Imperia CMS: remote command execution via server-side template injection Read on dbugs: dbu.gs/news/imperia-cms-remo… Researcher Julien Ahrens from RCE Security discovered a critical vulnerability CVE-2026-110355 (dbu.gs/vulnerability/CVE-202…) in Imperia CMS, an enterprise content management system for websites. The flaw affects the SiteActive mechanism, which handles dynamic page processing, and allows unauthenticated arbitrary code execution on the server. The issue is caused by insufficient validation of user-supplied data passed to the template handler. To exploit the vulnerability, an attacker sends a specially crafted request to "/cgi-bin/site_active.pl", passing a malicious expression in the "TEMPLATE" parameter. Using the "{SITE_ACTIVE}" prefix makes it possible to select a different template processing path and bypass the file name security check. Special characters then terminate the generated "include" directive, after which PHP code and the "<!--postconvert:PHPExec()-->" instruction are injected into the page content. In the next stage, the template conversion mechanism recognizes this instruction and passes the injected PHP code to the "PHPExec" handler, resulting in command execution on the server. Exploiting the vulnerability allows an attacker to execute operating system commands without an account, with the privileges of the CMS process, access application files, modify website content, and potentially establish persistence on the server. The attack requires the SiteActive CGI interface to be enabled, accessible over HTTP, and PHP to be present. Article: rcesecurity.com/2026/10/impe… CVE-2026-110355 — PT-2026-120552: dbu.gs/vulnerability/PT-2026…

Sale of a PoC for a vulnerability in Ivanti Connect Secure (CVE-2026-104935) Read on dbugs: dbu.gs/news/sale-of-a-poc-fo… According to the seller, the exploit works through the standard HTTPS port without credentials or authentication, escalates privileges to "root" and automatically extracts administrator password hashes, LDAP/AD, RADIUS, and SAML keys, and Azure private keys. The seller tested the attack on lab environments and two real targets. On 22.8+ builds with hardened SELinux, data exfiltration may be restricted. Vulnerability type: Pre-Auth RCE Affected versions: 25.1.1.1 (http://25.1.1.1/), 25.1.2.2 (http://25.1.2.2/), 22.8R2.4 Price: $3000 CVE-2026-104935 — PT-2026-111656: dbu.gs/vulnerability/PT-2026…

PHP2Shell: two critical vulnerabilities enable unauthenticated code execution Read on dbugs: dbu.gs/news/php2shell-two-cr… Researchers at OX Security analyzed two critical vulnerabilities CVE-2026-109618 (dbu.gs/vulnerability/CVE-202…) and CVE-2026-109619 (dbu.gs/vulnerability/CVE-202…), collectively known as PHP2Shell. Both issues stem from improper memory management in the PHP core and can lead to remote code execution without authentication. The vulnerabilities are notable because they affect the PHP interpreter itself rather than individual web applications or CMS platforms. Exploitation uses the "session.upload_progress", which tracks file uploads and processes HTTP request data before the PHP script starts. An attacker sends a specially crafted "multipart/form-data" POST request that triggers memory management errors. In the case of CVE-2026-109618, memory exhaustion causes request processing to terminate abnormally, followed by access to improperly initialized data. CVE-2026-109619 involves retaining pointers to memory that has already been freed and may be reused while processing subsequent requests. Both errors create conditions for memory corruption and potential control-flow hijacking. Successful exploitation allows an attacker to execute arbitrary code on the web server without an account, gain access to configuration files, application credentials, and other resources available to the PHP process. This creates a risk of compromising sites running WordPress, Drupal, Magento, and other PHP applications, regardless of whether their own code contains vulnerabilities. Article: ox.security/blog/cve-2026-10… CVE-2026-109618 — PT-2026-118596: dbu.gs/vulnerability/PT-2026… CVE-2026-109619 — PT-2026-118597: dbu.gs/vulnerability/PT-2026…

FortiSIEM: Remote Command Execution via Directory Traversal Read on dbugs: dbu.gs/news/fortisiem-remote… Researchers Horizon3.ai (horizon3.ai/) have published a technical analysis of the critical vulnerability CVE-2026-106173 (dbu.gs/vulnerability/CVE-202…) in Fortinet's FortiSIEM security monitoring platform. The flaw affects the "phQueryMaster" gRPC service, accessible on port 27918/TCP, and allows an unauthenticated user to write arbitrary files to the server's file system. The vulnerability received a CVSS score of 9.4. To exploit the vulnerability, an attacker calls the "SendQueryResult" method, which saves query results to files. The "query-id" parameter is used to construct the path without proper validation, allowing "../" sequences to be used to escape the intended directory. The researchers also discovered that a null byte "\0" can be injected, allowing the attacker to bypass the automatic addition of the filename and extension. As a result, an attacker can overwrite an existing executable script, such as "/opt/charting/redishb.sh", which runs automatically every 60 seconds to check the status of Redis. Exploiting the vulnerability allows an attacker to execute arbitrary commands on the FortiSIEM server without authentication. This enables access to configuration files and other data accessible to the process, disruption of the monitoring system, and further attacks within the internal network. Article: horizon3.ai/attack-research/… PoC: github.com/horizon3ai/CVE-20… CVE-2026-106173 — PT-2026-111783: dbu.gs/vulnerability/PT-2026…

