Python

GitPython CVE-2026-114145: Submodule Path Plants .git/hooks RCE

GitPython Will Happily Clone a Submodule Straight Into .git/hooks

Cybersecsloth Editorial1 week ago04 mins

create_submodule(path=”.git/hooks”) clones first, validates second. The planted post-checkout hook runs on the next checkout. Fixed in 3.2.1. Lab proof inside.

Read Full News

HTTP2Shell CVE-2026-111497: Brotli Decoder RCE in Node, Bun, Python

HTTP2Shell: the Brotli Decoder Bug That Is Already in Your Runtime and Nobody Imported It on Purpose

Cybersecsloth Editorial2 weeks ago08 mins

An out-of-bounds write in Google’s Brotli C decoder (1.0.3-1.2.0) ships inside Node, Bun, Python, Envoy and Istio. Inbound br bodies and outbound br responses both reach it. Safe lab repro, detection, patch matrix.

Read Full News

LXD and MicroCloud CVSS 10: Your Public Certificate Is Now a Password (CVE-2026-112816)

Two Senators Asked Meta Who Watches the Footage From Its Glasses. Answers Due by Thanksgiving

FBI Pins Binance’s $6.43B Theft on TraderTraitor, and the Private Keys Were Never the Problem

Polymarket’s Performance Monitor Became a Wallet Drainer, and the CSP Waved It Through

Hunting the Cursor Marketplace Claude Code Backdoor: svc-telemetry, .smt and a Reverse Tunnel

CVE-2026-98432: A 2015 IPv4 TCP Bug Got a Remote Root Exploit, and Go Turned MPTCP On for You

Cisco ASA and FTD SSL VPN Can Be Remotely Rebooted, and CISA Put the DoS on KEV

GitLab’s CI Regex Compiler Is a CVSS 10.0 RCE, and CISA Just Put It on KEV

Fragnesia Is on KEV, and It Is the Root Half of the PHP2Shell Chain

A CVSS 2.7 ESX Logging Bug Just Landed on CISA KEV Because Spies Used It as a Zero-Day

GitPython Will Happily Clone a Submodule Straight Into .git/hooks

HTTP2Shell: the Brotli Decoder Bug That Is Already in Your Runtime and Nobody Imported It on Purpose