29 stories tagged vulnerability, newest first.
154 points by cowlevel | 85 comments
A Nitter mirror of an Aikido Security post about http2shell, an HTTP/2-related remote code execution vulnerability affecting Node, Python and others; the page shows only a bot-check link.
14 points by rayhaanj | 3 comments
Oracle security alert for CVE-2026-91403, a remotely exploitable CVSS 9.1 JSSE vulnerability affecting Java SE and GraalVM, with affected versions and patch links.
110 points by hayd | 26 comments
GitHub issue requesting Amazon Linux 2023 ship patched PHP packages for critical CVEs, with users asking AWS for a release timeline.
78 points by Maxious | 7 comments
Cloudflare blog post announcing new WAF managed rules protecting against the php2shell PHP vulnerability and advising users to update PHP.
240 points by jacquesm | 94 comments
Notice from the Dutch National Cyber Security Centre that its website is temporarily offline as a precaution due to PHP vulnerabilities, with a patch expected at 16:00.
1438 points by xd | 658 comments
PHP announce mailing list post warning of an upcoming security release on 21 October 2026 fixing two critical vulnerabilities rated CVSS 9.2.
99 points by sysoleg | 59 comments
Archived copy on OpenNET of Rootshell Security Bulletin #22 from August 1998, a mailing list post including a report of a major ICQ security hole.
448 points by g-b-r | 285 comments
A security research blog post describing a one-click account takeover in Telegram Desktop via an unescaped separator in its single-instance IPC, enabling arbitrary file theft.
275 points by maguay | 235 comments
Stratechery essay by Ben Thompson about his computer getting hacked via a vulnerability reported by Ars Technica, and what it means for Apple and hackers.
471 points by trap0xcc | 451 comments
Blog post describing a flaw in Omarchy's default Docker configuration that let any desktop user process escalate to root without a password; fixed in 4.0.1.
620 points by ammar2 | 95 comments
A blog post describing a VSCode webview bug that lets an attacker steal a GitHub token with repo read/write access, including private repos, via a single click.
427 points by hetsaraiya | 97 comments
GitHub repository containing a proof-of-concept exploit for Nginx vulnerability CVE-2026-42945, called Nginx-Rift.
587 points by TangerineDream | 245 comments
Daniel Stenberg's blog post about the AI tool Mythos finding a security vulnerability in curl.
888 points by danpinto | 269 comments
Fingerprint blog post describing a stable Firefox identifier, reportedly via IndexedDB, that can link a user's separate private Tor Browser identities.
493 points by kykeonaut | 232 comments
NVD entry for CVE-2026-33579, a privilege escalation vulnerability in OpenClaw; the captured screenshot shows a Reddit network-policy block page instead.
377 points by Brajeshwar | 203 comments
Popular Science article about a man who accidentally gained control of about 7,000 DJI Romo robot vacuums while trying to steer his own with a gaming controller.
831 points by toomuchtodo | 381 comments
Blog post by a diving instructor and platform engineer recounting how reporting a security vulnerability led to a legal response from the affected organization.
737 points by riffraff | 450 comments
CVE record CVE-2026-20841 published by Microsoft describing a remote code execution vulnerability in the Windows Notepad app.
323 points by raggi | 47 comments
Blog post by Frank Denis, libsodium's author, describing a vulnerability found in the libsodium cryptographic library.
559 points by rayhaanj | 214 comments
GitHub security advisory GHSA-9qr9-h5gf-34mp for a critical (CVSS 10.0) remote code execution vulnerability in React Server Components affecting Next.js, with patched versions listed.
473 points by alexcos | 253 comments
Chromium issue tracker entry for an ipcz bug letting a compromised renderer duplicate a browser process handle to escape the sandbox, marked fixed.
357 points by dgl | 147 comments
A blog post explaining CVE-2025-48384, a Git vulnerability where carriage return handling allows remote code execution via git clone --recursive on Unix-like systems.
336 points by smig0 | 227 comments
BleepingComputer news article about a udisks vulnerability that lets attackers gain root privileges on major Linux distributions.
477 points by andy99 | 287 comments
Invariant Labs blog post describing a vulnerability in the official GitHub MCP server that lets attackers access private repository data via AI agent prompt injection.
467 points by sashk | 111 comments
A blog post describing an iOS vulnerability where a legacy Darwin notifications API could be abused with a single line of code to brick an iPhone.
630 points by tjwds | 388 comments
Changelog for iTerm2 3.5.11, a critical security fix for an SSH integration bug that logged terminal input and output to /tmp/framer.txt on remote hosts.
434 points by KomoD | 198 comments
Tweet by Jake Moore showing he deactivated a WhatsApp account on a test device by emailing WhatsApp support claiming the phone was lost or stolen.
339 points by LinuxBender | 104 comments
KrebsOnSecurity article reporting that Barracuda is telling customers to physically replace, rather than patch, Email Security Gateway appliances hit by a zero-day.
469 points by liuandrewk | 118 comments
A blog post describing how an arithmetic overflow exploit in Magic: The Gathering Arena allowed buying millions of card packs with starting in-game currency.