Active Directory: Bypassing LDAP Signing and Compromising the Domain via NTLM Relay Read on dbugs: dbu.gs/news/active-directory… SpecterOps researchers discovered a way to bypass LDAP Signing — a mechanism that protects the integrity of LDAP messages and was previously considered one of the primary defenses against NTLM Relay attacks. A flaw in reauthentication handling allowed LDAP operations to be performed with another user's privileges even when message signing was mandatory. The attack affected Windows Server domain controllers starting with version 2016, and Microsoft released a fix in October 2026. To exploit the vulnerability, an attacker first establishes a signed LDAP connection to the domain controller using a session key known to the attacker. The attacker then coerces the target host into authenticating over NTLM via SMB and relays the authentication through the already-established LDAP connection. The key feature is that the reauthentication message and the malicious LDAP request are placed in a single signed SASL record. The domain controller verifies the signature using the original key, then switches the security context to the victim's account and executes the LDAP request with that account's privileges. Exploiting the vulnerability allows an attacker to modify Active Directory objects on behalf of the compromised account without knowing its password. For example, the researchers demonstrated modifying the "msDS-AllowedToActOnBehalfOfOtherIdentity" attribute to carry out an RBCD attack. When a domain controller's authentication is relayed, this can lead to taking control of the controller, performing DCSync, and fully compromising the domain. The attack requires access to LDAP over port 389/TCP; this bypass does not apply to LDAPS. Article: specterops.io/blog/2026/10/2…

PowerShell: bypassing detection via a nonstandard -EncodedCommand Read on dbugs: dbu.gs/news/powershell-bypas… Most detection tools look for the string "-enc" in the command line, sometimes "-e", and sometimes the full "-EncodedCommand". But PowerShell does not treat this flag as a word. It treats it as a parameter name, accepts any prefix it can resolve unambiguously, ignores case, and accepts certain characters in place of the leading hyphen. What exactly PowerShell accepts If you encode a harmless command and pass it to PowerShell using different spellings of the flag, PowerShell 7.6.6 accepts the following: "-e", "-ec", "-en", "-enc", "-enco", "-encod", "-encode", "-encoded", "-encodedc", "-EncodedCommand" — in any combination of uppercase and lowercase letters. PowerShell also accepts "/enc", "--enc", and "enc" preceded by a typographic dash: a short one (en dash), a long one (em dash), or a horizontal bar. Three other dash-like characters are rejected: the figure dash, the Unicode hyphen, and the minus sign. Spellings longer than the name, such as "-encodedcommandx", are also rejected. The dashes matter. A command line copied from a document, a chat message or phishing lure may pick up typographic dashes along the way. A detection rule that looks for a space followed by a hyphen will miss these variants. How this is used in an attack 1. Payload preparation. The command is encoded as expected by "-EncodedCommand": first in UTF-16LE, then in base64. The payload is often encoded again: the decoded command passes a second base64 string to "FromBase64String", and the result is passed to "Invoke-Expression". 2. Launch obfuscation. Instead of the full flag, the command line uses an accepted prefix or a variant with a slash, a double hyphen, or a typographic dash. To PowerShell, it resolves to the same parameter; to detection, it is a different string. 3. Execution. The process starts normally, without errors. The encoded command executes even though a rule tailored to -enc failed to catch it. What an attacker needs to know • PowerShell version. The testing was performed on PowerShell 7.6.6. Windows PowerShell 5.1, which is still widely used by attacker tooling, needs to be tested separately in your own environment. • Payload length. Encoding increases the command’s size: UTF-16 doubles the number of bytes, and base64 adds another third. A short command can become noticeably longer. • Logging. If script block logging is enabled on the host, the decoded text may appear in event 4104. This does not eliminate command-line obfuscation, but it makes the payload easier to inspect. Article: ridgelinecyber.com/blog/enco…

