This page provides a bit of a log of when and why the internet was on fire. Note: a lot more stuff broke on any given day than listed here.

• CVE-2023-50387: Extreme CPU consumption in DNSSEC validator
• CVE-2023-50868: NSEC3 closest encloser proof can exhaust CPU resources
• KeyTrap Research Paper
• ISC Blog Post, RIPE Labs Blog Post

• 2024-01-10: Authentication Bypass (CVE-2023-46805), Command Injection (CVE-2024-21887)
• 2024-01-31: Privilege Escalation (CVE-2024-21888), SSRF (CVE-2024-21893)
• 2024-02-09: XML external entity injection (CVE-2024-22024)
• Ivanti KB

• OpenSSL X.509 Email Address Buffer Overflows
• CVE-2022-3786 and CVE-2022-3602

• CVE-2022-33980
• Apache Commons Configuration advisory

Oh, also, there's an RCE in OpenSSL:

• CVE-2022-2274
• Heap memory corruption with RSA private key operation
• blog post, github issue

• CVE-2022-0847
• Dirty Pipe write-up and PoC
• Alternate PoC

• CVE-2021-4034
• Qualys Announcement
• PoC
• previous identification of the attack vector

• CVE-2022-21907: CVSS 9.8 HTTP Protocol Stack RCE
• CVE-2022-21969, CVE-2022-21846, CVE-2022-21855: CVSS 9.0 Exchange RCE
• CVE-2022-21874: CVSS 7.8 Security Center RCE
• CVE-2022-21893: CVSS 8.8 Rogue RDP RCE
• CVE-2022-21840: CVSS 7.7 Office RCE
• CVE-2022-21849: CVSS: 9.8 IKE RCE

• CVE-2021-044228: Actively exploited RCE in Log4j.
• Quickly followed by CVE 2021-45046, CVE-2021-45105, and CVE-2021-44832
• Apache Log4j Security Advisory, CERT NZ Advisory
• LunaSec write-up ("Log4Shell" branding); Local detection script
• Possible impact catalogue and community compiled list of vendor advisories

• NSO's "Pegasus" spyware now comes with a no-knock warrant: #ForcedEntry.
• iMessage Zero-Click Exploit delivers NSO Group's Pegasus
• Apple iOS and macOS updates to address CVE-2021-30860

• How REvil Ransomware Took Out Thousands of Business at Once
• REvil

• Cross-protocol TLS MitM attack: https://alpaca-attack.com/
• It's not a POODLE, but it's got a cute logo, so here we are.

• Supply chain attack hits FireEye and several US agencies.
• SolarWinds Advisody
• CISA Emergency Directive 21-01
• FireEye Threat Research Post
• FireEye SunBurst Countermeasures

• More like Complete Disaster Protocol, amiright?
• Multiple RCE and DoS vulnerabilities in Cisco's proprietary L2 protocol, CDP
• Branded Website with Logo | Actual Paper
• CVE-2020-3110: heap overflow to RCE in IP cameras
• CVE-2020-3111: stack overflow RCE/DoS in VoIP
• CVE-2020-3118: format string vuln to RCE in IOS-XR
• CVE-2020-3119: stack overflow RCE in NX-OS
• CVE-2020-3120: DoS in FXOS/IOS XR/NX-OS

• Privilege Escalation and Information Disclosure via Software-based Fault Injection Attacks against Intel SGX
• Branded Website with Logo
• Actual Paper | PoC
• Intel Advisory
• CVE-2019-11157
• CVE-2019-11090
• CVE-2019-16863

• Timing based side-channel atacks against Intel fTPM and STMicroelectronics TPM chips.
• CVE-2019-11090 / CVE-2019-16863
• Branded Website with Logo
• Actual Paper

• CVE-2019-10149: Remote Command Execution and Local Privilege Escalation in Exim
• Exim Advisory (Versions affected: 4.87 to 4.91)
• Exim Bug 2310 and code diff; NIST NVD Entry
  
• For historical reference:
  CVE-1999-0145: Sendmail WIZ and CVE-1999-0095: Sendmail DEBUG

