⚡️ 0-Day Alert: PHP remote code execution CVE-2026-109618: OOM bailout to UAF CVE-2026-109619: state corruption to UAF We independently scrutinized the bugs, they are legitimate and should be fixed asap. Update to: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35

⚡️ 0-Day Alert: Apple CoreGraphics RCE exploited in targeted attacks CVE-2026-86950: out-of-bounds write in CoreGraphics parsing a maliciously crafted image/PDF, leading to arbitrary code execution. Both iOS and macOS are vulnerable. This AV is reachable through a wide variety of iOS native and 3rd party apps that render graphics, such as WhatsApp (first suspect due to report credit), Safari, iMessage, etc. Zero-click where auto-preview renders the file. However, the bug alone is not enough to compromise the device, and requires further chaining such as sandbox escape and EoP. These further bugs are not public. Patched in iOS/iPadOS 26.7.1, macOS Tahoe 26.7.1, macOS Sequoia 15.8.1. intelligence.zerodayengineer…

⚡️ 0-Day Alert: Chrome v8 RCE exploited in the wild CVE-2026-85046: v8 array-builtin callback side-effect to elements-kind transition confusion. Affects both Turbofan and Maglev. Exploit will work in default config but requires multiple other bugs to achieve arbitrary code execution on the system. The bug alone without helpers could do for an UXSS. Patched in Chrome 152.0.7977.82/.83

Browser Exploit Surface model + bug overlay CVE callouts: randomly picked exploitable bug samples from historical records @alisaesage xitter.cf/alisaesage/status/2091…

Mastery container: Multi-Specialization Essentials A curated course of foundational webinars and hands-on masterclasses taught by @alisaesage, covering the introductory essentials of the three classic specializations at Zero Day Engineering: vulnerability discovery, hypervisor and browser exploitation. Made for self-paced study with minimal prerequisites that can be taken over a weekend as orientation in the field or initialization of multi-specialized work with AI.

⚡️ 0-Day Alert: IBM LangFlow OSS RCE LangFlow agent orchestration deployments have been under active exploitation since May. CVE-2025-34291: CORS misconfiguration + SameSite=None CVE-2026-33017*: Unauthenticated RCE via build_public_tmp's data parameter CVE-2026-55255: IDOR in /api/v1/responses: run any user's flow by ID CVE-2026-0770: Unauthenticated RCE via validate_code() / decorator abuse CVE-2026-9198: Unauthenticated RCE via auto_login + validate/code chain Bugs are not hard, likely spotted by generally available AI. Public exploit POCs exist. Majority takes input from an API endpoint variable and executes it directly on the OS. Attack pattern suggests that LangFlow has not seen basic security QA from the developer, and shouldn't be deployed in environments where arbitrary code execution poses a risk. * Attached: 33017 patch diff and code trace to exec()