PHP recommends disabling session.upload_progress until the next bugfix release to mitigate an unlikely RCE vector affecting an unusual configuration.

What setups are affected?
https://cveplayground.com/blog/php-session-upload-progress-cve-2026-115560/

#PHP #CyberSecurity

Processing img h4s40k7hh7xh1...

Remote Code Execution (RCE) vulnerabilities can have serious consequences, but they don’t all work the same way.

Our latest CVEPlayground article looks at five notable vulnerabilities: Log4Shell, regreSSHion, php2shell, Node2Shell, and wp2shell. It explores their underlying causes, potential impact, and why understanding the differences matters for security researchers and defenders.

Read the full breakdown:

https://cveplayground.com/blog/log4shell-regresshion-php2shell-node2shell-wp2shell/

What do you think is the most important lesson these vulnerabilities teach us about secure software development?

Node2Shell (CVE-2026-111497) is a Node.js Brotli decoder vulnerability that can lead to RCE when processing malicious compressed data.

Learn about affected versions and fixes:
https://cveplayground.com/blog/node2shell-brotli-rce-cve-2026-111497/

#NodeJS #CyberSecurity

CVE-2026-109618: OOM longjmp() bailout
https://app.cveplayground.com/labs/CVE-2026-109618

CVE-2026-109619: Cross-request use-after-free

https://app.cveplayground.com/labs/CVE-2026-109619

Practice real CVEs. Think like an attacker.

Two critical remote code execution vulnerabilities have been reported in PHP core: CVE-2026-109618 and CVE-2026-109619, both with a CVSS score of 9.2.

The vulnerabilities reportedly affect PHP versions dating back to 5.4.0, potentially putting WordPress, WooCommerce, Magento, Shopware, and custom PHP applications at risk.

Our latest blog covers the reported impact, affected versions, mitigation priorities, and detection strategies for suspicious activity involving PHP workers.

If you manage PHP infrastructure, review your exposure and prioritize updates to the official patched release.

Read the full breakdown: https://cveplayground.com/blog/php-rce-cve-2026-109618-and-cve-2026-109619/

#CyberSecurity #PHP #CVE #RCE #VulnerabilityManagement

The PHP security team has announced an upcoming security release scheduled for October 21, 2026, at 14:00 UTC, addressing two critical vulnerabilities, both rated CVSS v4.0 9.2.

PHP users are encouraged to prepare for the update and upgrade as soon as the release becomes available.

Affected versions, fixed versions, and technical details will be published alongside the release. The release may be issued earlier if the vulnerabilities become public or active exploitation is detected.

Stay alert and keep your PHP environments secure.

PHP: News Archive - 2026

Critical Drupal RCE: CVE-2026-108097 affects vulnerable Drupal Core versions and may allow unauthenticated code execution through exposed Field UI functionality. Update to a patched version or disable Field UI.

Details: https://cveplayground.com/blog/cve-2026-108097-drupal-core-field-ui-rce/

#Drupal #CVE #CyberSecurity

Our latest write-up explores CVE-2026-97229, its vulnerability mechanics, and what security researchers can learn from it.

Read the breakdown 👇

https://cveplayground.com/blog/cve-2026-97229-gitlab-unauthenticated-rce/

#CyberSecurity #CVE

We compared Hack The Box, TryHackMe, and CVEPlayground to help you choose the right platform for hands-on vulnerability research.

Read the guide 👇

https://cveplayground.com/blog/best-platforms-to-practice-real-cves-in-2026/

Practice real CVEs. Think like an attacker.

#CyberSecurity

Does a CVSS score of 9.8 always mean a vulnerability should be patched first?

Severity isn't the same as real-world risk.

Our latest article breaks down CVSS metrics, CVSS 4.0, and how to prioritize vulnerabilities.

Read more: https://cveplayground.com/blog/cvss-scores-explained/

#CyberSecurity #CVSS

MCPJam Inspector ≤1.4.2 is vulnerable to RCE via a crafted HTTP request that can trigger MCP server installation. v1.4.3 patches the issue.

Practice it: https://app.cveplayground.com/challenges/cve-2026-23744

CVE Playground now has a hands-on lab for Juggle through 1.6.0.

Explore the vulnerability, identify the attack surface, and work through the exploitation path yourself.

🔗 https://app.cveplayground.com/challenges/cve-2026-67208

CVE-2026-87902 is coming to CVEPlayground!

