Threat Research - Safe Security
SAFE Named a Leader in the 2026 Liminal Index for Cyber TPRM. Get the Report →
Book a demo

Threat Research

Threat Research SSHole: High-Severity OpenSSH Vulnerability Turns Disabled Passwords Into Unauthorized Access By SAFE Threat Research Team Overview An account with no valid password should never accept password authentication. A newly disclosed OpenSSH vulnerability breaks that fundamental security assumption, potentially… SAFE Safe Security Nov 6, 2026 8 min read
Threat Research CVE-2026-18963 Inside the Keycloak Reset-Credentials Bypass and Pre-Auth Account Takeover A pre-authentication logic flaw in Keycloak 26.0.0–26.7.1 allows an attacker who knows only a victim’s username to change their password – without credentials, phishing, or any victim interaction.… SAFE Safe Security Nov 4, 2026 11 min read
Threat Research TAILWORM Inside the Tailscale SSH Privilege Boundary Flaws in Tailscale SSH and Serve can cross local privilege boundaries, expose node-local services to tailnet peers, or exhaust resources. SSH paths require policy-authorized access; Serve paths have… SAFE Safe Security Nov 3, 2026 11 min read
Threat Research CVE-2026-115806: Prime Mover PHP Object Injection Leads to Privilege Escalation 1. Introduction CVE-2026-115806 is a PHP object-injection flaw in Prime Mover – Backup and Migration for WordPress. An unauthenticated visitor can store a base64-encoded serialized object in a… SAFE Safe Security Oct 29, 2026 9 min read
Threat Research CVE-2026-111497: Inside Node2Shell and the Brotli Decoder Flaw A vulnerability first surfaced through Node.js has exposed a much broader attack surface in one of the web ecosystem’s most widely embedded compression components. CVE-2026-111497 is an out-of-bounds… Threat Research Team Safe Security Oct 26, 2026 11 min read
Threat Research CVE-2026-54293 NLTK: URL-Encoded Path Traversal in nltk.data.load() 1. Introduction This article examines a path-traversal flaw in nltk.data.load() in NLTK 3.9.4 and earlier, tracked as CVE-2026-54293 with a CVSS v3.1 score of 7.5 (High) and fixed… SAFE Safe Security Oct 24, 2026 16 min read
Threat Research This Week in CVEs: The Week Defenders Lost the Head Start This week, the normal vulnerability lifecycle broke down. PHP2Shell set the tone for the week. CVE-2026-109618 and CVE-2026-109619, two critical unauthenticated RCEs in PHP, were already being probed… Threat Research Team Safe Security Oct 23, 2026 7 min read
Threat Research CVE-2026-109618 and CVE-2026-109619 PHP2Shell: Critical PHP Flaws Explained and What Organizations Must Do to Mitigate Risk 1. Introduction This article examines two related memory-safety vulnerabilities in the PHP engine, CVE-2026-109618 and CVE-2026-109619. In our reproduced mod_php chain, multipart HTTP requests combine an out-of-memory trigger… SAFE Safe Security Oct 22, 2026 16 min read
Threat Research CVE-2026-44381 MISP Threat Intelligence Platform Authenticated SQL Injection via ORDER BY Parameter POST /events/index — Boolean-Blind + Time-Based Oracle 1. Introduction This document illustrates a SQL injection vulnerability in MISP — the Malware Information Sharing Platform and Threat Sharing system — an open-source threat intelligence platform used… SAFE Safe Security Oct 21, 2026 9 min read
Threat Research One Person, Five AI Tools, a Country’s Banks: Inside South Korea’s AI-Run Breach A financially motivated hacker used a stack of AI tools to hit South Korean banks at the speed of a whole team. The tooling was new. The way… Rahul Tyagi Safe Security Oct 20, 2026 9 min read
Threat Research CVE-2026-101894: Symlink-Chain Path Traversal in @xhmikosr/decompress 1. Introduction The @xhmikosr/decompress package extracts tar, tar.gz, tar.bz2, and ZIP archives in Node.js applications. CVE-2026-101894 is a symlink-chain path traversal in its default decompress(input, output) API: crafted… SAFE Safe Security Oct 20, 2026 10 min read
Threat Research CVE-2026-41948 Dify ≤ 1.14.1 – Unauthenticated Plugin Daemon Internal API Exposure via Path Traversal in the Console Icon Proxy 1. Introduction This document illustrates a relative path traversal vulnerability in Dify, the open-source large language model (LLM) application development platform used by more than 50,000 organisations to… SAFE Safe Security Oct 19, 2026 10 min read