Loading video...

Video Failed to Load

Go Home

Security recap from the last 24 hours that actually matters. - PHP, 2 CVEs - Node.js, 10 CVEs - SSL, 8 eMudhra intermediate certificates compromised - GitLab self-managed, 1 CVE rated 10.0 What's the problem? PHP - CVE-2026-109618 and CVE-2026-109619, both CVSS 9.2 - Unauthenticated remote code execution in...

naufaldi's profile picture

λL-D1 | AI for Buzzer 🍉

19,283 subscribers

42,278 views • 24 days ago •via X (Twitter)

Science & TechnologyNews & Politics
LIVE

Anya Rossi• Live Now

Private livecam show

4 Comments

Toivo Mattila's profile picture
Toivo Mattila24 days ago

Dude why are you still talking about this ancient stuff? Literally yesterday's news We have a fresh batch already coming in

Colbert's profile picture
Colbert24 days ago

That GitLab vulnerability is a massive headache for self-hosted teams. Honestly, it feels like the security landscape is getting more chaotic by the hour lately.

λL-D1 | AI for Buzzer 🍉's profile picture
λL-D1 | AI for Buzzer 🍉24 days ago

Yuk Ikut Free Workshop bikin Saas AI buat Enterprise!

yj9978's profile picture
yj997824 days ago

Bang kok Komdigi diem aje yah ngak ada himbauan sama sekali ini ?.

Related Videos

It's the bug of the month for June 2026! CVE-2026-45657 - A CVSS 9.8 vulnerability in Kernel that allows remote, unauthenticated code execution at SYSTEM without user interaction. Yikes!
0:38

It's the bug of the month for June 2026! CVE-2026-45657 - A CVSS 9.8 vulnerability in Kernel that allows remote, unauthenticated code execution at SYSTEM without user interaction. Yikes!

TrendAI Zero Day Initiative

34,389 views • 5 months ago

🤬CVE-2025-49113: Post‑Auth Remote Code Execution in Roundcube via PHP Object Deserialization FOFA Link: FOFA Query: app="roundcube" Results: 51,584,735 Advisory: CVSS: 9.9
0:28

🤬CVE-2025-49113: Post‑Auth Remote Code Execution in Roundcube via PHP Object Deserialization FOFA Link: FOFA Query: app="roundcube" Results: 51,584,735 Advisory: CVSS: 9.9

X

15,021 views • 1 year ago

CVE-2026-64638: XSS2Shell WordPress Pre-Authentication XSS to Remote Code Execution PoC:
0:28

CVE-2026-64638: XSS2Shell WordPress Pre-Authentication XSS to Remote Code Execution PoC:

Dark Web Informer

120,745 views • 23 days ago

⚠🔴 New PoC for CVE-2026-109618 affecting ALL PHP VERSIONS, EVEN THOSE RECENTLY PATCHED
0:57

⚠🔴 New PoC for CVE-2026-109618 affecting ALL PHP VERSIONS, EVEN THOSE RECENTLY PATCHED

Marcos Besteiro 👧🏻👶🏻

62,533 views • 20 days ago

‼️ CVE-2026-48907: Joomla! JCE extension 2.9.99.5 - unauthenticated Remote Code Execution Video Credit: Gaurav Bhattacharjee
3:36

‼️ CVE-2026-48907: Joomla! JCE extension 2.9.99.5 - unauthenticated Remote Code Execution Video Credit: Gaurav Bhattacharjee

Dark Web Informer

47,567 views • 4 months ago

PHP2Shell, explained by cats. PHP2Shell is two critical flaws in PHP itself. A form stuffed with hundreds of empty uploads makes PHP run out of memory and clear it, but one pointer still points there, so the next visit can leak other users' passwords or run an attacker's code. No login needed. The fix: update PHP and restart it. Old versions like PHP 5.6 get no patch. #cat #php #security #cybersecurity #programming
1:23

