Search: “html-formhandler”

28 stories

DomainAll Cyber AIWindow24h 3d 7d 30d AllIn the wild Important only Show duplicates

CategoryAll

SeverityAll critical 0 high 0 medium 0 low 0 info 0

Smart search ranks by meaning as well as keywords (one row per story, last 45 days).

CVE-2026-19872: HTML::FormHandler versions before 0.410000 for Perl allow cross-site scripting via a submitted value rendered unescaped in an error message

Perl form library HTML::FormHandler before 0.410000 fixes CVE-2026-19872, a cross-site scripting flaw via unescaped submitted values in error messages.

CVE-2026-19872 was disclosed for the Perl HTML::FormHandler distribution: versions before 0.410000 render a submitted value unescaped within an error message, allowing cross-site scripting. The issue was announced by Robert Rothenberg on the oss-security mailing list. Applications using affected HTML::FormHandler versions should upgrade to 0.410000 or later.

oss-securitySep 8, 20:14 UTC · 7d agoVulnerability 2 sources CVE-2026-19872

CVE-2026-85630: HTML::FormHandler versions before 0.410002 for Perl render field attributes into HTML without escaping using the process_attrs method

CVE-2026-85630: HTML::FormHandler Perl versions before 0.410002 render field attributes into HTML unescaped, enabling HTML injection.

The Perl module HTML::FormHandler before version 0.410002 renders field attributes into HTML without escaping via the process_attrs method, per an oss-security disclosure. Applications using affected versions could allow unescaped markup to be injected into generated HTML. Users should upgrade to version 0.410002 or later.

oss-securitySep 8, 20:30 UTC · 7d agoVulnerability 2 sources CVE-2026-856301

Over 440,000 Exploit Attempts Target Super Forms and Elementor Pro RCE Flaws

Wordfence blocked 440,000+ exploit attempts against critical unauthenticated RCE flaws in WordPress plugins Super Forms and Elementor Pro.

Wordfence reports mass exploitation of two unauthenticated arbitrary file upload RCE flaws: CVE-2026-14894 in Super Forms (CVSS 9.8, fixed in 6.3.314) and CVE-2026-32475 in Elementor Pro (CVSS 9.0/9.8, fixed in 4.2.2), with over 250,000 and 190,000 blocked exploit attempts respectively. Attackers upload Base64-encoded PHP web shells such as Mushr00w_upl.php to execute code, create administrator accounts, exfiltrate data, or seize sites. Super Forms exploitation began July 14, 2026 and peaked above 40,000 requests on August 18; Elementor Pro attacks started August 19. Successful Elementor Pro exploitation requires a published page with a Form widget containing a File Upload field.

The Hacker NewsSep 4, 08:48 UTC · 12d agoExploit / PoC in the wildCVE-2026-14894 CVE-2026-32475

27.5KB language-agnostic WebGPU syntax highlighter

A developer released gpu-lexer, a 27.5KB language-agnostic syntax highlighter that uses a tiny WebGPU model to label code tokens in the browser.

gpu-lexer splits source into words, whitespace, and symbols, then a small WebGPU model uses local and whole-file context to assign nine token classes, working on languages never seen in training. On held-out files, 12.57% of token labels differ from Shiki, though this measures agreement with Shiki rather than objective correctness. In benchmarks against Shiki 4.4.3, Prism.js, Highlight.js, Sugar High, and Starry Night, it highlighted 10 concatenated copies of three.min.js (5.56M characters) about 10x faster on an Apple M4 Pro in Chrome 152. The author frames it as an experiment, not a grammar-equivalent highlighter.

Hacker News · securitySep 9, 01:14 UTC · 7d agoAI tools & infra HN 21↑ · 5 comments1

Elementor Pro RCE Flaw Under Active Attack

A critical Elementor Pro Forms module flaw allowing unauthenticated file uploads is under active attack against widely used WordPress sites.

A critical vulnerability in Elementor Pro, a widely used WordPress page builder plugin, allowed unauthenticated attackers to upload arbitrary files through the plugin's Forms module. The SOCRadar report indicates the flaw is being actively exploited in the wild. No CVE identifier was provided in the available text.

SOCRadarSep 4, 13:34 UTC · 12d agoExploit / PoC in the wild

WordlistLoader Delivers Amatera via ClickFix, SynkLoader Phishes Windows Passwords

Gen Digital details WordlistLoader delivering Amatera Stealer via ClickFix and EtherHiding, while SynkLoader phishes Windows credentials through Microsoft Teams.

