0-Day Exploit for Windows OS for Sale Read on dbugs: dbu.gs/news/0-day-exploit-fo… Vulnerability Type: LPE Affected Versions: • Windows 11 24H2 (26100.9550+) • Windows 11 25H2 (26200.9550+) • Windows 11 26H1 (28000.3086+) • Windows 11 26H2 (26300.9550+) Price: $30K

PHP2Shell: what happened in the first 24 hours after disclosure Read on dbugs: dbu.gs/news/php2shell-what-h… After PHP2Shell (CVE-2026-109618 (dbu.gs/vulnerability/PT-2026…) and CVE-2026-109619 (dbu.gs/vulnerability/PT-2026…)) was publicly disclosed, Imperva recorded (imperva.com/blog/php2shell-e…) a sharp increase in scanning and exploitation attempts. The first 24 hours of attacker activity in numbers: • 482,342 requests associated with scanning and/or exploitation attempts. • 122,311 attack sessions with an average of 3.9 requests per session. • 21,998 targeted resources with an average of about 22 requests per site. • 103 countries, where the targeted resources were located. The first information about the vulnerability appeared on October 20 at 15:20 (UTC), while Imperva observed the first unsuccessful probing attempts around 12:00 on October 21, before the official patch was released at 13:48. About seven hours after the patch was published, activity peaked at 94,870 requests per hour, followed by a second notable spike on the morning of October 22 — to approximately 42,000 requests per hour. 64.5% of the targeted sites were located in the United States, followed by Indonesia, Australia, Germany, and Brazil. By industry, business led the list at 34.3%, followed by education and financial services. The level of automation is also worth noting: about half of the requests originated from known bots and tools based on Go HTTP libraries. This clearly shows how quickly tools for mass scanning emerge after a critical vulnerability is disclosed. The attacks began before the official patch was released: shortly after the public information appeared, automated scanners started looking for potential targets. As a result, the response window effectively begins when the vulnerability is disclosed, not when a patch or an exploit becomes available — and is measured in hours, not days. CVE-2026-109618 — PT-2026-118596: dbu.gs/vulnerability/PT-2026… CVE-2026-109619 — PT-2026-118597: dbu.gs/vulnerability/PT-2026…

A PoC/exploit has been discovered for vulnerability CVE-2025-27740 PT ID: PT-2025-15563 Read on dbugs: dbu.gs/vulnerability/PT-2025… Vendor: Microsoft Products: • Windows Server 2008 R2 Service Pack 1 • Windows Server 2008 R2 Service Pack 1 (Server Core installation) • Windows Server 2008 Service Pack 2 • Windows Server 2008 Service Pack 2 (Server Core installation) • Windows Server 2012 • Windows Server 2012 (Server Core installation) • Windows Server 2012 R2 • Windows Server 2012 R2 (Server Core installation) • Windows Server 2016 • Windows Server 2016 (Server Core installation) and 6 more products Description: Weak authentication in Windows Active Directory Certificate Services allows an authorized attacker to elevate privileges over a network. Link: github.com/dannners/cve-2025…

Pathrunner — AWS Privilege Escalation Read on dbugs: dbu.gs/news/pathrunner-aws-p… A modular AWS privilege escalation framework from Datadog that automates the exploitation of AWS IAM privilege escalation paths. It helps determine whether existing permissions can be used to gain access as another AWS identity. The tool includes 81 exploit modules across 24 AWS services. Key features: • Payload selection — lets you choose from multiple payloads for each exploit module based on environmental constraints, such as extracting credentials or creating a new user. • Switching between identities — obtained credentials are automatically imported and made available for subsequent attack steps. • Attacker infrastructure deployment — deploys infrastructure in a separate AWS account to collect credentials obtained during exploitation. • Resource tracking and cleanup — tracks created and modified resources, generates a report of changes, and provides commands to clean up created resources after testing. The project is complemented by a catalog of techniques at pathfinding.cloud (pathfinding.cloud/) and training labs at Pathfinding Labs (pathfinding.cloud/labs/). The catalog documents AWS IAM privilege escalation paths, while the labs let you deploy a vulnerable AWS environments in your own account and practice exploiting these paths. Article: securitylabs.datadoghq.com/a… Tool: github.com/DataDog/pathrunne…