ADINT on a global scale Read on dbugs: dbu.gs/news/adint-on-a-globa… Researchers from Citizen Lab (citizenlab.ca/research/how-d…) and Confiant (blog.confiant.com/p/adint-we…) have published investigations into how digital advertising infrastructure was used to distribute Candiru spyware. Analysts believe this is the first technical evidence that targeted advertising has been used to deliver mercenary spyware. "The investigation focuses on the Israeli company Discover-Tech, which operated the MyDSP platform, using it to bid in advertising auctions on Google, Yandex, Vungle, and other platforms. Through the Controlium platform, its clients—including operators of mercenary spyware—could select specific user devices for profiling or infection based on mobile advertising identifiers (on iOS or Android), browser identifiers, and/or victims’ IP addresses." Researchers dubbed this infection technique AdFection. The pipeline works as follows: 1) Discover-Tech wins an ad auction, and the ad is displayed on the user’s device. 2) When the ad loads, it connects to a Discover-Tech server and transmits the user’s advertising identifiers. 3) If the device is selected as a target, the server returns JavaScript code to be executed; otherwise, it returns an empty response. The ad still collects browser data, including cookies and the public IPv6 address. The researchers confirmed the practical use of this scheme through the example of the Al Jazeera news network. At least 45 devices on the media network were targeted in attacks using Discover-Tech infrastructure in 2024–2025. Analysis of network logs showed that the victims’ devices initially connected to Discover-Tech infrastructure domains, which analysts attribute to ad delivery. A validation server then checked the devices before profiling and infecting them. Ultimately, the compromised device connected to Candiru C2 servers. Al Jazeera also provided a DLL file from one of the compromised Windows devices containing hardcoded C2 server addresses. Citizen Lab attributed the sample to Candiru with high confidence: its persistence mechanisms, string obfuscation, and connection-checking mechanisms match those described in the 2021 report (citizenlab.ca/research/hooki…). The scale of the advertising infrastructure—billions of bids. From March through June 2026, MyDSP participated in auctions for 3.77 billion ad impressions and won approximately 11.7% of them. At least 718 million bids (approximately 19%) involved ads that showed signs of contacting NOAS servers, a component used to selectively deliver JavaScript code to specific devices. The Yandex advertising system accounted for 67.4% of the bids. One example was an Akedo ad displayed on livelib[.]ru in May 2025. ID syncing expanded profiling capabilities. Analysts found that Discover-Tech synchronized user identifiers with Comcast’s Beeswax, Yandex, and Microsoft’s Xandr advertising systems. This makes it possible to match the same user across different advertising platforms and use a known identifier to find and target that user in another system. For example, the Controlium platform allows a Beeswax ID to be specified as the target identifier, potentially enabling data from one advertising system to be used to target a user through another. Synchronization can occur even when the user does not see an ad: visiting a website where the relevant requests run in the background is sufficient. The advertising infrastructure had already been used to deanonymize users at scale. Researchers found that the threat actor known as DARK CARTOGRAPHER had been using platforms such as Discover-Tech for this purpose since 2019. One method relies on mobile carrier frictionless authentication: when certain websites are accessed, carriers add a header containing the user’s phone number to unencrypted HTTP requests. Weaknesses in the validation of allowed websites allow attackers to obtain this information through ads. Ads were displayed on sensitive networks around the world. Researchers note that the bidding data contains evidence of ads being displayed on IP addresses belonging to critical infrastructure organizations, government agencies, and international organizations. Those mentioned include: • NATO and UN networks; • Russian government networks; • Armenia—the Central Election Commission, Central Bank, and Prime Minister’s Office; • Israel—the Ministry of Health, Ministry of Foreign Affairs, Ministry of Defense, and other agencies; • networks belonging to Intel, Nvidia, Broadcom, and several media companies. "However, the mere fact that an ad was displayed does not confirm an infection or a targeted attack—it primarily demonstrates the scale of Discover-Tech infrastructure’s presence." As a result, Google, Beeswax, Vungle (Liftoff), Eskimi, and IAB Europe took steps to restrict or terminate Discover-Tech’s access to their advertising infrastructure after engaging with the researchers and receiving the results of their work. Insufficient oversight of advertising vendors and the technical characteristics of digital advertising infrastructure create conditions for the spread of malvertising and make such threats difficult to counter. To reduce the risks, organizations need to improve mechanisms for detecting and blocking malicious campaigns and strengthen cooperation between researchers and ad-tech providers.

Sale of an RCE exploit for WhatsApp on Android Read on dbugs: dbu.gs/news/sale-of-an-rce-e… Vulnerability type: Remote Code Execution (RCE) / Sandbox Escape Affected versions: WhatsApp for Android 2.25.xx–2.26.xx, Privileges obtained: code execution in the context of the WhatsApp process (com.whatsapp) Price: $10 000 The seller claims to be offering an exploit for WhatsApp on Android that enables remote arbitrary code execution by sending a specially crafted image or sticker. According to the seller, successfully exploiting the vulnerability requires only delivery of the message, with no additional action from the user. The claimed exploit chain uses type confusion and out-of-bounds (OOB) access bugs in the media data handler. According to the author, these bugs enable a controlled write to the WhatsApp process memory and code execution within com.whatsapp. An additional component for a limited sandbox escape is offered for an extra fee. The seller claims that the exploit works against WhatsApp for Android versions 2.25.xx–2.26.xx, described in the listing as the current stable range at the time of publication. Testing is claimed on Google Pixel 8, Pixel 8 Pro, and Samsung Galaxy S24 smartphones running One UI. In addition, according to the author, code execution occurs directly in memory, without installing an APK. The package does not include a persistence mechanism. The delivery includes the initial payload, a loader, and a basic template for communicating with the command-and-control server.

