SecPod Labs
Security Research
In-depth CVE write-ups, vulnerability analysis, and security intelligence from the SecPod Research team.
CVE Research
Inside CVE-2026-55200: How a Missing Bounds Check in libssh2 Becomes Remote Code Execution
A malicious SSH server can corrupt heap memory on any client using libssh2, before authentication and without any user interaction. This blog walks through the exact arithmetic behind the bug, why it lives in ssh2_transport_read(), how the exploitation path works conceptually, and what to check in your own environment.
CVE Research
UNK_MassTraction Exploits Critical Roundcube Vulnerabilities to Compromise University Mail Servers
A suspected China-aligned threat cluster, tracked as UNK_MassTraction, is actively targeting vulnerable Roundcube webmail servers at U.S. and Canadian universities. The campaign exploits two critical Roundcube vulnerabilities to steal credentials, bypass two-factor authentication, deploy web shells or VShell, and establish persistent access to institutional mail servers while minimizing forensic evidence.
CVE Research
CVE-2026-11405: Actively Exploited Zero-Day Hidden Admin Backdoor Threatens Tenda Routers
A critical advisory about a hidden administrative backdoor embedded in multiple Tenda router firmware builds has been released. Tracked as CVE-2026-11405, the flaw lets an unauthenticated attacker walk straight into the device's web management interface with full admin rights. With no official patch available, it stands as an active zero-day that opportunistic scanners are already probing for.
CVE Research
Granted Without Asking: How CVE-2026-48558 Lets TaskWeaver and Djinn Stealer Walk in the Front Door
A maximum-severity authentication bypass in SimpleHelp's OIDC flow, CVE-2026-48558, is being actively exploited to hijack technician sessions, even past MFA. Attackers use this access to deploy TaskWeaver, a stealth Node.js loader disguised as jQuery, then Djinn Stealer, which harvests cloud, developer, AI-assistant, and crypto-wallet credentials. Now in CISA's KEV catalog with a CVSS of 10.0, this is an urgent, assume-compromise scenario for any SimpleHelp OIDC deployment.