ROME: how to change model outputs without touching the weight file Read on dbugs: dbu.gs/news/rome-how-to-chan… ROME (Rank-One Model Editing) — a method for surgically editing factual associations in language models. It targets a specific weight matrix in a middle layer and applies a rank-one update, allowing the model’s outputs to be changed without retraining it. How the edit works In the Stealthium demonstration, a small PyTorch transformer is loaded from a checkpoint on disk. Nothing in the model or its weights is a crafted artifact. Instead, the malicious code arrives through an importable Python library: it injects itself into PyTorch, is armed by an environment variable, and applies the edit when the model is put into evaluation mode. From the driver’s perspective, this looks like standard model inference with an additional series of CUDA kernel launches. The modification proceeds in three stages, each characterized by a set of kernels and a call stack: 1. Key collection. The model is run on calibration prompts, and the required activations from the middle layer are accumulated in a buffer ("CatArrayBatchedCopy_vectorized"). Stack: "_keys" → "_calibrate" → "_eval". 2. Target weight calculation. A linear system is solved: matrix multiplication ("ampere_sgemm_32x128_nt") and LU decomposition ("getrf_pivot") produce the required update. Stack: "_calibrate" → "_eval". 3. Writing to the live weights. The update is added in place to the model's weights in GPU memory ("CUDAFunctorOnSelf_add"). Stack: "_calibrate" → "_eval". The third stage changes the weights using a rank-one matrix: a rank-one matrix derived from the collected keys is added to one of the model’s weight matrices. The tensor’s shape and size remain unchanged, so the model continues to function normally while producing different outputs. Why standard security tools don’t detect this The weights are patched directly in GPU memory: there is no file access, no extra system calls, and not even memory mapping. The same "python3" process and the same CUDA context are used. Traditional endpoint security tools, such as EDRs and application-level monitoring tools, focus on process activity: opening files, spawning child processes, and communicating over the network. From that perspective, the workload looks like a normal inference job. A kernel that adds two tensors while generating an output is indistinguishable from one that applies an update to the weights: its arguments are raw pointers to device memory. Article: stealthium.io/blog/hands-off…

Imperia CMS: remote command execution via server-side template injection Read on dbugs: dbu.gs/news/imperia-cms-remo… Researcher Julien Ahrens from RCE Security discovered a critical vulnerability CVE-2026-110355 (dbu.gs/vulnerability/CVE-202…) in Imperia CMS, an enterprise content management system for websites. The flaw affects the SiteActive mechanism, which handles dynamic page processing, and allows unauthenticated arbitrary code execution on the server. The issue is caused by insufficient validation of user-supplied data passed to the template handler. To exploit the vulnerability, an attacker sends a specially crafted request to "/cgi-bin/site_active.pl", passing a malicious expression in the "TEMPLATE" parameter. Using the "{SITE_ACTIVE}" prefix makes it possible to select a different template processing path and bypass the file name security check. Special characters then terminate the generated "include" directive, after which PHP code and the "<!--postconvert:PHPExec()-->" instruction are injected into the page content. In the next stage, the template conversion mechanism recognizes this instruction and passes the injected PHP code to the "PHPExec" handler, resulting in command execution on the server. Exploiting the vulnerability allows an attacker to execute operating system commands without an account, with the privileges of the CMS process, access application files, modify website content, and potentially establish persistence on the server. The attack requires the SiteActive CGI interface to be enabled, accessible over HTTP, and PHP to be present. Article: rcesecurity.com/2026/10/impe… CVE-2026-110355 — PT-2026-120552: dbu.gs/vulnerability/PT-2026…

Sale of a PoC for a vulnerability in Ivanti Connect Secure (CVE-2026-104935) Read on dbugs: dbu.gs/news/sale-of-a-poc-fo… According to the seller, the exploit works through the standard HTTPS port without credentials or authentication, escalates privileges to "root" and automatically extracts administrator password hashes, LDAP/AD, RADIUS, and SAML keys, and Azure private keys. The seller tested the attack on lab environments and two real targets. On 22.8+ builds with hardened SELinux, data exfiltration may be restricted. Vulnerability type: Pre-Auth RCE Affected versions: 25.1.1.1 (http://25.1.1.1/), 25.1.2.2 (http://25.1.2.2/), 22.8R2.4 Price: $3000 CVE-2026-104935 — PT-2026-111656: dbu.gs/vulnerability/PT-2026…