BiSON — secure semantic search over a billion encrypted vectors Read on dbugs: dbu.gs/news/bison-secure-sem… Microsoft Research has unveiled BiSON (microsoft.com/en-us/research…) (Billion-Scale Oblivious Nearest-Neighbor Search) — a system for quickly searching for similar objects in encrypted vector databases. According to the researchers, it can operate on a database of a billion vectors, while keeping response times in the millisecond range. The paper (eprint.iacr.org/2026/1343.pd…)was presented at IEEE EuroS&P 2026. The development addresses one of the key challenges facing modern AI systems: how to perform semantic searches in the cloud without revealing the contents of the database, the search query, or the algorithm's data access patterns to the provider. Why conventional encryption is not enough Semantic search operates on vector representations. Documents, images, and other objects are converted into sets of numbers that describe their meaning. The user's query is also converted into a vector, after which the system searches for the most similar objects. This approach is used in vector databases, recommendation systems, and RAG (retrieval-augmented generation). For large datasets, approximate nearest-neighbor (ANN) search is typically used to avoid comparing the query with every object individually. However, if such a database is hosted in the cloud, basic encryption is not enough. The server can still observe which areas of storage the algorithm queries, and analyze recurring access patterns. BiSON is designed to conceal this information as well. How BiSON works The system is built on Oblivious RAM (ORAM) — a technology that conceals a client's actual data accesses. The server performs read and write operations but cannot determine which specific data the client is accessing at a given moment. However, ORAM typically requires a large number of additional operations and substantial network traffic, making it too costly to apply to vector databases containing hundreds of millions or billions of objects. In BiSON, Microsoft developed an ORAM variant designed for disk storage. This means the protected index does not need to reside entirely in memory, allowing the system to scale to billion-record datasets. The system is based on DiskANN — a nearest-vector search algorithm developed by Microsoft and optimized for storing large indexes on SSDs. In BiSON, this index is transformed into a protected ORAM structure. According to Microsoft, BiSON maintains search quality close to that of modern unprotected ANN systems, while a query against a database of one billion vectors can be completed in milliseconds. Compared with the previous private search system, Compass, the developers report: – a reduction in the volume of transmitted data by up to 28×; – a reduction in end-to-end query latency by up to 23.5×; – an increase in the supported database size of approximately two orders of magnitude. Existing approaches already enabled private nearest-neighbor searches, but they generally performed poorly at the scale typical of large cloud and AI services. Where it can be used BiSON is designed for scenarios in which an organization wants to use cloud computing without revealing either its vector database or its search queries to the provider. This could be useful for: – enterprise search across internal documents; – RAG systems working with confidential information; – medical and financial applications; – personal AI assistants; – searches across sensitive user data. Tool: github.com/r-dott/bison

h3fuzz — ffuf with HTTP/3 support and a web interface Read on dbugs: dbu.gs/news/h3fuzz-ffuf-with… h3fuzz is a fork of ffuf for discovering files and directories on web servers. The tool retains familiar wordlists, filters, and fuzzing options, while adding HTTP/3 support and a persistent web interface for managing scans. The tool automatically uses HTTP/3 when supported, falling back to HTTP/2 and then HTTP/1.1 when necessary. Key features: • High speed — in the author's local benchmark, the tool exceeded 100,000 requests per second. • Scan management — launch multiple scans from the web interface, pause and resume them, rerun scans, and compare results. • Result analysis — search, sort, and filter findings. Scan sessions, settings, and results persist between runs. Actual fuzzing speed depends on the network and the server's capabilities. Article: slcyber.io/research/how-prac… Tool: github.com/assetnote/h3fuzz

CVE-2026-81983: Integer overflow leads to an out-of-bounds write in Adobe Acrobat Read on dbugs: dbu.gs/news/cve-2026-81983-i… Remedio researchers discovered CVE-2026-81983 (dbu.gs/vulnerability/CVE-202…) in Adobe Acrobat's image-processing pipeline. The vulnerability is triggered by opening a PDF containing a specially crafted 16-bit image and can cause an out-of-bounds write in "Acrobat.dll". The flaw lies in a function that normalizes 16-bit image samples before compositing. The byte-swapping loop uses the product of the image width and the number of components as its iteration count, without checking it against the buffer size. Meanwhile, the buffer-size check calculates the required data length as "Width × components × 2", using the same 32-bit arithmetic. A CMYK image with a width of "0x20000000" is sufficient to trigger the vulnerability. The product "4 × 0x20000000" yields "0x80000000". Multiplying this by two during the size check causes the 32-bit result to wrap to zero, allowing an image data stream containing just 8 bytes to pass validation. The byte-swapping loop then uses the original iteration count of "0x80000000", advancing through memory two bytes at a time. The minimized trigger is a 745-byte PDF containing a single image row. The loop reads and writes beyond a 16-byte buffer, with the observed access violation occurring approximately 144 KB beyond the buffer's start. The vulnerable code is part of the 16-bit sample normalization routine, which swaps the bytes of each value directly in the source buffer. Whether this branch executes depends in part on the "keepEndian" flag. The minimal trigger uses an image XObject with "/BitsPerComponent 16", "/ColorSpace /DeviceCMYK", a height of 1, and a width of "0x20000000". Adobe fixed the vulnerability by introducing a 64-bit range check and rejecting sample counts greater than "INT_MAX". The fix was published in security bulletin APSB26-141 on September 8, 2026. The fixed versions are Acrobat / Acrobat Reader Continuous "26.002.21901" and Acrobat 2024 Classic "24.001.30429". Article: remedio.io/blog/cve-2026-819… CVE-2026-81983 — PT-2026-88482: dbu.gs/vulnerability/PT-2026…

