Skip to content
Friday, October 23, 2026
meme dump: patch your stuff edition
Mistune’s RST Include Just Read Your .env (CVE-2026-115353)
Incus Backup Import: ../ in a Volume Name, Root on the Host (CVE-2026-115375)
vLLM Will Import Your Attacker’s Processor If You Ask Nicely (CVE-2026-114053)

Cybersecsloth

the security industry is a joke. we cover it anyway.

Random News
meme dump: patch your stuff edition
Mistune’s RST Include Just Read Your .env (CVE-2026-115353)
Incus Backup Import: ../ in a Volume Name, Root on the Host (CVE-2026-115375)
vLLM Will Import Your Attacker’s Processor If You Ask Nicely (CVE-2026-114053)

Cybersecsloth

the security industry is a joke. we cover it anyway.

Random News
Headlines
Meme: Drake-style panels rejecting safe vLLM settings and approving trust_remote_code for CVE-2026-114053

meme dump: patch your stuff edition

CVE-2026-115353: Mistune Include Path Traversal File Read

Mistune’s RST Include Just Read Your .env (CVE-2026-115353)

CVE-2026-115375: Incus Backup Path Traversal to Host Root

Incus Backup Import: ../ in a Volume Name, Root on the Host (CVE-2026-115375)

CVE-2026-114053: vLLM code_revision RCE via /tokenize

vLLM Will Import Your Attacker’s Processor If You Ask Nicely (CVE-2026-114053)

WebRTC Datachannel C2 Lab Walkthrough and Detection

WebRTC Datachannels: C2 That Looks Like a Call Your Firewall Already Allows

WebSocket C2 Channel Lab: Upgrade, Subprotocol, Detection

Your C2 Is a WebSocket Upgrade and the Proxy Logged It as Chat

Linux memfd_create Fileless ELF Exec Lab Walkthrough

Linux Fileless ELF: memfd_create, fexecve, and a Fake kworker Name

Plex2Shell CVE-2026-96652 to 96656: KEV Chain and Lab Hunt

Plex2Shell: Your Home Theater Just Joined CISA KEV and Learned dlopen

PHP2Shell CVE-2026-109618 CVE-2026-109619: Patch PHP Now

PHP2Shell Just Turned Every Unpatched Upload Form Into a Shell Lottery

Geolocation and Metadata Deep Dive: Verifying a Claim With OSINT

Verify or Burn a Claim: Chaining Photo, Map, and Public Records

dead drop