meme dump: patch your stuff edition
seven original cybersec memes: vLLM trust_remote_code, Incus ../ backups, Mistune .env includes, Warden stealer, ClickFix, open Ollama, and a patch checklist.
Read Full News
Mistune’s RST Include Just Read Your .env (CVE-2026-115353)
Live mistune 3.2.1 lab: .. include:: reads absolute and ../ paths into HTML. Patch to 3.3.0 and stop rendering stranger markdown next to secrets.
Incus Backup Import: ../ in a Volume Name, Root on the Host (CVE-2026-115375)
Dependent custom volume names in index.yaml skipped validation. filepath.Join, root daemon, host write. Fixed in Incus 7.5.1.
vLLM Will Import Your Attacker’s Processor If You Ask Nicely (CVE-2026-114053)
Request-controlled code_revision reaches AutoProcessor.from_pretrained. Unauthenticated /tokenize, trust_remote_code, auto_map. Lab recreation and the 0.31.0 fix.
WebRTC Datachannels: C2 That Looks Like a Call Your Firewall Already Allows
SDP on a paste, ICE through NAT, DTLS datachannel tasking. Lab peer plus allowlist and signaling hunts.
Your C2 Is a WebSocket Upgrade and the Proxy Logged It as Chat
101 Upgrade, Origin cosplay, JSON tasking on a long-lived socket. Lab server and implant plus what to alert on.
Linux Fileless ELF: memfd_create, fexecve, and a Fake kworker Name
Anonymous RAM ELF, fake kworker argv0, /proc/pid/exe says memfd deleted. Lab exec plus the audit rules that catch it.
Plex2Shell: Your Home Theater Just Joined CISA KEV and Learned dlopen
Unauth SSRF, dead agent guard, sslip.io token theft, dump-yuv planted .so. CISA KEV Oct 20. Update past 1.43.3.10861 and hunt timeline plus Codecs.
PHP2Shell Just Turned Every Unpatched Upload Form Into a Shell Lottery
Two critical PHP core RCEs, default upload_progress On, patches Oct 21, probing since Oct 17. Inventory, lab probe, and hunt notes before your fpm pool parents a shell.
Verify or Burn a Claim: Chaining Photo, Map, and Public Records
a claim is a hypothesis. chain exif, the map, the sun, and the public record until the story holds or falls apart. most fake claims fall apart on the date.