Vulnerability-disclosure is a topic tracked in our intelligence system with 5 linked articles.
Security firm FoxIO disclosed unauthenticated QPACK flaws in HTTP/3 that let a single remote connection crash servers via up to 4,000-fold memory amplification, with working proof-of-concept code released.
Two CVSS 9.0 remote code execution flaws in the Linux kernel's built-in KSMBD SMB server (ZDI-CAN-33774 and ZDI-CAN-33549) were disclosed publicly on mailing lists before any mainline kernel fix exists, with one exploitable pre-authentication.
Amazon's Threat Intelligence team says it detected exploitation attempts against the newly disclosed PHP2Shell vulnerabilities on its MadPot honeypot four days before public disclosure, with the flaws now under broad in-the-wild exploitation.
Public exploit details for a pre-auth RCE in unpatched vBulletin; affects versions up to 6.2.1 and 6.1.6, executable via unauthenticated PHP eval() calls on unpatched servers; exploit details disclosed on July 27.
OAuth parameter injection vulnerability in auth0/nextjs-auth0, plus AI-generated commit attribution and a controversial disclosure stance, highlighting governance and compliance risk for vendor security handling.
Curl reportedly won't accept vulnerability reports during July 2026.
Subscribe for real-time topic updates and unlimited access to our intelligence platform.