Ransomware attackers are expanding their pressure tactics Read on dbugs: dbu.gs/news/ransomware-attac… Semperis has released (semperis.com/ransomware-risk…) 2026 Ransomware Risk Report. It is based on a survey of 1,200 IT and information security professionals from nine countries and eight industries; the sample included only organizations where at least one ransomware attack had succeeded and disrupted operations. Because ransomware activity is frequently covered in various reports, the overall statistics and trends are summarized briefly below: • By country, France, Australia, Italy, and Spain stand out: 100%, 84%, 81%, and 81% of respondents, respectively, reported more than one attack during the year. • By industry, repeated successful attacks were most common in healthcare (82%), transportation (77%), and manufacturing (72%). • Most attacks occur outside working hours; repeated attacks and multiple ransom payments remain common, while attackers typically spend 2–6 days inside the infrastructure. Let’s take a closer look at how attackers' methods and pressure points are changing: AI is already having a noticeable impact on ransomware attacks. 84% of respondents encountered attacks in which AI was used in some way: 40% faced attacks involving AI, while 44% experienced attacks targeting their own AI agents or the company's AI systems. The latter is particularly dangerous when such systems have access to other services: attackers can use them to escalate privileges and move further through the infrastructure. Identity management systems are attacked more often than organizations are prepared to restore them. In 87% of cases, ransomware attackers targeted Active Directory, Entra ID, or Okta. Yet only 50% of organizations had dedicated backups of these systems, and just 42% had automated recovery. The growing role of identity attacks has previously been highlighted by Microsoft, Rubrik Zero Labs and others. Pressure extends beyond the digital environment and beyond the organization itself. In 17% of attacks, threat actors resorted to physical threats, including abduction and bodily harm. In 37% of cases, the pressure extended to employees' friends and relatives, while about a quarter of organizations faced the publication of employees' and their families' personal data (doxxing) or fake emergency calls to law enforcement (swatting) at their addresses. Response challenges are often organizational rather than technical. 48% of companies cited the lack of clearly defined roles and responsibilities as an obstacle, while 44% each pointed to problems with coordination between teams and outdated response plans. Preparing for ransomware attacks is not limited to creating backups and restoring encrypted systems. After a compromise, it is important not only to regain control of accounts and access, but also to verify that the attackers no longer have access to the environment: otherwise, recovery can quickly give way to another attack. At the same time, organizations must maintain reliable communication channels between teams and define in advance how to respond to threats against employees and their loved ones — including coordination with law enforcement.

ReDoS via the Cache-Control header in Symfony and Laravel Read on dbugs: dbu.gs/news/redos-via-the-ca… Researcher Martino Spagnuolo demonstrated how a regular expression in "symfony/http-foundation" can be exploited to exhaust the resources of PHP applications built on Symfony, Laravel, Drupal, and other platforms. The vulnerability, CVE-2026-108082 (dbu.gs/vulnerability/CVE-202…), can be exploited without authentication: an attacker only needs to send an ordinary HTTP request with a specially crafted header. A single request can keep a CPU core busy for several seconds, while multiple concurrent requests can make the application unavailable. The root cause lies in "HeaderUtils::split()", which parses HTTP header values. The regex fragment "[^",=]+" allows spaces within a token, while the negative lookbehind "(?<!\s)" prevents a match from ending with a whitespace character. A string consisting of "a" followed by 17 spaces and ",x" forces the regex engine to explore roughly "2^17" ways of partitioning the spaces before rejecting the match. In one real-world test, a single request took 12.7 seconds to process. The vulnerability can be triggered through the "Cache-Control" header, which Symfony parses automatically when constructing the request object, before routing and authentication. This includes requests that ultimately receive "404" or "401" responses. Laravel parses the headers three times during request initialization, increasing the processing overhead. Behind nginx, multiple "Cache-Control" headers can be merged into a single value without rechecking the combined length. In a laboratory test using Laravel behind nginx, four headers of approximately 8 KB each resulted in a request processing time of nearly nine seconds. A test involving 100 requests with a concurrency level of eight caused increasing response times, timeouts, and "504" errors. The vulnerability affects "symfony/http-foundation" from version 4.1 up to the October 2026 security fixes. The recommended fixed releases are 6.4.48, 7.4.21, and 8.1.9, depending on the maintained branch. The initial fixes — 5.4.54, 6.4.46, 7.4.19, and 8.1.7 — addressed the ReDoS issue but introduced regressions in other functionality. The 5.4 branch is no longer supported, and the advisory does not identify a subsequent corrected release for that branch. As a temporary mitigation, administrators can reject requests with unusually long "Cache-Control" headers, for example using a WAF rule that limits their length to 50–100 bytes, as suggested by the researcher. Article: r3verii.github.io/cve/2026/1… CVE-2026-108082 — PT-2026-114951: dbu.gs/vulnerability/PT-2026…

RCE Exploit for Google Chrome/Chromium for Sale Read on dbugs: dbu.gs/news/rce-exploit-for-… Vulnerability Type: Remote Code Execution (RCE) / Sandbox Escape Vulnerable Versions: Google Chrome/Chromium versions 154–156 Privileges Gained: SYSTEM Price: $10,000 The author claims to be selling an exploit for Chromium-based browsers that allows remote execution of arbitrary code, bypasses the browser’s isolation mechanisms (Sandbox Escape), and can potentially grant SYSTEM-level privileges on Windows 10 and 11 operating systems. According to the seller, a successful attack requires only that the victim visit a specially crafted web page or download malicious content. The exploit uses an exploit chain that includes code execution within the browser’s rendering process (Renderer RCE) and subsequent sandbox escape via the Mojo/IPC mechanism. No additional user interaction is required. The author claims that the tool is compatible with Google Chrome/Chromium versions 154–156 and has been tested on Windows 10 22H2, as well as Windows 11 23H2, 24H2, and 25H2. It is claimed that the tool can execute malicious code directly in RAM without needing to write files to disk. The chain uses JavaScript and native shellcode, and also includes a core component for communicating with the command-and-control (C2) server.