PHP2Shell, explained by cats. PHP2Shell is two critical flaws in PHP itself. A form stuffed with hundreds of empty uploads makes PHP run out of memory and clear it, but one pointer still points there, so the next visit can leak other users' passwords or run an attacker's code. No login needed. The fix: update PHP and restart it. Old versions like PHP 5.6 get no patch. #cat #php #security #cybersecurity #programming

coding.kitty

98,000 views • 23 days ago

⚠️CVE-2026-18963 (CVSS 9.1)⚠️ Critical Unauthenticated Account Takeover vulnerability in Keycloak’s reset-credentials flow. In affected Keycloak 26.x versions, unauthenticated attackers can bypass email verification during password recovery and continue the reset-credentials flow. This allows an attacker who knows a target username or email address to set new credentials without accessing the victim’s email, resulting in full account takeover. Patched versions include 26.4.15, 26.6.6, and 26.7.2. Users should upgrade to a fixed release. 🔥PoC + Vulnerable environment: #Keycloak #AccountTakeover #AuthenticationBypass #PasswordReset #CWE640 #CyberSecurity #CVE #PoC #Exploit #CVE_2026_18963
0:30

⚠️CVE-2026-18963 (CVSS 9.1)⚠️ Critical Unauthenticated Account Takeover vulnerability in Keycloak’s reset-credentials flow. In affected Keycloak 26.x versions, unauthenticated attackers can bypass email verification during password recovery and continue the reset-credentials flow. This allows an attacker who knows a target username or email address to set new credentials without accessing the victim’s email, resulting in full account takeover. Patched versions include 26.4.15, 26.6.6, and 26.7.2. Users should upgrade to a fixed release. 🔥PoC + Vulnerable environment: #Keycloak #AccountTakeover #AuthenticationBypass #PasswordReset #CWE640 #CyberSecurity #CVE #PoC #Exploit #CVE_2026_18963

EQST

28,573 views • 1 month ago

Here’s the Age of Empires RCE from yesterday’s Patch Tuesday: CVE-2026-50663. Join an attacker’s lobby, (auto-)accept UCG, and you get remote code execution.
0:22

Here’s the Age of Empires RCE from yesterday’s Patch Tuesday: CVE-2026-50663. Join an attacker’s lobby, (auto-)accept UCG, and you get remote code execution.

Rick de Jager

512,042 views • 4 months ago

For the last two days, our Research Team has been looking into the recently disclosed Citrix NetScaler vulnerabilities CVE-2026-88771 and CVE-2026-88772 and building detection coverage to help identify compromised systems. The new THOR Preview signature set currently includes: - EXPL_CVE_2026_88772_POC_Sep26 Detects artifacts related to the public CVE-2026-88772 PoC - LOG_SUSP_EXPL_CVE_2026_88771_Sep26 Detects potential CVE-2026-88771 exploitation traces in NetScaler logs - WEBSHELL_CSS_PassThrough_Sep26 Detects the PHP webshell pattern observed in the post-exploitation activity reported by GreyNoise We also released a new IOC set: - NetScaler ADC suspicious file artifacts It contains filesystem indicators derived from the Citrix IOC scanner script and covers suspicious PHP/XHTML files and other unusual artifacts in NetScaler web directories. The Preview signatures are already available with: ./thor-util update --sigdev We’ll keep adding signatures as new technical details become available from public research and from information shared with us by partners and customers. Details: And if you’re wondering how to actually scan a NetScaler appliance with THOR: we documented a remote scanning approach using SSHFS a few years ago, which still applies here:
1:21

For the last two days, our Research Team has been looking into the recently disclosed Citrix NetScaler vulnerabilities CVE-2026-88771 and CVE-2026-88772 and building detection coverage to help identify compromised systems. The new THOR Preview signature set currently includes: - EXPL_CVE_2026_88772_POC_Sep26 Detects artifacts related to the public CVE-2026-88772 PoC - LOG_SUSP_EXPL_CVE_2026_88771_Sep26 Detects potential CVE-2026-88771 exploitation traces in NetScaler logs - WEBSHELL_CSS_PassThrough_Sep26 Detects the PHP webshell pattern observed in the post-exploitation activity reported by GreyNoise We also released a new IOC set: - NetScaler ADC suspicious file artifacts It contains filesystem indicators derived from the Citrix IOC scanner script and covers suspicious PHP/XHTML files and other unusual artifacts in NetScaler web directories. The Preview signatures are already available with: ./thor-util update --sigdev We’ll keep adding signatures as new technical details become available from public research and from information shared with us by partners and customers. Details: And if you’re wondering how to actually scan a NetScaler appliance with THOR: we documented a remote scanning approach using SSHFS a few years ago, which still applies here:

