Loading story…
phpIPAM released version 1.8.2 to fix a REST API authentication bypass tracked as CVE-2026-67602, caused by an object-cache key collision in versions prior to 1.8.2. According to the vendor patch and advisory, the cache logic keyed entries only by lookup value and not by the searched column, allowing an app_id lookup to collide with an app_code lookup. An unauthenticated attacker could exploit that behavior by supplying a numeric database row identifier as an API token and obtain full API access.
The flaw could allow attackers to read, modify, and delete IP address management records through the API. The security fix updates cache read and write handling across multiple classes so entries are keyed with an explicit identifier and method, preventing collisions between different object lookup paths. The 1.8.2 release also bundles additional security fixes affecting API and sharing functionality, including permission bypasses, arbitrary local file inclusion, insecure direct object references, missing CSRF protections, and second-order SQL injection, alongside signed release artifacts and published SHA-256 hashes.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
On August 24, 2026, VulnCheck published an advisory describing how phpIPAM versions before 1.8.2 could be exploited through insecure REST API object cache keying. The advisory said an unauthenticated attacker could use a numeric database row identifier as an API token to gain full API access and read, write, or delete IP address management records.
On August 16, 2026, phpIPAM released version 1.8.2, which included the fix for the API authentication bypass caused by an object cache key collision. The release also bundled multiple other security fixes affecting API and sharing functionality.
On August 16, 2026, phpIPAM committed a security fix for CVE-2026-67602, an API authentication bypass caused by an object cache key collision. The patch changed cache lookup and write logic to include an explicit identifier and method in cache keys, preventing collisions across different object lookup paths.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
4 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcevulncheck.com
Open sourcegithub.com
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A **use-after-free** flaw in PHP's `ext-soap` component can let attackers achieve **remote code execution** by sending a crafted SOAP request that abuses `apache:Map` handling and `href` references. Tracked as **`CVE-2026-6722`** and **`GHSA-85c2-q967-79q5`**, the bug occurs because PHP stores plain object pointers in `SOAP_GLOBAL(ref_map)` keyed by libxml2 node pointers without increasing the objects' reference counts, allowing stale references to remain after the original object has been freed. The issue affects **PHP 8.2 before 8.2.31, 8.3 before 8.3.31, 8.4 before 8.4.21, and 8.5 before 8.5.6**. According to the advisory, duplicate keys in an `apache:Map` node can trigger object replacement and free the original object while leaving a dangling pointer in the reference map; a later `href` dereference can then access reclaimed memory, which attackers may shape through subsequent string allocations to gain code execution. PHP fixed the bug by incrementing the object's reference count before inserting it into the map and using safe cleanup logic with `ZVAL_PTR_DTOR` when processing ends.
Jun 29, 2026
PHP has patched two memory-safety vulnerabilities in its `ext/standard` image-handling code that can be triggered by specially crafted JPEG input. One issue, tracked as **CVE-2025-14177**, affects `getimagesize` and can disclose uninitialized heap memory when JPEG APP segments are read across multiple chunks, potentially exposing server-side data through returned metadata such as `APP1`. A second flaw in `iptcembed` can cause a heap buffer overflow and denial of service because the function sizes its output buffer from a single `fstat()` result and then continues copying data until EOF, creating risk when processing FIFOs, pipes, sockets, or files that grow after the initial size check. The bugs were discovered by Positive Technologies researcher Nikita Sveshnikov, who published proof-of-concept demonstrations showing both filter-based and direct exploitation paths for `getimagesize`, as well as a FIFO-based overflow scenario for `iptcembed`. PHP addressed the flaws by correcting chunk-buffer pointer handling in `php_read_stream_all_chunks` and adding boundary checks and safer error handling for `iptcembed`; fixes were released in **PHP 8.1.34, 8.2.30, 8.3.29, 8.4.16, and 8.5.1**. The most exposed deployments include public upload endpoints, CMS thumbnailing workflows, webmail platforms, and image CDNs that inspect user-supplied images on the server side.
Jun 29, 2026
SuiteCRM disclosed **CVE-2026-29189**, a high-severity insecure direct object reference (`IDOR`) flaw in its REST API V8 caused by missing ACL checks on user preferences and relationship endpoints. In versions before **7.15.1** and **8.9.3**, authenticated users could access or modify data beyond their assigned permissions, creating high confidentiality and integrity risk in deployments of the open-source CRM platform. The issue is tracked as **CWE-639** and carries a CVSS v3.1 rating reflecting low attack complexity and no user interaction requirement. Auth0 also patched **CVE-2026-34236** in the **Auth0-PHP SDK**, where insufficient entropy in cookie encryption allowed attackers to potentially brute-force encryption keys and forge session cookies. The flaw affects versions **8.0.0 through before 8.19.0** and is classified as **CWE-331**, with significant confidentiality and integrity impact for applications relying on the SDK for authentication. Auth0 fixed the issue in **8.19.0**, while SuiteCRM remediated its API authorization weakness in **7.15.1** and **8.9.3**.
Jun 29, 2026