SecPod Labs
Security Research
In-depth CVE write-ups, vulnerability analysis, and security intelligence from the SecPod Research team.
CVE Research
Tracking Gafgyt C0XMO: How a New Malware Variant Spreads Across Platforms
A newly identified Gafgyt botnet variant, C0XMO, is actively targeting internet-exposed devices through a combination of vulnerability exploitation, weak-credential attacks, and automated lateral movement. Unlike traditional Gafgyt campaigns, C0XMO separates its propagation logic into a dedicated Python-based scanner, enabling it to compromise a wider range of architectures and device types while scaling infections more efficiently.
CVE Research
HTTP/2 Bomb: How an AI Chained Two Decade-Old Techniques Into a Devastating Remote DoS
Cybersecurity researchers have discovered a remote denial-of-service exploit that affects major web servers, including NGINX, Apache HTTPD, Microsoft IIS, Envoy, and Cloudflare Pingora. The vulnerability has been codenamed HTTP/2 Bomb.
CVE Research
Two Actors, One Flaw: Gamaredon and UAC-0226 Leverage Delayed WinRAR Patching
Two Russia-aligned threat groups, Gamaredon and UAC-0226, are actively exploiting CVE-2025-8088, a high-severity WinRAR path traversal vulnerability, against Ukrainian government, military, and critical infrastructure organizations. Nearly a year after a patch was made available, both groups continued to operate unimpeded.
CVE Research
Three Zero-Days, 206 Flaws Fixed: Microsoft Delivers Record-Breaking June 2026 Patch Tuesday
The second Tuesday of June 2026 marked Microsoft's largest Patch Tuesday release on record, delivering security updates for a massive range of vulnerabilities affecting Windows, Microsoft Office, Azure, Exchange, Hyper-V, Active Directory, Remote Desktop, BitLocker, and numerous core operating system components.
CVE Research
Inside CVE-2026-0257: PAN-OS GlobalProtect Authentication Bypass Under Active Attack
A critical authentication bypass vulnerability, CVE-2026-0257, affects Palo Alto Networks PAN-OS GlobalProtect Portal and Gateway deployments. The vulnerability allows a remote, unauthenticated attacker to establish an unauthorized VPN connection by exploiting weaknesses in the handling of authentication override cookies.
HTTP/2 Bomb: How an AI Chained Two Decade-Old Techniques Into a Devastating Remote DoS
CVE Research
HTTP/2 Bomb: How an AI Chained Two Decade-Old Techniques Into a Devastating Remote DoS
Cybersecurity researchers have discovered a remote denial-of-service exploit that affects major web servers, including NGINX, Apache HTTPD, Microsoft IIS, Envoy. The vulnerability has been codenamed HTTP/2 Bomb.
