appsec.fyi · Sources

cyberinsider.com

7 curated AppSec resources from cyberinsider.com across 3 topics on appsec.fyi.

cyberinsider.com

Resources curated from this publisher and indexed across appsec.fyi topic pages. Last item added: 2026-07-20.

RCE 3 Supply Chain 3 SQLi 1
Date Added Resource Excerpt
2026-07-20 2026Millions of Shark robot vacuums vulnerable to remote code executionRCEAnalysis of a remote code execution vulnerability affecting millions of Shark robot vacuums details how overly permissive AWS IoT policies and insecure handling of an `Exec_Command` cloud command allow attackers to gain control of devices. The researcher demonstrated arbitrary command execution by subscribing to other users' MQTT topics using extracted credentials, potentially enabling access to sensitive data like Wi-Fi credentials, home maps, and live camera feeds. The issue impacts approximately 1.5 million devices, with at least 673,816 identified as vulnerable in one AWS region, and remains unpatched.
2026-07-18 2026WordPress releases emergency update for critical 'wp2shell' RCE flawRCEWriteup on the wp2shell RCE vulnerability in WordPress. This critical chain, affecting versions 6.9 to 7.0.1, allows unauthenticated attackers remote code execution. It combines CVE-2026-60137, an SQL injection flaw, with CVE-2026-63030, a REST API batch-route confusion. Proof-of-concept exploits are circulating, and initial real-world exploitation has been observed, prompting emergency updates and warnings for administrators to patch immediately.
2026-06-28 2026Polymarket suffers supply chain attack leading to $3 million crypto theftSupply ChainWriteup of Polymarket's supply chain attack, where a compromised third-party vendor injected malicious code into the platform's frontend. This incident led to approximately $3 million in cryptocurrency theft from users via a phishing campaign, with affected funds bridged from Polygon to Ethereum. Blockchain security firms PeckShield and Bubblemaps investigated, identifying fewer than 15 affected accounts and tracking the stolen ETH. Users are advised to monitor wallet activity and revoke token approvals.
2026-06-22 2026FFmpeg PixelSmash bug triggers code execution on media file openRCELibrary for FFmpeg's CVE-2026-8461, "PixelSmash," a critical heap out-of-bounds write vulnerability in the MagicYUV decoder. This flaw allows remote code execution through specially crafted media files like AVI, MKV, or MOV, impacting numerous downstream applications including Kodi, OBS Studio, Jellyfin, and Nextcloud. Exploitation involves overwriting function pointers within FFmpeg's heap structures, enabling arbitrary command execution. The vulnerability was patched in FFmpeg 8.1.2.
2026-06-17 2026Supply-chain attack injects backdoor on ShapedPlugin WordPress softwareSupply ChainLibrary for detecting and mitigating supply-chain attacks like CVE-2026-10735 affecting ShapedPlugin's premium WordPress software. This attack involved injecting backdoors through legitimate update channels, leading to credential theft, 2FA secret exfiltration, and the deployment of tools like Tiny File Manager and Adminer. The incident highlights risks associated with compromised build pipelines and vendor update systems, impacting plugins such as Real Testimonials Pro, Product Slider Pro, and Smart Post Pro.
2026-05-25 2026Drupal warns of active exploitation attempts targeting critical SQL injection flawSQLiAnalysis of CVE-2026-9082, a critical SQL injection vulnerability affecting Drupal sites using PostgreSQL, details active exploitation attempts observed by Imperva. This flaw in Drupal's database abstraction API allows unauthenticated attackers to execute arbitrary SQL, leading to potential information disclosure, privilege escalation, and remote code execution. CISA has added it to the KEV catalog, and agencies must secure systems by May 27. Patches are available for supported Drupal versions, and immediate updates are advised.
2026-05-15 2026OpenAI confirms exposure in recent Shai-Hulud supply-chain attackSupply ChainWriteup of the Mini Shai-Hulud supply-chain attack impacting OpenAI, which involved compromised npm packages from TanStack and exposed limited internal credentials and code-signing certificates. The incident led OpenAI to rotate signing keys for its desktop applications and prompted macOS users to update software by June 12, 2026, to avoid disruptions. The attack leveraged techniques like cache poisoning and OpenID Connect token extraction to compromise repositories and harvest secrets.