.   . . t h e d e a d . d o g ...
                                                    :
                                  ...c D d . . .. .  . .  .
            /\                  :                        .                  /\
           /  \  .              . .:: :::::::::::::::::. :              .  /  \
          / /\ \.::.            : ..:.:::::::::::::::::: :            .::./ /\ \
         / /  \::::::..         : :::.::::: ..`::::::::. :         ..::::::/  \ \
        / /    `:::::::::.......: :::::::::::::::::::::: :.......:::::::::'    \ \
       / /  cDd  `::::::::::::::: ::::::::::::::::::::'.::::::::::::::::'  ACiD \ \
      /_/         `:::::. `:::::: ::::::::::::::::::' .::::::' .::::::'          \_\
        |          ::::::..  ` ```::::''    ` :'    ``::::'''  ..::::::          |
        |          ::::::::::.....           .          .....::::::::::          |
        |         .::::::::::::::: :'   [ x ]   [ x ]  `:::::::::::::::.         |
        \        .::::::::::::::::.                      .::::::::::::::.        /
         \       | `::::::.:::::::: :.      ____      .::::::::::::::::'|       /
          \___   |     ` .. ....... :: .   /    \   .::: ....... .. '   |   ___/
              \  |                 : ::::. \____/ .:::: :               |  /
               \ |                 : ::::::_||||_:::::: :               | /
                \|                 . :: /\_/ \/ \_/\ :: .               |/
                                     :: \/ \_/\_/ \/ ::
                                     `::.          .::'
                                   8===8 `::::::::' 8===8

         _________________________/ - x X x - \________________________

                        /\___/\               .-. _)/
        _   _          / @   x \             (x,x) .\
       /_\_/_\       /\__\_V_/__/\            (u)   ()        /_\_/_\
       [ x x ]      /    8===8    \     _\)  .-="=-.//        [ - x ]
        \_Y_/       \/\/\/w w\/\/\/      \,//==\===            \_Y_/
        (' ')                             ()  =====            (' ')
       .-(U)-.  \(_           .-.         _____ =,=           .-(U)-.
      //==I==\\,/            (x.x)       ()--___(0V0)        //==I==\\
cDd // CULT OF THE DEAD DOG // CYBER INTEL & BUG BOUNTY WIRE • "Latrando, Vulnera Invenio"
[ STACK: 216 items (0.5 MiB / 16 GiB cap) ] [ NEWS: 47 | X: 110 | GIT: 59 ] [ SYNC: 2026-11-14 10:53 UTC ] [ AI: opencode-go/deepseek-v4.1-flash ]
[ RESET ]
=== [ DEEPSEEK FLASH BRIEF // THIS MONTH // LAST 30 DAYS ] ===2026-11-14 08:59 UTC (opencode-go/deepseek-v4.1-flash)
  • WordPress 7.1.4 (Oct 28, 2026) patched 22 flaws including an unauthenticated race-condition RCE in the core upgrade path, and Wordfence is already seeing active probing for it — this is the highest-urgency item in the window [Ram Gall / Wordfence].
  • Two infrastructure-grade RCEs landed back-to-back: Apache HTTP/2 CVE-2026-119618 (mod_http2, RCE) and the Brotli CVE-2026-111497 "HTTP2Shell" chain — both directly relevant to shared WordPress hosting where nobody controls the httpd build [Wordfence].
  • @albinowax dropped three bangers: CSP allow-list abuse for credential theft ("Blind trust"), a CRLF-powered desync check that escalates plain header injection to critical via a single prompt, and "Scalable Vector Grief" — 6 of 8 SVG sanitizers bypassed, with a response *header* alone executing JS in Firefox [James Kettle].
  • WordPress ecosystem volume remains brutal: 497 vulns across 312 plugins in one week, 549 the week prior — plugin-level hunting is still a numbers game with a very low signal bar [Wordfence Intelligence].
  • Critical Thinking Ep. 200 (Cloud Hacking w/ Nick Copi) and Ep. 197 ("800 Bugs w/ DeepSeek + Local Model Hacks") are the two episodes worth your time — cloud threat-model framing and local-model-driven bug volume [Critical Thinking Podcast].
  • @rez0__ took 2nd overall at Google Bugswat Singapore against ~50 hackers — worth watching what he publishes next [@rez0__].
  • GitHub signal is dominated by @xssdoctor's Git client-side fixture corpus and @vitorfhc's "negative-day" pre-CVE detector — both are pre-disclosure hunting machinery, not retro PoCs.
=== [ POSSIBILITIES & HUNTING ANGLES // THIS MONTH // LAST 30 DAYS ] ===75 sources analyzed
  • Git client-side RCE/escape sweep: @xssdoctor's fixture set now covers unborn HEAD symref escape (CVE-2026-113408), partial-clone promisor `upload-pack` execution (CVE-2024-32004), submodule hook injection (CVE-2025-48384), and option-injection via filenames beginning with `-`. Audit every service that clones attacker-influenced repos: CI runners, dependency bots, IDE/SCM plugins, monorepo vendoring scripts, AI coding agents with `git clone` tools. Build a argv-fuzzing shim that wraps `git` and logs missing `--` terminators.
  • CSP allow-list → credential theft (per @albinowax "Blind trust"): enumerate targets whose CSP whitelists third-party hosts, then diff those hosts for JSONP endpoints, open redirects, user-content subdomains, and Angular/library sinks. Pair with [renniepak/CSPBypass]'s fresh matcher fix for scheme-relative and multi-directive policies — its parser was just corrected, meaning previously-missed policies now resolve.
  • CRLF header-injection escalation: @albinowax's new check turns boring header injection into desync. Re-audit every parameter that lands in a response or forwarded header — filename fields, redirect/locale params, `X-Forwarded-Host`, CDN cache keys — and instrument a crawler to flag any reflected CR/LF into headers, then test for response splitting and cache poisoning rather than blind XSS.