PHP2Shell: two critical vulnerabilities enable unauthenticated code execution Read on dbugs: dbu.gs/news/php2shell-two-cr… Researchers at OX Security analyzed two critical vulnerabilities CVE-2026-109618 (dbu.gs/vulnerability/CVE-202…) and CVE-2026-109619 (dbu.gs/vulnerability/CVE-202…), collectively known as PHP2Shell. Both issues stem from improper memory management in the PHP core and can lead to remote code execution without authentication. The vulnerabilities are notable because they affect the PHP interpreter itself rather than individual web applications or CMS platforms. Exploitation uses the "session.upload_progress", which tracks file uploads and processes HTTP request data before the PHP script starts. An attacker sends a specially crafted "multipart/form-data" POST request that triggers memory management errors. In the case of CVE-2026-109618, memory exhaustion causes request processing to terminate abnormally, followed by access to improperly initialized data. CVE-2026-109619 involves retaining pointers to memory that has already been freed and may be reused while processing subsequent requests. Both errors create conditions for memory corruption and potential control-flow hijacking. Successful exploitation allows an attacker to execute arbitrary code on the web server without an account, gain access to configuration files, application credentials, and other resources available to the PHP process. This creates a risk of compromising sites running WordPress, Drupal, Magento, and other PHP applications, regardless of whether their own code contains vulnerabilities. Article: ox.security/blog/cve-2026-10… CVE-2026-109618 — PT-2026-118596: dbu.gs/vulnerability/PT-2026… CVE-2026-109619 — PT-2026-118597: dbu.gs/vulnerability/PT-2026…

FortiSIEM: Remote Command Execution via Directory Traversal Read on dbugs: dbu.gs/news/fortisiem-remote… Researchers Horizon3.ai (horizon3.ai/) have published a technical analysis of the critical vulnerability CVE-2026-106173 (dbu.gs/vulnerability/CVE-202…) in Fortinet's FortiSIEM security monitoring platform. The flaw affects the "phQueryMaster" gRPC service, accessible on port 27918/TCP, and allows an unauthenticated user to write arbitrary files to the server's file system. The vulnerability received a CVSS score of 9.4. To exploit the vulnerability, an attacker calls the "SendQueryResult" method, which saves query results to files. The "query-id" parameter is used to construct the path without proper validation, allowing "../" sequences to be used to escape the intended directory. The researchers also discovered that a null byte "\0" can be injected, allowing the attacker to bypass the automatic addition of the filename and extension. As a result, an attacker can overwrite an existing executable script, such as "/opt/charting/redishb.sh", which runs automatically every 60 seconds to check the status of Redis. Exploiting the vulnerability allows an attacker to execute arbitrary commands on the FortiSIEM server without authentication. This enables access to configuration files and other data accessible to the process, disruption of the monitoring system, and further attacks within the internal network. Article: horizon3.ai/attack-research/… PoC: github.com/horizon3ai/CVE-20… CVE-2026-106173 — PT-2026-111783: dbu.gs/vulnerability/PT-2026…

Active Directory: Bypassing LDAP Signing and Compromising the Domain via NTLM Relay Read on dbugs: dbu.gs/news/active-directory… SpecterOps researchers discovered a way to bypass LDAP Signing — a mechanism that protects the integrity of LDAP messages and was previously considered one of the primary defenses against NTLM Relay attacks. A flaw in reauthentication handling allowed LDAP operations to be performed with another user's privileges even when message signing was mandatory. The attack affected Windows Server domain controllers starting with version 2016, and Microsoft released a fix in October 2026. To exploit the vulnerability, an attacker first establishes a signed LDAP connection to the domain controller using a session key known to the attacker. The attacker then coerces the target host into authenticating over NTLM via SMB and relays the authentication through the already-established LDAP connection. The key feature is that the reauthentication message and the malicious LDAP request are placed in a single signed SASL record. The domain controller verifies the signature using the original key, then switches the security context to the victim's account and executes the LDAP request with that account's privileges. Exploiting the vulnerability allows an attacker to modify Active Directory objects on behalf of the compromised account without knowing its password. For example, the researchers demonstrated modifying the "msDS-AllowedToActOnBehalfOfOtherIdentity" attribute to carry out an RBCD attack. When a domain controller's authentication is relayed, this can lead to taking control of the controller, performing DCSync, and fully compromising the domain. The attack requires access to LDAP over port 389/TCP; this bypass does not apply to LDAPS. Article: specterops.io/blog/2026/10/2…

