watchTowr Labs
watchtowr · B · active
Edge-device exploit research, often ahead of vendor disclosures. RSS at https://labs.watchtowr.com/rss/. | 2026-06-20 full audit (v2.62): live=Y, drill=Y. FETCH → rss: python3 tools/fetch_source.py feed https://labs.watchtowr.com/rss/ 5 (RSS carries near-full body) then webfetch the /<slug>/ for full article. AVOID: Cadence is bursty (multiple posts in days then quiet); sparse periods are normal, not a failure. WebFetch on the article 403'd once in this audit; RSS is the more reliable entry and already carries substantive body HTML.. | 2026-07-05 admiralty audit: B, original edge-device exploit research, often ahead of vendors; RSS carries substantive body, bursty cadence is normal. No status change. | 2026-09-29: tier standard -> essential: edge-device exploitation evidence (root-cause and exploitation-status reporting that routinely precedes or sharpens vendor and KEV signal), cheap to read by feed; rss_url pinned from the notes. (2026-09-29 operator-directed setup review) | 2026-10-23 (S1): watchTowr now publishes vulnerability FAQs under https://watchtowr.com/intelligence/ (the PHP2Shell FAQ is there and `extract` reads it); the labs RSS feed does not carry them, so the feed under-collects.
Cited in 11 entries
Citation cadence
Citation days per ISO week (18 weeks of coverage span, total 10).
- CVE-2026-21589, Atlassian Data Center: unauthenticated arbitrary file access in every version of eight self-managed products, patch or take them off the internet (CVSS 4.0 9.3)2026-10-06
- CVE-2026-88771 / CVE-2026-88772, Citrix NetScaler ADC and Gateway: unauthenticated pre-auth RCE zero-days exploited before a patch existed (CVSS 4.0 9.5)2026-09-28
- CVE-2026-94127, F5 BIG-IP APM: unauthenticated heap overflow in OAuth-profile processing reaches RCE on the TMM data plane (CVSS 9.8)2026-09-23
- CVE-2026-82078 / CVE-2026-81578, PaperCut NG/MF: an Apache Tapestry request-routing confusion chains an unauthenticated config rewrite to arbitrary code execution, exploited before a patch existed2026-08-29
- Unit 42 recovers a live autonomous-AI attack operation after it exposed its own home directory, the confirmed compromises came from manual exploitation of Citrix NetScaler (CVE-2026-3055) and Marimo notebooks, not the agent2026-07-31
- Progress orders ShareFile Storage Zone Controller shutdown over a 'credible external threat'; the cause is a path-traversal flaw, fixed in 5.12.5 and 6.0.22026-07-13
- CVE-2026-8451, Citrix NetScaler ADC/Gateway: pre-auth SAML memory overread (CitrixBleed lineage), public PoC2026-07-01
- CVE-2026-8037, Progress Kemp LoadMaster: pre-auth RCE via uninitialized heap in the /accessv2 API2026-06-30
- CVE-2026-20253: Splunk Enterprise unauthenticated file write through the PostgreSQL sidecar chains to RCE, exploited and KEV-listed2026-06-14
- CVE-2026-47344 et al. TYPO3 core June release: 13 CVEs across every supported branch (10.4 ELTS → 14.3 LTS)2026-06-10
- CVE-2026-10520 / CVE-2026-10523, Ivanti Sentry: pre-auth OS command injection to root (CVSS 10.0), public PoC published today2026-06-10