  • SVG sanitizer bypass at scale: test upload/preview pipelines against the "Scalable Vector Grief" methodology — the kill shot isn't in the XML, it's in how the response is *served*. Focus on attacker-influenced `Content-Type`, `Content-Disposition`, multipart, and charset headers on any endpoint that reflects user SVG (avatars, invoices, e-signature, chart export).
  • Shared-hosting HTTP/2 & Brotli blast radius: mass-fingerprint mod_http2 versions and Brotli handling behind WordPress/asset hosts, prioritize multi-tenant hosts where a single httpd RCE = hundreds of tenants. Build a low-noise h2 prober that avoids crashing production.
  • Upgrade-window race replication: WordPress's unauthenticated TOCTOU in the core updater is a pattern, not a one-off. Hunt the same shape in plugin/theme auto-updaters, WP-CLI wrappers, and other PHP CMSes (Joomla/Drupal/October) — look for update flows that write-then-verify with an attacker-observable window and no locking.
  • Negative-day pipeline (inspired by @vitorfhc/videt): watch high-value OSS repos for commits that touch sanitizers, parsers, authz, or deserializers with no CVE, no advisory, and terse messages. Auto-diff, auto-classify exploitability, auto-draft a PoC skeleton — you beat the advisory feed by days.
  • MCP/agent attack surface: [assetnote/assetnote-mcp-server-public-docs] documents an AI-to-attack-surface bridge, and [7urb0/intent-anchor] exists precisely because agents drift from constraints. Test MCP servers for prompt-injection → privileged-action chains, and probe approval boundaries where "read-only" tools can be steered into mutations.
=== [ CYBER NEWS, RESEARCH BLOGS & PODCASTS (THIS MONTH // LAST 30 DAYS) ] ===28 items
NEWS/BLOG • Ram Gall2026-11-12 16:38 UTC
Wordfence Intelligence Weekly WordPress Vulnerability Report (November 2, 2026 to November 8, 2026)
Wordfence's weekly report tallies 497 vulnerabilities across 312 WordPress plugins and one theme, contributed by 218 researchers, highlighting plugin-heavy disclosure volume.
[ SOURCE -> ]
[ + RAW EXCERPT ]
Last week, there were 497 vulnerabilities disclosed in 312 WordPress Plugins and 1 WordPress Theme that have been added to the Wordfence Intelligence Vulnerability Database, and there were 218 Vulnerability Researchers that contributed to WordPress Security last week. The post Wordfence Intelligence Weekly WordPress Vulnerability Report (November 2, 2026 to November 8, 2026) appeared first on Wordfence .
NEWS/BLOG • Ram Gall2026-11-12 14:39 UTC
PSA: Critical Apache HTTP/2 Vulnerability: What WordPress Site Owners Should Know
Critical Apache HTTP/2 flaw CVE-2026-119618 can enable remote code execution; WordPress owners on Apache should confirm their host has applied the fix.
[ SOURCE -> ]
[ + RAW EXCERPT ]
Apache has released a fix for a critical vulnerability in the HTTP/2 module of Apache HTTP Server. The issue, CVE-2026-119618, can lead to remote code execution on affected servers. If your WordPress site is hosted on Apache, check your host’s website or announcements to see if they have already fixed this. If you can’t find ... Read More The post PSA: Critical Apache HTTP/2 Vulnerability: What WordPress Site Owners Should Know appeared first on Wordfence .
PODCAST • Critical Thinking Podcast (Mirror)2026-11-12 10:00 UTC
Episode 200: Cloud Hacking w/ Nick Copi
Critical Thinking episode discusses cloud hacking scope, threat models, and how providers and attackers can use or misuse cloud services.
[ SOURCE -> ]
[ + RAW EXCERPT ]
Episode 200: In this episode of Critical Thinking - Bug Bounty Podcast JD sits down with Nick Copi to pick his brain about Cloud Hacking. They talk through what actually qualifies and the cloud, threat models, and how providers can use and misuse cloud services. Follow us on twitter at: https://x.com/ctbbpodcast Got any ideas and suggestions? Feel free to send us any feedback here: info@criticalthinkingpodcast.io Shoutout to YTCracker for the awesome intro music! ====== Links ====== Follow your hosts Rhynorater, rez0 and gr3pme on X: https://x.com/Rhynorater https://x.com/rez0__ https://x.com/gr3pme Critical Research Lab: https://lab.ctbb.show/ Need a Pentest? We just launched CTBB Pentests! https://pentest.ctbb.show/ Hack full time? Check out the Full-Time Hunter’s Guild! https://ctbb.show/fthg ====== Ways to Support CTBBPodcast ====== Hop on the CTBB Discord at https://ctbb.show/discor...
NEWS/BLOG • James Kettle (albinowax)2026-11-11 14:26 UTC
Blind trust: stealing credentials through CSP
PortSwigger research shows CSP can be bypassed when an allow-listed domain hosts exploitable gadgets or endpoints, enabling credential theft despite the policy.
[ SOURCE -> ]
[ + RAW EXCERPT ]
Content Security Policy is supposed to be the safety net that stops an HTML injection from turning into XSS. Usually it works. But sometimes it doesn't, because the policy allows-lists a domain that h
NEWS/BLOG • Daniel Miessler2026-11-10 21:50 UTC
The Bitter Wall
Miessler argues model output quality plateaus at a "Bitter Wall" set by what users can articulate, and better harness/context can raise that ceiling.
[ SOURCE -> ]
[ + RAW EXCERPT ]
A chart of output quality against model intelligence: a purple curve rises steeply, then flattens under a brick wall labeled The Bitter Wall, whose height is marked What you can articulate; a teal arrow labeled Better articulation: harness + context lifts the ceiling to a higher dashed line, and a d...
