Nostr notes by watchTowr

join us once again for meme-based therapy ...

2026-10-21T13:33:25Z

join us once again for meme-based therapy

it was this, or an interpretive dance on TikTok - be glad we ...

2026-10-21T10:32:12Z

it was this, or an interpretive dance on TikTok - be glad we chose this option

RE: https://infosec.exchange/@watchTowr/117474644870827640 Small ...

2026-10-20T22:57:39Z

RE: https://infosec.exchange/@watchTowr/117474644870827640

Small update: we've now pushed network-level mitigation capabilities to watchTowr Platform clients (via Active Defense), ahead of PHP providing patches.

https://watchTowr.com for more information.

quoting
note18s8…nl5w

We were all supposed to wait until Thursday at 11am ET.

Information has leaked wrt zero-day embargoed RCE vulns in PHP. We can confirm that they're real. CVE-2026-109618/619

We cannot share further information right now. Take this seriously and apply patches when available.

We were all supposed to wait until Thursday at 11am ET. ...

2026-10-20T18:27:06Z

We were all supposed to wait until Thursday at 11am ET.

Information has leaked wrt zero-day embargoed RCE vulns in PHP. We can confirm that they're real. CVE-2026-109618/619

We cannot share further information right now. Take this seriously and apply patches when available.

once again, we are vigorously tapping the sign ...

2026-10-10T13:26:05Z

once again, we are vigorously tapping the sign

CVE-2026-88771 - the loaded Citrix footgun went off again, and ...

2026-09-28T10:56:21Z

CVE-2026-88771 - the loaded Citrix footgun went off again, and the screaming noise is back in our ear.

You knew it was coming - enjoy the latest watchTowr Labs blogpost.

https://labs.watchtowr.com/oh-look-the-foot-gun-went-off-again-citrix-netscaler-preauth-command-injection-cve-2026-88771/

Nostr event nevent1qqs0xg2xleyc5qrjgehh8htsm5wmydlhw68zjct9clywpnpdmggtasszyz9jvacgk5rv95lwk92hla305r9q5cnafgpwks9yhz3seh8kt7ddvm6wcnp

2026-09-27T18:19:51Z

wdyt

RE: https://infosec.exchange/@watchTowr/117338396418850285 ...

2026-09-26T17:12:52Z

RE: https://infosec.exchange/@watchTowr/117338396418850285

Update: We have high confidence in the information and have verified it with authoritative sources.

Please, react NOW.

quoting
note1e84…x8ar

We are currently rapidly reacting to rumors that multiple unpatched Citrix NetScaler RCE vulnerabilities are circulating in the wild. While details are scarce, the limited information available is credible, and we are thus imploring organizations to take it seriously.

Active watchTowr Platform clients have been made aware of their Citrix NetScaler exposure.

We are currently rapidly reacting to rumors that multiple ...

2026-09-26T16:57:19Z

We are currently rapidly reacting to rumors that multiple unpatched Citrix NetScaler RCE vulnerabilities are circulating in the wild. While details are scarce, the limited information available is credible, and we are thus imploring organizations to take it seriously.

Active watchTowr Platform clients have been made aware of their Citrix NetScaler exposure.

watchTowr Intel is already seeing exploitation of the JFrog ...

2026-09-01T04:12:56Z

watchTowr Intel is already seeing exploitation of the JFrog Artifactory Auth Bypass (CVE-2026-82329), with attackers minting themselves admin tokens.

Reach out if you need help determining your exposure ahead of exploitation.

Death by a thousand (paper)cuts (also known as WT-2026-0144) ...

2026-08-31T16:17:43Z

Death by a thousand (paper)cuts (also known as WT-2026-0144) brings us back aboard the HellScape Express.

The saga continues… and we'll be back soon.

(We gently, kindly, and calmly suggest pulling PaperCut entirely off the Internet at this point)

It's hot, and we're desperate - so we turned to Adobe ...

2026-07-02T16:39:34Z

It's hot, and we're desperate - so we turned to Adobe ColdFusion and APSB26-68, our favorite Security Bulletin.

