📌 Q&A

Place to ask questions and discuss topics that don't belong under other posts.

🐞 0-Day Insights: PHP RCE

Independent analysis of PHP CVE-2026-109618 and CVE-2026-109619 from first principles: patch reverse engineering and RCA.

📌 Monthly Webinar Access

I host a monthly technical review webinar, looking at the past month's security news. Next webinar is scheduled on Wednesday, 21st October. Between 0-days, AI hacks and global policy shifts, the purpose is to curate real signals that reflect the underlying trends in the field, and offer

🐞 CVE-2026-86950: patch RE + RCA (AI Assisted Methodology)

CoreGraphics Out-of-Bounds Write: Patch Diff & Root-Cause Analysis

⚡️ 0-Day Alert: Apple CoreGraphics RCE exploited in targeted attacks

Update iOS/iPadOS and macOS.

⚡️ 0-Day Alert: Chrome v8 RCE

Update Chrome to 153.0.8010.36/.37

⚡️ 0-Day Alert: Chrome v8 RCE

Update Chrome to 152.0.7977.82/.83

⚡️ 0-Day Alert: IBM LangFlow OSS RCE

LangFlow deployments have been under active exploitation since May.

⚡️ 0-Day Alert: VMware ESXi + vCenter

VMware just released a critical security update for ESXi hypervisor suite (VMSA-2026-0006). Two attack vectors.

⚡️ 0-Day Alert: Google Chrome GPU Remote to Elevation of Privilege exploit in the wild

Update Chrome to 146.0.7680.177/178

⚡️ 0-Day Alert: Google Chrome RCE + EoP in the wild

Update Chrome to 146.0.7680.80

⚡️ 0-Day Alert: Android Qualcomm msm kernel - exploit in-the-wild since December 2025.

CVE-2026-21385: kgsl msm kernel exploited in the wild

0-Day Alerts

⚡️ 0-Day Alert: Dell RecoverPoint for Virtual Machines exploited in-the-wild

CVE-2026-22769 (CVSS 10.0) allows remote unauthorized access with root privileges - exploited in the wild

0-Day Alerts

⚡️ 0-Day Alert: Google Chrome RCE exploit in the wild

Update Chrome to 145.0.7632.75/76

0-Day Alerts

⚡️ 0-Day Alert: Full-chain exploit for Apple Safari/WebKit in the wild (just patched)

Update Safari

0-Day Alerts

⚡️ 0-Day Alert: Google Chrome exploit in the wild

Update Chrome to 143.0.7499.109/.110

0-Day Insights

Google Chrome "actively exploited" bug chain on Viz & v8-wasm (May 2024)

Root cause analysis of a two-bug Chrome exploit chain under active exploitation in May 2024: CVE-2024-4671 (sandbox escape via Use-after-free in Viz) and CVE-2024-4761 (remote code execution via v8-wasm type confusion).

0-Day Insights

VMware Critical Security Advisory for ESXi, Workstation, Fusion hypervisors

1. Vmware just released security patches for four critical vulnerabilities that affect their entire core hypervisor stack: CVE-2024-22252, CVE-2024-22253, CVE-2024-22254, CVE-2024-22255. 2. The bugs were publicly…

0-Day Insights

Google Chrome WebRTC 0-Day Vulnerability (CVE-2023-7024)

WebRTC is a universal open source codec library for processing audio and video streaming, which is embedded in a wide variety of software products, especially in web browsers. Google justdiscloseda zero-day vulnerability in WebRTC, which is being exploited in the wild to achieve…

0-Day Insights

Deep Dive: Qualcomm MSM Linux Kernel & ARM Mali GPU 0-day Exploit Attacks of October 2023

This deep technical note briefly covers five kernel vulnerabilities in Qualcomm chipsets & ARM Mali GPU, which landed on CISA Known Exploited Vulnerabilities Catalog between October and December 2023. All the bugs were reported to be exploited "in…

0-Day Insights

Google Chrome Skia Vulnerability Analysis (CVE-2023-6345)

Google recently disclosed a new zero day vulnerability in Chrome browser that was exploited to attack users "in the wild". The bug is said to affect Skia component and tracked as CVE-2023-6345, with a CVSS score of 9.6 (Critical). No technical details of the vulnerability or…