Gen Digital identified WordlistLoader, an intermediate stage that reconstructs shellcode encoded as plain English words (or 16-byte UUID chunks) and loads Amatera Stealer 4.3.3-alpha1, delivered through ClearFake ClickFix prompts on compromised websites. The chain uses EtherHiding to fetch JavaScript from a blockchain smart contract, hidden cmd.exe via conhost, WebDAV-mounted shares with rundll32 execution, and ETW bypass via hardware breakpoints. The stealer adds hardened WoW64 syscalls, Heaven's Gate indirect-syscall trampolines and a redesigned application-bound encryption bypass. Separately, Expel observed SynkLoader distributed via Microsoft Teams phishing impersonating IT service desks, installing an MSI from Azure blob storage and serving a fake lock screen to capture credentials.

The Hacker NewsAug 26, 05:08 UTC · 21d agoMalware

Forminator WordPress Flaw Can Enable Unauthenticated RCE via Malicious PHP Uploads

Wordfence disclosed CVE-2026-15748, a critical unauthenticated file upload flaw enabling RCE in the Forminator Forms WordPress plugin, patched in version 1.56.2.

Wordfence reported CVE-2026-15748 (CVSS 9.8) in Forminator Forms, a WordPress plugin with over 600,000 active installations, allowing unauthenticated attackers to upload arbitrary PHP files and achieve remote code execution. The flaw stems from insufficient file type validation in the handle_file_upload() function, and exploitation requires a form containing both a File Upload field and a Select field, plus a custom upload storage root lacking .htaccess PHP protection. All versions up to and including 1.56.1 are affected; version 1.56.2 released July 31, 2026 fixes the issue. Wordfence also disclosed CVE-2026-15826 (CVSS 9.8), an authentication bypass in User Profile Builder (40,000+ installs) letting unauthenticated attackers log in as administrator, fixed in version 3.16.5 on July 16, 2026.

The Hacker NewsAug 17, 18:22 UTC · 29d agoVulnerability CVE-2026-15748 CVE-2026-15826

Elementor Pro WordPress Plugin Vulnerability Exploited to Hack Sites

Attackers are actively exploiting critical file-upload flaw CVE-2026-32475 in Elementor Pro, hacking WordPress sites; Defiant has blocked over 190,000 exploit attempts since patching.

Defiant warns that attackers are exploiting CVE-2026-32475 (CVSS 9.8), an unauthenticated arbitrary file upload flaw in the Elementor Pro WordPress plugin's form submission handling, which affects all versions up to 4.2.1 and was patched in version 4.2.2 on August 19. Exploitation began immediately after the fix shipped, with Defiant blocking over 190,000 exploit attempts to date; roughly two-thirds of Elementor's 10 million installations still ran a vulnerable version as of September 4. Successful exploitation writes attacker-controlled PHP files to /wp-content/uploads/elementor/forms/ and can lead to full site compromise; administrators should check that directory for PHP files and review requests to /wp-admin/admin-ajax.php.

SecurityWeekSep 5, 13:00 UTC · 11d agoExploit / PoC in the wildCVE-2026-32475

Technical Manual for a Toolkit for Measuring Contextual Individuation in Transformer Language Models

An open methodology toolkit measures whether transformer language models contextualize fixed word forms across domains using bridge forms and layer-wise silhouette analysis.

The manual documents an open toolkit built around 'bridge forms' - identical written words recurring across two or more subject domains with a different sense in each - to test whether transformer language models individuate word occurrences by context beyond the embedding layer. It covers declarative specification of bridge forms, Wikipedia corpus acquisition, occurrence localization, layer-wise representation extraction, domain-pairwise silhouette measurement, and visualization, justifying each choice against failure modes such as sense contamination and subword-tokenization misalignment. It is a methodological and implementation reference and reports no empirical results.

arXiv cs.AI / cs.LG / cs.CLSep 4, 16:38 UTC · 12d agoAI research

Critical Unauthenticated File Upload to RCE in Elementor Pro Plugin

Elementor Pro WordPress plugin has an unauthenticated arbitrary file upload flaw in its Forms module allowing remote code execution.

Patchstack disclosed a critical unauthenticated arbitrary file upload vulnerability in the Elementor Pro WordPress plugin that can lead to remote code execution. The flaw is in the Forms module's File Upload field, where the extension check and the file-move step run in two separate loops with inconsistent handling of empty file entries. The writeup describes exploitation via crafted upload submissions; no CVE id or evidence of in-the-wild exploitation is given in the post.