Enjoy, and speak soon... ;-)

https://labs.watchtowr.com/its-37oc-and-all-we-can-think-about-is-coldfusion-adobe-coldfusion-security-bulletin-apsb26-68-cve-bonanza

Nostr event nevent1qqs9ryrg7zay2yqwy8prfezj46c35puk036jv7hvydrfyqmktdyz8jszyz9jvacgk5rv95lwk92hla305r9q5cnafgpwks9yhz3seh8kt7ddvwar3mz

2026-07-01T03:08:10Z

what's the biggest number you can think of? speak soon... ...

2026-06-30T16:20:21Z

what's the biggest number you can think of? speak soon...

We're back, analyzing CVE-2026-8037, a pre-auth RCE in ...

2026-06-29T19:26:35Z

We're back, analyzing CVE-2026-8037, a pre-auth RCE in Progress' Kemp LoadMaster appliance.

https://labs.watchtowr.com/enterprise-tech-in-shell-out-progress-kemp-loadmaster-uninitialized-heap-to-pre-auth-rce-cve-2026-8037/

Speak soon...

Noise, hysteria, confusion, and AI slop surround CVE-2026-35273 - ...

2026-06-15T23:40:47Z

Noise, hysteria, confusion, and AI slop surround CVE-2026-35273 - we believe this is the first-stage SSRF in the Oracle PeopleSoft RCE chain being flung around.

We will share the full chain when we feel the time is right, and when we're bored of the vibecoded PoCs.

Speak soon.

We're back with unplanned content - analyzing CVE-2026-10520, ...

2026-06-10T00:53:56Z

We're back with unplanned content - analyzing CVE-2026-10520, a Pre-Auth RCE in Ivanti's confusingly named Sentry product.

Enjoy!

https://labs.watchtowr.com/more-evidence-that-words-dont-mean-what-we-thought-they-meant-ivanti-sentry-pre-auth-os-command-injection-cve-2026-10520/

Nostr event nevent1qqsvkpcua3d5zz6tdeppvx9pvrtcplnz4x8f3s9k732e60qzqxrj6zqzyz9jvacgk5rv95lwk92hla305r9q5cnafgpwks9yhz3seh8kt7ddvmmn8ja

2026-06-07T01:32:51Z

speak soon xo

it's not shitposting, it's memewrecking

2026-05-21T01:03:06Z

In reply to nevent1q…pk5w
_________________________

it's not shitposting, it's memewrecking

We're looking for new colleagues to join the phorce to work ...

2026-05-21T00:27:29Z

We're looking for new colleagues to join the phorce to work on "Project Red", our autonomous, LLM-driven N-day reproduction and 0-day discovery capability.

We're having fun, we promise ;-)

https://careers.watchtowr.com/jobs/7629309-ai-vulnerability-research-engineer

CVE-2026-0265, the PAN-OS auth bypass (when Cloud Auth Services ...

2026-05-19T14:00:52Z

CVE-2026-0265, the PAN-OS auth bypass (when Cloud Auth Services are enabled) was fun to reproduce and load into the watchTowr Platform.

Our friends @ @HacktronAI are publishing their analysis this week, so we won’t be publishing. Looking forward to it 🚀

The Internet is falling down, falling down, falling down Welcome ...

2026-04-29T17:21:07Z

The Internet is falling down, falling down, falling down

Welcome back to another disaster - this time, an Auth Bypass in cPanel/WHM, tracked as CVE-2026-41940

Enjoy with us..
https://labs.watchtowr.com/the-internet-is-falling-down-falling-down-falling-down-cpanel-whm-authentication-bypass-cve-2026-41940/

We are currently rapidly reacting to cPanel Authentication Bypass ...

2026-04-29T13:14:39Z

We are currently rapidly reacting to cPanel Authentication Bypass Vulnerability, a security flaw that allows attackers to bypass authentication mechanisms affecting cPanel & WHM.
Active watchTowr Platform clients have been made aware of their exposure. Reach out for support.

