News · r/netsec

• r/netsec 20 Oct

  Free real-time Certificate Transparency stream, no API key

  r/netsec · certstream.dev
• r/netsec 20 Oct

  All vulnerabilities are now race conditions

  r/netsec · blog.himanshuanand.com
• 
  r/netsec 20 Oct

  How I got over 300 Tor exit nodes removed

  r/netsec · kaba.cx
• 
  r/netsec 20 Oct

  CVE-2026-106173 Deep-Dive: Fortinet FortiSIEM gRPC Path Traversal File Write to RCE

  r/netsec · horizon3.ai

  CVE-2026-106173
• 
  r/netsec 20 Oct

  Prompt injection, XSS and SIEM-exfil payloads living in reverse DNS, plus 28 fake Googlebots that passed FCrDNS

  r/netsec · ellio.tech
• 
  r/netsec 20 Oct

  How practical is 100k requests per second? Introducing h3fuzz

  r/netsec · slcyber.io
• 
  r/netsec 20 Oct

  Unauthenticated SQL injection in GLPI (≤ 11.0.8)

  r/netsec · mobeta.fr
• 
  r/netsec 19 Oct

  An attack that corrupts a LLM model about one specific fact - no file changes, no process, no network. Nothing to scan, and you can still detect.

  r/netsec · stealthium.io
• 
  r/netsec 19 Oct

  CVE-2026-108097 Deep Dive: Turning a Drupal Field UI Callback Into RCE

  r/netsec · fortbridge.co.uk

  CVE-2026-108097
• 
  r/netsec 19 Oct

  abuse list for ips · NicheDB

  r/netsec · nichedb.dev
• 
  r/netsec 18 Oct

  PhantomBuffer: Effective EDR Evasion Through Stealth Injection

  r/netsec · zerosalarium.com
• r/netsec 16 Oct

  New web obfuscation technique where even just formatting rewrites script logic (Chromium DevTools, prettier, WebCrack, Terser and more)

  r/netsec · trustsig.eu
• 
  r/netsec 16 Oct

  Deep-Dive into Android Binder UaF (CVE-2023-20938) using Time-Travel Debugging

  r/netsec · eshard.com

  CVE-2023-20938
• 
  r/netsec 16 Oct

  Nadella Calls Your AI an Insider Risk. Lawmakers Already Put Your Name on the Liability Certification.

  r/netsec · galratner.substack.com
• 
  r/netsec 16 Oct

  16% of RPKI-covered IPv4 routes still allow a forged-origin hijack that passes validation, the setup behind the Virtualizor update attack

  r/netsec · ipinfo.io
• 
  r/netsec 16 Oct

  CVE-2026-108082: Symfony ReDoS. One request. Seconds of CPU

  r/netsec · r3verii.github.io

  CVE-2026-108082
• 
  r/netsec 16 Oct

  The Cloudflare Appstore (Appflare) Malware Audit

  r/netsec · mainbrella.com
• r/netsec 16 Oct

  Web Environment Integrity vs. Private Access Tokens - They're the same thing!

  r/netsec · snellman.net
• 
  r/netsec 16 Oct

  PwnEscape: Guest-to-Host KVM Escape (CVE-2026-99999)

  r/netsec · pwn.ai

  CVE-2026-99999
• 
  r/netsec 15 Oct

  Exposing AdFection: How Discover-Tech Turned Targeted Ads Into a Pipeline for Zero-Click Mercenary Spyware

  r/netsec · citizenlab.ca
• 
  r/netsec 15 Oct

  Trivy and govulncheck found the same vulnerability, but the code wasn't in the binary

  r/netsec · a3thinker.it
• 
  r/netsec 14 Oct

  Anthropic's Sept 2026 threat report: attackers prompt-injected an eval sandbox, stole customer API keys, then burned the victims' own compute to attack ~30 AI labs

  r/netsec · anthropic.com
• 
  r/netsec 14 Oct

  AhsayCBS Deep-Dive: Auth Bypass to RCE

  r/netsec · horizon3.ai
• 
  r/netsec 14 Oct

  [email protected]: A Worm With Valid Provenance, and the Firewall Rule That Stops It

  r/netsec · hextrap.io
• r/netsec 14 Oct

  Vghost (CVE-2026-74580): Linux kernel vhost stale IOTLB cache leading to universal LPE and Guest-to-Host escape vector

