CVE Tracker(cve.0xosprey.com)
204 points by Group_B | 71 comments
An interactive dashboard charting published CVE counts over time from the CVEProject cvelistV5 data, with monthly and yearly projections.
#cve on Hacker News
23 stories tagged cve, newest first.
Is this the new cyber normal?(drew.silcock.dev)
169 points by drewsberry | 203 comments
Blog post surveying a week of critical software vulnerabilities, including PHP2Shell RCEs found with AI, and discussing whether LLM-driven exploitation is the new normal.
What’s getting pwned right now(pwn.watch)
353 points by mrkd | 165 comments
pwn.watch is a live feed of ongoing security incidents and CVEs, listing affected software, patch status, fixed versions, and source advisories.
Tell HN: I unknowingly broke the PHP RCE embargo. I am sorry
683 points by petecooper | 244 comments
A Tell HN post in which a user apologizes for unknowingly breaking the coordinated disclosure embargo on two PHP remote code execution CVEs, followed by community discussion.
CVE-2026-111943: Compromised Intermediate Certificate Authority(nvd.nist.gov)
314 points by keks24 | 120 comments
NVD vulnerability detail page for CVE-2026-111943, described in the title as a compromised intermediate certificate authority.
There isn't an easy exploit for this PHP vulnerability(eliastaylor.com)
566 points by zkldi | 437 comments
Blog post arguing a newly disclosed PHP vulnerability is hard to exploit and that thousands of LLM-generated GitHub PoC exploits don't work against vanilla PHP.
Qpack amplification attacks against HTTP/3 servers(foxio.io)
13 points by kozika | 1 comments
FoxIO blog post detailing QPACK header decompression amplification attacks that let unauthenticated clients exhaust memory on multiple HTTP/3 server implementations.
PHP web runtimes (CVE-2026-109618 and CVE-2026-109619)(aws.amazon.com)
110 points by hayd | 26 comments
GitHub issue requesting Amazon Linux 2023 ship patched PHP packages for critical CVEs, with users asking AWS for a release timeline.
GitLab critical patch release(docs.gitlab.com)
395 points by artooro | 92 comments
GitLab's critical patch release notes for versions 19.5.1 and backports, fixing a CVSS 10.0 regex compiler integer overflow RCE and other security issues.
Today's PHP security release, and how we're strengthening security(thephp.foundation)
761 points by ejohnso49 | 394 comments
PHP Foundation blog post on a PHP security release fixing two critical RCE vulnerabilities, how they were found, the disclosure leak, and how PHP security work is being strengthened.
PHP 8.2.35(github.com)
1036 points by tuyuri | 562 comments
GitHub release page for PHP 8.2.35, a security release fixing two critical unauthenticated remote code execution vulnerabilities; PHP 8.2 reaches end of life December 2026.
Upcoming critical PHP security release (CVE-2026-109618 / -109619)(news-web.php.net)
1438 points by xd | 658 comments
PHP announce mailing list post warning of an upcoming security release on 21 October 2026 fixing two critical vulnerabilities rated CVSS 9.2.
Several vulnerabilities have been discovered in the Linux kernel(lwn.net)
529 points by luispa | 380 comments
LWN.net repost of Debian Security Advisory DSA-6528-1, a Linux kernel security update fixing numerous CVEs, dated September 29, 2026.
Sourcehut account takeover via build logs (XSS in ansi2html)(blog.arusekk.pl)
136 points by arusekk | 27 comments
A vulnerability writeup describing a wormable XSS in SourceHut's ansi2html.py that let attackers take over accounts of users viewing injected build logs.
Zero-downtime Linux kernel zero-day mitigation via eBPF and SECCOMP(github.com)
5 points by mc493 | 0 comments
GitHub repository with a toolkit for mitigating actively exploited Linux kernel CVEs without reboots using eBPF, module disarmament, seccomp profiles, and user namespaces.
Actively exploited sandbox RCE in all Chromium versions(nvd.nist.gov)
779 points by negura | 473 comments
NVD vulnerability detail page for CVE-2026-85046, reportedly an actively exploited sandbox remote code execution flaw affecting Chromium.
SQLite Critical CVEs or LLM Slop?(research.jfrog.com)
690 points by ymir_e | 342 comments
JFrog Security Research blog post examining whether recently published critical SQLite CVEs are real vulnerabilities or LLM-generated slop reports.
CERT is releasing six CVEs for serious security vulnerabilities in dnsmasq(lists.thekelleys.org.uk)
358 points by chizhik-pyzhik | 199 comments
Mailing list post by dnsmasq maintainer Simon Kelley announcing six CERT CVEs for long-standing dnsmasq vulnerabilities and a patched 2.92rel2 release.
Windows Notepad App Remote Code Execution Vulnerability(cve.org)
737 points by riffraff | 450 comments
CVE record CVE-2026-20841 published by Microsoft describing a remote code execution vulnerability in the Windows Notepad app.
About the security content of iOS 15.8.5 and iPadOS 15.8.5(support.apple.com)
333 points by jerlam | 142 comments
Apple support page describing the security content and fixed vulnerabilities in iOS 15.8.5 and iPadOS 15.8.5.
CVE Foundation(thecvefoundation.org)
401 points by layer8 | 71 comments
Press release dated April 16, 2025 announcing the launch of the CVE Foundation to secure the future of the CVE vulnerability identification program.
CVE program faces swift end after DHS fails to renew contract(csoonline.com)
1827 points by healsdata | 972 comments
CSO Online news analysis on the CVE program facing an abrupt end after DHS failed to renew MITRE's contract, leaving vulnerability tracking uncertain.
Multiple new macOS sandbox escape vulnerabilities(jhftss.github.io)
546 points by transpute | 176 comments
Blog post accompanying a POC2024 talk describing an overlooked macOS attack surface and more than ten new sandbox escape vulnerabilities.