SecPod Labs
Security Research
In-depth CVE write-ups, vulnerability analysis, and security intelligence from the SecPod Research team.
CVE Research
Gunra Ransomware Exploits Fortinet Auth Bypass Flaws in Global Double Extortion Campaign
Gunra, a Conti-derived ransomware-as-a-service group, breaches networks by exploiting Fortinet authentication bypass flaws CVE-2024-55591 and CVE-2025-24472, then exfiltrates data and deploys ChaCha20/RSA-4096 encryption in a double extortion scheme.
CVE Research
Three Zero-Days, 421 Flaws Fixed: Microsoft's August 2026 Patch Tuesday Delivers a Massive Update
The second Tuesday of August 2026 brought one of the largest Patch Tuesday releases in recent memory, with Microsoft shipping updates for 421 CVEs across Windows, Office, Azure, SharePoint, Exchange Server, and critical developer tools — including three zero-day vulnerabilities, one of which was actively exploited in the wild.
CVE Research
Terraform MCP, Veeam Console, Django Push Critical Patches — 11 CVEs Fixed, Including CVSS 10.0 Cross-Tenant Token Reuse Flaw
HashiCorp, Veeam, and the Django Software Foundation have patched 11 vulnerabilities across Terraform MCP Server, Veeam Service Provider Console, and Django. The most critical is a cross-tenant credential reuse flaw in Terraform MCP Server (CVE-2026-16498, CVSS 10.0) that allows one user's token to be reused for subsequent requests. Veeam fixed an unauthenticated agent credential theft bug (CVE-2026-58073, CVSS 9.5) and an arbitrary file write leading to RCE. Django addressed a GeoDjango flaw enabling file writes and SSRF via spatial lookups. This article examines the technical details, affected versions, and available patches.
CVE Research
Breaking the Database Boundary: A Technical Analysis of CVE-2026-58048
CVE-2026-58048 is a critical privilege escalation vulnerability in cPanel & WHM that enables authenticated users to execute SQL statements with database administrator privileges. By exploiting a flaw in cPanel's database rename process, attackers can bypass intended privilege boundaries and gain elevated access to MySQL or MariaDB databases associated with their account. This article examines how the vulnerability works, its potential impact on shared hosting environments, the affected versions, and the security updates released to remediate the issue.
