Vulnerability & exploit intelligence CVE • EPSS • KEV • Exploit Evidence Prioritize what matters now. Know Before They Strike. https://xitter.cf/t.co/zbz8DJisKw
Joined June 2026
- Tweets1.4K
- Following36
- Followers433
- Likes438
ExploitGrid retweeted
Some more updates, github.com/GoldraK/php2shell… , implements chain_e, which was first reported from jackalsyn. This works on a lab for the patched releases. Verify on your end always under a lab env.
ExploitGrid retweeted
An impressive disclosure from Alessandro Fanio Gonzalez targeting Chroma with a 2 N-days & 1 collision in the AI Infrastructure category for a net total win of $4,500 and 1 Master of Pwn points #Pwn2Own
ExploitGrid retweeted
🚨 PoC RELEASED: Technical details and a public PoC are now available for CVE-2026-43682, a critical macOS HFS+ kernel heap overflow.
The vulnerability carries a CVSS 9.8 and can allow a remote user to trigger unexpected system termination or corrupt kernel memory.
⚠️ Affected:
• macOS Tahoe < 26.6
• macOS Sequoia < 15.7.8
• macOS Sonoma < 14.8.8
🔴 Apple patched the vulnerability in July. If you haven’t updated, patch now.
PoC: github.com/petermalone/CVE-2…
Source: Apple Security Advisory
#CVE #CyberSecurity #InfoSec #Apple #macOS
ExploitGrid retweeted
🚨 PoC RELEASED: A public PoC is now available for CVE-2026-94545, a critical Next.js RCE vulnerability in the Node.js implementation of ImageResponse (CVSS 9.5).
An unauthenticated attacker can inject crafted SVG markup through attacker-controlled values, potentially leading to arbitrary code execution with the privileges of the Next.js server process.
⚠️ Affects Next.js 16.2.0–16.3.5.
🔴 Fixed in Next.js 16.3.6. Update immediately.
PoC: github.com/EQSTLab/CVE-2026-…
Source: github.com/vercel/next.js/se…
#CVE #CyberSecurity #InfoSec #NextJS #NodeJS
ExploitGrid retweeted
🚨 101 malicious npm packages can quietly add WhatsApp accounts to groups without consent.
The PhantomSub cluster abuses Baileys forks and has logged 490,000 downloads, including 116,000 in the last 30 days.
Read: thehackernews.com/2026/09/10…
ExploitGrid retweeted
🚨 Citrix NetScaler 0-Day RCE Vulnerabilities Actively Exploited in Attacks
Source: cybersecuritynews.com/citrix…
Citrix NetScaler administrators are confronting reports of two undisclosed remote code execution vulnerabilities allegedly exploited in real-world attacks.
watchTowr said the flaws are unpatched zero-days, were identified during forensic investigations, and that Citrix communications and fixes are expected early next week.
However, Citrix had not published technical details, CVE identifiers, affected builds, indicators of compromise, or an advisory for these reported flaws at the time of writing, leaving defenders to make high-impact decisions with limited verified information. The warning began with reports that multiple unpatched NetScaler RCE vulnerabilities were circulating in the wild.
#cybersecuritynews
ExploitGrid retweeted
‼️ WARNING — Citrix NetScaler is facing two unpatched RCE 0-days under active exploitation.
Researchers at watchTowr say the flaws are being exploited in the wild. Citrix has not confirmed them or released a patch, affected-version guidance, workaround, or indicators of compromise.
What defenders should know now: thehackernews.com/2026/09/wa…
ExploitGrid retweeted
We are currently rapidly reacting to rumors that multiple unpatched Citrix NetScaler RCE vulnerabilities are circulating in the wild. While details are scarce, the information is credible.
watchTowr Platform clients have been made aware of their Citrix NetScaler exposure.
ExploitGrid retweeted
Windows Privilege Escalation: SeManageVolumePrivilege hackingarticles.in/windows-p…
ExploitGrid retweeted
⚠️ Elementor CSRF flaw can create a rogue WordPress admin account when an administrator opens a crafted link.
The bug affects 4.3.0 and 4.3.1, bypasses CSRF protection across the site's REST API, and is fixed in 4.3.2.
Here's how it works: thehackernews.com/2026/09/el…
ExploitGrid retweeted
‼️BREAKING: An actively exploited unknown critical Citrix NetScaler zero-day has prompted governments and organizations to SHUTDOWN all their devices immediately.
We don't know what's exactly going on yet. Stay tuned for more info.
ExploitGrid retweeted
‼️ Attackers are exploiting a SharePoint flaw that Microsoft says can enable remote code execution.
CISA also flagged a MikroTik RouterOS flaw used in a chain that gives unauthenticated attackers full admin access to vulnerable routers.
