We found a ReDoS in OpenTelemetry for Python: one oversized tracestate header can stall an asyncio server for seconds. Fixed in opentelemetry-api 1.45.1 (CVE-2026-114603).
Technical writeup:
New C++ challenge: Anushiya.cpp. One process handles requests one after another, and each request's memory should leave no trace. Find the vulnerabilities in the cleanup and fix them.
Built from PHP2Shell (CVE-2026-109618, CVE-2026-109619).
An open redirect lends your domain to someone else's phishing link. If a login flow sends users to an unchecked destination from the request, it can end on any site.
New Python challenge, inspired by CVE-2026-28415 in Gradio:
We found two DoS bugs in the toml parser for Node.js: a ~100 KB settings file freezes the process for seconds, a ~200 KB one crashes it. Fixed in toml 5.0.1 (CVE-2026-114143, CVE-2026-114141).
Technical writeup:
Four new PHP challenges: a TOCTOU race, a Unicode username takeover, server-side request forgery and command injection. Three are inspired by real incidents at Steam, Spotify and Capital One.
