{"metadata": {"vulnerability": "CVE-2026-33626", "count": 86, "kinds": {"milestone": 6, "sighting": 47, "kev": 0, "other": 33}}, "data": [{"timestamp": "2026-03-23T14:24:11.617Z", "date_only": false, "value": "2026-03-23T14:24:11.617Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-33626", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-04-20T20:29:19.558Z", "date_only": false, "value": "2026-04-20T20:29:19.558Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-33626", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-04-20T20:29:19.558Z", "date_only": false, "value": "2026-04-20T20:29:19.558Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / GitHub_M", "record": "CVE-2026-33626", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-04-20T21:16:35Z", "date_only": false, "value": "2026-04-20T21:16:35Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-6W67-HWM5-92MQ", "record": "GHSA-6W67-HWM5-92MQ", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-04-20T21:16:35.097Z", "date_only": false, "value": "2026-04-20T21:16:35.097", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-33626", "record": "FKIE_CVE-2026-33626", "field": "published"}, {"timestamp": "2026-04-20T21:37:35.151Z", "date_only": false, "value": "2026-04-20T21:37:35.151844Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mjxghobgwf2f", "record": "CVE-2026-33626", "field": "creation_timestamp", "uuid": "5a5dcee6-d6eb-43bb-b3a2-9cff02a478d6", "url": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mjxghobgwf2f"}, {"timestamp": "2026-04-20T22:15:46.949Z", "date_only": false, "value": "2026-04-20T22:15:46.949542Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mjxilyimcp2c", "record": "CVE-2026-33626", "field": "creation_timestamp", "uuid": "79a4d1e5-9e83-4d7f-bc5a-f9c1addf0684", "url": "https://bsky.app/profile/cve.skyfleet.blue/post/3mjxilyimcp2c"}, {"timestamp": "2026-04-20T23:18:29Z", "date_only": false, "value": "2026-04-20T23:18:29.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/9Djs_e05P71eOqOBKGWSEvRis3v2yPmwIHyqqWc98-IGQuI", "record": "CVE-2026-33626", "field": "creation_timestamp", "uuid": "237664b3-b960-4244-832e-e01713b32668"}, {"timestamp": "2026-04-21T15:04:13Z", "date_only": false, "value": "2026-04-21T15:04:13Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-6W67-HWM5-92MQ", "record": "GHSA-6W67-HWM5-92MQ", "field": "published"}, {"timestamp": "2026-04-21T15:04:13Z", "date_only": false, "value": "2026-04-21T15:04:13Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-6W67-HWM5-92MQ", "record": "GHSA-6W67-HWM5-92MQ", "field": "modified"}, {"timestamp": "2026-04-21T17:52:10.383Z", "date_only": false, "value": "2026-04-21T17:52:10.383689Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-33626", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-04-21T17:52:10.383Z", "date_only": false, "value": "2026-04-21T17:52:10.383689Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-33626", "record": "FKIE_CVE-2026-33626", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-04-21T19:50:13.326Z", "date_only": false, "value": "2026-04-21T19:50:13.326Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-33626", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-04-21T19:50:13.326Z", "date_only": false, "value": "2026-04-21T19:50:13.326Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-33626", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-04-21T22:00:00Z", "date_only": false, "value": "2026-04-21T22:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-1228", "record": "WID-SEC-W-2026-1228", "field": "document.tracking.revision_history.0.date"}, {"timestamp": "2026-04-21T22:00:00Z", "date_only": false, "value": "2026-04-21T22:00:00.000+00:00", "kind": "milestone", "label": "Published", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-1228", "record": "WID-SEC-W-2026-1228", "field": "document.tracking.initial_release_date"}, {"timestamp": "2026-04-21T22:00:00Z", "date_only": false, "value": "2026-04-21T22:00:00.000+00:00", "kind": "other", "label": "Release date", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-1228", "record": "WID-SEC-W-2026-1228", "field": "vulnerabilities.0.release_date"}, {"timestamp": "2026-04-22T17:20:38.054Z", "date_only": false, "value": "2026-04-22T17:20:38.054107Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/blackhatnews.tokyo/post/3mk3z22tp3x2v", "record": "CVE-2026-33626", "field": "creation_timestamp", "uuid": "f55b2ac8-fa42-4206-aea0-10a91dc0c224", "url": "https://bsky.app/profile/blackhatnews.tokyo/post/3mk3z22tp3x2v"}, {"timestamp": "2026-04-22T18:30:12.198Z", "date_only": false, "value": "2026-04-22T18:30:12.198908Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cyberveille-ch.bsky.social/post/3mk44whd3352c", "record": "cve-2026-33626", "field": "creation_timestamp", "uuid": "6af1960d-1ad8-4e24-9331-9cc160c7a1c7", "url": "https://bsky.app/profile/cyberveille-ch.bsky.social/post/3mk44whd3352c"}, {"timestamp": "2026-04-22T18:38:42.072Z", "date_only": false, "value": "2026-04-22T18:38:42.072574Z", "kind": "sighting", "label": "Seen", "source": "https://swecyb.com/ap/users/116080658609901341/statuses/116449589272103072", "record": "cve-2026-33626", "field": "creation_timestamp", "uuid": "0f1bebb8-60b4-47d8-9da0-51d28092bce9", "url": "https://swecyb.com/ap/users/116080658609901341/statuses/116449589272103072"}, {"timestamp": "2026-04-22T20:42:35.442Z", "date_only": false, "value": "2026-04-22T20:42:35.442842Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/LLMs.activitypub.awakari.com.ap.brid.gy/post/3mk4ed4w5sq72", "record": "CVE-2026-33626", "field": "creation_timestamp", "uuid": "0b862fb0-8ea2-488d-bb66-b19b787475fc", "url": "https://bsky.app/profile/LLMs.activitypub.awakari.com.ap.brid.gy/post/3mk4ed4w5sq72"}, {"timestamp": "2026-04-22T22:00:00Z", "date_only": false, "value": "2026-04-22T22:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-1228", "record": "WID-SEC-W-2026-1228", "field": "document.tracking.revision_history.1.date"}, {"timestamp": "2026-04-23T03:45:21.668Z", "date_only": false, "value": "2026-04-23T03:45:21.668236Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/hendryadrian.bsky.social/post/3mk53x5igcf2q", "record": "CVE-2026-33626", "field": "creation_timestamp", "uuid": "70278fd0-6cf9-4133-a6a3-239e4df749ae", "url": "https://bsky.app/profile/hendryadrian.bsky.social/post/3mk53x5igcf2q"}, {"timestamp": "2026-04-23T21:03:16.099Z", "date_only": false, "value": "2026-04-23T21:03:16.099263Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/beikokucyber.bsky.social/post/3mk6vwuemhs2g", "record": "CVE-2026-33626", "field": "creation_timestamp", "uuid": "377097b9-a2e7-40b1-9a5d-e23a5c4b2d4b", "url": "https://bsky.app/profile