tech-insider.org
Resources curated from this publisher and indexed across appsec.fyi topic pages. Last item added: 2026-08-13.
| Date Added | Resource | Excerpt |
|---|---|---|
| 2026-08-13 2026 | TeamCity Vulnerability CVE-2026-63077: CVSS 9.8 RCE [2026]RCE | A critical vulnerability in TeamCity, identified as CVE-2026-63077, has been disclosed. This flaw carries a severe CVSS score of 9.8 and allows for Remote Code Execution (RCE). The provided link offers further details on this significant security issue. |
| 2026-08-11 2026 | Ruby on Rails Flaw Hits CVSS 9.5 No Login Needed [2026]RCE | Library flaw CVE-2026-66066 in Ruby on Rails' Active Storage allows unauthenticated arbitrary file reads, including secrets for remote code execution. Dubbed KindaRails2Shell, the vulnerability, tracked as CWE-1188, arises from insecure libvips operations when processing uploaded images, affecting Rails 7.x and 8.x by default. Discovered by Ethiack and analyzed by Rapid7, the issue requires Active Storage, libvips processing, and user-facing image uploads to be exploitable. |
| 2026-07-29 2026 | XBOW AI Penetration Testing Exposes Bing RCE [2026]RCE | Writeup of CVE-2026-32194 and CVE-2026-32191, detailing how XBOW's AI autonomously discovered critical RCE flaws in Microsoft Bing Image Search. The exploit leveraged a crafted SVG file uploaded via the "Search by Image" tool, allowing command injection via ImageMagick delegates. This vulnerability enabled execution as NT AUTHORITYSYSTEM on Windows and root on Linux, without requiring authentication. Microsoft patched these flaws in March 2026, with XBOW publishing the technical breakdown in July 2026. |
| 2026-07-29 2026 | How to Set Up Semgrep for AI Code: 13 Steps 60 Min [2026]Python | Library for integrating Semgrep into AI code generation workflows. This tutorial details setting up the Semgrep CLI and Semgrep Guardian to scan AI-generated code for vulnerabilities like cross-site scripting and privilege escalation paths, and demonstrates writing custom rules. It covers connecting Semgrep to agents such as Claude Code, Cursor, and GitHub Copilot, gating pull requests, and fixing issues introduced by tools like OpenAI Codex, addressing the significant security gap in AI-assisted development. |
| 2026-07-24 2026 | Splunk Zero-Day CVE-2026-20253: CVSS 9.8 CISA KEV [2026]RCE | Writeup of CVE-2026-20253, a critical pre-authentication RCE vulnerability in Splunk Enterprise. This flaw, rated CVSS 9.8 and added to CISA's KEV catalog, allows unauthenticated attackers to execute arbitrary code by exploiting a PostgreSQL sidecar service. The exploit chain involves redirecting backup/restore jobs to an attacker-controlled server, leveraging PostgreSQL's `lo_export` function for file writes, stealing credentials from `.pgpass`, overwriting a Python module, and achieving code execution as the system user. Affected versions include Splunk Enterprise 10.2.0-10.2.3 and 10.0.0-10.0.6. |
| 2026-07-16 2026 | Windows Netlogon Flaw CVE-2026-41089: CVSS 9.8 [2026]RCE | Writeup of CVE-2026-41089, a critical Windows Netlogon flaw, details a stack-based buffer overflow in the MS-NRPC protocol. This vulnerability, rated CVSS 9.8, allows unauthenticated remote attackers to execute arbitrary code with SYSTEM privileges on domain controllers. Researchers flagged it as wormable due to its lack of authentication requirements, network reachability prerequisite, and direct SYSTEM-level code execution, drawing comparisons to the 2020 Zerologon attack. Active exploitation was confirmed weeks after Microsoft's May 12, 2026, patch release. |
| 2026-07-07 2026 | SharePoint Vulnerability CVE-2026-45659 Exploited [2026]RCE | Writeup of CVE-2026-45659, a SharePoint RCE vulnerability, details how a flaw initially assessed as "less likely to be exploited" by Microsoft became a federally mandated fix by CISA within weeks. The deserialization bug requires only "Site Member" privileges and low complexity, making authenticated access a potent attack vector. This "n-day" exploit highlights the danger of unpatched on-premises SharePoint servers, impacting sectors like government and finance, and underscores the urgency of CISA's Known Exploited Vulnerabilities catalog. |
| 2026-07-06 2026 | npm Supply Chain Attack: North Korea Hits Mastra AI [2026]Supply Chain | Analysis of the @mastra npm supply chain attack reveals North Korea's Sapphire Sleet (BlueNoroff, APT38) compromised over 140 packages via a stolen maintainer account. The attackers leveraged a typosquatted dependency, `easy-day-js`, within a `postinstall` script to inject malware. This implant disabled TLS verification, contacted C2 infrastructure, deployed a persistent implant, and targeted cryptocurrency wallets like MetaMask, Phantom, and Coinbase Wallet, along with cloud credentials, demonstrating a significant maturation in nation-state-sponsored open-source malware campaigns. |
| 2026-06-01 2026 | Mercor Hit: 4TB Stolen via LiteLLM (95M Downloads) [2026]Supply Chain | Library providing a unified interface to over 100 LLM providers, LiteLLM was compromised, leading to a 4TB data exfiltration from Mercor. The attack chain involved compromising Trivy, injecting malicious code into LiteLLM, and exfiltrating credentials from downstream environments. This incident highlights the risks of fast-moving open-source projects in AI infrastructure and the critical importance of pinned dependencies to prevent supply-chain attacks. |