Learn how the two attack paths work: thehackernews.com/2026/09/sh…
ExploitGrid retweeted
2ez. CVE-2026-62062 - WordPress - Elementor Website Builder - High 8.8 - CSRF to Administrator Account Creation.
exploit...
github.com/abraxas/CVE-2026-…
ExploitGrid retweeted
CISA publishes framework for improving CVE program as vulnerability counts rise scworld.com/news/cisa-publis…
ExploitGrid retweeted
A PoC/exploit has been discovered for vulnerability CVE-2026-94127
PT ID: PT-2026-96761
Vendor: F5
Product: BIG-IP
Description: When a BIG-IP APM access policy and an OAuth profile are configured on a virtual server, specific malicious traffic can lead to remote code execution (RCE). This vulnerability is only present when BIG-IP APM is configured as an OAuth Authorization Server. Deployments using APM strictly as an OAuth Client / Resource Server (without OAuth authorization server profiles configured) are not affected by this vulnerability.
Impact:
This vulnerability allows an unauthenticated attacker to perform remote code execution. The BIG-IP system in Appliance mode is also vulnerable. This is a data plane issue; there is no control plane exposure.
References:
• dbu.gs/vulnerability/PT-2026…
• github.com/watchtowrlabs/wat…
ExploitGrid retweeted
A PoC/exploit has been discovered for vulnerability CVE-2026-93485
PT ID: PT-2026-95257
Vendor: Automattic
Product: WordPress
Description: Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Automattic WordPress core allows DOM-Based XSS.
The Unauthenticated Stored XSS vulnerability in the WordPress core can be reproduced on a default WordPress installation. Comment moderation is disabled by default, and the requirement for commenters to have a previously approved comment can be bypassed.
References:
• dbu.gs/vulnerability/PT-2026…
• github.com/deathshotxd/comme…
ExploitGrid retweeted
🚨 BITGET CONFIRMS ~$351.6M HOT/WARM WALLET INCIDENT (SEP 24)
Crypto exchange Bitget published an official Security Notice stating that at 18:31 UTC on September 24, 2026 its security systems detected unauthorized transfers from some hot wallets.
What Bitget confirmed:
• Estimated funds affected: approximately $351.6 million
• Breach contained to portions of the hot and warm wallet layers
• Cold wallets remain fully secure (three-tier wallet architecture)
• Loss covered by Bitget’s User Protection Fund (fund >$464 million)
• Withdrawals temporarily suspended pending security review
• Deposits and trading remain operational
• Law enforcement and on-chain security firms notified
⚠️ Analyst Note:
This is an official Bitget disclosure. Prefer the primary Security Notice over secondary media.
Bitget’s notice explicitly says it will not speculate on the attack vector until the investigation is complete. Separate preliminary media / CEO remarks have discussed possible North Korea / Lazarus links (including on-chain XRP flow commentary) — treat those as unconfirmed attribution unless Bitget or a government agency formally confirms. Do not frame Lazarus (or any actor) as proven solely from secondary reporting.
Official Bitget Security Notice:
bitget.com/support/articles/…
#DDW #DarkWeb #Bitget #Crypto #ExchangeSecurity #ThreatIntelligence #CyberSecurity
ExploitGrid retweeted
A PoC/exploit has been discovered for vulnerability CVE-2026-94128
PT ID: PT-2026-96033
Vendor: BioStar
Product: VIVID LED DJ
Description: A security vulnerability has been detected in BioStar VIVID LED DJ 4.0.2411.1500. This affects the function sub_1105C of the file BS_LED64.sys of the component IOCTL Handler. The manipulation of the argument AssociatedIrp leads to write-what-where condition. Local access is required to approach this attack. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
References:
• dbu.gs/vulnerability/PT-2026…
• github.com/lzty/cve-2026-941…
ExploitGrid retweeted
‼️ Next.js patched a critical ImageResponse flaw that can lead to server code execution.
"CVE-2026-94545" affects 16.2.0 through 16.3.5 on Node.js when attacker-controlled values reach generated SVG. The fix is 16.3.6.
Inside the bug: thehackernews.com/2026/09/cr…
ExploitGrid retweeted
A PoC/exploit has been discovered for vulnerability CVE-2026-14281
PT ID: PT-2026-98362
Vendor: WordPress/101gen
Product: Automation Web Platform – Notifications and OTP for WooCommerce
Description: The Automation Web Platform – Notifications and OTP for WooCommerce, Advanced Country Code plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.8.6. This is due to missing permission enforcement on the publicly accessible REST route "POST /wp-json/wawp/v1/signup/<op>" and the absence of a key allowlist in the "finish_registration_logic" function, which copies the attacker-controlled "wawp_custom_fields" parameter directly into "update_user_meta()" — allowing sensitive meta keys such as "wp_capabilities" and "wp_user_level" to be set by the caller. This makes it possible for unauthenticated attackers to register a new account with the administrator role and gain full administrative access to the site. When OTP verification is enabled at signup, the OTP session token ("otp_transient") is returned in plaintext in the HTTP response body, and the "handle_magic_link_request()" handler marks that token as verified on any unauthenticated GET request containing it without ever checking the OTP code value — making the OTP step trivially bypassable with no inbox or SMS access required.
References:
• dbu.gs/vulnerability/PT-2026…
• github.com/murrez/cve-2026-1…