NEWS/BLOG • Ram Gall2026-11-10 18:27 UTC
What’s New in Wordfence 9.1.0: Security News, Faster Rules and Smarter Alerts
Wordfence 9.1.0 adds a security news widget, faster firewall rule updates, sharper request parsing, logging for app-password/REST API login failures, and configurable alert thresholds.
[ SOURCE -> ]
[ + RAW EXCERPT ]
Wordfence 9.1.0 is now available. It adds the new Wordfence Security News Widget, which brings the latest WordPress security alerts and research to your dashboard, plus faster firewall rule updates, sharper request parsing, Live Traffic logging for application password and REST API login failures, and configurable attack alert thresholds. The post What’s New in Wordfence 9.1.0: Security News, Faster Rules and Smarter Alerts appeared first on Wordfence .
NEWS/BLOG • Daniel Miessler2026-11-07 19:30 UTC
The Bitter Lesson, Generalized
Miessler generalizes the Bitter Lesson, suggesting general methods that scale with compute/context outperform hand-crafted, domain-specific approaches.
[ SOURCE -> ]
[ + RAW EXCERPT ]
A charcoal sketch of an ornate carved stone gate whose emblem, a giant stone hand raised palm-out in refusal, has been split by the roots of a huge tree whose crown towers over the gate/images/bitter-lesson-generalized-header.webp/images/bitter-lesson-generalized-header.webp Just had a thought tha...
NEWS/BLOG • Daniel Miessler2026-11-07 18:38 UTC
Vibe Coding Isn't Using AI to Make Things
Miessler argues "vibe coding" is not merely using AI to build things; the distinction centers on working inside an open, inspectable engine versus relying on a sealed black box.
[ SOURCE -> ]
[ + RAW EXCERPT ]
Two builders with the same AI arm feeding both engines: one works inside the open engine, the other leans on a sealed purple box/images/vibe-coding-isnt-using-ai.webp/images/vibe-coding-isnt-using-ai.webp Slight ok medium-sized pet peeve here. Vibe Coding isn't using AI to make things. Vibe Codi...
NEWS/BLOG • Ram Gall2026-11-05 17:28 UTC
Wordfence Intelligence Weekly WordPress Vulnerability Report (October 26, 2026 to November 1, 2026)
Last week, there were 549 vulnerabilities disclosed in 351 WordPress Plugins and 4 WordPress Themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 222 Vulnerability Researchers that contributed to WordPress Security last week. Review those vulnerabilities in this report now to ensure your site is not affected. The post Wordfence Intelligence Weekly WordPress Vulnerability Report (October 26, 2026 to November 1, 2026) appeared first on Wordfence .
[ SOURCE -> ]
NEWS/BLOG • Ram Gall2026-11-05 15:52 UTC
Attackers Actively Probing for Upgrade-Window RCE Vulnerability in WordPress Core
On October 28th, 2026, the WordPress Security Team released WordPress 7.1.4, along with backported security releases for older branches, addressing several security issues, most notably an Unauthenticated Remote Code Execution vulnerability in WordPress core, identified as CVE-2026-119977. The vulnerability affects WordPress core versions 4.7 through 7.1.3 and can be leveraged by unauthenticated attackers to execute code on the server during a core upgrade, which can lead to complete site compromise. The post Attackers Actively Probing for Upgrade-Window RCE Vulnerability in WordPress Core appeared first on Wordfence .
[ SOURCE -> ]
PODCAST • Critical Thinking Podcast (Mirror)2026-11-05 10:00 UTC
Episode 199: Hardware LHE Rehash
Episode 199: In this episode of Critical Thinking - Bug Bounty Podcast Justin, Brandyn and JD reflect on their experience at a Hardware LHE. They cover some of the bugs they found, what their prep time looked like, and using AI in IoT hacking. Follow us on twitter at: https://x.com/ctbbpodcast Got any ideas and suggestions? Feel free to send us any feedback here: info@criticalthinkingpodcast.io Shoutout to YTCracker for the awesome intro music! ====== Links ====== Follow your hosts Rhynorater, rez0 and gr3pme on X: https://x.com/Rhynorater https://x.com/rez0__ https://x.com/gr3pme Critical Research Lab: https://lab.ctbb.show/ Need a Pentest? We just launched CTBB Pentests! https://pentest.ctbb.show/ Hack full time? Check out the Full-Time Hunter’s Guild! https://ctbb.show/fthg ====== Ways to Support CTBBPodcast ====== Hop on the CTBB Discord at https://ctbb.show/discord ! We also do Disc...
[ SOURCE -> ]
NEWS/BLOG • Daniel Miessler2026-11-04 20:00 UTC
Focus on Problems Instead of Companies
Charcoal sketch of a person kneeling to repair a neighbour's hand water pump with a softly glowing tool while the neighbour fills a bucket, a quiet purple office tower standing in the background/images/focus-on-problems-not-companies-v2.webp/images/focus-on-problems-not-companies-v2.webp A thought...
[ SOURCE -> ]
NEWS/BLOG • Daniel Miessler2026-11-04 17:30 UTC
The Hard Problem of Jealousy and the Easy Problem of Consciousness
A robot head cut open: its eyes feed a projector that throws a flame onto a screen, and one person sits in a chair watching/images/hard-problem-of-jealousy.webp/images/hard-problem-of-jealousy.webp 📃 I intent to massively simplify this argument soon. It's ok, but far too wandering for my taste. ...
[ SOURCE -> ]
NEWS/BLOG • James Kettle (albinowax)2026-11-04 15:12 UTC
Making HTTP header injection critical with one prompt
You can now escalate HTTP header injection to a CRLF-Powered Desync and exploit it to serve random users a redirect to your collaborator, in a single prompt. We’ve just introduced a new scan check for
[ SOURCE -> ]
NEWS/BLOG • Ram Gall2026-11-03 15:44 UTC
Wordfence Price Increase Coming December 3, 2026
On Thursday, December 3, 2026, pricing for Wordfence Premium, Care, and Response will increase. We’re announcing this change a month in advance so you have time to purchase new licenses or renew eligible subscriptions at current pricing. Existing licenses can be renewed up to one year before their expiration dates. Purchase or renew before December 3 to take advantage of current pricing. The post Wordfence Price Increase Coming December 3, 2026 appeared first on Wordfence .
