Skip to content 
wp2shell: How WordPress Core Handed Attackers a Shell on 800 Million Sites With Zero Credentials
SECURIFY AI LLC · THREAT INTELLIGENCE BRIEF wp2shell CVE-2026-63030 + CVE-2026-60137 Zero Clicks. No Plugins. No Login. — How WordPress Core Handed Attackers a Shell on 800 Million Sites CVSS 9.8 · Pre-Auth RCE · WordPress Core · CISA KEV July 21 · 60% of WP Orgs Initially Exposed · July 17, 2026 Author: Securify […]
CVE-2026-24061: The GNU telnetd Flaw That Handed Attackers a Root Shell for 11 Years
SECURIFY AI LLC · THREAT INTELLIGENCE BRIEF CVE-2026-24061 One Flag. No Password. Root Shell. — The GNU telnetd Flaw That Slept for 11 Years CVSS 9.8 · CWE-88 Argument Injection · CISA KEV · 212K+ Exposed Devices · Active Exploitation — July 2026 Author: Securify AI Security Research Team | securifyai.co/blog 9.8 CVSS Score CRITICAL […]
Android APK Security Testing: A Guide for Bug Hunters and Pentesters
Mobile applications have become a prime target for attackers, making Android security testing an essential skill for penetration testers and bug bounty hunters. Whether you’re analyzing a banking application or participating in a bug bounty program, understanding the Android attack surface can help uncover critical vulnerabilities before attackers do. In this guide, we’ll walk through […]
From Anonymous to TenantAdmin: Chaining a Firebase Custom Claims Authorization Bypass into Full Tenant Takeover
From Anonymous to TenantAdmin: Chaining a Firebase Custom-Claims Authorization Bypass into Full Tenant Takeover Every so often, a bug isn’t one bug. It’s three boring ones standing on each other’s shoulders, wearing a trench coat. Individually, none of these would make a triager’s heart race. Chained together, they let an anonymous person on the internet […]
Zero-Click Account Takeover via Unicode Homoglyph Email Collision
An accent-insensitive email comparison lets an attacker-owned look-alike domain authenticate as the victim and quietly receive their password-reset link. No clicks. No phishing. Full takeover. What We Found During testing on a recent bug bounty engagement, we found that the application resolves and authenticates accounts using an accent-insensitive (diacritic-folding) email comparison. Accented Latin characters are […]
Ghost CMS Blind SQL Injection – How a Blog Endpoint Became a Mass Compromise Machine
9.4CVSS Score CRITICALSeverity CWE-89SQL Injection 3.24.0–6.19.0Affected Versions 700+Sites Compromised 52K+GitHub Stars ⚡ TL;DR — What You Need to Know Right NowCVE-2026-26980 is a blind SQL injection in Ghost CMS’s public Content API — unauthenticated, exploitable with a single HTTP request, affecting every version from 3.24.0 through 6.19.0. Attackers used it to silently steal Admin API […]
A Practical Guide on Prompt Injection – Part 2
Welcome to Part Two of this AI security lab series. In the first part, we explored how straightforward prompt-based attacks can sometimes succeed and where they immediately fail. At that stage, most techniques were direct, obvious, and relatively easy for modern AI systems to detect. In this section, things change. Here, we move into more […]
The Rise of Initial Access Brokers (IABs): How Attackers Buy Access to Corporate Networks
1. Overview / Summary In recent years, the cybercrime ecosystem has evolved into a highly specialized marketplace where different threat actors perform distinct roles. One of the most significant developments is the rise of Initial Access Brokers (IABs) — threat actors who specialize in gaining unauthorized access to corporate environments and then selling that access […]
Audio Steganography in Supply Chain Attacks: How Malware Hides Inside WAV Files
A practitioner’s breakdown of the TeamPCP campaign — how attackers smuggled credential-harvesting malware inside structurally valid WAV audio files to bypass network inspection, EDR, and static analysis tools. Introduction Most malware evasion techniques rely on obfuscation: encode something, encrypt it, rename it. What the TeamPCP campaign demonstrated in March 2026 was something more unsettling — […]
Langflow RCE Vulnerability: Unauthenticated Code Execution Explained
1. Context: Why an AI Orchestration Tool Is a High-Value Target Langflow isn’t a toy. It’s the platform engineering teams reach for when they need to wire together LLM calls, retrieval pipelines, agents, and data sources without writing everything from scratch. With over 79,000 GitHub stars and DataStax-backed commercial support, it has quietly become infrastructure […]