Add your product or open-source project on TechLogHub
Listing is free. Sponsored featured placements are paid and priced in USD — open the pricing dialog to see plan details.
Products
Discover amazing products built by our community
Open Source ProjectsNEW
Curating the best open-source projects shaping the future
Latest from the Blog
Analysis, product insight, and practical reads for builders
CISA flags two-year-old Oracle flaw as actively exploited in attacks
CISA has classified the two-year-old Oracle WebLogic Server flaw CVE-2024-21182 as actively exploited and added it to the Known Exploited Vulnerabilities catalog. Federal agencies were ordered to patch WebLogic servers by June 4, 2026, under BOD 22-01, with a strong urging for private-sector defenders to patch promptly. The flaw affects WebLogic versions 12.2.1.4.0 and 14.1.1.0.0 and can be exploited remotely by unauthenticated attackers, potentially giving access to sensitive data or full server control. With about 1,592 exposed online according to Shodan, the guidance emphasizes applying vendor mitigations or discontinuing the product if mitigations are unavailable.
Google fixes one actively exploited Android zero-day, 124 flaws
Google’s June 2026 Android security patches fix 124 vulnerabilities, including an actively exploited zero-day (CVE-2025-48595) that can enable remote code execution and privilege escalation on Android 14+. The updates also address 18 critical flaws across System, Framework, and Qualcomm components and are released in two patch levels (2026-06-01 and 2026-06-05). Pixel devices will receive the updates first, with other OEMs likely to take longer. The patching continues a trend of prior zero-days such as CVE-2025-48633, CVE-2025-48572, and CVE-2026-21385 being addressed in earlier updates.
Hackers hijack thousands of sites for ClickFix and FakeUpdate attacks
Researchers link the DriveSurge group to massive campaigns that hijack thousands of sites to deliver malware via ClickFix and FakeUpdates. Using the open-source Traffic Distribution System zTDS, they tailor lures to visitors and redirect them to malicious payloads, including fake browser updates and PowerShell-based commands. The operation, which also targets macOS, acts as an initial access broker (PPI) and relies on dozens of malicious injection domains and fingerprints. Users are advised to download updates only from official app settings and to ignore unfamiliar update prompts.
WordPress malware campaign hides payloads in Steam profiles
GoDaddy researchers warn of a WordPress malware campaign that has infected nearly 2,000 sites since mid-2025 by embedding payloads in Steam Community profile comments. The attacker uses invisible Unicode characters to encode a payload that constructs a URL to a malicious JavaScript script, hiding the C2 channel on Steam to blend with legitimate traffic. The final stage delivers a backdoor that accepts base64-encoded PHP code via POST when a specific authentication cookie is present. Potential infection vectors include stolen admin credentials, compromised FTP/SFTP, vulnerable plugins/themes, or supply-chain compromises. Defense guidance includes watching for Steam URLs, suspicious JavaScript injections, outbound connections to Steam, and indicators like invisible characters or unusual cached entries; responders should restore from a known-good backup or perform thorough manual cleanup to prevent reinfection.