🕵️ RESEARCH & DEEP DIVES
Sponsored: PortSwigger launches AI pen-testing product Burp AT for web apps
PortSwigger has launched Burp AT, an AI pen-testing product natively integrated with Burp Suite.- Applies to security engineers and penetration testers testing web applications
- Burp AT is an AI pen-testing product with different levels of autonomy modes
- Natively integrated with Burp Suite: once it finds vulnerabilities it can spin up intruder attacks, configure everything and brute-force the code
- Beta trial users reported findings, including one that found a vulnerability disclosing reports from a company's anonymous whistle blower platform
CloudClassroom-PHP-Project loginlinkstudent.php missing authentication flaw disclosed (CVE-2026-100876)
A missing authentication vulnerability in CloudClassroom-PHP-Project's loginlinkstudent.php has been disclosed as CVE-2026-100876.- Affects mathurvishal's CloudClassroom-PHP-Project up to commit 5dadec098bfbbf3300d60c3494db3fb95b66e7be
- An unknown function in loginlinkstudent.php allows missing authentication via manipulation of the umail argument
- Remote exploitation is possible; a public exploit exists and the vendor did not respond to disclosure
- CVSS 3.1 score 6.3 (Medium); classified as Missing Authentication (CWE-306)
- Reported by rmsbpro via VulDB; advisory published 2026-09-27
CloudClassroom-PHP-Project CSRF vulnerability disclosed as CVE-2026-100873
A cross-site request forgery vulnerability in mathurvishal's CloudClassroom-PHP-Project has been disclosed with a public exploit.- Affects mathurvishal CloudClassroom-PHP-Project up to commit 5dadec098bfbbf3300d60c3494db3fb95b66e7be; the project does not use versioning.
- The flaw is cross-site request forgery (CWE-352) with missing authorization (CWE-862), exploitable remotely by an unauthenticated attacker.
- The exploit is public; the vendor was contacted early but did not respond.
- Severity is rated medium: CVSS 3.1 score 4.3, CVSS 4.0 score 5.3.
- Reported by vinniboy021 and disclosed via VulDB on 2026-09-27 as VDB-410803.
Kevin Beaumont posts "Last years blog" on Cyberplace
Kevin Beaumont shared a short post reading "Last years blog" with no additional detail.- The post is from Kevin Beaumont (@GossiTheDog) on Cyberplace.
- It contains no technical details, IOCs, or affected products.
Citrix accused of downplaying security flaw reportedly used to hack governments
Kevin Beaumont claims Citrix knew of a security flaw used to hack governments and tried to hide it.- Citrix customers, including government organizations, are reportedly affected by an undisclosed security issue.
- The flaw has allegedly been used to hack governments, according to security researcher Kevin Beaumont.
- Beaumont claims Citrix knew about the issue and attempted to conceal it; Citrix has posted a security statement on its website.
Sources 📄 Source: mastodon.social · 📎 Coverage: cyberplace.social · 👁 via @GossiTheDog@cyberplace.social404 Media reports OpenAI relies on thousands of contractors
404 Media reports that OpenAI uses thousands of contractors.- Applies to OpenAI and its workforce practices.
- OpenAI reportedly employs thousands and thousands of contractors.
- Details were shared by 404 Media via Mastodon; limited detail available in source material.
📋 ADVISORIES
📄 Source for SQL injection in CloudClassroom-PHP-Project updatedetailsfromfaculty.php (CVE-2026-100875) — vuldb.com
📄 Source for SQL injection flaw in CloudClassroom-PHP-Project addnewstudent.php (CVE-2026-100874) — vuldb.com
[RESEARCH & DEEP DIVES] • Citrix has a security post on its website that also confirms exploitation and has a bunch of remedation advice, which... (5) — @zackwhittaker@mastodon.social
[RESEARCH & DEEP DIVES] • Shoutout to the folks on that Citrix subreddit thread, the security researchers validating the bugs, and the random IT... (5) — @zackwhittaker@mastodon.social
[RESEARCH & DEEP DIVES] • CISA has confirmed two bugs in Citrix NetScaler are under attack, CVE-2026-88771 and CVE-2026-88772, per its catalog of... (5) — @zackwhittaker@mastodon.social