• Zombieload Attack (PoC)
• CVE-2018-12130: Cross-Privilege-Boundary Data Sampling in Intel CPUs
• RIDL (Rogue In-Flight Data Load)
• Fallout: Reading Kernel Writes From User Space (CVE-2018-12126)
• Store-to-Leak Forwarding: Leaking Data on Meltdown-resistant CPUs

• Foreshadow / L1TF speculative execution attack
• CVE-2018-3615, CVE-2018-3620, CVE-2018-3646
• Additional info from Google Cloud, Intel, Microsoft, RedHat, VMWare

• Plaintext leak of OpenPGP or S/MIME encrypted HTML emails
• Full Paper

• RYZENFALL, MASTERKEY, FALLOUT, CHIMERA --
  "13 Critical Security Vulnerabilities and Manufacturer Backdoors discovered throughout AMD Ryzen & EPYC product lines." via https://amdflaws.com/
• AMD Response

• Codenames: "Meltdown" (paper) and "Spectre" (paper).
• Kernel Page Table Isolation (KPTI), formerly KAISER patches, have been merged in the linux kernel.
• AWS, GCE, and Azure scheduled forced reboots
• Previous speculation here and here.

• The ROBOT Attack, aka Return Of Bleichenbacher's Oracle Threat
• Test your server here or on SSLLabs (dev).

• Empty password root login in macOS High Sierra
• arsTechnica article, Wired article
• To fix: sudo passwd -u root or dsenableroot -d

• KRACK Attacks - Key Reinstallation Attacks in WP2
• Key Reinstallation Attacks: Forcing Nonce Reuse in WPA2
• In other news: that ROCA TPM vulnerability
• And of course there's a fresh Flash 0-day (CVE-2017-11292).

• Local privilege escalation via PIE/stack corruption
• RedHat Advisory and Bugzilla
• Ubuntu impact matrix
• Possible mitigation: sysctl vm.legacy_va_layout=1
• PoC published

• Petya/Petrwrap ransomware spreading across Europe
• Symantec confirms use of ETERNALBLUE, again.
• Microsoft SMB Vulnerability MS17-010

• The Stack Clash: A fistful of CVEs, including local root escalations via Exim, sudo(8), ld.so, various setuid binaries etc. across Linux, *BSD, and Solaris
• RedHat Bugzilla
• more info

• Microsoft SMB Vulnerability MS17-010 exploited via ransomware
• Customer Guidance for WannaCrypt attacks, Talos summary
• Accidentally sinkholed by @malwaretechblog

• Remotely Exploitable Type Confusion in Microsoft Malware Protection
• Google Project Zero report; CVE-2017-0290
• Microsoft Security Advisory 4022344

• Intel AMT Firmware RCE, aka INTEL-SA-00075
• CVE-2017-5689 - Detection Guide, Mitigation Guide
• Details

• Possible RCE via Ghostscript "/OutputFile (%pipe%" trickery.
• CVE-2017-8291 - Fixes in git: diff1, diff2

• "SHAttered" - get it? Full paper
• First practical techniques to generate SHA1 collisions found.
• Cloudflare leaked unitialized memory; details here.

• DDoS Attack Against Dyn Managed DNS
• Brian Krebs knows a bit about DDoS attacks
• Also brought to you by the letter 'D':
  DirtyCOW, a local privilege escalation vulnerability in the linux kernel.

• KrebsOnSecurity Hit With Record DDoS

• #httpoxy: MitM CGIs by way of HTTP_PROXY environment variable
  Originally noted and fixed in Perl in 2001, now available in your preferred language/stack.
• Want more? Try this ASN.1 heap corruption.

• CVE-2016-3714: Remote Code Execution vulnerability in ImageMagick
• Branded for great justice as ImageTragick

• CVE-2016-2108: Memory corruption in the ASN.1 encoder
• CVE-2016-2107: Padding oracle in AES-NI CBC MAC check
• OpenSSL announcement, LibreSSL announcement
  
• (If you need something branded, try ImageTragick, an RCE in ImageMagick.)