PatchstackAug 19, 17:17 UTC · 27d agoVulnerability

RenderFormer-V2: Neural Rendering with Heterogeneous Scene Primitives

RenderFormer-V2 is a transformer-based neural renderer handling caustics, volumetric scattering and out-of-distribution materials without per-scene training or specialized code.

RenderFormer-V2 is a learned transformer-based neural rendering model that models global light transport as a sequence-to-sequence transformation, handling caustics, volumetric scattering, environment lighting, textured and displaced surfaces and out-of-distribution materials. It uses a two-stage process: a view-independent stage resolving primitive-to-primitive transport, and a view-dependent stage converting the neural scene representation into pixels. Improvements include combined windowed-attention with a rendering-informed attention sink for scalability, support for heterogeneous primitives like environment maps and participating media, and a surface-reflectance-independent neural material encoding, validated across diverse scenes with extensive ablations.

Hugging Face daily papersSep 3, 20:00 UTC · 12d agoAI research

Training and Finetuning Multi-Vector Embedding Models with Sentence Transformers

Hugging Face published a tutorial on training and finetuning multi-vector embedding models using the Sentence Transformers library.

Hugging Face's blog walks through training and finetuning multi-vector embedding models with Sentence Transformers. Multi-vector approaches store multiple vectors per document to support late-interaction retrieval. The post is a practical guide for developers building retrieval pipelines with the library.

Hugging Face BlogAug 26, 00:00 UTC · 21d agoAI tools & infra1

Cartesian – AI 3D Modeling for Design

Formas launches Cartesian, an AI 3D modeling tool for architecture and product design with natural-language editing and CAD exports.

Cartesian by Formas is an AI-powered 3D modeling tool aimed at architecture and product design that converts photos, rough plans, sketches, and scans into precise geometry. Users can edit models conversationally while explicitly preserved elements stay unchanged. It creates real solids and NURBS geometry and exports to AutoCAD DWG, Rhino 3DM, and SketchUp SKP, with BIM IFC support planned, removing the need for a separate desktop CAD license.

Hacker News · AISep 15, 15:26 UTC · 1d agoAI industry HN 42↑ · 32 comments

Can Foundation Models Moderate Online Content? Evaluating Instruction- vs. Example-Driven Policy Operationalization

ModerationBench shows foundation models can nearly triple Bluesky's moderation F1 (0.60 vs 0.22), with instruction- and example-driven guidance performing comparably.

Researchers built ModerationBench, a new benchmark of 4,000 manually annotated in-the-wild posts from Bluesky, to test whether foundation models can reliably operationalize content moderation policies. They systematically compare instruction-driven guidance (reasoning from policy precepts) with example-driven guidance (generalizing from precedents) for Vision-Language Models. Both paradigms achieve comparable peak effectiveness, and foundation models nearly triple the F1 of Bluesky's deployed moderation system on Random Posts (0.60 vs 0.22).

arXiv cs.AI / cs.LG / cs.CLSep 9, 16:30 UTC · 7d agoAI research1

CVE-2026-84939: Apache FreeMarker: A malformed locale may be exploitable for path traversal attacks

Apache FreeMarker CVE-2026-84939 permits path traversal via a malformed locale in template loading; fixed in FreeMarker 2.3.35.

A path traversal vulnerability in Apache FreeMarker's template loading mechanism can be triggered when an attacker controls a malformed locale value. FreeMarker 2.2.0 through 2.3.34 are affected for both the org.freemarker:freemarker and freemarker-gae artifacts, while 2.3.35 is unaffected. No exploitation or CVSS details were included in the announcement.

oss-securitySep 8, 15:27 UTC · 8d agoVulnerability CVE-2026-84939

Does Syntax Matter? A Graph-Augmented Variational Topic Model for Computational Social Sciences

SCPTM graph-augmented variational topic model shows syntax aids topic diversity and descriptor quality but gains stem mainly from the variational encoder.

The Structural Contextual Probabilistic Topic Model represents corpora as heterogeneous document-word graphs with lexical and syntactic edges processed by a Graph Attention Network inside a VAE for mixed-membership topic distributions. Across four corpora, neural gains in document-topic alignment are attributable to the variational encoder rather than syntax, while graph-augmented variants improve topic diversity everywhere. Dependency paths add value on argumentative deliberative texts but are redundant in technical and institutional registers.

arXiv cs.AI / cs.LG / cs.CLSep 7, 17:39 UTC · 8d agoAI research1

Foul Language: WordlistLoader Disguises Malware as Ordinary Text

ClickFix-style campaigns deploy WordlistLoader, which disguises malware as ordinary text, to deliver the increasingly prevalent Amatera infostealer.

