Loading story…
CERT Polska disclosed CVE-2026-91784, a local argument-injection flaw in cjbassi/gotop version 3.0.0. Gotop’s process-termination feature passes a selected process name to pkill without sanitization. A local attacker can create a process with a name beginning with -- that embeds a target user’s UID; when a gotop user selects that process for termination, pkill can interpret the name as a command-line option and terminate all processes owned by the target user.
The issue was reported by Michał Majchrowicz and Marcin Wyczechowski of AFINE Team and coordinated by CERT Polska. The product is unsupported and no fix is available; other untested releases may also be affected. Organizations using gotop should remove or restrict its process-killing capability, replace it with a maintained alternative, and assess exposure on multi-user systems where local users can create attacker-controlled process names.
Map this exposure pattern across your cloud, code, and identities.
1 event from the most recent confirmed update back to the earliest known activity.
CERT Polska published CVE-2026-91784, a CWE-88 local argument-injection vulnerability confirmed in gotop 3.0.0. Crafted process names beginning with "--" can be passed unsanitized to pkill through gotop's process-termination feature, potentially causing termination of all processes owned by a targeted user; the unsupported product has no fix available.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See where this exposure pattern shows up across your cloud, code, supply chain, and non-human identities.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
CERT Polska disclosed three vulnerabilities in **GNU cpio** affecting versions through **2.15**, tracked as `CVE-2026-66484`, `CVE-2026-66485`, and `CVE-2026-66486`. The issues were reported by researchers from the **AFINE Team** and include a **path traversal** flaw during tar extraction, an **uncontrolled memory allocation** bug that can trigger **stack overflow** and **denial of service**, and an **improper output escaping** weakness. The output-handling flaw can allow **forged archive listings** or **terminal escape-sequence injection**, creating opportunities to mislead users or manipulate terminal output. CERT Polska said the vulnerabilities have been addressed in specific upstream commits, while a separate security notice amplified the disclosure and directed users to the CERT advisory for details on the affected GNU cpio software.
Aug 10, 2026
A critical command injection flaw in **Palo Alto Networks GlobalProtect** exposed internet-facing devices running affected `PAN-OS` versions to unauthenticated remote code execution with **root-level access**. Palo Alto confirmed the vulnerability was being exploited in the wild, and **CISA** added it to the **Known Exploited Vulnerabilities (KEV)** catalog. The issue affected systems with GlobalProtect enabled on `PAN-OS 10.2`, `11.0`, and `11.1`, and public proof-of-concept exploit code increased the urgency for defenders to patch. Finland’s National Cyber Security Centre said it issued a serious warning after receiving the first breach notifications tied to the flaw and identified several hundred potentially vulnerable Palo Alto devices in domestic networks. About 15 incident reports related to Palo Alto devices were received, though no more serious breach cases were identified. Early vendor guidance that disabling telemetry could mitigate risk was later deemed insufficient, prompting a shift to immediate patching; fixes were released for supported branches including `10.2.9-h1`, `11.0.4-h1`, and `11.1.2-h3`, after which the Finnish warning was withdrawn as the threat subsided.
Jun 29, 2026
Rapid7 and BleepingComputer reported an unpatched **zero-day** in the self-hosted Git service **Gogs** that allows **authenticated remote code execution** through argument injection in the pull request rebase workflow. The flaw affects current releases including `0.14.2` and `0.15.0+dev`, and likely earlier versions that support rebase merging. An attacker can abuse the **"Rebase before merging"** feature by supplying a malicious branch name that is passed into a `git rebase` command without a proper option separator, enabling use of Git's `--exec` flag to run attacker-controlled shell commands as the Gogs server process user. The issue is rated **CVSSv4 9.4** and is considered especially dangerous on default-configured instances because **open registration** and unrestricted repository creation are enabled by default, lowering the barrier to exploitation. Successful attacks could expose private repositories, stored credentials, and secrets, enable code tampering and supply-chain compromise, and support lateral movement deeper into victim networks. Rapid7 said no vendor patch was available at publication time and released a Metasploit module for Linux and Windows, while separate reporting noted Gogs maintainers had only acknowledged the report. The disclosures follow broader scrutiny of Git hosting platforms, including a recently disclosed **Gitea** flaw, `CVE-2026-27771`, that can expose private container images without authentication on versions prior to `1.26.2`.
Jun 29, 2026