[ SOURCE -> ]
NEWS/BLOG • Ram Gall2026-11-02 15:48 UTC
HTTP2Shell: What the Critical Brotli Vulnerability Means for WordPress Sites
On October 22, 2026, Google published CVE-2026-111497, a critical vulnerability in Brotli, one day after the Brotli project released fixed versions. The vulnerability has circulated under several unofficial names, including HTTP2Shell, Node2Shell, and Brotli2Shell. The post HTTP2Shell: What the Critical Brotli Vulnerability Means for WordPress Sites appeared first on Wordfence .
[ SOURCE -> ]
NEWS/BLOG • Daniel Miessler2026-11-01 20:00 UTC
The Post-AI Security Floor
Hand-drawn diagram titled The Post-AI Security Floor with three numbered steps: know everything you have shipped, get it off the open internet, and lean on big vendors instead of small ones/images/post-ai-security-floor-diagram.webp/images/post-ai-security-floor-diagram.webp I have some critical r...
[ SOURCE -> ]
PODCAST • Critical Thinking Podcast (Mirror)2026-10-31 09:00 UTC
Episode 198: Scariest Bugs of 2026 - Halloween Special
Episode 198: In this episode of Critical Thinking - Bug Bounty Podcast we're back with the spookiest bug stories we've had this year. We're talking government hacks, summoning global agents, low payouts/long triage times, and possibly the scariest thing of all for us: Dealing with JD's technical issues... Follow us on twitter at: https://x.com/ctbbpodcast Got any ideas and suggestions? Feel free to send us any feedback here: info@criticalthinkingpodcast.io Shoutout to YTCracker for the awesome intro music! ====== Links ====== Follow your hosts Rhynorater, rez0 and gr3pme on X: https://x.com/Rhynorater https://x.com/rez0__ https://x.com/gr3pme https://x.com/xssdoctor Critical Research Lab: https://lab.ctbb.show/ Need a Pentest? We just launched CTBB Pentests! https://pentest.ctbb.show/ Hack full time? Check out the Full-Time Hunter’s Guild! https://ctbb.show/fthg ====== Ways to Support CT...
[ SOURCE -> ]
NEWS/BLOG • Daniel Miessler2026-10-30 20:00 UTC
Your Energy Level Changes How You See the World
A slumped figure sits beside a dim ember in the deep purple shadow of a stone tower, while the same figure climbs its lit face holding a lantern high/images/energy-changes-the-frames.webp/images/energy-changes-the-frames.webp I think so much of winning at life comes down to something that's hard t...
[ SOURCE -> ]
NEWS/BLOG • Ram Gall2026-10-29 21:58 UTC
WordPress 7.1.4 Patches Unauthenticated Upgrade-Window RCE; Exploitation Attempts Detected After Release
WordPress 7.1.4 was released on October 28, 2026. According to WordPress, it includes fixes for 22 security vulnerabilities. The most serious is an unauthenticated race condition in the Core update process that can lead to remote code execution. Threat actors are already actively attempting to exploit it, so site owners should verify that WordPress has updated to 7.1.4 or the corresponding security release for their branch. The post WordPress 7.1.4 Patches Unauthenticated Upgrade-Window RCE; Exploitation Attempts Detected After Release appeared first on Wordfence .
[ SOURCE -> ]
NEWS/BLOG • Ram Gall2026-10-29 19:20 UTC
Wordfence Bug Bounty Program Monthly Report – July 2026
In July 2026, the Wordfence Bug Bounty Program received 1077 vulnerability submissions from our growing community of security researchers working to improve the overall security posture of the WordPress ecosystem. These submissions are reviewed, triaged, and processed by the Wordfence Threat Intelligence team, with validated vulnerabilities responsibly disclosed to vendors, often through the Wordfence Vulnerability ... Read More The post Wordfence Bug Bounty Program Monthly Report – July 2026 appeared first on Wordfence .
[ SOURCE -> ]
NEWS/BLOG • Daniel Miessler2026-10-29 16:30 UTC
General Hill-Climbing: The One Main Loop in AI
A charcoal sketch of a figure climbing a steep slope toward a glowing Ideal State at the summit, past verification points along the path/images/general-hill-climbing-header.webp/images/general-hill-climbing-header.webp 💡There is basically One Main Loop in AI, and it applies to everything from bui...
[ SOURCE -> ]
NEWS/BLOG • Ram Gall2026-10-29 15:40 UTC
Wordfence Intelligence Weekly WordPress Vulnerability Report (October 19, 2026 to October 25, 2026)
Last week, there were disclosed in and that have been added to the Wordfence Intelligence Vulnerability Database, and there were that contributed to WordPress Security last week. Review those vulnerabilities in this report now to ensure your site is not affected. Our mission with Wordfence Intelligence is to make valuable vulnerability information easily accessible to ... Read More The post Wordfence Intelligence Weekly WordPress Vulnerability Report (October 19, 2026 to October 25, 2026) appeared first on Wordfence .
[ SOURCE -> ]
NEWS/BLOG • James Kettle (albinowax)2026-10-27 14:29 UTC
Scalable Vector Grief
I tested eight popular SVG sanitizers and bypassed six of them. In this post, I'll show you how a response header can run JavaScript in Firefox even when the response body is completely harmless XML.
[ SOURCE -> ]
NEWS/BLOG • Daniel Miessler2026-10-25 15:46 UTC
I'm on Team Explanation
A charcoal cutaway barn: a turkey professor points at a chart of sunrise feeding times while, inside, a farmer sharpens an axe beside roasting pans./images/team-explanation.webp/images/team-explanation.webp There are two major ways of assessing the quality of our understanding of a phenomenon: Pre...
