VulnCheck

Today, VulnCheck disclosed CVE-2026-60105, a high-severity unauthenticated flaw in Monsta FTP that could expose cloud metadata and internal services. Monsta FTP silently patched the issue in 2.14.5 under “Minor bugs and fixes.” Read the full report: vulncheck.com/blog/monsta-ft…

The THREATCON1 CFP has been extended to July 31. This is your chance to share novel research, technical deep dives, hands-on content, or field-informed perspectives with cybersecurity leaders, mission-driven teams, and global threat researchers. Submit: threatcon1.org/submissions

Last call: THREATCON1 CFP closes today, July 10. This is an opportunity to share novel research, technical deep dives, or field-informed perspectives with cybersecurity leaders, mission-driven teams, and global threat researchers. Submit today: threatcon1.org/submissions

What damage could a missing keyword do? In FOSSBilling, everything. A missing throw statement plus an unsandboxed Twig renderer can be chained into unauthenticated RCE against default FOSSBilling installs. Read more: vulncheck.com/blog/fossbilli…

CISA is giving federal agencies until Friday to patch an actively exploited Langflow vulnerability. Sergiu Gatlan at @BleepinComputer has the details, including VulnCheck’s Caitlin Condon reporting exploitation in the wild on June 10. bleepingcomputer.com/news/security/…

Recorded at RSA, Patrick Garrity & Kimber Duke sat down with Piotr Kijewski of @Shadowserver to discuss cyber threats, exploitation, botnet takedowns, and global threat intel. Watch: youtu.be/2E1Tn1zhgIQ

Have research, a deep dive, or insight the cybersecurity community needs to hear? Submit it to THREATCON1! The CFP closes on July 10, 2026. Submit your proposal: threatcon1.org/submissions

.@VentureBeat highlighted VulnCheck's research on vulnerabilities affecting AI frameworks, including active exploitation targeting exposed Langflow servers. Read more: venturebeat.com/security/7000-…

VulnCheck recently disclosed CVE-2026-53805, an NVIDIA GEN3C inference API flaw that could let unauthenticated attackers run code on vulnerable servers. Interested in learning how? Read the full report: vulncheck.com/blog/nvidia-ge…

What damage could a missing keyword do? In FOSSBilling, everything. Our latest research shows how a missing throw statement and an unsandboxed Twig renderer can be chained into unauthenticated RCE against default FOSSBilling installations. Read more: vulncheck.com/blog/fossbilli…

On the THREATCON1 Podcast, Piotr Kijewski (@Shadowserver) breaks down AI-generated vuln reports, fake exploits and “research” that fails in the real world. Could AI misinformation become its own threat vector? Watch: youtube.com/watch?v=2E1Tn1… Listen: podcasts.apple.com/us/podcast/epi…

Observed exploitation is only the starting point. New research from Adam Powis shows how VulnCheck Canary Intelligence and Target Intelligence can help defenders pivot from Canary activity to attacker infrastructure. Read the report: vulncheck.com/blog/meowproje…

In this THREATCON1 episode, Halcyon’s Cynthia Kaiser explains why victims often stay hidden, stolen data may not be deleted, and paying can make orgs repeat targets. Watch: youtube.com/watch?v=-rTBOK… Listen: podcasts.apple.com/us/podcast/epi…

Join VulnCheck June 24 for our next In the Wild webinar where we break down CISA BOD 26-04, SSVC-based prioritization, Vulnrichment gaps and what private-sector teams should take away. 12 PM CT Register: linkedin.com/events/7469779…

One of the nation’s most consequential cyber leaders is taking the THREATCON1 stage. Gen. Paul M. Nakasone, former Commander of U.S. Cyber Command and former NSA Director, will keynote THREATCON1 2026. Register, submit a CFP or learn more: vulncheck.com/press/2026-thr…

AI-assisted Linux LPE research is creating signal and noise. Landon Rice breaks down Copy Fail, Dirty Frag, and related page-cache overwrite bugs, with a focus on exploitability over headlines. Read: vulncheck.com/blog/copy-fail…

CISA’s BOD 26-04 puts risk-based remediation in focus for federal agencies. Patrick Garrity breaks down what it means, why SSVC matters, and how broader coverage plus earlier exploit intel can help teams prioritize. Read more: vulncheck.com/blog/cisa-bod-…

New research from Adam Powis shows how VulnCheck connects observed exploitation activity to the broader attacker infrastructure behind it. Canary Intelligence sees the activity. Target Intelligence helps map the operation. Read the full research: vulncheck.com/blog/meowproje…

Live June 24 at 12 PM CST: our next In the Wild webinar covers CISA BOD 26-04, SSVC-based prioritization, Vulnrichment gaps, and why it matters for federal agencies and private-sector teams. Register: wwv.vulncheck.com/in-the-wild-wi…

How much can a handful of suspicious indicators reveal? Join VulnCheck’s Adam Powis at LCHS 2026 for a look at mapping attacker infrastructure from initial signal to C2. 📅 June 25 | 🕕 6:15 p.m. | More here: More here: vulncheck.com/events/lchs-20…