Nextron Research ⚡️

21,734 views • 1 month ago

Does your web host know about this one yet? If you run anything on PHP, even a small WordPress site: did you get the October 21 update in, or is your host still quiet about it? Tell me what they said. #php #php2shell #wordpress #cybersecurity #networking
2:23

Does your web host know about this one yet? If you run anything on PHP, even a small WordPress site: did you get the October 21 update in, or is your host still quiet about it? Tell me what they said. #php #php2shell #wordpress #cybersecurity #networking

Kevin Nanns

14,800 views • 20 days ago

🚨CrowdStrike CEO urges fast patching after AI proved the PHP flaws can be exploited, putting tens of millions of servers at risk. George Kurtz says exploiting the almost 20-year-old flaws was only "theoretical" until AI proved it could be done. That has forced everyone into a "very quick patch cycle." PHP is the language that "drives the internet," and the flaws let attackers run commands on vulnerable web servers. Kurtz says large companies will patch their systems and modern PHP versions will get patched, though some older versions may not. What people aren't talking about enough, he says, is old routers and firewalls running outdated PHP that "will never be patched." He warns that long tail will lead to "a lot of breaches" in the coming months. "You need to be looking at your watch, not a calendar."
2:05

🚨CrowdStrike CEO urges fast patching after AI proved the PHP flaws can be exploited, putting tens of millions of servers at risk. George Kurtz says exploiting the almost 20-year-old flaws was only "theoretical" until AI proved it could be done. That has forced everyone into a "very quick patch cycle." PHP is the language that "drives the internet," and the flaws let attackers run commands on vulnerable web servers. Kurtz says large companies will patch their systems and modern PHP versions will get patched, though some older versions may not. What people aren't talking about enough, he says, is old routers and firewalls running outdated PHP that "will never be patched." He warns that long tail will lead to "a lot of breaches" in the coming months. "You need to be looking at your watch, not a calendar."

Coin Bureau

35,278 views • 22 days ago

💥 We have reproduced both CVE-2023–29357 and CVE-2023–24955 in Microsoft SharePoint. The chain allows unauthenticated users to execute arbitrary commands on the server. Update your software ASAP!
0:21

💥 We have reproduced both CVE-2023–29357 and CVE-2023–24955 in Microsoft SharePoint. The chain allows unauthenticated users to execute arbitrary commands on the server. Update your software ASAP!

PT SWARM

58,178 views • 3 years ago

CVE-2024-29269: Remote Code Execution PoC Credit:
3:00

CVE-2024-29269: Remote Code Execution PoC Credit:

Dark Web Informer

72,073 views • 1 year ago

So... we decided to hack WordPress Core, AGAIN! 🔥 ⛓️ Click2Shell is a one-click unauthenticated remote command execution chain (Preauth RCE) affecting every WordPress website. Wordpress rolled out a fix yesterday! The story about how one preview link made WordPress click Install, load an inactive theme's PHP, and hand us RCE is below. Happy Friday!
0:26

So... we decided to hack WordPress Core, AGAIN! 🔥 ⛓️ Click2Shell is a one-click unauthenticated remote command execution chain (Preauth RCE) affecting every WordPress website. Wordpress rolled out a fix yesterday! The story about how one preview link made WordPress click Install, load an inactive theme's PHP, and hand us RCE is below. Happy Friday!

pwn.ai

122,035 views • 1 month ago

Every influencer is posting the same two things. The Polymarket "hack" (it's a joke, nothing got hacked) and the $3M Binance drain. Nobody is talking about the fact that half the servers out there are exposed right now. Unless you run your own hardware and patch it yourself. CVE-2026-98432, a bug in the Linux kernel TCP/IPv4 stack. One CPU frees memory while another is still reading it to answer a SYN packet. Use-after-free. Remote, no auth, an open port is enough. CVSS 9.8 Critical on v3.1, 8.3 High on v4.0. In practice the most likely outcome is a crashed kernel, which means a dead server. Ubuntu 16.04, 18.04 and 20.04 are vulnerable. On 22.04, 24.04, 26.04 and 26.10 the fix is still in progress. The AWS, Azure, GCP and Oracle cloud kernels are on the list too. So basically every VPS running your bot, node or site. What to do: sudo apt update && sudo apt upgrade uname -r to check your kernel version and reboot after the update, the new kernel doesn't load otherwise Older releases can use Ubuntu Pro (ESM, Livepatch). Upstream Linux already has the fix in 7.3-rc7, now it's on Ubuntu to ship the packages. While everyone argues about someone else's $3M, go check your own server. It takes 2 minutes.
0:24