• OpenSSL update coming on May 3rd,
  'will fix several security defects with maximum severity "high"'

• CVE-2016-0800: cross-protocol DROWN attack by way of SSLv2
• OpenSSL Security advisory
• CVE-2016-0702: CacheBleed timing attack

• OpenSSL update coming on March 1st,
• 'will fix several security defects with maximum severity "high"'

CVE-2015-7547: glibc getaddrinfo stack-based buffer overflow
• PoC, glibc bugzilla, analysis and patch
• Branding as the GOLEM attack.

CVE-2016-0777: OpenSSH client side memory leak vulnerability, if experimental UseRoaming is not disabled.
• Full details from Qualys

• Possible backdoor in Juniper NetScreen devices.
• CVE-2015-7755, CVE-2015-7756
• Sound familiar? Better look into it

• OS X Security Update 2015-008
• 12 Microsoft Security Advisories
  (favorites: leaked privkey for *.xboxlive.com, RCE in Windows DNS)
• 79 vulnerabilities in, what else, Flash

• At least our GIFs are still safe.
  CVE-2015-8126: multiple buffer overflows in libpng.
  (Good thing that's not used everywhere.)

• Here it is, your moment of Xen: XSA-148 / CVE-2015-7835: Xen x86 privilege escalation
• Additional XSAs: XSA-145, XSA-146, XSA-147, XSA-149, XSA-150, XSA-151, XSA-152, XSA-153

• Best to stop caring.

• CVE-2015-5986: DoS vulnerability in bind(8)
• CVE-2015-5722: DoS vulnerability in bind(8)

• CVE-2015-5477: DoS vulnerability in bind(8)
• In other news: RCE in most Android phones via Stagefright

• Here's your monthly OpenSSL advisory (CVE-2015-1793).

• It's been awfully quiet lately.
  But then there's a new OpenSSL release coming on July 9th...

• CVE-2015-4000: Weak Diffie-Hellman downgrade attack
  Details: Imperfect Forward Security

• CVE-2015-3456: VENOM VM escape by way of virtual floppy driver
• XSA-133, RedHat Blog, RedHat Bugzilla

• MS15-043: RCE in Internet Explorer
• MS15-044: RCE in MS Windows, Office, Silverlight
• APSB15-09: RCE in Flash (related Chrome Update)

• No, seriously, it's got a CVE: CVE-2015-3152.
• And a website with a logo.
• And a blog post.

• WordPress 4.1.2 Security Release: XSS enabling SQLi or file upload vulnerabilities
• Of Phishing Attacks and WordPress 0days
• WordPress 4.2 Stored XSS

• ms15-034 / cve-2015-1635: http.sys remote code execution vulnerability
• ms15-033: remote code execution vulnerabilities in ms office
• cve-2015-1641: ms office memory corruption; attacks found in the wild

• APPLE-SA-2015-04-08: Security Updates for OS X, iOS, Safari, Apple TV, Xcode
• I'm sure new Wordpress, Flash or Java vulnerabilities are abound, too.

• Bar Mitzvah attack: 13-year old Invariance Weakness SSL vulnerability when using RC4

• OpenSSL advisory: 1.0.2 ClientHello Sigalg DoS (CVE-2015-0291)
• FREAK (CVE-2015-0204) re-classified as "high" severity;
• misc. moderate and low severity issues
  CVE-2015-1787, CVE-2015-0207, CVE-2015-0208, CVE-2015-0209, CVE-2015-0285, CVE-2015-0286, CVE-2015-0287, CVE-2015-0288, CVE-2015-0289, CVE-2015-0290, CVE-2015-0292, CVE-2015-0293

• DRAM rowhammer exploits (description for mortals)
• CVE-2015-0204: Factoring attack on RSA-EXPORT Keys (aka FREAK)
• And, as usual, Adobe Flash has a number of critical vulnerabilities.

