All notes

← Home

  1. Claude Code Exposes Thousands of Secrets on GitHub

    A security investigation by Apiiro has uncovered thousands of exposed credentials linked to Anthropic’s Claude Code. The issue stems from the “Yes, and don’t ask again” permission feature, which can store complete shell commands in .claude/settings.local.json. When these commands contain hardcoded passwords, API keys, or database credentials, sensitive data may end up in public GitHub […]

  2. Windows Paint Has a Security Fix, but You Won’t Find It in Windows Update

    Microsoft has quietly patched a serious security hole in Paint, the drawing app that ships with Windows. The fix, however, doesn’t arrive through the usual Windows Update channel — users need to grab it from the Microsoft Store instead. The vulnerability, tracked as CVE-2026-83844, could let an attacker execute code remotely, earning it an “Important” […]

  3. Deploying ModSecurity WAF in Front of IIS Using Nginx

    Adding a WAF to an existing IIS infrastructure doesn’t necessarily require changing the web servers or applications. In this setup, an Ubuntu server running Nginx, ModSecurity v3, and OWASP Core Rule Set (CRS) was deployed between the firewall and internal IIS servers. Architecture The firewall forwards incoming web traffic to the Nginx gateway. Nginx uses […]

  4. Critical Linux Kernel Flaw Could Allow Unauthenticated Remote Root Access

    A critical vulnerability in the Linux kernel, tracked as CVE-2026-98432, could allow remote attackers to execute arbitrary code with root privileges on vulnerable systems without authentication or user interaction. Rated CVSS 9.8 (Critical), the flaw is a use-after-free vulnerability in the kernel’s IPv4 TCP networking subsystem. It affects Linux kernels dating back to version 4.4 […]

  5. Hackers Are Actively Exploiting a Critical Drupal Commerce Vulnerability

    A highly critical security vulnerability in Drupal Commerce Core is being actively exploited in the wild, putting online stores at risk of unauthorized access and potential financial losses. Tracked as CVE-2026-118539, the flaw stems from missing authorization checks that allow attackers to bypass access controls on certain routes and entity fields. Drupal has rated the […]

  6. ChatGPT Share Link Flaw Could Expose Private Conversations

    A security vulnerability in ChatGPT’s shared conversation feature could have allowed attackers to execute JavaScript code within a victim’s authenticated session and access private chat histories. Discovered by security researchers at Parameter, the flaw could be exploited through a specially crafted ChatGPT sharing link. In the most advanced version of the attack, simply opening the […]

  7. Brotli2Shell: Critical Vulnerability in Google Brotli (CVE-2026-111497)

    A critical security vulnerability tracked as CVE-2026-111497, also known as Brotli2Shell, has been discovered in Google’s Brotli decompression library. The flaw is an out-of-bounds write vulnerability that can lead to memory corruption, information disclosure, denial of service, and potentially arbitrary code execution when processing malicious Brotli-compressed data. The vulnerability affects multiple platforms and software products, […]

  8. PHP RCE Alert: CVE-2026-115560

    PHP has disclosed another potential Remote Code Execution (RCE) vulnerability, tracked as CVE-2026-115560, involving Session Upload Progress handling. The vulnerability requires an unusual combination of session serialization settings and application code, but could allow remote code execution under specific conditions. Immediate Mitigation: Disable Session Upload Progress in PHP configuration: session.upload_progress.enabled = Off This disables upload […]

  9. PHP2Shell: Two Critical RCE Vulnerabilities Affect PHP Servers

    Two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, have been disclosed in PHP, potentially allowing unauthenticated attackers to execute arbitrary code on vulnerable servers. Tracked as PHP2Shell, both flaws affect PHP’s internal memory management and can put internet-facing PHP applications at serious risk. Fixed versions: PHP 8.5.12 PHP 8.4.27 PHP 8.3.36 PHP 8.2.35 Administrators should update affected […]