Every influencer is posting the same two things. The Polymarket "hack" (it's a joke, nothing got hacked) and the $3M Binance drain. Nobody is talking about the fact that half the servers out there are exposed right now. Unless you run your own hardware and patch it yourself. CVE-2026-98432, a bug in the Linux kernel TCP/IPv4 stack. One CPU frees memory while another is still reading it to answer a SYN packet. Use-after-free. Remote, no auth, an open port is enough. CVSS 9.8 Critical on v3.1, 8.3 High on v4.0. In practice the most likely outcome is a crashed kernel, which means a dead server. Ubuntu 16.04, 18.04 and 20.04 are vulnerable. On 22.04, 24.04, 26.04 and 26.10 the fix is still in progress. The AWS, Azure, GCP and Oracle cloud kernels are on the list too. So basically every VPS running your bot, node or site. What to do: sudo apt update && sudo apt upgrade uname -r to check your kernel version and reboot after the update, the new kernel doesn't load otherwise Older releases can use Ubuntu Pro (ESM, Livepatch). Upstream Linux already has the fix in 7.3-rc7, now it's on Ubuntu to ship the packages. While everyone argues about someone else's $3M, go check your own server. It takes 2 minutes.

cryptopsihoz

22,142 views • 16 days ago

⚠️ Update for CVE-2024-21413 💣 Managed & confirmed Microsoft Outlook Remote Code Execution (RCE) but won't publish details (yet).
0:22

⚠️ Update for CVE-2024-21413 💣 Managed & confirmed Microsoft Outlook Remote Code Execution (RCE) but won't publish details (yet).

Alex

175,950 views • 2 years ago

The internet is going into a LOCKDOWN. Hundreds of millions of websites are potentially at risk from cyberattacks. Governments, banks and major platforms have already taken their websites OFFLINE. Many are already calling it “Black October.” At the centre of the shutdowns is something most of us have never heard of, but use every day. PHP, the software behind roughly 7 in 10 websites, has two critical flaws that can let hackers break in without a password. Dubbed PHP2Shell, both are rated 9.2 out of 10 for severity. Details began circulating on Oct 20. Emergency fixes arrived the next day, but attackers were already moving. Cloudflare’s CEO says hacking attempts then jumped from thousands to MILLIONS within hours. Cybersecurity agencies across several countries are telling PHP site owners the same thing: Patch it now, or take it offline. Websites have gone dark worldwide, from government portals and hospitals to banks. CrowdStrike warns these attacks leave almost no trace, so some sites may not know if they’ve been hit. Around 2.6 MILLION internet-facing servers run PHP, potentially hosting hundreds of sites each. Over 1.1 million use older versions no longer receiving official PHP updates. Older installations may need an upgrade to a supported PHP version or a fix from their software provider. And patching does not remove a backdoor an attacker may already have planted. Cloudflare also says hackers are now tweaking their attacks to try to slip past its protections. But PHP isn’t the only security story unfolding. -Japan’s Onamae suspended ALL Desktop Cloud plans after malware was found on customer servers. -India’s eMudhra had 8 website-certificate keys so weak, one was literally the number “4”. -State Bank of India confirmed 3,897 customer records on the dark web. -Criminals used AI agents to break into 400+ Latin American banks. -Capcom confirmed a breach exposing 11.7 million email addresses. -GitLab disclosed a 10/10 severity flaw in versions going back to 2014. -LiteLLM removed a malware-containing release. Railway reported possible exposure of customer secrets. None of these has a confirmed link to PHP2Shell. We’re seeing separate breaches unfold together. The true number of incidents could take months to come out. The world is still on alert. Attacks are still coming.
0:28