[ SOURCE -> ]
NEWS/BLOG • Daniel Miessler2026-10-25 01:28 UTC
Models Are the How, Harnesses Are the What
A person hands their preferences, context, goals and how they like things done to a harness labeled the what, which feeds a model labeled the how, which produces a result that returns to the person; both harness and model point up at a hilltop flag labeled what you want/images/models-how-harnesses-w...
[ SOURCE -> ]
NEWS/BLOG • Daniel Miessler2026-10-23 19:40 UTC
Writing Is Closer to Thought Than Code
Three framed plates in a row, each separated by a dashed line. Plate one, the source: a head with a glowing purple crystal in its mind, labeled 1 idea, human thought. An arrow marked articulate leads to plate two, the first derivative: a handwritten page with a lighter sketch of the same head, label...
[ SOURCE -> ]
PODCAST • Critical Thinking Podcast (Mirror)2026-10-22 09:00 UTC
Episode 197: 800 Bugs w/ DeepSeek + Local Model Hacks
Episode 197: In this episode of Critical Thinking - Bug Bounty Podcast Joseph, Brandyn, and Ads serve up some tips on how they’re using local AI Models and optimizing their hardware. Follow us on twitter at: https://x.com/ctbbpodcast Got any ideas and suggestions? Feel free to send us any feedback here: info@criticalthinkingpodcast.io Shoutout to YTCracker for the awesome intro music! ====== Links ====== Follow your hosts Rhynorater, rez0 and gr3pme on X: https://x.com/Rhynorater https://x.com/rez0__ https://x.com/gr3pme Critical Research Lab: https://lab.ctbb.show/ Need a Pentest? We just launched CTBB Pentests! https://pentest.ctbb.show/ Hack full time? Check out the Full-Time Hunter’s Guild! https://ctbb.show/fthg ====== Ways to Support CTBBPodcast ====== Hop on the CTBB Discord at https://ctbb.show/discord ! We also do Discord subs at $25, $10, and $5 - premium subscribers get access...
[ SOURCE -> ]
Wordfence Intelligence Weekly WordPress Vulnerability Report (November 2, 2026 to November 8, 2026)
SOURCE: Ram Gall • ROLE: Guest • PUBLISHED: 2026-11-12 16:38 UTC
[ DEEPSEEK FLASH ANALYSIS ]:
Wordfence's weekly report tallies 497 vulnerabilities across 312 WordPress plugins and one theme, contributed by 218 researchers, highlighting plugin-heavy disclosure volume.
[ CACHED SOURCE EXCERPT ]:
Last week, there were 497 vulnerabilities disclosed in 312 WordPress Plugins and 1 WordPress Theme that have been added to the Wordfence Intelligence Vulnerability Database, and there were 218 Vulnerability Researchers that contributed to WordPress Security last week. The post Wordfence Intelligence Weekly WordPress Vulnerability Report (November 2, 2026 to November 8, 2026) appeared first on Wordfence .
[ OPEN ORIGINAL URL -> ]
PSA: Critical Apache HTTP/2 Vulnerability: What WordPress Site Owners Should Know
SOURCE: Ram Gall • ROLE: Guest • PUBLISHED: 2026-11-12 14:39 UTC
[ DEEPSEEK FLASH ANALYSIS ]:
Critical Apache HTTP/2 flaw CVE-2026-119618 can enable remote code execution; WordPress owners on Apache should confirm their host has applied the fix.
[ CACHED SOURCE EXCERPT ]:
Apache has released a fix for a critical vulnerability in the HTTP/2 module of Apache HTTP Server. The issue, CVE-2026-119618, can lead to remote code execution on affected servers. If your WordPress site is hosted on Apache, check your host’s website or announcements to see if they have already fixed this. If you can’t find ... Read More The post PSA: Critical Apache HTTP/2 Vulnerability: What WordPress Site Owners Should Know appeared first on Wordfence .
[ OPEN ORIGINAL URL -> ]
Episode 200: Cloud Hacking w/ Nick Copi
SOURCE: Critical Thinking Podcast (Mirror) • ROLE: Official Show • PUBLISHED: 2026-11-12 10:00 UTC
[ DEEPSEEK FLASH ANALYSIS ]:
Critical Thinking episode discusses cloud hacking scope, threat models, and how providers and attackers can use or misuse cloud services.
[ CACHED SOURCE EXCERPT ]:
Episode 200: In this episode of Critical Thinking - Bug Bounty Podcast JD sits down with Nick Copi to pick his brain about Cloud Hacking. They talk through what actually qualifies and the cloud, threat models, and how providers can use and misuse cloud services. Follow us on twitter at: https://x.com/ctbbpodcast Got any ideas and suggestions? Feel free to send us any feedback here: info@criticalthinkingpodcast.io Shoutout to YTCracker for the awesome intro music! ====== Links ====== Follow your hosts Rhynorater, rez0 and gr3pme on X: https://x.com/Rhynorater https://x.com/rez0__ https://x.com/gr3pme Critical Research Lab: https://lab.ctbb.show/ Need a Pentest? We just launched CTBB Pentests! https://pentest.ctbb.show/ Hack full time? Check out the Full-Time Hunter’s Guild! https://ctbb.show/fthg ====== Ways to Support CTBBPodcast ====== Hop on the CTBB Discord at https://ctbb.show/discor...
[ OPEN ORIGINAL URL -> ]
Blind trust: stealing credentials through CSP
SOURCE: James Kettle (albinowax) • ROLE: Guest • PUBLISHED: 2026-11-11 14:26 UTC
[ DEEPSEEK FLASH ANALYSIS ]:
PortSwigger research shows CSP can be bypassed when an allow-listed domain hosts exploitable gadgets or endpoints, enabling credential theft despite the policy.
