Browse public community intelligence reports, source analysis, and threat research.
Critical unauthenticated remote code execution flaws in PHP core (CVE-2026-109618 and CVE-2026-109619) allow attackers to take full control of web servers by exploiting memory corruption in session upload progress and fatal error handling.
2 intel reports
A high-severity out-of-bounds write vulnerability in the Brotli decompression library bundled with Node.js and Bun allows remote code execution via malformed compressed input.
Unauthorized actors compromised Railway's cloud platform to decrypt customer environment variables, specifically targeting AI inference API keys in a broader LLMjacking campaign.