/beikokucyber.bsky.social/post/3mk6vwuemhs2g"}, {"timestamp": "2026-04-23T22:00:00Z", "date_only": false, "value": "2026-04-23T22:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-1228", "record": "WID-SEC-W-2026-1228", "field": "document.tracking.revision_history.2.date"}, {"timestamp": "2026-04-24T05:24:00Z", "date_only": false, "value": "2026-04-24T05:24:00.000000Z", "kind": "sighting", "label": "Seen", "source": "https://thehackernews.com/2026/04/lmdeploy-cve-2026-33626-flaw-exploited.html", "record": "CVE-2026-33626", "field": "creation_timestamp", "uuid": "0120fdeb-c41c-4476-8fc2-aa5f9e940149", "url": "https://thehackernews.com/2026/04/lmdeploy-cve-2026-33626-flaw-exploited.html"}, {"timestamp": "2026-04-24T07:30:27Z", "date_only": false, "value": "2026-04-24T07:30:27.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/thehackernews/8866", "record": "CVE-2026-33626", "field": "creation_timestamp", "uuid": "ee043fda-17b8-48f5-804f-d945a27b5b21", "content": "\u26a0\ufe0f LMDeploy flaw exploited within 12.5 hours of disclosure.\n\nThe SSRF bug let attackers hit AWS metadata, Redis, and internal services via the image loader to scan networks and access data.\n\nWordPress plugin bugs are also being used for full site takeovers.\n\n\ud83d\udd17 Read \u2192 https://thehackernews.com/2026/04/lmdeploy-cve-2026-33626-flaw-exploited.html", "url": "https://t.me/thehackernews/8866"}, {"timestamp": "2026-04-24T07:47:30.766Z", "date_only": false, "value": "2026-04-24T07:47:30.766717Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/2rZiKKbOU3nTafniR2qMMSE0gwZ.activitypub.awakari.com.ap.brid.gy/post/3mk7zx2fgjb42", "record": "CVE-2026-33626", "field": "creation_timestamp", "uuid": "bb9bae84-eaac-4c1a-bb7c-1a3d9b9f68c7", "url": "https://bsky.app/profile/2rZiKKbOU3nTafniR2qMMSE0gwZ.activitypub.awakari.com.ap.brid.gy/post/3mk7zx2fgjb42"}, {"timestamp": "2026-04-24T08:19:11Z", "date_only": false, "value": "2026-04-24T08:19:11.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/ctinow/249298", "record": "CVE-2026-33626", "field": "creation_timestamp", "uuid": "0ac7ac0c-0531-461b-861d-67a962d66b6f", "content": "LMDeploy CVE-2026-33626 Flaw Exploited Within 13 Hours of Disclosure\nhttps://ift.tt/JZvHdxR", "url": "https://t.me/ctinow/249298"}, {"timestamp": "2026-04-24T08:19:22.840Z", "date_only": false, "value": "2026-04-24T08:19:22.840709Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/shiojiri.com/post/3mka3pjih7krs", "record": "cve-2026-33626", "field": "creation_timestamp", "uuid": "3c199d7a-3c12-49bc-9c4f-f4bcf338cf6e", "url": "https://bsky.app/profile/shiojiri.com/post/3mka3pjih7krs"}, {"timestamp": "2026-04-24T08:31:31.056Z", "date_only": false, "value": "2026-04-24T08:31:31.056086Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/2rZiKKbOU3nTafniR2qMMSE0gwZ.activitypub.awakari.com.ap.brid.gy/post/3mka4fn7ys4z2", "record": "CVE-2026-33626", "field": "creation_timestamp", "uuid": "379a2792-07ec-4128-8680-bc23252210cf", "url": "https://bsky.app/profile/2rZiKKbOU3nTafniR2qMMSE0gwZ.activitypub.awakari.com.ap.brid.gy/post/3mka4fn7ys4z2"}, {"timestamp": "2026-04-24T08:41:05.462Z", "date_only": false, "value": "2026-04-24T08:41:05.462757Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/infosec.skyfleet.blue/post/3mka4wrw5do2m", "record": "CVE-2026-33626", "field": "creation_timestamp", "uuid": "d92dbca7-9