Vulnerability Research

S Stefan Mitocaru · Jul 8, 2026 · 22 min

CVE-2026-43499: how a 15-year-old cleanup shortcut in the Linux kernel's futex code became a one-user path to root and a container escape

Inside GhostLock (CVE-2026-43499): a 15-year-old stack use-after-free in the Linux kernel's rtmutex priority-inheritance code lets any local...

P Paraschivoiu Alexandru · Jul 2, 2026 · 18 min

CVE-2025-29927: how one internal header let attackers walk straight past Next.js middleware auth

Inside CVE-2025-29927: a forged x-middleware-subrequest header makes Next.js skip its own middleware, bypassing every authentication and aut...

P Paraschivoiu Alexandru · Jun 17, 2026 · 19 min

npm v12: how switching off one install-time default cuts the legs out from under almost every recent npm worm

Inside npm v12: GitHub is disabling preinstall/install/postinstall scripts, Git, and remote-URL dependencies by default, killing the install...

S Stefan Mitocaru · Jun 15, 2026 · 16 min

CVE-2026-20253: how a localhost-only database helper turned every AWS Splunk box into a pre-auth RCE

Inside CVE-2026-20253 (CVSS 9.8): Splunk Enterprise's PostgreSQL backup sidecar trusted the network instead of the request, letting an unaut...

P Paraschivoiu Alexandru · Jun 12, 2026 · 18 min

Miasma: how a 157-byte binding.gyp file turned npm install into a self-spreading credential worm

Inside Miasma (Shai-Hulud's npm successor): a 157-byte binding.gyp file executes code during npm install with no lifecycle script, compromis...

P Paraschivoiu Alexandru · Jun 10, 2026 · 18 min

When the attacker is an agent: securing infrastructure with AI powered red teaming

Inside the shift to autonomous offense: AI agents now run the full infrastructure kill chain at machine speed, from recon to domain takeover...

P Paraschivoiu Alexandru · Jun 8, 2026 · 16 min

CVE-2026-20245: how a tenant-list CSV upload turned Cisco SD-WAN Manager into a root shell

Inside CVE-2026-20245: an unvalidated file-path argument to a privileged tenant-list upload script lets a netadmin execute commands as root...

S Stefan Mitocaru · Jun 5, 2026 · 19 min

Megalodon: how TeamPCP turned 5,561 GitHub pipelines into a credential harvest factory in six hours

Inside Megalodon: how threat actor TeamPCP pushed 5,718 malicious commits to 5,561 GitHub repositories in a six-hour window, injecting dorma...

P Paraschivoiu Alexandru · Jun 3, 2026 · 18 min

CVE-2026-45659: how an ordinary site member turns on-prem SharePoint into a remote code execution box

Inside CVE-2026-45659: an insecure-deserialization (CWE-502) flaw lets any authenticated SharePoint Server Site Member run code on-prem (CVS...

P Paraschivoiu Alexandru · Jun 2, 2026 · 17 min

CVE-2026-48095: how a 1-byte heap buffer turned 7-Zip's NTFS parser into an extension-agnostic code execution primitive

Inside CVE-2026-48095: an undefined-behavior shift in 7-Zip's NTFS handler allocates a 1-byte buffer, then writes 256 MB into it, corrupting...

S Stefan Mitocaru · May 22, 2026 · 19 min

CVE-2026-43640: how one `&&` short-circuit turned a stolen Bitwarden session into a persistent SCIM key

Inside CVE-2026-43640: the C# short-circuit boolean that lets any authenticated Bitwarden admin with a stolen session pull or rotate the org...

S Stefan Mitocaru · May 20, 2026 · 16 min

CVE-2026-6973: Ivanti EPMM RCE Actively Exploited in the Wild and Already in CISA KEV

Ivanti Ivanti Endpoint Manager Mobile (versions up to 12.8.0.0) contains an improper input validation vulnerability that allows remote code...