Researchers describe WordlistLoader, a new loader that disguises malicious payloads as ordinary text or wordlist files to evade detection. It is being used in ClickFix-style social engineering campaigns to deliver Amatera, an increasingly prevalent infostealer. The obfuscation technique helps the campaign slip past file-type-based inspections.

Dark ReadingAug 24, 20:51 UTC · 22d agoMalware in the wild

What Matters, When? Diagnosing and Improving Conditional Visual Grounding in Visuomotor Imitation Policies

Researchers diagnose conditional visual grounding failures in visuomotor imitation policies and show targeted interventions substantially improve distractor robustness.

The paper studies why ACT-based visuomotor imitation policies fail when visually similar distractor objects or receptacles are introduced, finding sensitivity depends on both distractor type and manipulation stage. Interventions including distractor augmentation, phase-dependent attention regularization, and appearance-based visual prompting improve target selection while preserving spatial control information, with gains in simulation and on a physical UR3e. The same failure pattern is confirmed in a pretrained vision-language-action policy on a state-conditioned medical instrument-handling task.

arXiv cs.AI / cs.LG / cs.CLSep 4, 17:27 UTC · 11d agoAI research

Show HN: LLM Attention Visualization

A developer released a browser-based tool that visualizes which past tokens influence each LLM output token using aggregated, value-weighted attention scores.

A Show HN project presents a React application built on Transformers.js that renders per-token attention influence by aggregating attention weights scaled by value-vector magnitudes across all attention heads and layers. To expose internal tensors, the author instrumented the ONNX computation graph, hosted a modified model on Hugging Face, and pre-generated prompts to avoid long model downloads in the browser. Demos with a 600-million-parameter model show how verbatim copying draws heavily on source tokens and how single outputs blend information from multiple phrases.

Hacker News · AISep 8, 16:59 UTC · 8d agoAI tools & infra HN 41↑ · 9 comments

Re: Vulnerabilities fixed in libxml2-2.15.4

libxml2 2.15.4 patches two flaws including a heap buffer overflow in xmlDictAddQString tracked as CVE-2026-86137 and CVE-2026-86138.

libxml2 releases before 2.15.4 are affected by an integer overflow in xmlDictAddQString in dict.c that leads to a heap-based buffer overflow, tracked as CVE-2026-86137 and CVE-2026-86138. The oss-security post from Debian's Salvatore Bonaccorso flags the fixed release for downstream tracking. No exploitation is mentioned in the disclosure.

oss-securitySep 5, 12:16 UTC · 11d agoVulnerability CVE-2026-86137 CVE-2026-86138

Elementor Pro Flaw Could Let Unauthenticated Attackers Upload PHP and Execute Code

Patchstack disclosed CVE-2026-32475 (CVSS 9.0), an unauthenticated file-upload flaw in Elementor Pro enabling PHP upload and RCE; fixed in version 4.2.2.

Patchstack researcher Tin Pham reported an unrestricted file upload flaw in Elementor Pro's Forms module (CVE-2026-32475, CVSS 9.0), affecting all versions up to and including 4.2.1. Submitting two file parts for one field bypasses the extension blocklist and writes attacker-controlled PHP into a public uploads directory, yielding unauthenticated remote code execution when a published Elementor page uses a Form widget with a File Upload field. A patched version 4.2.2 shipped August 19, 2026, a day after WordPress 7.0.4 fixed CVE-2026-65640 (CVSS 8.8), an RCE via Postscript file upload when Imagick and Ghostscript are in use.

The Hacker NewsAug 20, 06:04 UTC · 27d agoVulnerability CVE-2026-32475 CVE-2026-656401

Multi-Vector (Late Interaction) Embedding Models with Sentence Transformers

Hugging Face details building and using multi-vector late-interaction embedding models with Sentence Transformers for retrieval workloads.

Hugging Face published a guide on multi-vector, late-interaction embedding models (ColBERT-style) supported through Sentence Transformers. The post covers how practitioners can build and use these models for retrieval and RAG pipelines. It is a developer tooling and technique write-up, not a security advisory.

Hugging Face BlogAug 18, 00:00 UTC · 29d agoAI tools & infra1

Retrofitting Code Using LLMs to Support Exceptional Behavior

EXCODER combines static/dynamic analysis with LLMs to retrofit exception-handling code, achieving 85.92% pass@1 with Qwen 2.5 Coder 32B on Java benchmarks.

