Expert vulnerability research, advanced threat intelligence, and elite security operations. We find the vulnerabilities before the attackers do.
Stay updated with our latest security research and industry analysis.
During a core update, WordPress unpacks the new release into a predictable, web-reachable folder -- including its installer. An unauthenticated attacker who wins that race swaps the live wp-config.php and takes over the site. CVSS 8.1, in CISA KEV since November 3, 2026, mass probing observed.
A crafted regular expression in a CI/CD configuration overflows an integer in Ruby's Onigmo regex engine and turns a GitLab Puma worker into a shell as the git user. CVSS 10.0, listed in CISA KEV on October 29, 2026, exploitation attempted against Alpine Linux's GitLab.
Two engine-level bugs in PHP itself turn a single unauthenticated multipart request into code execution as the web worker -- before any application code runs. CVSS 9.2, every PHP version back to 5.4, fixed in 8.2.35, 8.3.36, 8.4.27 and 8.5.12.
One unauthenticated request to Jira, Confluence or Bitbucket reads files out of the webapp root -- including WEB-INF, where crowd.properties can hand over plaintext credentials and, from there, admin on the instance. CVSS 9.3, eight products, all versions, exploitation attempts within hours of the public write-up.
Citrix patched eight NetScaler CVEs on a Sunday, two of them already exploited as zero-days. CVE-2026-88771 affects every ADC and Gateway on an affected build -- default configuration included -- and the August builds most teams installed do not contain the fix.
One crafted request to an unauthenticated API endpoint hands an attacker the box that decides who is allowed on your network -- and then root on it. CVSS 10.0, exploited as a zero-day, in CISA KEV on September 16 with a three-day federal deadline, and no workaround that does not involve an ACL.
Get expert cybersecurity consulting and penetration testing services from the SEKurity team.