CVE-2026-14620
webpack-dev-server versions 5.2.5 and earlier expose two internal developer endpoints,
webpack-dev-server versions 5.2.5 and earlier expose two internal developer endpoints,
/webpack-dev-server/open-editor and /webpack-dev-server/invalidate, that perform state-changing actions on any GET request without verifying that the request originated from the dev server's own page. Any website a developer visits while the dev server is running can trigger these endpoints cross-origin with no interaction beyond the visit. An attacker can open an arbitrary existing local file in the developer's editor, including files outside the project root, and repeated requests can spawn editor processes and force recompilations that degrade the developer's machine. Patches: upgrade to webpack-dev-server 5.2.6. Workarounds: none.BareMetal RAM Dumper – Bare-metal x86 tool for Cold Boot Attack experiments
Article, Comments
Article, Comments
This tool was originally developed and successfully tested for experimenting with Cold Boot Attacks. By freezing a laptop's RAM (down to -60°C) and quickly rebooting from a USB drive containing this tool, it is possible to dump the frozen memory contents to the disk before the data decays, allowing for the extraction of sensitive information like encryption keys.
This tool writes raw data directly to the boot drive starting at Sector 64! If you write this to a USB drive containing important data, the RAM dump will overwrite whatever is present at LBA 64 and beyond. Use a dedicated, blank USB flash drive for this purpose.
GitHub
GitHub - pIat0n/BareMetal-RAM-Dumper: A bare-metal x86 utility to dump physical RAM directly to disk. Built and tested for Cold…
A bare-metal x86 utility to dump physical RAM directly to disk. Built and tested for Cold Boot Attack experiments on frozen memory. - pIat0n/BareMetal-RAM-Dumper
CVE-2026-45045: GoFiber is vulnerable to
Affected versions: <= 2.52.13 and <= 3.2.0
The
Data flow:
1. Attacker sends request with
2.
3.
4. Upstream server receives:
5. Most HTTP servers (nginx, Node.js, Apache) read the FIRST value
6. Upstream uses
X-Real-IP Spoofing via Header.Add() call in BalancerForwardAffected versions: <= 2.52.13 and <= 3.2.0
The
BalancerForward proxy helper in GoFiber uses Header.Add() instead of Header.Set() when injecting the X-Real-IP header. This appends the real client IP as a second header value rather than replacing any attacker-supplied value. Upstream servers that read the first X-Real-IP header (nginx, Express, most HTTP servers) use the attacker's spoofed IP for logging, rate limiting, and access control.Data flow:
1. Attacker sends request with
X-Real-IP: 10.0.0.1 (spoofed internal IP)2.
BalancerForward handler executes at line 2823.
c.Request().Header.Add("X-Real-IP", c.IP()) APPENDS the real IP as a second header4. Upstream server receives:
X-Real-IP: 10.0.0.1 AND X-Real-IP: <real-attacker-ip>5. Most HTTP servers (nginx, Node.js, Apache) read the FIRST value
6. Upstream uses
10.0.0.1 for all IP-dependent logicYesterday, we made GPT-5.6 Sol Ultra generally available. Today, we're sharing that it produced a proof of the 50-year-old Cycle Double Cover Conjecture using 64 subagents in just under one hour. We're sharing the prompt and proof below. We're excited to see what you all do with Ultra!
Posted by Ethan Knight, 2 hours ago
see: https://t.me/DoItByCode/1858
Posted by Ethan Knight, 2 hours ago
see: https://t.me/DoItByCode/1858
GPT-5.6 Sol overtakes Fable 5 on VoxelBench
the highest scoring model yet with over 1k votes!
Posted by Voxelbench, 7 minutes ago
the highest scoring model yet with over 1k votes!
Posted by Voxelbench, 7 minutes ago
😱1
Linus jogou a real: AI é útil e vai ser usada no desenvolvimento do kernel Linux, quem achar ruim pode fazer fork e vazar
Posted by Gustavo Noronha, 9 hours ago
source
Posted by Gustavo Noronha, 9 hours ago
source
CVE-2026-63030:
WordPress RCE: REST API batch-route confusion and SQL injection issue leading to Remote Code Execution (severity: critical)
CVE-2026-60137:
Facilitated SQL injection vulnerability in the
PoCs so far:
- Icex0/wp2shell-poc (no actual rce, pretty useless)
- dinosn/wp2shell-lab
- codeb0ssx/Ultimate-wp2shell
WordPress RCE: REST API batch-route confusion and SQL injection issue leading to Remote Code Execution (severity: critical)
WordPress versions 6.9 and higher are vulnerable to a REST API batch-route confusion weakness, which combined with an SQL injection issue (GHSA-fpp7-x2x2-2mjf) leads to Remote Code Execution.
