Can HTTP/3 really give you 100k requests per second for content discovery? We tested it in a fork of ffuf and are releasing h3fuzz, a web UI for fuzzing.

A network named IgnoreAllPreviousInstructions got an AI search summary to write a poem. A home PTR tells AI agents to attack whoever sent them.

FortiSIEM CVE-2026-106173: Horizon3 analyzes how an unauthenticated gRPC service enables path traversal, arbitrary file writes, and remote code execution.

TLDR AI made finding bugs cheap. It did nothing to make getting paid for them any easier. The same bug now gets found by ten different people inside a fortnight. One of them collects the money. The other nine collect a polite duplicate notice and a dent in…

Free hosted CertStream API. Stream new TLS certificates and domain names in real time over WebSocket. No API key or sign-up. Works with certstream clients.

OffiDocs runs 60 Chrome extensions with 2.3M installs across 4 publisher accounts, mostly everyday office tools. 37 of them hex-encode and exfiltrate every full URL you visit, with no explicit consent, under privacy policies that allow sharing with business…

A post attributed to watchTowr names two PHP RCE vulnerabilities, but their existence, affected versions and patch status could not be independently confirmed.

This research documents my development of payloads for the CVE-2026-46633. - CVE-2026-46633 writeup.md

IPinfo scans reveal that 85% of exposed French refrigeration controllers had known security flaws before the October 2026 cyberattack.

CVE-2026-109618 FAQ: affected PHP versions, fixes and more - updated as details emerge.

PHP is a popular general-purpose scripting language that powers everything from your blog to the most popular websites in the world.

Introduction

uCreater (the vendor's own name for the product is YingGai) is a commercial Android surveillance platform built around 群控 (“mass control”). Branded through packages in the com.ucreator.* namespace, it is not a single malware family but a productized…

The PHP2Shell leak got the severity right and most details wrong: an out-of-memory error turned into RCE, and the real stopgap went unmentioned.

PHP2Shell (CVE-2026-109618, CVE-2026-109619) is a critical unauthenticated PHP RCE. What the two bugs are, how to patch, and what ELLIO's sensors recorded on disclosure day.

Gallery of websites shut down by the October 2026 PHP vulnerabilities.

PHP's phprequeststartup() function reaches two consecutive calls in main/main.c. Line 1942 calls phphashenvironment(). Line 1943 calls zendactivatemodules().

October 21, 2026 If your website runs on PHP, check your version today. The PHP security team released emergency fixes this morning for two critical vulnerabilities, and attack tools are already circulating online. The fix: update to PHP 8.5.12, 8.4.27, 8.3.36…

No scheduled tasks. No registry keys. Just a RAT hidden behind 200 spaces in the tools developers use every day, with a Python stager…

Describing the story behind how critical security vulnerabilities were found and fixed.