Tenable Research
tenable-research · B · active
Tenable vuln research; Patch Tuesday analysis. RSS at https://www.tenable.com/blog/feed. | 2026-06-20 full audit (v2.62): live=Y, drill=Y. FETCH → rss: python3 tools/fetch_source.py feed https://www.tenable.com/blog/feed 5 (feed carries full HTML bodies inline; WebFetch the article URL only if more detail needed).. AVOID: The feed already includes substantive article bodies; often no separate per-article fetch is needed.. | 2026-07-05 admiralty audit: B, original vendor vuln research with own telemetry; feed carries full bodies. Keep active. | 2026-08-13: blog.xml feed parses to count=0 and the /blog listing is a JS-rendered shell with no drillable items; recipe gap unresolved this run. | 2026-08-23 audit: RECIPE FIXED; the blog listing is a Drupal JS shell with zero static post links, but the shell itself advertises the real feed: rss_url set to https://feeds.feedburner.com/tenable/qaXL (verified: 10 full-body dated items). fetch_method switched to rss.
Cited in 10 entries
Citation cadence
Citation days per ISO week (24 weeks of coverage span, total 9).
- CVE-2026-111497, Node.js and Google Brotli (Node2Shell): an out-of-bounds write in the Brotli decoder lets crafted compressed data run code, reached through fetch() and Express 5 or body-parser 2 request bodies; fixed in Node.js 22.23.4, 24.22.1 and 26.12.1 and in the PyPI packages Brotli 1.2.1 and brotlicffi 1.2.1.0 (CVSS 4.0 9.2)2026-10-24
- CVE-2026-109618 / CVE-2026-109619, PHP (PHP2Shell): two unauthenticated remote-code-execution flaws in the runtime, fixed on 2026-10-21 in 8.5.12, 8.4.27, 8.3.36 and 8.2.35, with attack traffic already observed and no upstream release for 8.1 and older (CVSS 4.0 9.2)2026-10-21
- CVE-2026-88771 / CVE-2026-88772, Citrix NetScaler ADC and Gateway: unauthenticated pre-auth RCE zero-days exploited before a patch existed (CVSS 4.0 9.5)2026-09-28
- Open-source AI pentesting harnesses (Strix, Cairn, Hermes) run an autonomous intrusion-and-skimmer campaign against online retailers for about $25 a target2026-09-23
- A near-autonomous, multi-agent AI framework compromised Taiwanese government infrastructure over four days, cracking 85 accounts, exfiltrating 2,564+ personnel records, and bypassing its own safety guardrails by reframing itself as 'authorized penetration testing'2026-08-28
- CVE-2026-5027, Langflow: unauthenticated path traversal to arbitrary file write, exploited in the wild2026-06-11
- CVE-2026-47344 et al. TYPO3 core June release: 13 CVEs across every supported branch (10.4 ELTS → 14.3 LTS)2026-06-10
- CVE-2026-47291, Microsoft June Patch Tuesday: HTTP.sys pre-auth RCE (CVSS 9.8) headlines the largest-ever release (198 CVEs)2026-06-10
- CVE-2026-9642, Delta Electronics DIAView SCADA: incomplete fix for prior unauthenticated remote database access (CVE-2025-62582)2026-05-27
- Microsoft May 2026 Patch Tuesday: Netlogon pre-auth RCE on domain controllers (CVE-2026-41089), later reported exploited by Belgium's CCB, leads four critical fixes2026-05-13