Threat intelligence, automated.
AI-researched threat write-ups, live IOC feeds, and MITRE ATT&CK mappings — human-reviewed before every publish. Built for defenders.
CVE-2026-119977: WordPress Core RCE via TOCTOU Race Condition
A critical Time-of-Check Time-of-Use (TOCTOU) race condition vulnerability (CVE-2026-119977) in WordPress Core versions 4.7 through 7.1.3 allows unauthenticated attackers to achieve Remote Code Execution. This occurs during the core upgrade window due to predictable, web-accessible staging paths, enabling attackers to inject malicious code.
Read full report →CVE-2026-118527: Ivanti Connect Secure Predictable Numbers Vulnerability Leading to File Upload
CVE-2026-118527 is a critical vulnerability in Ivanti Connect Secure that allows a remote authenticated attacker to upload arbitrary files to a known location on disk. This flaw stems from the generation of predictable numbers or identifiers and can be chained with other vulnerabilities for broader system compromise. Given its presence in CISA’s KEV, it is actively exploited in the wild.
CVE-2026-111357: Ivanti Connect Secure Privilege Escalation
CVE-2026-111357 is a high-severity privilege escalation vulnerability in Ivanti Connect Secure appliances, actively exploited in the wild since October 2026. A local authenticated attacker can leverage this flaw, which involves mishandling of DSCache configuration data by the `dsinvoked` broker, to gain root privileges. This vulnerability can be chained with other Ivanti zero-days.
CVE-2026-76418: Cisco Secure Firewall ASA/FTD Denial of Service Vulnerability
Cisco Secure Firewall ASA and FTD Software are vulnerable to a remote, unauthenticated denial of service (DoS) condition (CVE-2026-76418). Exploitation involves sending crafted requests to the SSL remote access VPN service when secondary authentication is configured, causing the device to unexpectedly reload. This vulnerability is rated 8.6 (HIGH) and is listed in CISA’s Known Exploited Vulnerabilities Catalog.
CVE-2026-41709: Broadcom VMWare ESX Insufficient Logging Vulnerability
Broadcom VMWare ESX contains an insufficient logging vulnerability, CVE-2026-41709, allowing malicious administrators to perform unlogged operations. This low-severity flaw could aid in evading detection by obscuring administrative actions within virtualized environments. It requires high privileges to exploit.
CVE-2026-46300: Linux Kernel Privilege Escalation via Shared Fragment Handling
CVE-2026-46300 is a high-severity vulnerability in the Linux kernel that allows for unintended modification of page-cache-backed data. This flaw can be chained with other vulnerabilities to achieve privilege escalation, implant PHP webshells, and execute commands as root. Active exploitation has been observed in the wild, notably by IoT malware families like KATARU and Mirai.
CVE-2026-48356: Adobe Commerce Unrestricted File Upload Leading to RCE
Adobe Commerce and Magento are affected by CVE-2026-48356, an unrestricted file upload vulnerability (CWE-434) that can lead to arbitrary code execution. Exploitation requires user interaction with a malicious URL or compromised page, potentially granting attackers elevated access or control over victim sessions. This vulnerability is actively exploited in the wild.
CVE-2026-111497: Google Brotli Buffer Overflow Leads to Remote Code Execution
A critical buffer overflow vulnerability (CVE-2026-111497) in Google Brotli versions 1.0.3 through 1.2.0 allows remote unauthenticated attackers to achieve arbitrary code execution, denial of service, or sensitive memory disclosure via a crafted Brotli-compressed stream. Immediate patching to versions 1.0.10, 1.1.1, or 1.2.1 is required to mitigate this risk, as exploitation is publicly confirmed.
CVE-2026-109619: PHP Stale Internal Request-State RCE Vulnerability
CVE-2026-109619 is a high-severity vulnerability in PHP that allows unauthenticated remote code execution due to improper handling of global state and request memory. This flaw affects multiple PHP versions and products, including Palo Alto Networks PAN-OS, and is actively exploited by various threat actors, including DPRK-linked groups and ransomware gangs, often leveraging `PHP2Shell` exploitation.
Transparently AI-authored
Every report on this site is researched and drafted by an AI agent, then reviewed and approved by a human analyst before publication. The Agent Logbook shows every step — sources consulted, enrichment calls, tokens used, and approval status — in real time.