d0a-4391-818c-fd016d358950", "url": "https://bsky.app/profile/infosec.skyfleet.blue/post/3mka4wrw5do2m"}, {"timestamp": "2026-04-24T09:17:49.186Z", "date_only": false, "value": "2026-04-24T09:17:49.186943Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/tomcat/statuses/116458931406640098", "record": "cve-2026-33626", "field": "creation_timestamp", "uuid": "7c05c008-a941-427d-a4a7-38898bbc3999", "url": "https://infosec.exchange/users/tomcat/statuses/116458931406640098"}, {"timestamp": "2026-04-24T09:24:28.650Z", "date_only": false, "value": "2026-04-24T09:24:28.650353Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/bitnewsbot.bsky.social/post/3mka7ehvb3e2u", "record": "CVE-2026-33626", "field": "creation_timestamp", "uuid": "868a9243-2ae5-42ac-b503-d61e8b7869a2", "url": "https://bsky.app/profile/bitnewsbot.bsky.social/post/3mka7ehvb3e2u"}, {"timestamp": "2026-04-24T10:12:58.140Z", "date_only": false, "value": "2026-04-24T10:12:58.140435Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cybersecurity0001.bsky.social/post/3mkac364t6v27", "record": "CVE-2026-33626", "field": "creation_timestamp", "uuid": "85db993c-3883-4f7b-8a89-b6946a83881d", "url": "https://bsky.app/profile/cybersecurity0001.bsky.social/post/3mkac364t6v27"}, {"timestamp": "2026-04-24T11:01:00Z", "date_only": false, "value": "2026-04-24T11:01:00.000000Z", "kind": "sighting", "label": "Exploited", "source": "Telegram/UBTKotZyxCy9tJBu8isS9UFyZbohCEb5kcnlBncswYXP8g", "record": "CVE-2026-33626", "field": "creation_timestamp", "uuid": "8f2b54f5-12be-462d-a7a5-adb446c78fc0"}, {"timestamp": "2026-04-24T11:46:31.860Z", "date_only": false, "value": "2026-04-24T11:46:31.860693Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cyberwarriorsme.bsky.social/post/3mkahchtfmw23", "record": "CVE-2026-33626", "field": "creation_timestamp", "uuid": "82b2ac33-2978-418a-bc0e-aadf1fa5e456", "url": "https://bsky.app/profile/cyberwarriorsme.bsky.social/post/3mkahchtfmw23"}, {"timestamp": "2026-04-24T11:52:32.624Z", "date_only": false, "value": "2026-04-24T11:52:32.624404Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/nidouille.bsky.social/post/3mkahn6rmic2l", "record": "CVE-2026-33626", "field": "creation_timestamp", "uuid": "86b3ef0a-63a1-4e86-bb67-801086a7f103", "url": "https://bsky.app/profile/nidouille.bsky.social/post/3mkahn6rmic2l"}, {"timestamp": "2026-04-24T12:03:23Z", "date_only": false, "value": "2026-04-24T12:03:23.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/TengkorakCyberCrewzz/39842", "record": "CVE-2026-33626", "field": "creation_timestamp", "uuid": "79748036-f699-4c52-b427-717600443e3b", "content": "LMDeploy CVE-2026-33626 Flaw Exploited Within 13 Hours of Disclosure \u2013 thehackernews.com\n\nFri, 24 Apr 2026 15:24:00", "url": "https://t.me/TengkorakCyberCrewzz/39842"}, {"timestamp": "2026-04-24T12:03:23Z", "date_only": false, "value": "2026-04-24T12:03:23.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/TengkorakCyberCrewzz/9935", "record": "CVE-2026-33626", "field": "creation_timestamp", "uuid": "cc48b5e0-8194-4c1d-a256-2448443a8f97", "content": "LMDeploy CVE-2026-33626 Flaw Exploited Within 13 Hours of Disclosure \u2013 thehackernews.com\n\nFri, 24 Apr 2026 15:24:00", "url": "https://t.me/TengkorakCyberCrewzz/9935"}, {"timestamp": "2026-04-24T13:28:04.030Z", "date_only": false, "value": "2026-04-24T13:28:04.030774Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/rmcholewa.bsky.social/post/3mkamxzsk3525", "record": "CVE-2026-33626", "field": "creation_timestamp", "uuid": "ca0d8374-862c-40c6-8dfe-802e4287ebbe", "url": "https://bsky.app/profile/rmcholewa.bsky.social/post/3mkamxzsk3525"}, {"timestamp": "2026-04-24T18:15:32Z", "date_only": false, "value": "2026-04-24T18:15:32.