[ CACHED SOURCE EXCERPT ]:
Content Security Policy is supposed to be the safety net that stops an HTML injection from turning into XSS. Usually it works. But sometimes it doesn't, because the policy allows-lists a domain that h
[ OPEN ORIGINAL URL -> ]
The Bitter Wall
SOURCE: Daniel Miessler • ROLE: Guest • PUBLISHED: 2026-11-10 21:50 UTC
[ DEEPSEEK FLASH ANALYSIS ]:
Miessler argues model output quality plateaus at a "Bitter Wall" set by what users can articulate, and better harness/context can raise that ceiling.
[ CACHED SOURCE EXCERPT ]:
A chart of output quality against model intelligence: a purple curve rises steeply, then flattens under a brick wall labeled The Bitter Wall, whose height is marked What you can articulate; a teal arrow labeled Better articulation: harness + context lifts the ceiling to a higher dashed line, and a d...
[ OPEN ORIGINAL URL -> ]
What’s New in Wordfence 9.1.0: Security News, Faster Rules and Smarter Alerts
SOURCE: Ram Gall • ROLE: Guest • PUBLISHED: 2026-11-10 18:27 UTC
[ DEEPSEEK FLASH ANALYSIS ]:
Wordfence 9.1.0 adds a security news widget, faster firewall rule updates, sharper request parsing, logging for app-password/REST API login failures, and configurable alert thresholds.
[ CACHED SOURCE EXCERPT ]:
Wordfence 9.1.0 is now available. It adds the new Wordfence Security News Widget, which brings the latest WordPress security alerts and research to your dashboard, plus faster firewall rule updates, sharper request parsing, Live Traffic logging for application password and REST API login failures, and configurable attack alert thresholds. The post What’s New in Wordfence 9.1.0: Security News, Faster Rules and Smarter Alerts appeared first on Wordfence .
[ OPEN ORIGINAL URL -> ]
The Bitter Lesson, Generalized
SOURCE: Daniel Miessler • ROLE: Guest • PUBLISHED: 2026-11-07 19:30 UTC
[ DEEPSEEK FLASH ANALYSIS ]:
Miessler generalizes the Bitter Lesson, suggesting general methods that scale with compute/context outperform hand-crafted, domain-specific approaches.
[ CACHED SOURCE EXCERPT ]:
A charcoal sketch of an ornate carved stone gate whose emblem, a giant stone hand raised palm-out in refusal, has been split by the roots of a huge tree whose crown towers over the gate/images/bitter-lesson-generalized-header.webp/images/bitter-lesson-generalized-header.webp Just had a thought tha...
[ OPEN ORIGINAL URL -> ]
Vibe Coding Isn't Using AI to Make Things
SOURCE: Daniel Miessler • ROLE: Guest • PUBLISHED: 2026-11-07 18:38 UTC
[ DEEPSEEK FLASH ANALYSIS ]:
Miessler argues "vibe coding" is not merely using AI to build things; the distinction centers on working inside an open, inspectable engine versus relying on a sealed black box.
[ CACHED SOURCE EXCERPT ]:
Two builders with the same AI arm feeding both engines: one works inside the open engine, the other leans on a sealed purple box/images/vibe-coding-isnt-using-ai.webp/images/vibe-coding-isnt-using-ai.webp Slight ok medium-sized pet peeve here. Vibe Coding isn't using AI to make things. Vibe Codi...
[ OPEN ORIGINAL URL -> ]
Wordfence Intelligence Weekly WordPress Vulnerability Report (October 26, 2026 to November 1, 2026)
SOURCE: Ram Gall • ROLE: Guest • PUBLISHED: 2026-11-05 17:28 UTC
[ CACHED SOURCE EXCERPT ]:
Last week, there were 549 vulnerabilities disclosed in 351 WordPress Plugins and 4 WordPress Themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 222 Vulnerability Researchers that contributed to WordPress Security last week. Review those vulnerabilities in this report now to ensure your site is not affected. The post Wordfence Intelligence Weekly WordPress Vulnerability Report (October 26, 2026 to November 1, 2026) appeared first on Wordfence .
[ OPEN ORIGINAL URL -> ]
Attackers Actively Probing for Upgrade-Window RCE Vulnerability in WordPress Core
SOURCE: Ram Gall • ROLE: Guest • PUBLISHED: 2026-11-05 15:52 UTC
[ CACHED SOURCE EXCERPT ]:
On October 28th, 2026, the WordPress Security Team released WordPress 7.1.4, along with backported security releases for older branches, addressing several security issues, most notably an Unauthenticated Remote Code Execution vulnerability in WordPress core, identified as CVE-2026-119977. The vulnerability affects WordPress core versions 4.7 through 7.1.3 and can be leveraged by unauthenticated attackers to execute code on the server during a core upgrade, which can lead to complete site compromise. The post Attackers Actively Probing for Upgrade-Window RCE Vulnerability in WordPress Core appeared first on Wordfence .
[ OPEN ORIGINAL URL -> ]
Episode 199: Hardware LHE Rehash
SOURCE: Critical Thinking Podcast (Mirror) • ROLE: Official Show • PUBLISHED: 2026-11-05 10:00 UTC
[ CACHED SOURCE EXCERPT ]:
Episode 199: In this episode of Critical Thinking - Bug Bounty Podcast Justin, Brandyn and JD reflect on their experience at a Hardware LHE. They cover some of the bugs they found, what their prep time looked like, and using AI in IoT hacking. Follow us on twitter at: https://x.com/ctbbpodcast Got any ideas and suggestions? Feel free to send us any feedback here: info@criticalthinkingpodcast.io Shoutout to YTCracker for the awesome intro music! ====== Links ====== Follow your hosts Rhynorater, rez0 and gr3pme on X: https://x.com/Rhynorater https://x.com/rez0__ https://x.com/gr3pme Critical Research Lab: https://lab.ctbb.show/ Need a Pentest? We just launched CTBB Pentests! https://pentest.ctbb.show/ Hack full time? Check out the Full-Time Hunter’s Guild! https://ctbb.show/fthg ====== Ways to Support CTBBPodcast ====== Hop on the CTBB Discord at https://ctbb.show/discord ! We also do Disc...
