories/GHSA-4pwq-3fv3-gm94. Zend have … SSD Advisory – extract() double-free(5.X)/use-after-free(7.X/8.X) Read More »

This writeup could be considered a continuation of my previous findings for $10,000.  Previously, I was able to access the source code…

We discovered vulnerabilities in Horde Webmail that allow an attacker to execute arbitrary code on Horde instances by having a victim open an email

Use POSIX file capabilities and PHP to create a backdoor that opens a root back-channel to the attacker's PC on port TCP 53 when a PHP page is called with a special url.

Ambionics Security team discovered an RCE in Laravel, when the framework is in debug mode.

CTF writeups from GatorSheavesMutably (https://ctftime.org/team/109518) - ctf-writeups/hxp-2020/heiko at master · aels/ctf-writeups

RCE 0-day for GhostScript 9.50 - Payload generator - GitHub - duc-nt/RCE-0-day-for-GhostScript-9.50: RCE 0-day for GhostScript 9.50 - Payload generator

~450K QNAP NAS devices were vulnerable to a pre-auth root RCE, which chains multiple CVSS-9.8 vulnerabilities. ALL QNAP models were…

Last week a new exploitation technique for PHP applications was announced at the BlackHat USA conference. Find out everything you need to know in this blog post.SummaryThe security researcher Sam Thom…