Author: Nihal, V12 Published: August 26, 2026 Source: https://v12.sh/blog/signal Summary Researchers at V12 report two critical object-lifetime vulnerabilities in Signal’s Contact Discovery Service (CDSI) that let the untrusted host server break the Intel SGX enclave boundary the service relies on for privacy. CDSI lets a Signal client learn which of its phone contacts use Signal … Read more
Author: Do Son (SecurityOnline.info) Published: August 26, 2026 Source: https://securityonline.info/nextjs-rce-vulnerability/ Summary Vercel has patched two critical, unauthenticated remote code execution flaws in Next.js, the widely used full-stack JavaScript framework. The primary bug, CVE-2026-75604 (CVSS 9.0), is a Windows-only path traversal that can lead to RCE; a second flaw in the image-optimization path (CVSS 9.5) allows … Read more
Author: y198 (published on the Verichains blog) Published: June 6, 2026 Source: https://blog.verichains.io/p/two-bytes-to-rce-chaining-rift-poolslip Summary This Verichains writeup chains two separately disclosed nginx rewrite-engine memory-corruption bugs — CVE-2026-42945 (“rift”), a heap-overflow write primitive, and CVE-2026-9256 (“PoolSlip”), a heap over-read leak primitive — into a single remote code execution exploit against nginx 1.30.0 that works with ASLR … Read more
Author: Edra (edrabb.fr — Bug Bounty, Pentest, CTF) Published: August 9, 2026 Source: https://edrabb.fr/posts/full-chain-preauth-rce-jfrog-artifactory/ Summary Edra documents a five-step, pre-authentication remote code execution chain against JFrog Artifactory that goes from zero credentials to command execution with no prerequisites (no anonymous-access setting, repository, user permission, or license required). The write-up is framed around AI-assisted vulnerability research: … Read more
Author: 0day Rubbish Research Team (advisory produced by an automated multi-LLM ensemble — the project credits Claude, OpenAI, DeepSeek, and GLM) Published: 2026-08-02 Source: https://0day-rubbish.com/blog/apache-struts2-restful-mapper-ognl-rce Summary An advisory from the 0day Rubbish project reports an unauthenticated remote code execution chain in Apache Struts 2 6.11.0 (and earlier 6.x releases that have not enabled the new … Read more
Author: FearsOff (research team; no individual author bylined) Published: July 21, 2026 (last updated July 26, 2026) Source: https://fearsoff.org/research/fastjson-1-2-83-rce Summary FearsOff disclosed CVE-2026-16723, a remote code execution vulnerability affecting fastjson 1.2.68 through 1.2.83 — including 1.2.83, the final 1.x release long considered the “safe” version because it ships with AutoType disabled by default. The researchers … Read more
Author: Nebula Security Published: June 29, 2026 Source: https://nebusec.ai/research/v8-cve-2026-6307-writeup/ Summary Nebula Security published a technical writeup, dubbed “Longinus,” of CVE-2026-6307, a high-severity flaw in Google Chrome’s V8 JavaScript engine. The bug lives in the TurboFan JIT compiler and is notable because a single vulnerability crosses two security boundaries at once: it yields a stable arbitrary … Read more
Author: Mandiant / Google Threat Intelligence Group (GTIG) Published: June 11, 2026 Source: https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-targets-education-sector-oracle-exploit Summary Mandiant and the Google Threat Intelligence Group report a zero-day exploitation and extortion campaign by ShinyHunters (tracked as UNC6240) against Oracle PeopleSoft environments, running from May 27 to June 9, 2026. The actor exploited CVE-2026-35273, a critical (CVSS 9.8) unauthenticated … Read more
Author: Sergiu Gatlan Published: June 1, 2026 Source: https://www.bleepingcomputer.com/news/microsoft/critical-windows-netlogon-remote-code-execution-flaw-now-exploited-in-attacks/ Summary BleepingComputer reports that CVE-2026-41089, a critical remote code execution vulnerability in the Windows Netlogon RPC interface, is now being exploited in attacks according to Belgium’s Centre for Cybersecurity (CCB). Rated CVSS 9.8, the flaw affects Windows servers acting as domain controllers and can be triggered … Read more
Patch Gap to Mobile Renderer RCE: Pwning Samsung Internet’s V8 on the Galaxy S25 Author: Hrvoje Mišetić, Jamie Hill-Daniel, William Liu (Otter Audits LLC / Crusaders of Rust Security Research Group) Published: April 1, 2026 Source: https://osec.io/blog/2026-04-01-patch-gap-to-mobile-renderer-rce/ Summary Researchers from Otter Audits LLC and the Crusaders of Rust Security Research Group demonstrated a full renderer … Read more
