VulnCheck Archives • Daily CyberSecurity

ZBT Router Backdoor: VulnCheck Sinkholes SPEAKINGSTONE and DARKLANTERN Implants

ZBT router backdoor implants SPEAKINGSTONE and DARKLANTERN mapped by VulnCheck in the supply chain

ZBT Router Backdoor: VulnCheck Sinkholes SPEAKINGSTONE and DARKLANTERN Implants

Do Son August 28, 2026

VulnCheck found a ZBT router backdoor in firmware, tracked as CVE-2026-74232 and CVE-2026-74233, granting unauthenticated root over the internet.

Fake AI PoCs Flood Exploit Repositories in 2026 Fake AI PoCs and malicious code found in GitHub exploit repositories.

Fake AI PoCs Flood Exploit Repositories in 2026

Do Son August 25, 2026

Fake AI PoCs and malicious code are taking over GitHub exploit repositories. Discover how researchers filter through the noise to find real vulnerabilities.

libssh2 Flaws Let Malicious SSH Servers Corrupt Client Memory libssh2 vulnerabilities let a malicious SSH server corrupt heap memory in SSH and SFTP clients

libssh2 vulnerabilities let a malicious SSH server corrupt heap memory in SSH and SFTP clients

libssh2 Flaws Let Malicious SSH Servers Corrupt Client Memory

Do Son July 28, 2026

Four libssh2 vulnerabilities let a malicious SSH server corrupt memory in connecting clients. Update past version 1.11.1 to stay protected.

libssh2 Vulnerability CVE-2026-58050 Gets Public PoC Exploit

libssh2 vulnerability CVE-2026-58050 publickey subsystem heap buffer overflow PoC exploit

libssh2 Vulnerability CVE-2026-58050 Gets Public PoC Exploit

Do Son June 28, 2026

Researchers publicly disclosed a libssh2 vulnerability, CVE-2026-58050, with PoC code. A malicious SSH server can corrupt a client's heap. Patch now.

NGINX Rift: Critical 18-Year-Old Flaw CVE-2026-42945 Actively Exploited to Crash Servers NGINX Rift CVE-2026-42945

NGINX Rift: Critical 18-Year-Old Flaw CVE-2026-42945 Actively Exploited to Crash Servers

Do Son May 19, 2026

Critical 18-year-old "NGINX Rift" flaw CVE-2026-42945 is under active exploitation. Learn how to patch your proxies and block the unauthenticated heap overflow.

Silent Intrusion: “Metro4Shell” Exploited in the Wild Since December Metro4Shell CVE-2025-11953

Silent Intrusion: “Metro4Shell” Exploited in the Wild Since December

Do Son February 4, 2026

VulnCheck reveals CVE-2025-11953 (Metro4Shell) was exploited in the wild since Dec 2025. Attackers target Windows & Linux dev servers. Patch now.

CISA Warns of Active Exploitation in XWiki and VMware Vulnerabilities n8n RCE Vulnerability CVE-2025-68613 CISA KEV WinRAR Zero-Day, Cloud Files UAF OpenPLC ScadaBR, CVE-2021-26829 CISA KEV, Gladinet LFI RCE XWiki RCE, VMware EoP CISA KEV CISA, Known Exploited Vulnerabilities CVE-2020-2883 CISA, Trend Micro

n8n RCE Vulnerability CVE-2025-68613 CISA KEV WinRAR Zero-Day, Cloud Files UAF OpenPLC ScadaBR, CVE-2021-26829 CISA KEV, Gladinet LFI RCE XWiki RCE, VMware EoP CISA KEV CISA, Known Exploited Vulnerabilities CVE-2020-2883 CISA, Trend Micro

CISA Warns of Active Exploitation in XWiki and VMware Vulnerabilities

Do Son October 31, 2025

CISA adds XWiki (CVE-2025-24893) and VMware (CVE-2025-41244) to its KEV Catalog after confirming active exploitation in the wild.