[ OPEN ORIGINAL URL -> ]
Focus on Problems Instead of Companies
SOURCE: Daniel Miessler • ROLE: Guest • PUBLISHED: 2026-11-04 20:00 UTC
[ CACHED SOURCE EXCERPT ]:
Charcoal sketch of a person kneeling to repair a neighbour's hand water pump with a softly glowing tool while the neighbour fills a bucket, a quiet purple office tower standing in the background/images/focus-on-problems-not-companies-v2.webp/images/focus-on-problems-not-companies-v2.webp A thought...
[ OPEN ORIGINAL URL -> ]
The Hard Problem of Jealousy and the Easy Problem of Consciousness
SOURCE: Daniel Miessler • ROLE: Guest • PUBLISHED: 2026-11-04 17:30 UTC
[ CACHED SOURCE EXCERPT ]:
A robot head cut open: its eyes feed a projector that throws a flame onto a screen, and one person sits in a chair watching/images/hard-problem-of-jealousy.webp/images/hard-problem-of-jealousy.webp 📃 I intent to massively simplify this argument soon. It's ok, but far too wandering for my taste. ...
[ OPEN ORIGINAL URL -> ]
Making HTTP header injection critical with one prompt
SOURCE: James Kettle (albinowax) • ROLE: Guest • PUBLISHED: 2026-11-04 15:12 UTC
[ CACHED SOURCE EXCERPT ]:
You can now escalate HTTP header injection to a CRLF-Powered Desync and exploit it to serve random users a redirect to your collaborator, in a single prompt. We’ve just introduced a new scan check for
[ OPEN ORIGINAL URL -> ]
Wordfence Price Increase Coming December 3, 2026
SOURCE: Ram Gall • ROLE: Guest • PUBLISHED: 2026-11-03 15:44 UTC
[ CACHED SOURCE EXCERPT ]:
On Thursday, December 3, 2026, pricing for Wordfence Premium, Care, and Response will increase. We’re announcing this change a month in advance so you have time to purchase new licenses or renew eligible subscriptions at current pricing. Existing licenses can be renewed up to one year before their expiration dates. Purchase or renew before December 3 to take advantage of current pricing. The post Wordfence Price Increase Coming December 3, 2026 appeared first on Wordfence .
[ OPEN ORIGINAL URL -> ]
HTTP2Shell: What the Critical Brotli Vulnerability Means for WordPress Sites
SOURCE: Ram Gall • ROLE: Guest • PUBLISHED: 2026-11-02 15:48 UTC
[ CACHED SOURCE EXCERPT ]:
On October 22, 2026, Google published CVE-2026-111497, a critical vulnerability in Brotli, one day after the Brotli project released fixed versions. The vulnerability has circulated under several unofficial names, including HTTP2Shell, Node2Shell, and Brotli2Shell. The post HTTP2Shell: What the Critical Brotli Vulnerability Means for WordPress Sites appeared first on Wordfence .
[ OPEN ORIGINAL URL -> ]
The Post-AI Security Floor
SOURCE: Daniel Miessler • ROLE: Guest • PUBLISHED: 2026-11-01 20:00 UTC
[ CACHED SOURCE EXCERPT ]:
Hand-drawn diagram titled The Post-AI Security Floor with three numbered steps: know everything you have shipped, get it off the open internet, and lean on big vendors instead of small ones/images/post-ai-security-floor-diagram.webp/images/post-ai-security-floor-diagram.webp I have some critical r...
[ OPEN ORIGINAL URL -> ]
Episode 198: Scariest Bugs of 2026 - Halloween Special
SOURCE: Critical Thinking Podcast (Mirror) • ROLE: Official Show • PUBLISHED: 2026-10-31 09:00 UTC
[ CACHED SOURCE EXCERPT ]:
Episode 198: In this episode of Critical Thinking - Bug Bounty Podcast we're back with the spookiest bug stories we've had this year. We're talking government hacks, summoning global agents, low payouts/long triage times, and possibly the scariest thing of all for us: Dealing with JD's technical issues... Follow us on twitter at: https://x.com/ctbbpodcast Got any ideas and suggestions? Feel free to send us any feedback here: info@criticalthinkingpodcast.io Shoutout to YTCracker for the awesome intro music! ====== Links ====== Follow your hosts Rhynorater, rez0 and gr3pme on X: https://x.com/Rhynorater https://x.com/rez0__ https://x.com/gr3pme https://x.com/xssdoctor Critical Research Lab: https://lab.ctbb.show/ Need a Pentest? We just launched CTBB Pentests! https://pentest.ctbb.show/ Hack full time? Check out the Full-Time Hunter’s Guild! https://ctbb.show/fthg ====== Ways to Support CT...
[ OPEN ORIGINAL URL -> ]
Your Energy Level Changes How You See the World
SOURCE: Daniel Miessler • ROLE: Guest • PUBLISHED: 2026-10-30 20:00 UTC
[ CACHED SOURCE EXCERPT ]:
A slumped figure sits beside a dim ember in the deep purple shadow of a stone tower, while the same figure climbs its lit face holding a lantern high/images/energy-changes-the-frames.webp/images/energy-changes-the-frames.webp I think so much of winning at life comes down to something that's hard t...