PowerShell: bypassing detection via a nonstandard -EncodedCommand Read on dbugs: dbu.gs/news/powershell-bypas… Most detection tools look for the string "-enc" in the command line, sometimes "-e", and sometimes the full "-EncodedCommand". But PowerShell does not treat this flag as a word. It treats it as a parameter name, accepts any prefix it can resolve unambiguously, ignores case, and accepts certain characters in place of the leading hyphen. What exactly PowerShell accepts If you encode a harmless command and pass it to PowerShell using different spellings of the flag, PowerShell 7.6.6 accepts the following: "-e", "-ec", "-en", "-enc", "-enco", "-encod", "-encode", "-encoded", "-encodedc", "-EncodedCommand" — in any combination of uppercase and lowercase letters. PowerShell also accepts "/enc", "--enc", and "enc" preceded by a typographic dash: a short one (en dash), a long one (em dash), or a horizontal bar. Three other dash-like characters are rejected: the figure dash, the Unicode hyphen, and the minus sign. Spellings longer than the name, such as "-encodedcommandx", are also rejected. The dashes matter. A command line copied from a document, a chat message or phishing lure may pick up typographic dashes along the way. A detection rule that looks for a space followed by a hyphen will miss these variants. How this is used in an attack 1. Payload preparation. The command is encoded as expected by "-EncodedCommand": first in UTF-16LE, then in base64. The payload is often encoded again: the decoded command passes a second base64 string to "FromBase64String", and the result is passed to "Invoke-Expression". 2. Launch obfuscation. Instead of the full flag, the command line uses an accepted prefix or a variant with a slash, a double hyphen, or a typographic dash. To PowerShell, it resolves to the same parameter; to detection, it is a different string. 3. Execution. The process starts normally, without errors. The encoded command executes even though a rule tailored to -enc failed to catch it. What an attacker needs to know • PowerShell version. The testing was performed on PowerShell 7.6.6. Windows PowerShell 5.1, which is still widely used by attacker tooling, needs to be tested separately in your own environment. • Payload length. Encoding increases the command’s size: UTF-16 doubles the number of bytes, and base64 adds another third. A short command can become noticeably longer. • Logging. If script block logging is enabled on the host, the decoded text may appear in event 4104. This does not eliminate command-line obfuscation, but it makes the payload easier to inspect. Article: ridgelinecyber.com/blog/enco…

ADINT on a global scale Read on dbugs: dbu.gs/news/adint-on-a-globa… Researchers from Citizen Lab (citizenlab.ca/research/how-d…) and Confiant (blog.confiant.com/p/adint-we…) have published investigations into how digital advertising infrastructure was used to distribute Candiru spyware. Analysts believe this is the first technical evidence that targeted advertising has been used to deliver mercenary spyware. "The investigation focuses on the Israeli company Discover-Tech, which operated the MyDSP platform, using it to bid in advertising auctions on Google, Yandex, Vungle, and other platforms. Through the Controlium platform, its clients—including operators of mercenary spyware—could select specific user devices for profiling or infection based on mobile advertising identifiers (on iOS or Android), browser identifiers, and/or victims’ IP addresses." Researchers dubbed this infection technique AdFection. The pipeline works as follows: 1) Discover-Tech wins an ad auction, and the ad is displayed on the user’s device. 2) When the ad loads, it connects to a Discover-Tech server and transmits the user’s advertising identifiers. 3) If the device is selected as a target, the server returns JavaScript code to be executed; otherwise, it returns an empty response. The ad still collects browser data, including cookies and the public IPv6 address. The researchers confirmed the practical use of this scheme through the example of the Al Jazeera news network. At least 45 devices on the media network were targeted in attacks using Discover-Tech infrastructure in 2024–2025. Analysis of network logs showed that the victims’ devices initially connected to Discover-Tech infrastructure domains, which analysts attribute to ad delivery. A validation server then checked the devices before profiling and infecting them. Ultimately, the compromised device connected to Candiru C2 servers. Al Jazeera also provided a DLL file from one of the compromised Windows devices containing hardcoded C2 server addresses. Citizen Lab attributed the sample to Candiru with high confidence: its persistence mechanisms, string obfuscation, and connection-checking mechanisms match those described in the 2021 report (citizenlab.ca/research/hooki…). The scale of the advertising infrastructure—billions of bids. From March through June 2026, MyDSP participated in auctions for 3.77 billion ad impressions and won approximately 11.7% of them. At least 718 million bids (approximately 19%) involved ads that showed signs of contacting NOAS servers, a component used to selectively deliver JavaScript code to specific devices. The Yandex advertising system accounted for 67.4% of the bids. One example was an Akedo ad displayed on livelib[.]ru in May 2025. ID syncing expanded profiling capabilities. Analysts found that Discover-Tech synchronized user identifiers with Comcast’s Beeswax, Yandex, and Microsoft’s Xandr advertising systems. This makes it possible to match the same user across different advertising platforms and use a known identifier to find and target that user in another system. For example, the Controlium platform allows a Beeswax ID to be specified as the target identifier, potentially enabling data from one advertising system to be used to target a user through another. Synchronization can occur even when the user does not see an ad: visiting a website where the relevant requests run in the background is sufficient. The advertising infrastructure had already been used to deanonymize users at scale. Researchers found that the threat actor known as DARK CARTOGRAPHER had been using platforms such as Discover-Tech for this purpose since 2019. One method relies on mobile carrier frictionless authentication: when certain websites are accessed, carriers add a header containing the user’s phone number to unencrypted HTTP requests. Weaknesses in the validation of allowed websites allow attackers to obtain this information through ads. Ads were displayed on sensitive networks around the world. Researchers note that the bidding data contains evidence of ads being displayed on IP addresses belonging to critical infrastructure organizations, government agencies, and international organizations. Those mentioned include: • NATO and UN networks; • Russian government networks; • Armenia—the Central Election Commission, Central Bank, and Prime Minister’s Office; • Israel—the Ministry of Health, Ministry of Foreign Affairs, Ministry of Defense, and other agencies; • networks belonging to Intel, Nvidia, Broadcom, and several media companies. "However, the mere fact that an ad was displayed does not confirm an infection or a targeted attack—it primarily demonstrates the scale of Discover-Tech infrastructure’s presence." As a result, Google, Beeswax, Vungle (Liftoff), Eskimi, and IAB Europe took steps to restrict or terminate Discover-Tech’s access to their advertising infrastructure after engaging with the researchers and receiving the results of their work. Insufficient oversight of advertising vendors and the technical characteristics of digital advertising infrastructure create conditions for the spread of malvertising and make such threats difficult to counter. To reduce the risks, organizations need to improve mechanisms for detecting and blocking malicious campaigns and strengthen cooperation between researchers and ad-tech providers.