The internet is going into a LOCKDOWN. Hundreds of millions of websites are potentially at risk from cyberattacks. Governments, banks and major platforms have already taken their websites OFFLINE. Many are already calling it “Black October.” At the centre of the shutdowns is something most of us have never heard of, but use every day. PHP, the software behind roughly 7 in 10 websites, has two critical flaws that can let hackers break in without a password. Dubbed PHP2Shell, both are rated 9.2 out of 10 for severity. Details began circulating on Oct 20. Emergency fixes arrived the next day, but attackers were already moving. Cloudflare’s CEO says hacking attempts then jumped from thousands to MILLIONS within hours. Cybersecurity agencies across several countries are telling PHP site owners the same thing: Patch it now, or take it offline. Websites have gone dark worldwide, from government portals and hospitals to banks. CrowdStrike warns these attacks leave almost no trace, so some sites may not know if they’ve been hit. Around 2.6 MILLION internet-facing servers run PHP, potentially hosting hundreds of sites each. Over 1.1 million use older versions no longer receiving official PHP updates. Older installations may need an upgrade to a supported PHP version or a fix from their software provider. And patching does not remove a backdoor an attacker may already have planted. Cloudflare also says hackers are now tweaking their attacks to try to slip past its protections. But PHP isn’t the only security story unfolding. -Japan’s Onamae suspended ALL Desktop Cloud plans after malware was found on customer servers. -India’s eMudhra had 8 website-certificate keys so weak, one was literally the number “4”. -State Bank of India confirmed 3,897 customer records on the dark web. -Criminals used AI agents to break into 400+ Latin American banks. -Capcom confirmed a breach exposing 11.7 million email addresses. -GitLab disclosed a 10/10 severity flaw in versions going back to 2014. -LiteLLM removed a malware-containing release. Railway reported possible exposure of customer secrets. None of these has a confirmed link to PHP2Shell. We’re seeing separate breaches unfold together. The true number of incidents could take months to come out. The world is still on alert. Attacks are still coming.

Coin Bureau

2,090,588 views • 24 days ago

Remember when we got PHP running in Node.js? That was just the warmup. Our next project is going to break some minds 🤯 What's your guess?
0:25

Remember when we got PHP running in Node.js? That was just the warmup. Our next project is going to break some minds 🤯 What's your guess?

Matteo Collina

21,871 views • 1 year ago

💥 Remote Code Execution in GitHub Copilot (CVE-2025-53773) 👉 Prompt injection exploit writes to Copilot config file and puts it into YOLO mode, then we get immediate RCE 🔥 Bypasses all user approvals 🛡️ Patch is out today. Update before someone else does it for you
0:32

💥 Remote Code Execution in GitHub Copilot (CVE-2025-53773) 👉 Prompt injection exploit writes to Copilot config file and puts it into YOLO mode, then we get immediate RCE 🔥 Bypasses all user approvals 🛡️ Patch is out today. Update before someone else does it for you

Johann Rehberger

117,719 views • 1 year ago

⚠️CVE-2026-72898 (CVSS 10.0)⚠️ Your Metabase's "forgot password" page will run an attacker's SQL. 😱 No login. No account. An attacker just POSTs to /api/session/reset_password with a crafted user-id — Metabase drops it straight into a database query with zero validation. Full unauthenticated SQL injection: dump admin credentials, session tokens, the whole app DB. If you self-host Metabase, patch to the latest release now. 🔥PoC + setup: #Metabase #SQLi #CVE #PoC #Exploit #CyberSecurity #CVE_2026_72898
0:32

⚠️CVE-2026-72898 (CVSS 10.0)⚠️ Your Metabase's "forgot password" page will run an attacker's SQL. 😱 No login. No account. An attacker just POSTs to /api/session/reset_password with a crafted user-id — Metabase drops it straight into a database query with zero validation. Full unauthenticated SQL injection: dump admin credentials, session tokens, the whole app DB. If you self-host Metabase, patch to the latest release now. 🔥PoC + setup: #Metabase #SQLi #CVE #PoC #Exploit #CyberSecurity #CVE_2026_72898

EQST

31,365 views • 2 months ago