Nostr event nevent1qqsz653akhfyjxgn2x39rtrqpe76fmj0hnexd5wsq6srrdm96qg2keqzyz9jvacgk5rv95lwk92hla305r9q5cnafgpwks9yhz3seh8kt7ddvhm8rwv

2026-04-29T13:02:30Z

🫡 We’re back. Today, we’re publishing vulnerabilities we ...

2026-04-02T11:04:38Z

🫡 We’re back.

Today, we’re publishing vulnerabilities we discovered, disclosed, and chained to achieve pre-auth RCE against Progress ShareFile.

Enjoy the journey with us, while you sob into your hands 🫠

https://labs.watchtowr.com/youre-not-supposed-to-sharefile-with-everyone-progress-sharefile-pre-auth-rce-chain-cve-2026-2699-cve-2026-2701/

while we’re eating our best writing crayons and using finger ...

2026-03-28T01:40:14Z

while we’re eating our best writing crayons and using finger paint to finish our latest research, we’ve decided to take this opportunity to share research from the archives with new followers 🙂

happy Friday… for now 🥹

https://labs.watchtowr.com/we-spent-20-to-achieve-rce-and-accidentally-became-the-admins-of-mobi/

(Yes this is not new don’t @ us)

What's new is old, and what's old is new - as is ...

2026-03-19T20:22:34Z

What's new is old, and what's old is new - as is relentlessly proven.

Join us in our analysis of CVE-2026-32746, the recent pre-auth RCE in inteutils' Telnetd.

Speak soon.

https://labs.watchtowr.com/a-32-year-old-bug-walks-into-a-telnet-server-gnu-inetutils-telnetd-cve-2026-32746

Can you feel it too? Join us today for our analysis of ...

2026-03-03T14:19:49Z

Can you feel it too?

Join us today for our analysis of Juniper's recent pre-auth RCE - CVE-2026-21902 - affecting a very specific set of devices. Curious?

https://labs.watchtowr.com/sometimes-you-can-just-feel-the-security-in-the-design-junos-os-evolved-cve-2026-21902-rce/

where is the punch line? ...

2026-03-03T13:27:18Z

where is the punch line?

2026, the year of the AI-driven attacker that could do back ...

2026-02-13T14:20:41Z

2026, the year of the AI-driven attacker that could do back flips, they said.

Meanwhile, there's a magic number that allows Auth Bypass against Ivanti EPM (CVE-2026-1603)

something about a pledge 🙄

Someone knows Bash disgustingly well, and we love it. Here's ...

2026-01-30T16:18:16Z

Someone knows Bash disgustingly well, and we love it.

Here's our analysis of the Ivanti EPMM Pre-Auth RCE vulnerabilities - CVE-2026-1281 & CVE-2026-1340.

This research fuels our technology, enabling our clients to accurately determine their exposure.

https://labs.watchtowr.com/someone-knows-bash-far-too-well-and-we-love-it-ivanti-epmm-pre-auth-rces-cve-2026-1281-cve-2026-1340

Earlier this month, we reported a zero-day auth. bypass in the ...

2026-01-22T00:35:26Z

Earlier this month, we reported a zero-day auth. bypass in the SmarterTools SmarterMail email solution.

Someone has reversed the patch (released on 15th Jan) and begun exploiting it in the wild.

Read our analysis and please, ASSUME BREACH + PATCH NOW.

https://labs.watchtowr.com/attackers-with-decompilers-strike-again-smartertools-smartermail-wt-2026-0001-auth-bypass/

Don't let talking bobble-heads convince you the React ...

2025-12-06T17:01:18Z

Don't let talking bobble-heads convince you the React vulnerabilities aren't serious. Please, patch now.

If you need support understanding your exposure, reach out via our website @ http://watchTowr.com

Over the last 12 months, watchTowr Labs uncovered thousands of ...

2025-11-25T11:33:40Z

Over the last 12 months, watchTowr Labs uncovered thousands of leaked credentials: cloud keys, AD creds, API tokens, even KYC data - already being abused.

Join us on our journey into “innocent” developer tools.

https://labs.watchtowr.com/stop-putting-your-passwords-into-random-websites-yes-seriously-you-are-the-problem/