Sale of an RCE exploit for WhatsApp on Android Read on dbugs: dbu.gs/news/sale-of-an-rce-e… Vulnerability type: Remote Code Execution (RCE) / Sandbox Escape Affected versions: WhatsApp for Android 2.25.xx–2.26.xx, Privileges obtained: code execution in the context of the WhatsApp process (com.whatsapp) Price: $10 000 The seller claims to be offering an exploit for WhatsApp on Android that enables remote arbitrary code execution by sending a specially crafted image or sticker. According to the seller, successfully exploiting the vulnerability requires only delivery of the message, with no additional action from the user. The claimed exploit chain uses type confusion and out-of-bounds (OOB) access bugs in the media data handler. According to the author, these bugs enable a controlled write to the WhatsApp process memory and code execution within com.whatsapp. An additional component for a limited sandbox escape is offered for an extra fee. The seller claims that the exploit works against WhatsApp for Android versions 2.25.xx–2.26.xx, described in the listing as the current stable range at the time of publication. Testing is claimed on Google Pixel 8, Pixel 8 Pro, and Samsung Galaxy S24 smartphones running One UI. In addition, according to the author, code execution occurs directly in memory, without installing an APK. The package does not include a persistence mechanism. The delivery includes the initial payload, a loader, and a basic template for communicating with the command-and-control server.

