Searchlight Cyber

Search everything

Mentions · 7d2
Mentions · 30d5
All mentions6
First seenAug 28, 2026
Last mentioned2d ago

Timeline

6 articles · newest first

Researchers chain Cloudflare image flaws into a CSP-bypass XSS

A public write-up shows script execution via /cdn-cgi/image/ using an SVG namespace bug and a Chromium cache quirk.

Cyber Security Newsupdated Oct 29, 06:18 UTC · 1d agofirst Oct 28, 15:38 UTC · 2d agoVulnerability 2 sources2 · 1 read

Critical PHP2Shell flaws patched in PHP; PAN-OS still unfixed

CVE-2026-109618 and CVE-2026-109619 are fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35; Palo Alto has no PAN-OS fix yet.

Help Net SecurityOct 25, 09:00 UTC · 5d agoVulnerabilityCVE-2026-109618 CVE-2026-1096191

Discourse ImageMagick Vulnerability Enables Arbitrary File Read Through Malicious Image Uploads

Researchers disclosed CVE-2026-55420, letting low-privilege Discourse users read server files via ImageMagick uploads.

GBHackersOct 12, 11:13 UTC · 18d agoVulnerabilityCVE-2026-554206 · 2 reads

Discourse Image Pipeline Exploit Chains JPEG Race, GhostScript and ImageMagick for File Read

Searchlight Cyber showed a patched Discourse upload chain letting basic users read server files via ImageMagick.

Cyber Security NewsOct 12, 06:43 UTC · 18d agoVulnerabilityCVE-2026-554203

GoBalance Flaw Lets Attackers Hijack .onion Addresses by Recovering Tor-Format Keys

GoBalance signing flaw lets attackers recover Tor .onion master keys from public descriptors and hijack dark-web sites, as seen with Dread.

The Hacker NewsOct 9, 09:03 UTC · 21d agoVulnerabilityExploited5 · 3 reads

Three CVSS 10.0 ServiceNow Flaws Could Let Unauthenticated Attackers Execute Code and SQL

ServiceNow patched four AI Platform flaws, including three pre-authentication CVSS 10.0 issues enabling unauthenticated code execution, SQL injection, and privilege escalation.

The Hacker NewsAug 28, 11:20 UTC · Aug 28, 2026VulnerabilityExploitedCVE-2026-18885 CVE-2026-18886 CVE-2026-74820+21 · 1 read

Related CVEs

by mentions

CVE-2026-55420<1%8.1
Discourse: 2026.5.1, 2026.4.2, and 2026.1.5, under certain non-default configurations, processing of PDF uploads could be exploited to…
published Jul 9, 2026discourse discourse
CVE-2026-109618100%9.2
OOM longjmp memory flaw enabling RCE in PHP
published 9d agophpKEVPoC ×25
CVE-2026-109619100%9.2
Use-after-free RCE in PHP via stale request globals
published 9d agophpKEVPoC ×15
CVE-2026-6876<1%10.0
Unauthenticated Sandbox Escape Allows Code Execution in ServiceNow AI Platform
published Aug 27, 2026ServiceNow AI Platform
CVE-2026-18885<1%10.0
Unauthenticated Code Injection in ServiceNow AI Platform (CVSS 10.0)
published Aug 27, 2026ServiceNow AI platform
CVE-2026-18886<1%10.0
Improper Access Control (Privilege Escalation) in ServiceNow AI Platform
published Aug 27, 2026ServiceNow AI Platform
CVE-2026-74820<1%10.0
Unauthenticated SQL Injection in ServiceNow AI Platform
published Aug 27, 2026ServiceNow AI platform
CVE-2026-68751%9.5
Unauthenticated Remote Code Execution in ServiceNow AI Platform
published Jul 13, 2026ServiceNow AI Platform (hosted/SaaS instances)PoC

Appears with

Ghostscriptproduct · 2
Discourseproduct · 2
Discoursevendor · 2
ImageMagickproduct · 2
Cloudflare Image Transformationsproduct · 1
ServiceNow AI Platformproduct · 1
GoBalanceorganization · 1
ServiceNowvendor · 1
ConnectWisevendor · 1
svg-hushproduct · 1
Google Cloud Storageproduct · 1
Dreadorganization · 1
AOMEI Backupperproduct · 1
PHPproduct · 1
PAN-OSproduct · 1
Netlifyvendor · 1

Entities are extracted by the model from each article. First seen Aug 28, 2026, last mentioned 2d ago. Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.