The paper introduces the task of retrofitting existing code with Exception Related Code (throw statements, guarding conditions, try/catch blocks) so that given Exceptional Behavior Tests pass. EXCODER performs context engineering by integrating static and dynamic program analysis output with LLMs; it was evaluated on a benchmark built from 304 methods across 75 GitHub Java projects. Combined with Qwen 2.5 Coder 32B, EXCODER achieves pass@1, 5, and 10 rates of 85.92%, 86.18%, and 86.51%, roughly 13 percentage points over baseline, and manual inspection reveals remaining limitations.

arXiv cs.AI / cs.LG / cs.CLSep 9, 16:18 UTC · 7d agoAI research1

Hackers Actively Exploit Critical WooCommerce Plugin Vulnerability to Upload PHP Backdoors

Attackers actively exploit CVE-2026-27540 (CVSS 9.8) in WooCommerce Wholesale Lead Capture plugin to upload PHP webshells; patch shipped in version 2.0.3.2.

CVE-2026-27540 (CVSS 9.8) in the WooCommerce Wholesale Lead Capture plugin affects versions 2.0.3.1 and earlier across roughly 6,000 active installations. The unauthenticated AJAX handler wwlc_file_upload_handler trusts a client-supplied file_settings allowlist, letting attackers upload shell.php for remote code execution. Wordfence has blocked more than 100,000 exploit attempts since disclosure, with spikes in June, July, and August 2026. The vendor fixed the flaw in version 2.0.3.2.

GBHackersupdated 15:00 UTC · 2h agofirst Sep 15, 12:05 UTC · 1d agoExploit / PoC in the wild 6 sources CVE-2026-27540

Ask HN: How do you manage skills files?

A Hacker News thread debates whether agent skill files are worth managing, citing 2–4x output-token reductions on flagship models in one company's testing.

Commenters argue skills are stored prompts that help less-technical users compensate for weak prompting, while one participant reports company testing found skills reduce flagship-model output tokens by roughly 2–4x, a gap growing with newer models. Others note skills can bundle reusable scripts and inline commands for deterministic context building, and that harnesses now execute backticked commands before the agent sees the skill. Some argue improving model capability makes downloadable skills redundant.

Hacker News · securitySep 6, 19:27 UTC · 9d agoAI tools & infra HN 303↑ · 271 comments

Rosetta at AlexandriaX-2026: LoRA-Adapted NileChat for Context-Aware Dialectal Arabic Dialogue Translation

Rosetta ranks 4th and 5th in AlexandriaX-2026 dialectal Arabic dialogue translation using a LoRA adapter on NileChat-3B, finding limited pretraining benefit.

The Rosetta system for the AlexandriaX-2026 shared task fine-tunes a LoRA adapter on NileChat-3B for context-aware English-to-dialectal Arabic dialogue translation. The adapter was additionally pretrained on MADAR and PADIC dialect corpora for the unconstrained track. It achieved spBLEU 26.10 (4th, constrained) and 25.09 (5th, unconstrained). External dialect pretraining improved only two of thirteen dialects while slightly degrading overall performance, indicating negative transfer.

arXiv cs.AI / cs.LG / cs.CLSep 9, 16:15 UTC · 7d agoAI research1

What Is a Website Attack Surface? A Beginner’s Guide to Reducing Risk

Sucuri's beginner guide explains how logins, plugins, APIs, and forgotten backups expand a website's attack surface and how to reduce that risk.

Sucuri published educational guidance explaining that login pages, contact forms, plugins, APIs, staging sites, and forgotten backups each add exposed components that constitute a website's attack surface. The article frames continuous attack surface reduction as a risk management practice for website owners. It is evergreen educational content rather than breaking incident news.

Sucuri BlogAug 19, 20:06 UTC · 27d agoIndustry

[20260805] - Core - Improper ACL checks for category webservice endpoints

Joomla fixes CVE-2026-72532, an improper ACL check letting unauthorized users create categories via webservice endpoints, in CMS 5.4.8/6.1.3.

Joomla disclosed an incorrect access control flaw (CVE-2026-72532) in category webservice endpoints, allowing unauthorized users to create categories for inaccessible components. It affects Joomla CMS 4.0.0-5.4.7 and 6.0.0-6.1.2 and is rated moderate impact and severity with low probability. The fix ships in Joomla 5.4.8 and 6.1.3 on 2026-08-18; it was reported by Amin Isayev and Geo.

Joomla Security CentreAug 17, 14:00 UTC · Aug 17, 2026Advisory CVE-2026-72532