BiSON — secure semantic search over a billion encrypted vectors Read on dbugs: dbu.gs/news/bison-secure-sem… Microsoft Research has unveiled BiSON (microsoft.com/en-us/research…) (Billion-Scale Oblivious Nearest-Neighbor Search) — a system for quickly searching for similar objects in encrypted vector databases. According to the researchers, it can operate on a database of a billion vectors, while keeping response times in the millisecond range. The paper (eprint.iacr.org/2026/1343.pd…)was presented at IEEE EuroS&P 2026. The development addresses one of the key challenges facing modern AI systems: how to perform semantic searches in the cloud without revealing the contents of the database, the search query, or the algorithm's data access patterns to the provider. Why conventional encryption is not enough Semantic search operates on vector representations. Documents, images, and other objects are converted into sets of numbers that describe their meaning. The user's query is also converted into a vector, after which the system searches for the most similar objects. This approach is used in vector databases, recommendation systems, and RAG (retrieval-augmented generation). For large datasets, approximate nearest-neighbor (ANN) search is typically used to avoid comparing the query with every object individually. However, if such a database is hosted in the cloud, basic encryption is not enough. The server can still observe which areas of storage the algorithm queries, and analyze recurring access patterns. BiSON is designed to conceal this information as well. How BiSON works The system is built on Oblivious RAM (ORAM) — a technology that conceals a client's actual data accesses. The server performs read and write operations but cannot determine which specific data the client is accessing at a given moment. However, ORAM typically requires a large number of additional operations and substantial network traffic, making it too costly to apply to vector databases containing hundreds of millions or billions of objects. In BiSON, Microsoft developed an ORAM variant designed for disk storage. This means the protected index does not need to reside entirely in memory, allowing the system to scale to billion-record datasets. The system is based on DiskANN — a nearest-vector search algorithm developed by Microsoft and optimized for storing large indexes on SSDs. In BiSON, this index is transformed into a protected ORAM structure. According to Microsoft, BiSON maintains search quality close to that of modern unprotected ANN systems, while a query against a database of one billion vectors can be completed in milliseconds. Compared with the previous private search system, Compass, the developers report: – a reduction in the volume of transmitted data by up to 28×; – a reduction in end-to-end query latency by up to 23.5×; – an increase in the supported database size of approximately two orders of magnitude. Existing approaches already enabled private nearest-neighbor searches, but they generally performed poorly at the scale typical of large cloud and AI services. Where it can be used BiSON is designed for scenarios in which an organization wants to use cloud computing without revealing either its vector database or its search queries to the provider. This could be useful for: – enterprise search across internal documents; – RAG systems working with confidential information; – medical and financial applications; – personal AI assistants; – searches across sensitive user data. Tool: github.com/r-dott/bison

h3fuzz — ffuf with HTTP/3 support and a web interface Read on dbugs: dbu.gs/news/h3fuzz-ffuf-with… h3fuzz is a fork of ffuf for discovering files and directories on web servers. The tool retains familiar wordlists, filters, and fuzzing options, while adding HTTP/3 support and a persistent web interface for managing scans. The tool automatically uses HTTP/3 when supported, falling back to HTTP/2 and then HTTP/1.1 when necessary. Key features: • High speed — in the author's local benchmark, the tool exceeded 100,000 requests per second. • Scan management — launch multiple scans from the web interface, pause and resume them, rerun scans, and compare results. • Result analysis — search, sort, and filter findings. Scan sessions, settings, and results persist between runs. Actual fuzzing speed depends on the network and the server's capabilities. Article: slcyber.io/research/how-prac… Tool: github.com/assetnote/h3fuzz

CVE-2026-81983: Integer overflow leads to an out-of-bounds write in Adobe Acrobat Read on dbugs: dbu.gs/news/cve-2026-81983-i… Remedio researchers discovered CVE-2026-81983 (dbu.gs/vulnerability/CVE-202…) in Adobe Acrobat's image-processing pipeline. The vulnerability is triggered by opening a PDF containing a specially crafted 16-bit image and can cause an out-of-bounds write in "Acrobat.dll". The flaw lies in a function that normalizes 16-bit image samples before compositing. The byte-swapping loop uses the product of the image width and the number of components as its iteration count, without checking it against the buffer size. Meanwhile, the buffer-size check calculates the required data length as "Width × components × 2", using the same 32-bit arithmetic. A CMYK image with a width of "0x20000000" is sufficient to trigger the vulnerability. The product "4 × 0x20000000" yields "0x80000000". Multiplying this by two during the size check causes the 32-bit result to wrap to zero, allowing an image data stream containing just 8 bytes to pass validation. The byte-swapping loop then uses the original iteration count of "0x80000000", advancing through memory two bytes at a time. The minimized trigger is a 745-byte PDF containing a single image row. The loop reads and writes beyond a 16-byte buffer, with the observed access violation occurring approximately 144 KB beyond the buffer's start. The vulnerable code is part of the 16-bit sample normalization routine, which swaps the bytes of each value directly in the source buffer. Whether this branch executes depends in part on the "keepEndian" flag. The minimal trigger uses an image XObject with "/BitsPerComponent 16", "/ColorSpace /DeviceCMYK", a height of 1, and a width of "0x20000000". Adobe fixed the vulnerability by introducing a 64-bit range check and rejecting sample counts greater than "INT_MAX". The fix was published in security bulletin APSB26-141 on September 8, 2026. The fixed versions are Acrobat / Acrobat Reader Continuous "26.002.21901" and Acrobat 2024 Classic "24.001.30429". Article: remedio.io/blog/cve-2026-819… CVE-2026-81983 — PT-2026-88482: dbu.gs/vulnerability/PT-2026…

