CyStack

@CyStackSecurity

An innovative #Cybersecurity company provides comprehensive and tailored solutions to combat security threats. Product: @whitehubnet @lockerpm

Hà Nội, Việt Nam

CyStack
@CyStackSecurity
Nov 5
Amazon Virtual Engineering Workbench passes CloudFormation templates through a template engine unfiltered. Any logged-in user can run code under a shared IAM role and cross tenant boundaries. Found by a CyStack researcher. Learn more: cystack.net/disclosures #Vulnerability #AWS
CyStack
@CyStackSecurity
Nov 3
Docker Desktop for Windows installer skips package signature checks. A crafted package runs as LocalSystem while the UAC prompt still shows Docker's valid signature. Patched in 4.92.0. Found by a CyStack researcher. cystack.net/disclosures #Vulnerability #Docker #Windows
CyStack
@CyStackSecurity
Oct 29
@Cisco License On-Prem exposes its Smart Licensing API without authentication. One HTTP request writes arbitrary files or crashes the service. No workaround. Patched in 10-202608. Found by a CyStack researcher. cystack.net/disclosures
1
CyStack
@CyStackSecurity
Oct 27
SAML provider confusion in @zitadel (10k+ GitHub stars): the callback verifies one provider's signature but identifies the user via another, enabling account takeover. Patched in 4.19.2. Found by a CyStack researcher. cystack.net/disclosures
CyStack
@CyStackSecurity
Oct 23
#PHP2Shell (CVE-2026-109618, CVE-2026-109619, CVSS 9.2): unauthenticated RCE in the #PHP core. Is your site at risk? Check it free in about a minute. Got the red PHP2Shell alert? Patch to 8.5.12/8.4.27/8.3.36/8.2.35 and restart workers. bit.ly/4dY6jQC #CyberSecurity

CyStack’s posts