Imperva Threat Research (Red Team validation write-ups)
imperva-threat-research · B · candidate
Added 2026-10-24 (2026-10-24T0255Z-intel): S1/S4 candidate: independent exploit validation within a day of disclosure (Node2Shell on 2026-10-22, the PHP2Shell vulnerability updates); articles read cleanly with `extract`; feed path not probed.
Cited in 5 entries
Citation cadence
Citation days per ISO week (23 weeks of coverage span, total 5).
- CVE-2026-111497, Node.js and Google Brotli (Node2Shell): an out-of-bounds write in the Brotli decoder lets crafted compressed data run code, reached through fetch() and Express 5 or body-parser 2 request bodies; fixed in Node.js 22.23.4, 24.22.1 and 26.12.1 and in the PyPI packages Brotli 1.2.1 and brotlicffi 1.2.1.0 (CVSS 4.0 9.2)2026-10-24
- CVE-2026-16723, Alibaba fastjson 1.2.68–1.2.83: remote code execution under stock defaults in Spring Boot fat-JARs, exploited in the wild with no 1.x patch2026-07-27
- Imperva and Varonis: indirect prompt injection and "agent phishing" against the OpenClaw AI agent, fixed in v2026.4.23, but the attack class generalises2026-06-12
- CVE-2026-45247, Mirasvit Full Page Cache Warmer (Magento 2 / Adobe Commerce): unauthenticated PHP object-injection RCE, now in CISA KEV2026-06-04
- CVE-2026-9082: anonymous SQL injection in Drupal core on PostgreSQL, Highly critical, exploited and CISA KEV-listed2026-05-20