A pre-authentication XSS to RCE chain in WordPress Core that allows unauthenticated attackers to achieve remote code execution on any default WordPress installation through the login page.

You can outsource the hacking, but not the understanding

Pre-auth RCE in screensharingd — SRP frame-length validation returns success on oversized frames, bypassing authentication entirely. Root file read/write → code execution via crontab. No user interaction required.

Vulnerability intelligence that predicts avenues of attack with speed and accuracy.

A clear look into DarkSword, the latest public Kernel Exploit up to iOS 26.0.1, its root cause, and its reimplementation as ClearSword.

Summary A vulnerability in vBulletin has been identified, the vulnerability allows an unauthenticated user to cause the vBulletin to execute arbitrary code (PHP) on the remote server. Vendor Response The vendor has issued a fix available at: https://forum.vbulletin.com/forum/vbulletin-announcements/vbulletin-announcements_aa/4509404-vbulletin-6-2-2-is-available and https://forum.vbulletin.com/forum/vbulletin-announcements/vbulletin-announcements_aa/4509358-security-patch-released-for-vbulletin-6-2-1-6-2-0-and-6-1-6 CVE CVE-2026-61511 Credit An independent security researcher working with SSD Secure Disclosure. Affected Versions Root … vBulletin Runtime Template runMaths Preauth RCE Read More »

The HTTP protocol plays a vital role in the seamless functioning of web applications, however, the implementation of HTTP parsers across different technologies can introduce subtle discrepancies, leading to potential security loopholes. In this resea...

Technical breakdown of OnlyShells — a five-vulnerability chain in ONLYOFFICE Desktop Editors combining zero-click XSS, a Chromium V8 RCE, and an update-service LPE to achieve remote code execution as NT AUTHORITYSYSTEM when a victim opens a crafted document.

Stay current: Get research alerts for newly disclosed vulnerabilities and exposures If you're running WordPress and want to check if your instance is vulnerable, you can use our tool we've hosted here: https://wp2shell.com/. We held off on publishing this issue to give defenders a chance to upgrade their WordPress instances over the weekend, but during

A crafted manus:// Deep Link could replace the token used by Manus My Computer, reconnect the desktop app, and lead to remote code execution through its sidecar.

Stay current: Get research alerts for newly disclosed vulnerabilities and exposures Smashing the ServiceNow Sandbox: Pre Authentication RCE This blog post is our second exploring pre-auth script execution security vulnerabilities in ServiceNow. If you haven't seen the first, which includes some background context, you can read it here. After finding our first pre-auth critical bug

It’s 2025, and at this point, we’re convinced there’s a secret industry-wide pledge: every network appliance must include at least one trivially avoidable HTTP header parsing bug - preferably pre-auth. Bonus points if it involves sscanf. If that’s the case, well done! SonicWall’s SMA100

What is the main purpose of a Content Management System (CMS)? We have to accept that when we ask such existential and philosophical questions, we’re also admitting that we have no idea and that there probably isn’t an easy answer (this is our excuse, and we’re sticking

Learn how CVE-2026-20230 enables Cisco Unified CM pre-auth RCE through WebDialer SSRF, exploit analysis, and mitigation steps

### Summary The FastCGI transport's `splitPos()` in [`modules/caddyhttp/reverseproxy/fastcgi/fastcgi.go`](https://github.com/caddyserver/caddy/blob/master/modules/caddyhttp/reverseproxy/fastcgi/...

A Redis 8.6 stream PEL ownership bug, a malformed RESTORE payload, and a jemalloc size class collision that turns a shared NACK into code execution.

Analyst note: Proofpoint uses the UNK_ designator to define clusters of activity that are still developing and have not been observed for long enough to receive a numerical TA designation. Key

CVE-2026-20253 turns Splunk Enterprise, the platform built to catch intruders, into an unauthenticated way in. Here's how the exploit chain works, and how Miggo blinds it before Splunk's patch ships.

Analyzing and writing a PoC for CVE-2025-38352.

A novel and powerful twist on an old classic.

Technical analysis of a combination of two legitimate CivetWeb features producing arbitrary remote code execution.

Microsoft, Google, Red Hat, Grafana and LlamaIndex all shipped verified live credentials to public GitHub. I built the pipeline that found them: Gemini 2.5 distilled into regex, then TruffleHog with active verification. 3,830+ verified secrets, 1,443 unique repos, 95% rotation rate.

HackedAlert - Secure Today, Protect Tomorrow.

Contribute to Metnew/write-ups development by creating an account on GitHub.

Workflow execution protections are now in public preview for GitHub Enterprise, organizations, and repositories. This new capability lets enterprise administrators define an allow list that controls who can trigger GitHub…

Striga uncovered a fail-open regression in Apache Tomcat's cluster encryption that turns a one-line code change into unauthenticated Remote Code Execution.

We could have pwned every Metabase Cloud tenant by chaining an H2 INIT sanitizer bypass into RCE, then cloud misconfigurations into a full multi-tenant cluster compromise.

Stay current: Get research alerts for newly disclosed vulnerabilities and exposures Times Are Changing These last few months have been super weird. We've ended up in a situation several times where we have learnt that an exploits life cycle has significantly been reduced due to the introduction of frontier models that are extremely capable at