Ransomware attackers are expanding their pressure tactics Read on dbugs: dbu.gs/news/ransomware-attac… Semperis has released (semperis.com/ransomware-risk…) 2026 Ransomware Risk Report. It is based on a survey of 1,200 IT and information security professionals from nine countries and eight industries; the sample included only organizations where at least one ransomware attack had succeeded and disrupted operations. Because ransomware activity is frequently covered in various reports, the overall statistics and trends are summarized briefly below: • By country, France, Australia, Italy, and Spain stand out: 100%, 84%, 81%, and 81% of respondents, respectively, reported more than one attack during the year. • By industry, repeated successful attacks were most common in healthcare (82%), transportation (77%), and manufacturing (72%). • Most attacks occur outside working hours; repeated attacks and multiple ransom payments remain common, while attackers typically spend 2–6 days inside the infrastructure. Let’s take a closer look at how attackers' methods and pressure points are changing: AI is already having a noticeable impact on ransomware attacks. 84% of respondents encountered attacks in which AI was used in some way: 40% faced attacks involving AI, while 44% experienced attacks targeting their own AI agents or the company's AI systems. The latter is particularly dangerous when such systems have access to other services: attackers can use them to escalate privileges and move further through the infrastructure. Identity management systems are attacked more often than organizations are prepared to restore them. In 87% of cases, ransomware attackers targeted Active Directory, Entra ID, or Okta. Yet only 50% of organizations had dedicated backups of these systems, and just 42% had automated recovery. The growing role of identity attacks has previously been highlighted by Microsoft, Rubrik Zero Labs and others. Pressure extends beyond the digital environment and beyond the organization itself. In 17% of attacks, threat actors resorted to physical threats, including abduction and bodily harm. In 37% of cases, the pressure extended to employees' friends and relatives, while about a quarter of organizations faced the publication of employees' and their families' personal data (doxxing) or fake emergency calls to law enforcement (swatting) at their addresses. Response challenges are often organizational rather than technical. 48% of companies cited the lack of clearly defined roles and responsibilities as an obstacle, while 44% each pointed to problems with coordination between teams and outdated response plans. Preparing for ransomware attacks is not limited to creating backups and restoring encrypted systems. After a compromise, it is important not only to regain control of accounts and access, but also to verify that the attackers no longer have access to the environment: otherwise, recovery can quickly give way to another attack. At the same time, organizations must maintain reliable communication channels between teams and define in advance how to respond to threats against employees and their loved ones — including coordination with law enforcement.

ReDoS via the Cache-Control header in Symfony and Laravel Read on dbugs: dbu.gs/news/redos-via-the-ca… Researcher Martino Spagnuolo demonstrated how a regular expression in "symfony/http-foundation" can be exploited to exhaust the resources of PHP applications built on Symfony, Laravel, Drupal, and other platforms. The vulnerability, CVE-2026-108082 (dbu.gs/vulnerability/CVE-202…), can be exploited without authentication: an attacker only needs to send an ordinary HTTP request with a specially crafted header. A single request can keep a CPU core busy for several seconds, while multiple concurrent requests can make the application unavailable. The root cause lies in "HeaderUtils::split()", which parses HTTP header values. The regex fragment "[^",=]+" allows spaces within a token, while the negative lookbehind "(?<!\s)" prevents a match from ending with a whitespace character. A string consisting of "a" followed by 17 spaces and ",x" forces the regex engine to explore roughly "2^17" ways of partitioning the spaces before rejecting the match. In one real-world test, a single request took 12.7 seconds to process. The vulnerability can be triggered through the "Cache-Control" header, which Symfony parses automatically when constructing the request object, before routing and authentication. This includes requests that ultimately receive "404" or "401" responses. Laravel parses the headers three times during request initialization, increasing the processing overhead. Behind nginx, multiple "Cache-Control" headers can be merged into a single value without rechecking the combined length. In a laboratory test using Laravel behind nginx, four headers of approximately 8 KB each resulted in a request processing time of nearly nine seconds. A test involving 100 requests with a concurrency level of eight caused increasing response times, timeouts, and "504" errors. The vulnerability affects "symfony/http-foundation" from version 4.1 up to the October 2026 security fixes. The recommended fixed releases are 6.4.48, 7.4.21, and 8.1.9, depending on the maintained branch. The initial fixes — 5.4.54, 6.4.46, 7.4.19, and 8.1.7 — addressed the ReDoS issue but introduced regressions in other functionality. The 5.4 branch is no longer supported, and the advisory does not identify a subsequent corrected release for that branch. As a temporary mitigation, administrators can reject requests with unusually long "Cache-Control" headers, for example using a WAF rule that limits their length to 50–100 bytes, as suggested by the researcher. Article: r3verii.github.io/cve/2026/1… CVE-2026-108082 — PT-2026-114951: dbu.gs/vulnerability/PT-2026…