[ OPEN ORIGINAL URL -> ]
WordPress 7.1.4 Patches Unauthenticated Upgrade-Window RCE; Exploitation Attempts Detected After Release
SOURCE: Ram Gall • ROLE: Guest • PUBLISHED: 2026-10-29 21:58 UTC
[ CACHED SOURCE EXCERPT ]:
WordPress 7.1.4 was released on October 28, 2026. According to WordPress, it includes fixes for 22 security vulnerabilities. The most serious is an unauthenticated race condition in the Core update process that can lead to remote code execution. Threat actors are already actively attempting to exploit it, so site owners should verify that WordPress has updated to 7.1.4 or the corresponding security release for their branch. The post WordPress 7.1.4 Patches Unauthenticated Upgrade-Window RCE; Exploitation Attempts Detected After Release appeared first on Wordfence .
[ OPEN ORIGINAL URL -> ]
Wordfence Bug Bounty Program Monthly Report – July 2026
SOURCE: Ram Gall • ROLE: Guest • PUBLISHED: 2026-10-29 19:20 UTC
[ CACHED SOURCE EXCERPT ]:
In July 2026, the Wordfence Bug Bounty Program received 1077 vulnerability submissions from our growing community of security researchers working to improve the overall security posture of the WordPress ecosystem. These submissions are reviewed, triaged, and processed by the Wordfence Threat Intelligence team, with validated vulnerabilities responsibly disclosed to vendors, often through the Wordfence Vulnerability ... Read More The post Wordfence Bug Bounty Program Monthly Report – July 2026 appeared first on Wordfence .
[ OPEN ORIGINAL URL -> ]
General Hill-Climbing: The One Main Loop in AI
SOURCE: Daniel Miessler • ROLE: Guest • PUBLISHED: 2026-10-29 16:30 UTC
[ CACHED SOURCE EXCERPT ]:
A charcoal sketch of a figure climbing a steep slope toward a glowing Ideal State at the summit, past verification points along the path/images/general-hill-climbing-header.webp/images/general-hill-climbing-header.webp 💡There is basically One Main Loop in AI, and it applies to everything from bui...
[ OPEN ORIGINAL URL -> ]
Wordfence Intelligence Weekly WordPress Vulnerability Report (October 19, 2026 to October 25, 2026)
SOURCE: Ram Gall • ROLE: Guest • PUBLISHED: 2026-10-29 15:40 UTC
[ CACHED SOURCE EXCERPT ]:
Last week, there were disclosed in and that have been added to the Wordfence Intelligence Vulnerability Database, and there were that contributed to WordPress Security last week. Review those vulnerabilities in this report now to ensure your site is not affected. Our mission with Wordfence Intelligence is to make valuable vulnerability information easily accessible to ... Read More The post Wordfence Intelligence Weekly WordPress Vulnerability Report (October 19, 2026 to October 25, 2026) appeared first on Wordfence .
[ OPEN ORIGINAL URL -> ]
Scalable Vector Grief
SOURCE: James Kettle (albinowax) • ROLE: Guest • PUBLISHED: 2026-10-27 14:29 UTC
[ CACHED SOURCE EXCERPT ]:
I tested eight popular SVG sanitizers and bypassed six of them. In this post, I'll show you how a response header can run JavaScript in Firefox even when the response body is completely harmless XML.
[ OPEN ORIGINAL URL -> ]
I'm on Team Explanation
SOURCE: Daniel Miessler • ROLE: Guest • PUBLISHED: 2026-10-25 15:46 UTC
[ CACHED SOURCE EXCERPT ]:
A charcoal cutaway barn: a turkey professor points at a chart of sunrise feeding times while, inside, a farmer sharpens an axe beside roasting pans./images/team-explanation.webp/images/team-explanation.webp There are two major ways of assessing the quality of our understanding of a phenomenon: Pre...
[ OPEN ORIGINAL URL -> ]
Models Are the How, Harnesses Are the What
SOURCE: Daniel Miessler • ROLE: Guest • PUBLISHED: 2026-10-25 01:28 UTC
[ CACHED SOURCE EXCERPT ]:
A person hands their preferences, context, goals and how they like things done to a harness labeled the what, which feeds a model labeled the how, which produces a result that returns to the person; both harness and model point up at a hilltop flag labeled what you want/images/models-how-harnesses-w...
[ OPEN ORIGINAL URL -> ]
Writing Is Closer to Thought Than Code
SOURCE: Daniel Miessler • ROLE: Guest • PUBLISHED: 2026-10-23 19:40 UTC
[ CACHED SOURCE EXCERPT ]:
Three framed plates in a row, each separated by a dashed line. Plate one, the source: a head with a glowing purple crystal in its mind, labeled 1 idea, human thought. An arrow marked articulate leads to plate two, the first derivative: a handwritten page with a lighter sketch of the same head, label...
[ OPEN ORIGINAL URL -> ]
Episode 197: 800 Bugs w/ DeepSeek + Local Model Hacks
SOURCE: Critical Thinking Podcast (Mirror) • ROLE: Official Show • PUBLISHED: 2026-10-22 09:00 UTC
[ CACHED SOURCE EXCERPT ]:
Episode 197: In this episode of Critical Thinking - Bug Bounty Podcast Joseph, Brandyn, and Ads serve up some tips on how they’re using local AI Models and optimizing their hardware. Follow us on twitter at: https://x.com/ctbbpodcast Got any ideas and suggestions? Feel free to send us any feedback here: info@criticalthinkingpodcast.io Shoutout to YTCracker for the awesome intro music! ====== Links ====== Follow your hosts Rhynorater, rez0 and gr3pme on X: https://x.com/Rhynorater https://x.com/rez0__ https://x.com/gr3pme Critical Research Lab: https://lab.ctbb.show/ Need a Pentest? We just launched CTBB Pentests! https://pentest.ctbb.show/ Hack full time? Check out the Full-Time Hunter’s Guild! https://ctbb.show/fthg ====== Ways to Support CTBBPodcast ====== Hop on the CTBB Discord at https://ctbb.show/discord ! We also do Discord subs at $25, $10, and $5 - premium subscribers get access...
[ OPEN ORIGINAL URL -> ]