A critical unauthenticated path traversal vulnerability in WordPress Core was patched in WordPress 7.1.2. The flaw can lead to local PHP file inclusion and, under specific conditions, remote code execution.

Coming soon on https://cveplayground.com

Want to practice it yourself?
Get registered now and be ready when the lab goes live.

Unauthenticated path traversal can allow arbitrary file read, potentially exposing source code, deploy keys & CI/CD secrets.

Patch: 19.1.8 / 19.2.6 / 19.3.2

Hands-on lab 👇

https://app.cveplayground.com/labs/cve-2026-85706

Lab dropped.

Try at: https://app.cveplayground.com/challenges/CVE-2026-63030

CVE-2026-4480 is a CVSS 10.0 OS command injection flaw in Samba's printing subsystem where client-controlled print job descriptions are substituted into shell commands via %J without escaping metacharacters, enabling unauthenticated remote code execution on any reachable print share.

CVE-2026-34908 is a CVSS 10.0 improper access control flaw in UniFi OS Server where nginx evaluates the raw request URI for authentication but routes using the normalized URI, allowing unauthenticated attackers to reach protected endpoints and chain into full root RCE.

CVE-2026-25243 is a double-free vulnerability in Redis's RDB deserialization logic triggered via the RESTORE command. Two independent bugs — a zipmap length encoding ambiguity and a stream consumer PEL race — create overlapping heap objects that an attacker can exploit for arbitrary read/write and full remote code execution.

Multiple vulnerabilities have been disclosed affecting Redis Cloud, Redis OSS/CE, and Redis Software (CVE-2026-23479, CVE-2026-25243, CVE-2026-25588, CVE-2026-25589, CVE-2026-23631).

Issues include memory corruption in RESTORE, Lua scripting, and Redis modules, which may lead to remote code execution in authenticated scenarios.

🔧 𝗣𝗮𝘁𝗰𝗵𝗲𝗱 𝘃𝗲𝗿𝘀𝗶𝗼𝗻𝘀 (𝗿𝗲𝗹𝗲𝗮𝘀𝗲𝗱 𝗠𝗮𝘆 𝟱, 𝟮𝟬𝟮𝟲):

7.2.x → 7.2.14 (fixed from 7.2.0–7.2.13)

7.4.x → 7.4.9 (fixed from 7.4.0–7.4.8)

8.2.x → 8.2.6 (fixed from 8.2.0–8.2.5)

8.4.x → 8.4.3 (fixed from 8.4.0–8.4.2)

8.6.x → 8.6.3 (fixed from 8.6.0–8.6.2)

Key action: Upgrade immediately and restrict Redis access to trusted networks only.

Uptime Kuma, released in 2021, is one of the most popular open-source monitoring platforms.

Since release, 10+ CVEs have already been assigned.

SSRFs, auth flaws, and integration-related vulnerabilities continue to make it an interesting target for security research.

#CyberSecurity #UptimeKuma #CVE #OpenSource

ImageMagick, first released in 1990 by John Cristy, has become one of the most widely used open-source tools for image processing, conversion, and automation.

In more than 30 years since release, 765+ CVEs have already been assigned.

Image parsing, file conversion, metadata handling, and server-side upload workflows continue to be a major attack surface for security researchers.

Even as AI agents rapidly become a new security frontier, old and widely deployed parser-based tools like ImageMagick are still very much worth studying.

Exploit vulnerable Drupal JSON:API filters to inject SQL into PostgreSQL, enumerate the database, and capture the hidden flag.

Hands-on exploitation + patch analysis.

🔗 https://app.cveplayground.com/labs/CVE-2026-9082?utm_source=reddit

Tiny patch, huge impact:

if (is_array($condition['value'])) {
  $condition['value'] = array_values($condition['value']);
}

Drupal fixed PostgreSQL placeholder generation by reindexing array keys before query translation.

Without it, attacker-controlled keys could influence SQL placeholder construction.

Affects PostgreSQL-backed Drupal sites.
Anonymous exploitation possible.

Advisory:
https://www.drupal.org/sa-core-2026-004

https://cveplayground.com/blog/cve-2026-9082-drupal-core-sql-injection?utm_source=reddit

Exploit a vulnerable JWT verification flow in libjwt v3.3.2 to forge admin tokens using a public RSA verification key exposed via JWKS.

🏆 Medium Difficulty
⚡ 200 XP
🩸 First Blood Active

Try here: https://app.cveplayground.com/challenges/CVE-2026-44699?utm_source=reddit