Exploit

Researcher Publishes GitLab RCE PoC Letting Authenticated Users Run Commands as Git Source: The Hacker News Security researchers at depthfirst published working exploit code on July 24 for a GitLab flaw that GitLab patched six weeks earlier, on June 10. It runs commands as git on any self-managed 18.11.3 server that has not taken the update. Any authenticated user who can push to a project can run i Read original

NodeBB Patches Eight AI-Found Flaws Exposing Admin Access and Private Chats Source: The Hacker News Eight security flaws in NodeBB went public on Wednesday, along with the code to exploit them. Aikido Security rates all eight as high severity and says its AI pentest agents found them in a six-hour review of the forum software’s source code. Every version before 4.14.0 is affected. NodeBB has fixe Read original

NodeBB Patches Eight AI-Found Flaws Exposing Admin Access and Private Chats Source: The Hacker News Eight security flaws in NodeBB went public on Wednesday, along with the code to exploit them. Aikido Security rates all eight as high severity and says its AI pentest agents found them in a six-hour review of the forum software’s source code. Every version before 4.14.0 is affected. NodeBB has fixe Read original

NodeBB Patches Eight AI-Found Flaws Exposing Admin Access and Private Chats Source: The Hacker News Eight security flaws in NodeBB went public on Wednesday, along with the code to exploit them. Aikido Security rates all eight as high severity and says its AI pentest agents found them in a six-hour review of the forum software’s source code. Every version before 4.14.0 is affected. NodeBB has fixe Read original

NodeBB Patches Eight AI-Found Flaws Exposing Admin Access and Private Chats Source: The Hacker News Eight security flaws in NodeBB went public on Wednesday, along with the code to exploit them. Aikido Security rates all eight as high severity and says its AI pentest agents found them in a six-hour review of the forum software’s source code. Every version before 4.14.0 is affected. NodeBB has fixe Read original

NodeBB Patches Eight AI-Found Flaws Exposing Admin Access and Private Chats Source: The Hacker News Eight security flaws in NodeBB went public on Wednesday, along with the code to exploit them. Aikido Security rates all eight as high severity and says its AI pentest agents found them in a six-hour review of the forum software’s source code. Every version before 4.14.0 is affected. NodeBB has fixe Read original

Kimi K3 Agents Found Redis Zero-Days and Built RCE Exploit, Researchers Say Source: The Hacker News Redis shipped seven security releases on July 23 after researchers published authenticated RCE PoCs for stock Redis 6.2.22, 7.4.9, 8.6.4, and 8.8.0. All four chains require RESTORE. The Streams chains also need EVAL and XGROUP; the 8.8.0 chain needs EVAL and the bundled RedisBloom module. Redis say Read original

Kimi K3 Agents Found Redis Zero-Days and Built RCE Exploit, Researchers Say Source: The Hacker News Redis shipped seven security releases on July 23 after researchers published authenticated RCE PoCs for stock Redis 6.2.22, 7.4.9, 8.6.4, and 8.8.0. All four chains require RESTORE. The Streams chains also need EVAL and XGROUP; the 8.8.0 chain needs EVAL and the bundled RedisBloom module. Redis say Read original

Kimi K3 Agents Found Redis Zero-Days and Built RCE Exploit, Researchers Say Source: The Hacker News Redis shipped seven security releases on July 23 after researchers published authenticated RCE PoCs for stock Redis 6.2.22, 7.4.9, 8.6.4, and 8.8.0. All four chains require RESTORE. The Streams chains also need EVAL and XGROUP; the 8.8.0 chain needs EVAL and the bundled RedisBloom module. Redis say Read original

Kimi K3 Agents Found Redis Zero-Days and Built RCE Exploit, Researchers Say Source: The Hacker News Redis shipped seven security releases on July 23 after researchers published authenticated RCE PoCs for stock Redis 6.2.22, 7.4.9, 8.6.4, and 8.8.0. All four chains require RESTORE. The Streams chains also need EVAL and XGROUP; the 8.8.0 chain needs EVAL and the bundled RedisBloom module. Redis say Read original