The common change is reachability: trusted boot code, metadata-only file access, and a deployed WAF rule no longer enforce the boundaries operators expected.
Physical access or equivalent administrative control is still required, but the signed shell is accepted before it turns off enforcement for an unsigned payload.
UEFI PCs and servers whose Authorized Signature Database trusts one of 30 identified shell binaries or its signing certificate.
Secure Boot bypass and persistent execution of unsigned pre-OS code
The 30-binary inventory turns a known bypass class into something fleets can search for, while revocation remains incomplete and pre-remediation images can still be accepted.
An attacker places a listed shell, startup.nsh, and an unsigned payload on boot-accessible storage. The trusted shell runs the script, which overwrites the Security Architectural Protocol state checked by LoadImage and causes the payload to execute before operating-system defenses start.
This is not a completed revocation event: older images remain usable, revocation coverage is incomplete, and we do not know whether remediation reaches end-of-life hardware.
The first two answers assess the disclosed remediation as a whole, including the period where replacement shells shipped before revocation.
An unprivileged local user—or a permissionless Android app on affected shared storage—can observe events across another user’s or application’s boundary.
Linux inotify, Android FileObserver, Windows ReadDirectoryChangesW, and macOS FSEvents, the filesystem-change notification APIs built into their respective operating systems.
Cross-user activity surveillance from filesystem-event metadata without permission to read the underlying files
Runnable artifacts show one metadata side channel crossing account and application boundaries on Linux, Android, and Windows; the available Linux mitigation removes only part of the class.
The attacker watches a readable parent, shared-media directory, or Windows drive root. Event timing and, on Windows and Android, protected filenames can expose typing cadence, visited sites, WhatsApp media activity, or the appearance of an authentication prompt.
The researchers report no known exploitation in the wild. Linux now suppresses two event types on special files, but the broader notification boundary remains.
Definite answers use the Linux/Ubuntu patch path; the finding spans multiple operating systems whose deployment behavior differs.
The route reaches unpatched PSEMHUB deployments that operators protected only with a literal-path WAF or reverse-proxy rule.
Oracle PeopleSoft Enterprise PeopleTools, enterprise application servers commonly deployed on Windows or Linux with a WebLogic web tier.
Unauthenticated command execution and persistent web-shell deployment through PeopleSoft installations operators believed were protected by path-based WAF rules
The change is not another description of the deserialization flaw; it is evidence that the perimeter mitigation fails during ongoing exploitation on dozens of systems.
A request to /%50SEMHUB/hub is checked in encoded form at the perimeter, decoded by WebLogic, and routed to the vulnerable servlet. Deserialization then executes commands as the PeopleSoft or WebLogic service account.
Observed follow-on activity includes JSP web shells, fileless commands, tunnels, and remote-management tooling. Oracle has published fixes for supported affected versions.
Google attributes the encoded-path bypass to systems protected only by literal WAF rules and explicitly distinguishes them from patched systems; it does not show that the Oracle patch itself is bypassed.
GitHub Actions workflows that use actions/checkout v2–v5 with persisted credentials and publish Docker images whose build context includes the checkout's .git directory.
actions/checkout v2 through v5 stored the token in .git/config. A broad Docker COPY could preserve it in an image layer published while the token was still live, allowing a fast puller to use the workflow’s repository permissions.
The reported scan found more than 240,000 exposed tokens, but it did not say how many remained usable when discovered. Version 6 moves the credential to RUNNER_TEMP and closes this copy path for updated jobs.
WordPress Core, a self-hosted PHP content-management system.
A public, unauthenticated request can traverse outside the theme template directory. On systems with the required theme and PHP settings, attackers include pearcmd.php, write PHP into a temporary directory, and include it again for execution.
The new evidence is exploitation progressing from probes to file writes and shell commands. Fixed releases are available for supported WordPress branches.
WSO2 API Manager, API Control Plane, Traffic Manager and Universal Gateway, enterprise API-management and gateway services.
A network peer can present a forged token to an affected JWT-authenticated API. Once the verifier accepts it, the peer can invoke protected operations, obtain application credentials, and take management-plane control.
WSO2 has published fixed update levels for the affected products.
Claude Desktop for macOS, including its Cowork virtual-machine workspace and host file-opening integration.
Claude Desktop omitted one executable file type from its denylist. A compromised or prompt-injected agent can write that type into the shared Cowork folder, but this standalone path still requires the user to open it.
Anthropic identifies a fixed Claude Desktop release.
Kibana Agent Builder and Workflows, the AI-agent interface for Elasticsearch deployments.
An account allowed to manage agents and create Workflows can attach attacker-controlled behavior to a shared agent. When an administrator later interacts with it, the workflow runs with that administrator’s authority and can create durable cluster credentials.
Elastic says Agent Builder and Workflows are enabled by default and names fixed releases.
Addify Request a Quote for WooCommerce, a commercial WordPress/WooCommerce quotation plugin installed on online stores.
A store is exposed only when it has an unauthenticated quote rule using the multi-page popup. The AJAX handler then preserves an attacker’s PHP filename and writes the file into a web-accessible RFQ directory without extension or MIME validation.
A public repository includes both detection and exploit modes for the affected route and configuration.
Input Leap, an open-source keyboard-and-mouse sharing application whose Windows service launches its client or server process across desktop sessions.
An ordinary process connects to the unauthenticated localhost service, supplies a command and elevation byte, and causes the watchdog to duplicate the winlogon token and call CreateProcessAsUser. The daemon retains the command for execution after restart.
The upstream repository is archived and no fixed release is available.
AcyMailing Enterprise, an email-marketing extension for Joomla and WordPress websites, when mailbox actions or bounce handling use the bundled POP3 parser.
The path is limited to Enterprise installations using the bundled POP3 mailbox-action or bounce flow. A faulty MIME image test and missing extension check can write an attacker-named PHP part beneath media/com_acym/upload/.
Version 11.1.0 adds the checks. We do not know how often the final execution step works: it depends on PHP being enabled in the media directory, and the reporting researcher did not reproduce execution.
Recent changes were fixes, repeats, or maintenance; no new Bluetooth primitive was established.
iSteamX cross-customer start and stop control supplied the day’s direct physical consequence.
The same brief, every morning. One email a day, nothing else.
fullchain.sh follows the day’s disclosures from bug to shell — what each one enables, what it links to, and where the fix left the primitive in place.
Every finding here carries a source that was checked before it published. If something is wrong, write to admin@fullchain.sh — corrections are published on the day they affect.