CVE-2026-5917: OS Command Injection in libgit2’s SSH Backend
libgit2’s libssh2 backend quotes the repository path but escapes nothing. One quote in the path can run commands on an SSH server that gives a shell.
Read637th Research Lab
Featured
CVE-2026-5857: Remote Code Execution in Contiki-NG’s MQTT Client
A malicious broker splits one PUBLISH across two TCP segments, skips a bounds check that is present and correct, and overwrites a function pointer.
ReadCVE-2026-18759: Privilege Escalation in ASUSTOR Backup Plan
ASUSTOR Backup Plan’s Windows service ABP_VSS_Service treats encryption as authentication and checks paths with a substring test. Standard user to SYSTEM.
ReadU-Boot TCP/NFS Vulnerabilities: Integer Underflow and Buffer Overflow in the World’s Most Popular Bootloader
Three CVEs in U-Boot’s network stack: a TCP integer underflow that corrupts packet processing and an NFS path overflow that escapes a 2048-byte buffer.
ReadFour Vulnerabilities in barebox: From DHCP Parsing to EFI PE Loading
Four CVEs in barebox: an unbounded DHCP option scan, two ext4 parsing flaws, and a PE virtual-size integer overflow in the EFI loader.
ReadRogueProvision: A SYSTEM Task That Applies Unsigned Provisioning Packages — admin to SYSTEM, declined by MSRC
A SYSTEM service applies unsigned .ppkg packages from a folder — no signature, no consent. Microsoft’s docs promise otherwise. Honest catch: admin→SYSTEM.
ReadRebuilding a Security Researcher’s Mind in an AI — the Method, the Rig, and What It Cannot Do Yet
Building an AI that reverse-engineers undocumented Windows internals and raises its own hypotheses. The method, the rig, and the limit it has not crossed.
ReadSame Workflow, New Target: AI-Assisted Discovery of CVE-2026-29004 in BusyBox
How the AI workflow that found a strongSwan zero-day discovered a 9-year-old heap overflow in BusyBox’s DHCPv6 client, plus a full PoC walkthrough.
ReadFinding a 15-Year-Old Zero-Day in strongSwan with AI-Assisted Code Analysis
How I discovered CVE-2026-25075, a bug hiding in strongSwan since 2011, using a structured multi-pass AI analysis workflow.
ReadLatest
CVE-2026-5917: OS Command Injection in libgit2’s SSH Backend
libgit2’s libssh2 backend quotes the repository path but escapes nothing. One quote in the path can run commands on an SSH server that gives a shell.
CVE-2026-5857: Remote Code Execution in Contiki-NG’s MQTT Client
A malicious broker splits one PUBLISH across two TCP segments, skips a bounds check that is present and correct, and overwrites a function pointer.
CVE-2026-18759: Privilege Escalation in ASUSTOR Backup Plan
ASUSTOR Backup Plan’s Windows service ABP_VSS_Service treats encryption as authentication and checks paths with a substring test. Standard user to SYSTEM.
U-Boot TCP/NFS Vulnerabilities: Integer Underflow and Buffer Overflow in the World’s Most Popular Bootloader
Three CVEs in U-Boot’s network stack: a TCP integer underflow that corrupts packet processing and an NFS path overflow that escapes a 2048-byte buffer.