RCE Exploit for Google Chrome/Chromium for Sale Read on dbugs: dbu.gs/news/rce-exploit-for-… Vulnerability Type: Remote Code Execution (RCE) / Sandbox Escape Vulnerable Versions: Google Chrome/Chromium versions 154–156 Privileges Gained: SYSTEM Price: $10,000 The author claims to be selling an exploit for Chromium-based browsers that allows remote execution of arbitrary code, bypasses the browser’s isolation mechanisms (Sandbox Escape), and can potentially grant SYSTEM-level privileges on Windows 10 and 11 operating systems. According to the seller, a successful attack requires only that the victim visit a specially crafted web page or download malicious content. The exploit uses an exploit chain that includes code execution within the browser’s rendering process (Renderer RCE) and subsequent sandbox escape via the Mojo/IPC mechanism. No additional user interaction is required. The author claims that the tool is compatible with Google Chrome/Chromium versions 154–156 and has been tested on Windows 10 22H2, as well as Windows 11 23H2, 24H2, and 25H2. It is claimed that the tool can execute malicious code directly in RAM without needing to write files to disk. The chain uses JavaScript and native shellcode, and also includes a core component for communicating with the command-and-control (C2) server.

CVE-2026-94134 and CVE-2026-94135: Apache Airflow disables SSH host key verification by default Read on dbugs: dbu.gs/news/cve-2026-94134-a… OX Security researchers discovered that Apache Airflow's SSH and SFTP providers disable SSH server host key verification by default. This allows an attacker positioned between an Airflow worker and the target server to perform a man-in-the-middle (MITM) attack, intercept or modify session data, and potentially capture credentials. Normally, an SSH client verifies the server's public host key against a trusted key. On the first connection, the key may be stored for subsequent verification, depending on the client's configuration. Airflow uses "Paramiko" for synchronous SSH connections but defaults to "AutoAddPolicy", which automatically accepts previously unknown host keys. The warning about disabled verification appears only in the task log after the connection has been established, not in the Airflow UI. • CVE-2026-94134 (dbu.gs/vulnerability/CVE-202…) affects "SSHHook" and synchronous SFTP connections. In "SSHHook", "no_host_key_check" defaults to "True". In "SFTPHook", when "no_host_key_check" is absent from the connection's "Extra" settings, the provider also defaults to disabling verification by setting "known_hosts="none"". An attacker who intercepts the connection can impersonate the SSH server, inject command output, modify transferred files, or redirect data to attacker-controlled storage. Credential exposure depends on the authentication method and connection configuration. • CVE-2026-94135 (dbu.gs/vulnerability/CVE-202…) affects the asynchronous SFTP path. "SFTPHookAsync", "SFTPTrigger", and "SFTPClientPool" use "asyncssh" and pass "known_hosts=None" when host key verification is not explicitly enabled. Deferrable SFTP operators that use this asynchronous path are also affected. Exploitation requires the attacker to intercept or redirect traffic between the Airflow worker and the target server. Possible attack positions include ARP spoofing on a shared subnet, compromise of a network device, manipulation of routing within a cloud VPC, or BGP hijacking for internet-facing targets. The affected packages are "apache-airflow-providers-ssh" and "apache-airflow-providers-sftp", through version 6.0.1. Both issues were fixed in version 7.0.0 of the respective providers. As a temporary mitigation, administrators can explicitly set "no_host_key_check=false" and configure a trusted "host_key" for affected connections. If a trusted key is not configured, the connection may fail rather than silently accepting an unknown server key. Article: ox.security/blog/by-default-… PoC (CVE-2026-94134): github.com/MosesOX/POC-CVE-2… CVE-2026-94134 — PT-2026-115311: dbu.gs/vulnerability/PT-2026… CVE-2026-94135 — PT-2026-115312: dbu.gs/vulnerability/PT-2026…