🕵️ RESEARCH & DEEP DIVES
Multiple ModSecurity Flaws Let Attackers Bypass WAF Rules, Evade Inspection, and Potentially Execute Code
OWASP ModSecurity has disclosed multiple vulnerabilities that let attackers bypass WAF rules, evade request and response inspection, or trigger denial-of-service conditions.- Affects OWASP ModSecurity v3 (libmodsecurity3) and the v2 branch; users of ModSecurity with the OWASP Core Rule Set are impacted.
- High-severity GHSA-5pww-8rfg-9crf (CVSS 8.6): multipart parser ignores RFC 2231 filename* parameters, so Go, Python, Node.js, and Java backends may process a malicious filename (e.g., shell.php) while the WAF sees a benign one, bypassing CRS rules 920120, 922100, and 922110 and potentially enabling RCE via web-shell upload.
- CVE-2026-73857 (High, CVSS 7.5): uninitialized pointer dereference in the XML request-body processor of libmodsecurity3 before 3.0.17, reachable only when SecParseXmlIntoArgs is On or OnlyArgs, giving a restricted write-what-where primitive that could lead to DoS, memory disclosure, or code execution.
- Other flaws: malformed Base64 padding bypasses t:base64DecodeExt (GHSA-4j47-8qcr-jf59), adjacent comments evade t:removeComments (GHSA-qrch-pjfr-9g47), PCRE2 @rxGlobal match-limit errors treated as no-match (GHSA-5m93-4h75-3p2w), response-body inspection bypass via mixed-case Content-Type headers (GHSA-vmg8-j66p-vgvw, CVE-2026-73856), and weak libcurl TLS hostname verification (GHSA-2vqc-36qp-ccmw).
- Affected versions: libmodsecurity3 3.0.16 and earlier (patched in 3.0.17) and mod_security2 2.9.14 and earlier (patched in 2.9.15); PoC exploits published but no confirmed exploitation in the wild.
Google launches Gemini 4 Argon, giving vetted cyber defenders guardrail-free access
Google has announced its Gemini 4 Argon frontier AI model, initially rolling it out to trusted cyber defenders through its Fairwind Program.- Applies to vetted cyber defenders via the Fairwind Program (650+ partners including CrowdStrike and Palo Alto Networks), Google internal teams, and later paid API customers and Google AI Ultra subscribers
- Argon is built for cybersecurity defense and can autonomously find, validate, and patch critical software vulnerabilities; it found a critical flaw exposing personal data in healthcare software used by hospitals worldwide that earlier frontier models missed
- Trusted defenders and Google internal teams get Argon without cyber guardrails to leverage full frontier-level defense capabilities; Wiz uses it in the free Scan for Good initiative
- Scores 77.9% on DeepSWE v1.1, ties for first at 68% on CWE-bench v1 with GPT-6 Astra and Grok 4.7, and has a 1 million token output limit; introductory pricing is $2/$10 per million input/output tokens
- Google is participating in the US government's voluntary pre-release model access process and hardening safeguards against indirect prompt injection and CBRN misuse before broader release
2cloader-malware — Cyber Security News