Browse public community intelligence reports, source analysis, and threat research.
Critical unauthenticated remote code execution flaws in PHP core (CVE-2026-109618 and CVE-2026-109619) allow attackers to take full control of web servers by exploiting memory corruption in session upload progress and fatal error handling.
2 intel reports
A 12-year-old critical flaw in PostgreSQL's logical decoding allows low-privileged replication accounts to execute arbitrary code and achieve full superuser persistence.
An unauthenticated second-order SQL injection vulnerability in the All-in-One WP Migration and Backup plugin (CVE-2026-19949) enables remote code execution through malicious WordPress trackbacks and archive restoration.
