SecPod Labs
Security Research
In-depth CVE write-ups, vulnerability analysis, and security intelligence from the SecPod Research team.
Featured Article
CVE Research
Drupal Fixes Critical Field UI Flaw Linked to Remote Code Execution
A critical vulnerability in Drupal core's Field UI module could allow attackers to execute arbitrary code on vulnerable websites through exposed contributed modules or custom code. Tracked as CVE-2026-108097, the flaw stems from improper validation of PHP callbacks during table rendering. At least one known exploitation path does not require authentication, potentially putting affected websites at risk of server compromise.
CVE Research
The In-Memory Route to Root: Inside The Ivanti Connect Secure Chain
UTA0576 combined an authentication bypass, a short-lived file-write primitive and a separate privilege-escalation flaw to turn unauthenticated HTTPS requests into root commands on a fully patched Ivanti Connect Secure appliance.
CVE Research
Two Zero-Days, 1,407 Microsoft Flaws Fixed: October 2026 Patch Tuesday Delivers a Massive Update
Microsoft’s October 2026 Patch Tuesday addresses 1,407 CVEs, including one actively exploited zero-day in Windows Shell (CVE-2026-96951) that bypasses Mark of the Web protections. A second publicly disclosed zero-day affects .NET Framework. Critical remote code execution issues span DHCP, Hyper-V, Exchange, Outlook, and related services. This article covers the key risks, priority fixes, and end-of-support products.
CVE Research
CyberXero: AI-Augmented Initial Access Broker Behind Theft of 628,000 Ukrainian Records
CyberXero is a Russian-speaking initial access broker that combines Cobalt Strike and custom WordPress exploitation with an AI layer of Claude Code agents and PentAGI. Dual pipelines target global WordPress and e-commerce sites and Ukrainian energy infrastructure, with more than 628,000 Ukrainian records confirmed stolen. An exposed open directory revealed the operation. This article covers the attack stages, indicators of compromise, and defensive guidance.
CVE Research
WordPress Security Alert: Critical Bricksforge Vulnerability Exposes Sites to Remote Code Execution
A critical vulnerability in the Bricksforge plugin for WordPress is being actively exploited, allowing unauthenticated attackers to upload and execute arbitrary PHP code on vulnerable websites. Tracked as CVE-2026-85097, the flaw stems from insufficient validation of file metadata during form submissions. Successful exploitation can enable attackers to compromise websites, access sensitive information, deploy web shells, and establish persistent access.