• CVE-2015-0204: Factoring attack on RSA-EXPORT Keys (aka FREAK);
  see also: WaPo article, OpenSSL Advisory from 01/15
• 119, 120, 121, 122, 123, 124: Amazon, Rackspace, Linode forcing reboots

• Xen XSAs 119-123 (still embargoed); Amazon begins reboot of 10% of EC2
  Rackspace to perform reboots March 2nd - 9th; Linode announcement here; IBM SoftLayer to reboot as well
• CVE-2014-8687: Seagate Business NAS pre-authentication RCE

• Wordpress Slimstat SQL Injection
• Superfish MiTM malware installed on Lenovo laptops
  Similar shenanigans discovered in all sorts of phishy malware; Comodo Privdog being but one example.
• NSA/GCHQ hacked into Gemalto SIM provider

• Superfish MiTM malware installed on Lenovo laptops
  @erratarob extracted the SSL key; Komodia appears to be the company behind this product.
• Similar shenanigans discovered in all sorts of phishy malware; Comodo Privdog being but one example.
• NSA/GCHQ hacked into Gemalto SIM provider

• CVE-2015-0313: actively exploited 0-day RCE in Adobe Flash
• CVE-2015-0235: 14 year old glibc RCE in gethostbyname et al ("GHOST")
• CVE-2015-0311: actively exploited RCE in Adobe Flash

• CVE-2015-0235: 14 year old glibc RCE in gethostbyname et al ("GHOST")
• CVE-2015-0311: actively exploited and still unpatched RCE in Adobe Flash
• CVE-2015-0310: actively exploited memory randomization circumvention vulnerability in Adobe Flash

• CVE-2015-0311: actively exploited and still unpatched RCE in Adobe Flash
• CVE-2015-0310: actively exploited memory randomization circumvention vulnerability in Adobe Flash
• Oracle Critical Patch Update: 169 security fixes, including 13 remotely exploitable issues in Java

• CVE-2015-0206
• CVE-2014-3569
• CVE-2014-3572
• CVE-2015-0204
• CVE-2015-0205
• CVE-2014-8275
• CVE-2014-3570

• CVE-2014-9295: DOS / RCE in ntp
• CVE-2014-9390: arbitrary command execution via git
• CVE-2014-9222: residential gateway router compromise by way of maliciously crafted cookies

• Flash Remote Code Execution
• MS Windows recursive patching required
• POODLE bites certain TLS implementation

• Remote Code Execution on OS X 10.10.1, iOS 8.1.1
• Wordpress 3 Persistent Script Injection
• CVE-2014-6321: Remote Code Execution Vulnerability in Microsoft Secure Channel

• CVE-2014-6332: Windows OLE Automation Array Remote Code Execution Vulnerability
• CVE-2014-6321: Remote Code Execution Vulnerability in Microsoft Secure Channel
• your usual Flash remote code execution vulnerabilities

• Drupal PSA-2014-003: "you should proceed under the assumption that every Drupal 7 website was compromised"

• CVE-2014-3566: POODLE (Exploiting the SSL 3.0 Fallback) OpenSSL Advisory
• CVE-2014-4449: iOS does not verify iCloud cert, possibly cause of Chinese MitM Attack

• CVE-2014-3566: POODLE (Exploiting the SSL 3.0 Fallback) OpenSSL Advisory
• CVE-2014-4114: 0-day RCE in Windows #Sandworm (MS14-060)
• Oracle Critical Patch Update: 155 issues
• CVE-2014-3704: Drupal SQL Injection (#drupageddon)

• Dropbox passwords leaked: here, here, here

• CVE-2014-6271 #shellshock remote code execution through bash
• CVE-2014-7284 (NGRO Bug): Lack of randomness in Linux kernel network secrets

• CVE-2014-6271 #shellshock remote code execution through bash
• CVE-2014-3634 Remote DoS vulnerability in rsyslog, sysklogd

• CVE-2014-6271 #shellshock remote code execution through bash
• CVE-2014-1568 RSA Signature Forgery in NSS
• jQuery.com compromised
• Amazon begins rebooting parts of EC2 to address embargoed Xen Security Advisory

• CVE-2014-0224: Various OpenSSL vulnerabilities (incl. CCS Injection)

• CVE-2014-0160: Heartbleed