WordPress versions 7.0.2, 6.9.5, and 7.1 beta2 have been released, containing fixes for the vulnerability.
Due to the severity of the vulnerability it is recommended that you update your sites immediately.
Discovered and responsibly disclosed by Adam Kues at Assetnote / Searchlight Cyber.
CVE-2026-60137:
Facilitated SQL injection vulnerability in the
author__not_in parameter of WP_QueryWordPress versions 6.8 and higher are vulnerable to an SQL injection issue.
In WordPress versions 6.9 and higher, this combined with a REST API batch-route confusion issue (GHSA-ff9f-jf42-662q) leads to Remote Code Execution.
WordPress versions 7.0.2, 6.9.5, 6.8.6, and 7.1 beta2 have been released, containing fixes for the vulnerability.
Due to the severity of the vulnerability it is recommended that you update your sites immediately.
Discovered and responsibly disclosed as a team by TF1T, dtro, and haongo.
PoCs so far:
- Icex0/wp2shell-poc (no actual rce, pretty useless)
- dinosn/wp2shell-lab
- codeb0ssx/Ultimate-wp2shell
Cloudflare deployed WAF protections for 2 critical WordPress vulns before public release: unauthenticated RCE + SQLi.
If your WordPress traffic is proxied through Cloudflare, the new rules help reduce exposure while you patch. Fixes are in 7.0.2, with backports to 6.9.5, 6.8.6, and 7.1 Beta 2.
Patch anyway. WAF is not a substitute for updating.
https://cfl.re/4yrOFNH
Posted by Cloudflare, 3 hours ago
If your WordPress traffic is proxied through Cloudflare, the new rules help reduce exposure while you patch. Fixes are in 7.0.2, with backports to 6.9.5, 6.8.6, and 7.1 Beta 2.
Patch anyway. WAF is not a substitute for updating.
https://cfl.re/4yrOFNH
Posted by Cloudflare, 3 hours ago
https://en.wikipedia.org/wiki/Jacobian_conjecture
Posted by levent, 1 hour ago
hello there the jacobian conjecture is false thanx to my close friend akhil for asking about it and my other close friend fable for working during the world cup final
((1+xy)^3 z + y^2 (1+xy) (4+3xy), y + 3 x (1+xy)^2 z + 3 x y^2 (4+3xy), 2 x - 3 x^2 y - x^3 z): \C^3\to \C^3, has jacobian determinant -2, and sends (0, 0, -1/4), (1, -3/2, 13/2), and (-1, 3/2, 13/2) to (-1/4, 0, 0)
Posted by levent, 1 hour ago
This media is not supported in your browser
VIEW IN TELEGRAM
Last year we announced a partnership with Epic Games to bring Unity to Fortnite - and today, we want to show you where we are.
This is Fantasy Kingdom: a Unity game rendering natively inside @UnrealEngine. Physics, lighting, input: all synchronized between engines🎮👇
🔗 Want to try it out for yourself? Fill out our interest form to be considered for early access: https://on.unity.com/Fortnite_InterestForm
Posted by Unity, 1 hour ago
Media is too big
VIEW IN TELEGRAM
Introducing Happy Oyster, the groundbreaking real-time world model from @HappyOysterAI, live today on Reactor!
Explore any world you can imagine, or take the director's chair and shape the story as it happens.
Available via API.
Try it now: http://reactor.inc/happy-oyster
Posted by reactor, 10 hours ago
CVE-2026-11144
CVE-2026-11136
Use after free in Media in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted video file. (Chromium security severity: Medium)
CVE-2026-11136
Use after free in Canvas in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)
Do It by Code
TOCTOU
TOCTOU: time-of-check to time-of-use
It's a race condition that happens between "checking" and "using" something
this is a common and simple example of it:
where
since this is a purely logical race, race detectors tool usually can't detect it
The fix is to do the entire check + use with a single lock, e.g:
whereas the
It's a race condition that happens between "checking" and "using" something
this is a common and simple example of it:
cacheData := cacheMap.Get(key)
if cacheData == nil {
cacheData = &BinanceDepthCachedData{
Coin: key,
LastUsedAt: time.Now(),
}
cacheMap.Add(key, cacheData)
}
where
Get and Add are atomic (they have a lock in them to prevent concurrent operations); however the entire operation itself is not atomic:Goroutine A: Get → nil
Goroutine B: Get → nil
Goroutine A: Add(objectA)
Goroutine B: Add(objectB)
since this is a purely logical race, race detectors tool usually can't detect it
The fix is to do the entire check + use with a single lock, e.g:
mut := hlInfoReqMutexes.GetOrCreateDefault(mutKey)
mut.Lock()
defer mut.Unlock()
whereas the
GetOrCreateDefault (or GetOrCreate(key, lambda)) use a single lock operation