CVE-2026-94134 and CVE-2026-94135: Apache Airflow disables SSH host key verification by default Read on dbugs: dbu.gs/news/cve-2026-94134-a… OX Security researchers discovered that Apache Airflow's SSH and SFTP providers disable SSH server host key verification by default. This allows an attacker positioned between an Airflow worker and the target server to perform a man-in-the-middle (MITM) attack, intercept or modify session data, and potentially capture credentials. Normally, an SSH client verifies the server's public host key against a trusted key. On the first connection, the key may be stored for subsequent verification, depending on the client's configuration. Airflow uses "Paramiko" for synchronous SSH connections but defaults to "AutoAddPolicy", which automatically accepts previously unknown host keys. The warning about disabled verification appears only in the task log after the connection has been established, not in the Airflow UI. • CVE-2026-94134 (dbu.gs/vulnerability/CVE-202…) affects "SSHHook" and synchronous SFTP connections. In "SSHHook", "no_host_key_check" defaults to "True". In "SFTPHook", when "no_host_key_check" is absent from the connection's "Extra" settings, the provider also defaults to disabling verification by setting "known_hosts="none"". An attacker who intercepts the connection can impersonate the SSH server, inject command output, modify transferred files, or redirect data to attacker-controlled storage. Credential exposure depends on the authentication method and connection configuration. • CVE-2026-94135 (dbu.gs/vulnerability/CVE-202…) affects the asynchronous SFTP path. "SFTPHookAsync", "SFTPTrigger", and "SFTPClientPool" use "asyncssh" and pass "known_hosts=None" when host key verification is not explicitly enabled. Deferrable SFTP operators that use this asynchronous path are also affected. Exploitation requires the attacker to intercept or redirect traffic between the Airflow worker and the target server. Possible attack positions include ARP spoofing on a shared subnet, compromise of a network device, manipulation of routing within a cloud VPC, or BGP hijacking for internet-facing targets. The affected packages are "apache-airflow-providers-ssh" and "apache-airflow-providers-sftp", through version 6.0.1. Both issues were fixed in version 7.0.0 of the respective providers. As a temporary mitigation, administrators can explicitly set "no_host_key_check=false" and configure a trusted "host_key" for affected connections. If a trusted key is not configured, the connection may fail rather than silently accepting an unknown server key. Article: ox.security/blog/by-default-… PoC (CVE-2026-94134): github.com/MosesOX/POC-CVE-2… CVE-2026-94134 — PT-2026-115311: dbu.gs/vulnerability/PT-2026… CVE-2026-94135 — PT-2026-115312: dbu.gs/vulnerability/PT-2026…

PhantomBuffer: Effective EDR Evasion Through Stealth Injection Read on dbugs: dbu.gs/news/phantombuffer-ef… A new technique, PhantomBuffer, enables stealthy payload injection into a target process without relying on the well-known APIs — "WriteProcessMemory" and "VirtualAllocEx". Instead, it leverages legitimate Windows mechanisms to conceal injection activity. Why it works 1. Payload delivery without "WriteProcessMemory". Instead of writing to memory, it uses "SendMessageW" with the "WM_SETTEXT" message. The payload is sent as text to an edit control (for example, in Notepad on Windows 10 or in "regedit.exe" on Windows 11), and the system copies it into the target process's memory. 2. Hijacking execution flow through a legitimate debugger. Instead of using suspicious APIs such as "SetThreadContext", it leverages "cdb.exe", a debugger included in the Windows Debugger Tools. It attaches to the process and sets the instruction pointer register ("RIP") to the payload's address. Since debuggers are legitimate developer tools, their use may appear less suspicious. The PoC consists of two utilities: • "FindTargetWindows.exe" — searches for GUI processes with suitable input controls. If none are found, it can launch a suitable process. • "PhantomBuffer.exe" — the main tool, which delivers the payload, locates it in memory, and redirects a thread's execution to it using "cdb.exe". Limitations: • A suitable input control is required. The technique won't work without a target process containing an appropriate GUI control. • The null-byte issue. Payloads containing two consecutive null bytes ("0x00 0x00") may not be written correctly to the target process, as text-based transmission can truncate the data. • Debugger path. Some security tools may flag "cdb.exe" if it is launched from a nonstandard location. Using the default installation path for the Windows Debugger Tools may reduce suspicion. Article: zerosalarium.com/2026/10/Pha… Tools: github.com/TwoSevenOneT/Phan…

CVE-2026-7711: RCE in MindsDB — when the client itself chooses an unsafe Python execution mode Read on dbugs: dbu.gs/news/cve-2026-7711-rc… A technical analysis of CVE-2026-7711 (dbu.gs/vulnerability/CVE-202…) in MindsDB has been published. The vulnerability enables remote execution of arbitrary Python code through the BYOM (Bring Your Own Model) mechanism. The core issue is not bypassing uploaded-file validation, but an architectural flaw: the HTTP client can select an unsafe execution mode, while API authentication is disabled by default. MindsDB provides two execution modes for custom models: • "ModelWrapperSafe" — runs uploaded code in a separate process within a Python virtual environment. • "ModelWrapperUnsafe" — executes code directly inside the MindsDB worker process. Exploitation chain: The attacker sends "PUT /api/handlers/byom/<name>" with a Python file in the "code" field and the parameter "type=inhouse". The server converts "inhouse" to "BYOM_TYPE.INHOUSE", selecting "ModelWrapperUnsafe". The alternative value "VENV" selects "ModelWrapperSafe". The uploaded code is passed to "import_string()" in "proc_wrapper.py", which calls "exec(code, module.__dict__)". All top-level statements execute before the server checks whether the model class provides "train()" and "predict()" methods. Consequently, rejecting an invalid model does not prevent the malicious code from executing. The PoC invokes "subprocess.run(['whoami'])" and writes the output to "/tmp/pwned.txt". The command runs with the privileges of the MindsDB worker process. The "/api/handlers" namespace is listed in "protected_namespaces", but the authentication check is enforced only when "config["auth"]["http_auth_enabled"]" is set to "True". This setting defaults to "False". In the examined self-hosted deployment, the HTTP API listens on "0.0.0.0:47334", and BYOM is enabled. In MindsDB's cloud deployment mode, a separate safeguard exists: "MINDSDB_BYOM_ENABLED" defaults to "false". Therefore, the findings should not automatically be assumed to apply to the MindsDB cloud service. Notably, the file-upload mechanism works as designed: the server saves the uploaded file to a temporary directory and subsequently passes its contents to "exec()". The client also controls the choice between the safe and unsafe execution modes through a regular multipart form field. Mitigation: Do not expose the vulnerable BYOM API to untrusted networks. Enable HTTP authentication, restrict the ability to upload custom models, and prevent untrusted clients from selecting "INHOUSE" execution. Authentication restricts access, but it does not make "ModelWrapperUnsafe" a sandbox. Article: nefariousplan.com/posts/mind… PoC: github.com/nn0nkey/JD-Securi… CVE-2026-7711 — PT-2026-36728: dbu.gs/vulnerability/PT-2026…