  r/netsec · openwall.com

  CVE-2026-74580
• 
  r/netsec 13 Oct

  Passkeys are a trap

  r/netsec · nonfunctional.substack.com
• 
  r/netsec 13 Oct

  We Let AI Fuzz Adobe Reader for a Week. It Found a Critical Zero-Day CVE-2026-81983

  r/netsec · remedio.io

  CVE-2026-81983
• r/netsec 13 Oct

  Playing It SFAPE: Code Execution in Isolated User Mode

  r/netsec · blog.doyensec.com

  CVE-2026-83498
• 
  r/netsec 12 Oct

  CVE-2026-91768: FastCGI allowed_clients compared only 96 of an IPv6 address's 128 bits

  r/netsec · daubois.dev

  CVE-2026-91768
• r/netsec 12 Oct

  LG webOS sync-demo Preauth RCE

  r/netsec · ssd-disclosure.com
• 
  r/netsec 12 Oct

  Google paid me $90,000 for this RCE

  r/netsec · simonkoeck.com
• 
  r/netsec 12 Oct

  Telegram Desktop vulnerability allowed any user file to be stolen

  r/netsec · beaksec.github.io
• 
  r/netsec 10 Oct

  A story of wifi secrets, UART lockdowns and a damaged flash memory chip

  r/netsec · adepts.of0x.cc
• 
  r/netsec 10 Oct

  GitHub Actions leaking secrets when Miri output is cached

  r/netsec · blog.rust-lang.org
• 
  r/netsec 10 Oct

  Smashing the token limit with overlapping fragments (CSS injection token exfiltration, PortSwigger Research)

  r/netsec · portswigger.net
• 
  r/netsec 9 Oct

  Death By A Thousand PaperCuts (PaperCut Pre-Auth RCE Chain and Patch Bypasses WT-2026-0141-0144/CVE-2026-82077/CVE-2026-82078/CVE-2026-81578) - watchTowr Labs

  r/netsec · labs.watchtowr.com

  CVE-2026-82077, CVE-2026-82078, CVE-2026-81578
• 
  r/netsec 8 Oct

  A JPEG, a Race, and a Ghost: Breaking Discourse's Image Pipeline

  r/netsec · slcyber.io
• 
  r/netsec 8 Oct

  How We Found Thousands of Exposed NVIDIA GPUs and a Way to Disrupt Them (CVE-2026-47483)

  r/netsec · lava.security

  CVE-2026-47483
• 
  r/netsec 8 Oct

  Loupe: An Android Console in the Browser

  r/netsec · captmeelo.com
• 
  r/netsec 8 Oct

  A Single POST Freezes Any Next.js Server

  r/netsec · simonkoeck.com
• r/netsec 8 Oct

  I found yet another way to invoke JavaScript functions without parentheses

  r/netsec · blog.ikaes.de
• 
  r/netsec 7 Oct

  CVE-2026-102489 Deep-Dive: Zammad Session Leak to RCE

  r/netsec · horizon3.ai

  CVE-2026-102489
• 
  r/netsec 6 Oct

  You Won’t Hear About These, Even In Myths (Atlassian Jira, Confluence (and more) Pre-Auth Arbitrary File Read CVE-2026-21589) - watchTowr Labs

  r/netsec · labs.watchtowr.com

  CVE-2026-21589
• 
  r/netsec 6 Oct

  Teaching network intrusion in the funnest way possible

  r/netsec · store.steampowered.com
• 
  r/netsec 5 Oct

  Wordpress libheif RCE

  r/netsec · fortbridge.co.uk
• 
  r/netsec 5 Oct

  Open Build Service, one year later: command execution through Mercurial argument injection

  r/netsec · fenrisk.com
• r/netsec 4 Oct

  How to Hack Time, With C2PA

  r/netsec · da.vidbuchanan.co.uk
• 
  r/netsec 3 Oct

  RCE and bad crypto in Internxt's 'post-quantum' cloud storage

  r/netsec · schaerli.org
• r/netsec 3 Oct

  A peek into Reddit's anti-spam internals

  r/netsec · lyra.horse
• 
  r/netsec 2 Oct

  security.txt on the Czech web: Scanning 1k popular .cz domains

  r/netsec · vavkamil.cz

Older