Today we're launching cve.now 🚨

Yesterday was a rough day for security. php2shell, LiteLLM, Railway... How are we supposed to stay on top of all of this?

cve.now aggregates 4 vulnerability sources into one free feed and uses AI to explain each one in plain English. No login.

cve.now

The last 48 hours have been unusually intense for web infrastructure security.

- And a major bank confirmed limited customer data exposure on.
- Governments are advising: patch now or take systems offline.

🚨 Node2Shell: RCE in the spotlight.

Researchers demonstrated code execution using crafted Brotli data against vulnerable Node.js applications—even with an official Node.js build.

A reminder that trusted runtimes don't guarantee application security. 🔐


https://x.com/lucifer0xf_/status/2113590157370880063

🚨 CVE-2026-48907 — JoomlaSniper v1.0 released

Unauthenticated RCE in Joomla JCE Editor (≤2.9.99.4)
CVSS 10.0 • Affects ALL production versions

File upload → PHP execution in /tmp/ — no auth required

🔗 http://github.com/ynsmroztas/JoomlaSniper

Tool features:

✅ Dual vector (tmp/ + JCE browser)
✅ Interactive shell
✅ Zero dependencies (stdlib only)
✅ Pipeline: subfinder | httpx | JoomlaSniper
✅ Multi-function fallback (shell_exec → system → passthru)
✅ Auto store code detection

Fixed in JCE 2.9.99.5

Quick test:

python3 http://JoomlaSniper.py -u http://target.com --shell

Subdomain tarama:

subfinder -d http://target.com | httpx -silent | python3 http://JoomlaSniper.py

#BugBounty #InfoSec #RedTeam #AppSec #bugbountytip #bugbountytips #infosec #recon

FREE DOMAIN FOR 1 YEAR. NO CARD NEEDED

you can get a free domain for your next side project, portfolio or AI app

what you get:

- free .my.id, .biz.id or .web.id domain
- 1 full year for $0
- no credit card required

how to claim:

1. go to: order.idwebhost.com/domain-gratis
2. sign up or log in with Google
3. search for your domain
4. apply code "Mt5m-22okw" at checkout

limited quota, ends oct 25

renewal is paid after the first year, so keep that in mind

FREE .TECH DOMAIN FOR 1 YEAR 🤯

get example.tech for $0 through Hacktoberfest

how to claim

1. go to hacktoberfest.com/my/promos
2. sign in with MyMLH and verify your phone
3. find the .tech domain offer and get your code
4. go to get.tech and search your domain
5. apply the code at checkout

important
• turn off auto-renew to avoid the $29.99 yearly renewal
• one code per person
• SMS verification may not work for every number
• codes may run out, so claim early

WTF... Who made this 😂

THE OVEN IS HEATING UP

370 exposed sites and counting

the $COOKED Oven now tracks the number of sites flagged by our scanner

the web keeps changing, so keep checking

https://ismysitecooked.xyz

Evolving threat CVE-2026-111497, previously known to affect Node.js (node2shell) and Python has evolved into “HTTP2Shell.”

A significant blast radius.

This vulnerability leaves many libraries and applications using HTTP vulnerable to pre-auth RCE via Brotli decompression.

Please be aware. Fixes not yet available for all affected services. Look for Brotli (1.2.1) dependency upgrades when they become available.