Two Linux VM escape vulnerabilities: PwnEscape and Vghost — beyond KVM Read on dbugs: dbu.gs/news/two-linux-vm-esc… Two Linux kernel vulnerabilities have been disclosed that can breach VM isolation: CVE-2026-99999 (dbu.gs/vulnerability/CVE-202…) (PwnEscape) and CVE-2026-74580 (dbu.gs/vulnerability/CVE-202…) (Vghost). The first involves deferred network checksum calculation, while the second involves a stale address-translation cache in the "vhost" subsystem. CVE-2026-99999 (dbu.gs/vulnerability/CVE-202…) — PwnEscape: modifying the IPv4 header after validation Researchers at pwn.ai discovered that guest-controlled "CHECKSUM_PARTIAL" metadata — "skb->csum_start" and "skb->csum_offset" — can cause "skb_checksum_help()" to write a checksum into an already-validated IPv4 header. In the demonstrated exploit chain, the kernel initially processes a packet with "IHL=5" (20 bytes), but the deferred write changes it to "IHL=15" (60 bytes). "ip_do_fragment()" then uses the modified header length and includes 32 bytes of host memory beyond the logical "sk_buff" data in outgoing fragments. The leak results from a mismatch between the packet's logical length and the size of the copied header. In their own KVM test environment, the researchers turned the leak into a controlled 64-byte kernel-memory write and executed a command with root privileges on the host. The chain succeeded across four independent cold-boot tests, but the authors reserved the details of how they progressed from the leak to the write for a subsequent publication. Commit "6785011f8b16", merged into the Linux mainline on October 14, 2026, adds "ip_check_csum_start()" before checksum completion in five IPv4 code paths. The fix prevents writes into an already-processed IPv4 header, but it does not constitute comprehensive validation of incoming virtio checksum metadata. CVE-2026-74580 (dbu.gs/vulnerability/CVE-202…) — Vghost: stale IOTLB cache and VM escape The TencentOS Security Team discovered that Linux "vhost" does not invalidate the "vq->meta_iotlb[]" cache after virtqueue configuration changes through "VHOST_SET_VRING_ADDR" and "VHOST_SET_VRING_NUM". As a result, the new configuration may reuse a stale IOTLB translation without revalidating the address range. The resulting pointer is passed to "raw_copy_to_user()" or "raw_copy_from_user()", enabling memory read and write primitives. The researchers demonstrated two attack scenarios: • Local privilege escalation. A user with access to "/dev/vhost-" leaks kernel addresses, determines the KASLR slide, overwrites "modprobe_path", and executes code as root. The complete chain was reproduced on Ubuntu 26.04, RHEL 9.8, Amazon Linux 2023, Azure Linux 3.0, and Oracle Linux 10.2. On the latter four systems, "/dev/vhost-vsock" had "0666" permissions, making the attack accessible to an unprivileged local user. On the tested Ubuntu system, membership in the "kvm" group was required. • Guest-to-host escape. A guest VM with "vIOMMU", "iommu_platform", and "VIRTIO_F_RING_RESET" can reinitialize a virtqueue while retaining a stale cache entry. This causes an out-of-bounds write into the QEMU heap, outside the guest's memory region. The researchers demonstrated corruption of QOM structures and control over the QEMU process's instruction pointer (RIP), but did not claim to have completed an exploit chain that executes a root-level command on the host from the guest. Commit "de845981da67" invalidates the metadata cache when the virtqueue configuration changes. The first fixed releases of the corresponding stable kernel branches are 5.10.265, 5.15.216, 6.1.183, 6.6.152, 6.12.104, 6.18.45, 7.1.9, and 7.2. For distribution kernels, backported fixes must also be considered. Article (CVE-2026-99999): pwn.ai/blog/pwnescape Article (CVE-2026-74580): openwall.com/lists/oss-secur… PoC (CVE-2026-74580): github.com/zhangutah/securit… CVE-2026-74580 — PT-2026-79401: dbu.gs/vulnerability/PT-2026… CVE-2026-99999 — PT-2026-26264: dbu.gs/vulnerability/PT-2026…

