Topic
research
4 posts
- ArticleOct 2026 · 17 min
Node2Shell: One Brotli Bug, Reached From Both Sides of the Wire
CVE-2026-111497 is an out-of-bounds write in the Google Brotli decoder that Node.js bundles. Attackers reach it inbound, through request bodies that Express 5, Koa and @fastify/compress decompress by default, and outbound, through any response fetch(), axios or got decodes for you. Below: the exposure map, the version traps, what the proofs of concept actually show, and the checklist.
- ArticleOct 2026 · 18 min
PHP2Shell: Two Bugs in PHP Core That Fire Before Your Code Runs
CVE-2026-109618 and CVE-2026-109619 give an unauthenticated HTTP request two independent paths to code execution inside the PHP core itself, both reached while PHP parses the request rather than inside your application; what follows is the exposure matrix, the exploitation record so far, and the checklist for the days before you can patch.
- ArticleAug 2026 · 14 min
XSS2Shell: One Failed Login to PHP on the Server
CVE-2026-64638 is a reflected XSS on the WordPress login page — the finding most teams close as medium. Six gadgets sit between it and a PHP shell, and every one of them was already in core. Here is the chain, the log signatures, and what to harden after you patch.
- ArticleAug 2026 · 15 min
XSS2Shell: מניסיון התחברות כושל אחד ועד PHP על השרת
CVE-2026-64638 היא חולשת XSS מוחזר בעמוד ההתחברות של וורדפרס — בדיוק הממצא שרוב הצוותים סוגרים כבינוני. בין החולשה הזו לבין הרצת PHP על השרת עומדים שישה שלבים נוספים, וכולם כבר היו בליבת המערכת. הנה השרשרת המלאה, חתימות הזיהוי בלוגים, וההקשחה שצריך לעשות אחרי העדכון.