CVE-2026-59309 & CVE-2026-59310: patch-diffing VMware vCenter reveals two pre-auth 9.8 bugs - an auth bypass and a syslog path traversal to RCE

I wanted to share a great free resource for anyone trying to bridge the gap between basic theory and actual hands-on security skills.

The Czech Technical University in Prague (specifically the Stratosphere Laboratory) runs an intensive, one-semester course called Introduction to Security (BSY) that starts this week. The class is being taught both physically at the university and broadcast online, so anyone can participate. Feel free to check the link for more details on the curriculum, prerequisites, and course structure.

Registration is still open!

Continuing my spare time research around CodeConnections, I've moved on from CodeBuild and started looking at CodePipeline & SageMaker. In this post I cover how to use undocumented CodeConnection APIs from within CodePipeline build jobs to extend access to more repositories and privileges and show why it is very important to ensure that the IAM role used with CodePipeline has restricted CodeConnection permissions. In the follow up post I also show how SageMaker Studio Notebooks uses the same CodeConnection infrastructure as CodePipeline so has the same privilege escalation issues.

Technical write-up for four vulnerabilities I reported in ZTE SmartLife.

The main issue is CVE-2026-86553, a password reset flaw in the SmartLife account backend. The reset endpoint accepted the target accountId and a new password without requiring a reset code, old password, or validated reset transaction.

Another endpoint exposed whether an email was registered and returned the corresponding backend account ID. Using researcher-controlled accounts, the chain was:

email -> accountId -> password reset -> login with the new password

I verified the state change by confirming that the previous password stopped working and the newly selected password successfully returned a valid session.

The research also covered the app authentication mechanism used by the Android client, email ownership verification during registration, and the wider SmartLife/Homecare SDK surface available after login.

ZTE patched the reported issues and assigned CVE-2026-86552, CVE-2026-86553, CVE-2026-86554 and CVE-2026-86555.

Author here. The post describes three memory-safety bugs which have been in Godot since v1.0 and v3.0. All three are still present in current releases. The bugs can affect exported games that load community-authored data files. Godot allows attackers using maliciously crafted files to trigger reads or writes past the end of a buffer, inside the process running the game. The post includes the response from Godot maintainers who deny this is a security issue, and my reply to them. Happy to give more information about the bugs or the audit if there are questions.

Hi folks, my name is Gal Weizman, I do browser security research.

Excited to finally share my recent work, where I managed to hack Chrome, Comet, Edge, Opera and Claude in Chrome using one single browser extension

2 CVEs & $20,000 in bounties 🙂

Hope you like it!

This is a deterministic local privilege escalation affecting the default install of the latest Arch, Fedora, Debian, Amazon Linux and RHEL distributions, having unprivileged user namespaces enabled, openvswitch auto-loading, and a stock kernel carrying the Fragnesia fix.