CVE-2026-32710: From a plain SELECT to ALL PRIVILEGES in MariaDB via a heap overflow Read on dbugs: dbu.gs/news/cve-2026-32710-f… An analysis of CVE-2026-32710 (dbu.gs/vulnerability/CVE-202…) in MariaDB 11.4.9 has been published. The vulnerability was initially reported as a simple crash in "JSON_SCHEMA_VALID()" when processing a long string. However, the researcher demonstrated that the flaw could be exploited to escalate a low-privileged database user's permissions and retain the elevated privileges even after a server restart. The vulnerability lies in "json_get_normalized_string()" in "sql/json_schema_helper.cc". The function creates a "DYNAMIC_STRING" with an initial 128-byte buffer but uses "strncpy()" for string-valued JSON data without first expanding the buffer. As a result, a specially crafted value processed during "enum" validation triggers a heap-buffer overflow: copying a 194-byte string overwrites 66 bytes beyond the allocated buffer. Using heap grooming, the researcher arranges several MariaDB user variables adjacent to one another on the heap. The overflow modifies the lower two bytes of the "value" pointer in a "user_var_entry" structure, redirecting it to fields belonging to another variable. Subsequent assignments within a single "SELECT" turn this limited overflow into a write to an attacker-chosen address. The target is "Security_context::master_access". After eight bytes of "0xFF" are written to this field, the server treats the current session as having all privileges. With these permissions, the attacker executes "GRANT ALL PRIVILEGES ON . ... WITH GRANT OPTION", and MariaDB persists the privilege changes in the "mysql.global_priv" table. Even if the server process subsequently crashes because of heap corruption, the elevated privileges survive a restart because MariaDB reloads them from the table. Important PoC limitation: this is not yet a fully self-contained exploit. To determine the address of "master_access" and the required pointer bytes, the researcher used laboratory access to "/proc/1/mem". A real-world attack would require an additional address-disclosure primitive. Therefore, the demonstration does not establish that any user with "SELECT" privileges can immediately gain administrative access to an arbitrary MariaDB server. The researcher also demonstrated a path to OS command execution via a user-defined function (UDF), but this requires the ability to write to "plugin_dir". In the test Docker environment, the directory was deliberately made writable, so RCE cannot be considered a guaranteed outcome of the vulnerability. The fix replaces the unsafe "strncpy()" call with "dynstr_set()", which expands the buffer before copying. However, the update only fixes the overflow; privileges already granted through exploitation are not automatically revoked. After installing the fix, administrators should audit "mysql.global_priv" for unexpected grants of "ALL PRIVILEGES WITH GRANT OPTION", especially for accounts that were originally granted only "SELECT". Article: nefariousplan.com/posts/mari… PoC: github.com/dinosn/CVE-2026-3… CVE-2026-32710 — PT-2026-26661: dbu.gs/vulnerability/PT-2026…

Post-Quantum Cryptography in Healthcare Read on dbugs: dbu.gs/news/post-quantum-cry… Researchers at Forescout Vedere Labs assessed (forescout.com/research-labs/…) the healthcare sector's readiness to migrate to post-quantum cryptography (PQC). Their analysis of more than 2.5 million devices across over 50 healthcare organizations revealed a significant readiness gap between traditional IT systems and specialized medical devices, many of which are difficult to upgrade due to their long operational lifecycles. Medical devices lag significantly behind in PQC readiness. Across the networks analyzed, 50% of IT devices, such as workstations and servers, run OpenSSH versions that support PQC. That figure drops to 16% for operational technology (OT) devices, such as building automation systems and backup generators, and just 6% for connected medical devices (IoMT). However, running a compatible software version does not necessarily mean PQC is already in use. Long device lifecycles make migration more challenging. Patient monitors, infusion pumps, diagnostic systems, and other specialized medical devices often remain in service for many years. Updating their cryptographic capabilities can depend on vendor release cycles, firmware updates, recertification, or even replacing the equipment entirely. As a result, migrating these systems to PQC is likely to take considerably longer than upgrading traditional IT infrastructure. Internet-exposed healthcare systems face similar challenges. Researchers identified more than 5,500 instances of internet-exposed medical information systems, including electronic medical record (EMR) platforms (46%) and picture archiving and communication systems (PACS) (40%). On average, only 31% of these systems support TLS 1.3, the only TLS version that can accommodate standardized PQC mechanisms. Meanwhile, 15% still support the deprecated TLS 1.0 and TLS 1.1 protocols. Healthcare data is particularly vulnerable to harvest-now, decrypt-later (HNDL) attacks. Attackers can intercept and store encrypted traffic with the intention of decrypting it once sufficiently powerful quantum computers become available. Unlike passwords or payment data, medical histories, genetic information, laboratory results, and diagnostic images cannot simply be reset or replaced after a breach. Their sensitivity persists throughout a patient's lifetime. Migration priorities depend on data sensitivity, not just device type. Forescout identifies five categories of healthcare data most at risk from future quantum attacks: electronic health records, medical imaging, laboratory results, medication and prescription data, and financial/payment information. Particular attention should be given to data transmitted over external networks, especially through patient portals, cloud applications, and information exchanges between healthcare organizations. PQC migration in healthcare faces a fundamental challenge: patient data must remain protected for decades, while medical devices can take years to upgrade or replace. Healthcare organizations therefore need to assess cryptographic risks, prioritize upgrades, and implement additional safeguards for systems that cannot be made PQC-capable in the near term.