Start With a DNS Check Before Changing Your Email Setup
Before you change anything, look at what is actually published. The free DMARCsimple DNS checker is a practical starting point for reviewing your domain's SPF,…
CATEGORY
CYBERSECURITY
Security research, penetration testing, CVE analysis, PCI-DSS compliance, and defensive programming techniques for web applications.
79 ARTICLES
Why I Built DMARCsimple: Email Authentication Should Be Understandable
Email authentication records are technical and the reports are unfamiliar. Here is why I built DMARCsimple by CCMS: to give teams a clearer view of their…
Unauthenticated PHP Object Injection in Ajax Search Lite Actively Exploited (CVE-2026-28139)
CVE-2026-28139 is a CVSS 9.8 unauthenticated PHP Object Injection flaw in Ajax Search Lite (4.14.4 and earlier), now confirmed actively exploited. With 80,000+…
Adobe Commerce and Magento Under Active Attack: Customer Account Takeover via CVE-2026-71362
Adobe patched CVE-2026-71362 (CVSS 9.1) in its August 2026 update - a critical incorrect-authorization flaw that lets unauthenticated attackers hijack any…
VMware vCenter Actively Exploited: Directory Traversal to RCE Hits 361 Victims in 47 Countries (CVE-2026-59310)
Threat actors are actively exploiting CVE-2026-59310 (CVSS 9.8), a critical directory-traversal flaw in VMware vCenter enabling arbitrary code execution.…
SAP Commerce Cloud CVSS 10 Flaw Lets Unauthenticated Attackers Execute Arbitrary Code — CVE-2026-58231
SAP's August 2026 Patch Day includes CVE-2026-58231, a CVSS 10.0 flaw in SAP Commerce Cloud's Data Hub Adapter that lets unauthenticated attackers execute…
SharePoint Pre-Auth RCE Chain Is Now Complete: CVE-2026-63520 Closes the Loop
Rapid7 has disclosed CVE-2026-63520, an unsafe .NET type instantiation flaw in SharePoint's Business Connectivity Services that completes a two-CVE pre-auth…
Django Patches Four Vulnerabilities Including High-Severity GeoDjango File Write — CVE-2026-15307
Django 6.0.8 and 5.2.17 fix four CVEs including a high-severity server-side file write via GeoDjango GDALRaster spatial lookups (CVE-2026-15307), two…
Jenkins Patches Critical Deserialization Bypass and Three High-Severity Flaws — CVE-2026-70426
Jenkins 2.576 and LTS 2.568.2 fix a Critical deserialization filter bypass (CVE-2026-70426) in the Remoting library plus three High-severity flaws allowing…
Gitea Unauthenticated File Read + RCE Chain: Every Self-Hosted Instance Before 1.27.1 Is at Risk — CVE-2026-59774
Gitea 1.22.1 through 1.27.0 allows an unauthenticated attacker to read any file the server process can access via Org-mode #+INCLUDE path traversal in the…
WordPress Core Pre-Auth RCE (wp2shell): Update Every 6.9 and 7.0 Site Now — CVE-2026-63030
WordPress Core 6.9.0–6.9.4 and 7.0.0–7.0.1 are vulnerable to a pre-authentication RCE chain that requires no login, no plugins, and no special configuration.…
Gravity Forms ≤ 2.10.4: Unauthenticated Arbitrary File Read via Directory Traversal — CVE-2026-12997
Gravity Forms 2.10.4 and earlier allow an unauthenticated attacker to read any file the web server process can access — including wp-config.php and .env — and…