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/cibsecurity/89179", "record": "CVE-2026-33626", "field": "creation_timestamp", "uuid": "7bd93d48-0ad4-4a35-b717-82ffbacdb49a", "content": "\ud83d\udd8b\ufe0f LMDeploy CVE-2026-33626 Flaw Exploited Within 13 Hours of Disclosure \ud83d\udd8b\ufe0f\n\nA highseverity security flaw in LMDeploy, an opensource toolkit for compressing, deploying, and serving LLMs, has come under active exploitation in the wild less than 13 hours after its public disclosure. The vulnerability, tracked as CVE202633626 CVSS score 7.5, relates to a ServerSide Request Forgery SSRF vulnerability that could be exploited to access sensitive data. \"A serverside.\n\n\ud83d\udcd6 Read more.\n\n\ud83d\udd17 Via \"The Hacker News\"\n\n----------\n\ud83d\udc41\ufe0f Seen on @cibsecurity", "url": "https://t.me/cibsecurity/89179"}, {"timestamp": "2026-04-24T18:15:40Z", "date_only": false, "value": "2026-04-24T18:15:40.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/cibsecurity/89182", "record": "CVE-2026-33626", "field": "creation_timestamp", "uuid": "eb04e0d2-a38f-42e6-b490-87e2fd243f2a", "content": "\ud83d\udd8b\ufe0f LMDeploy CVE-2026-33626 Flaw Exploited Within 13 Hours of Disclosure \ud83d\udd8b\ufe0f\n\nA highseverity security flaw in LMDeploy, an opensource toolkit for compressing, deploying, and serving LLMs, has come under active exploitation in the wild less than 13 hours after its public disclosure. The vulnerability, tracked as CVE202633626 CVSS score 7.5, relates to a ServerSide Request Forgery SSRF vulnerability that could be exploited to access sensitive data. \"A serverside.\n\n\ud83d\udcd6 Read more.\n\n\ud83d\udd17 Via \"The Hacker News\"\n\n----------\n\ud83d\udc41\ufe0f Seen on @cibsecurity", "url": "https://t.me/cibsecurity/89182"}, {"timestamp": "2026-04-25T05:10:13.833Z", "date_only": false, "value": "2026-04-25T05:10:13.833285Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/hacker.at.thenote.app/post/3mkcbmqna4s2d", "record": "CVE-2026-33626", "field": "creation_timestamp", "uuid": "b3f76359-825e-4982-8158-bbe94e45f8a4", "url": "https://bsky.app/profile/hacker.at.thenote.app/post/3mkcbmqna4s2d"}, {"timestamp": "2026-04-25T11:09:11.452Z", "date_only": false, "value": "2026-04-25T11:09:11.452902Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/shortinfo.bsky.social/post/3mkcvomaxj22o", "record": "CVE-2026-33626", "field": "creation_timestamp", "uuid": "3f24733b-43c7-443a-a404-3bca7be3a33b", "url": "https://bsky.app/profile/shortinfo.bsky.social/post/3mkcvomaxj22o"}, {"timestamp": "2026-04-25T12:28:11.616Z", "date_only": false, "value": "2026-04-25T12:28:11.616030Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/vitobotta.com/post/3mkd23vhifk2z", "record": "CVE-2026-33626", "field": "creation_timestamp", "uuid": "88a1197a-0ff4-4fcd-841f-9a2db00893ee", "url": "https://bsky.app/profile/vitobotta.com/post/3mkd23vhifk2z"}, {"timestamp": "2026-04-26T06:50:55.967Z", "date_only": false, "value": "2026-04-26T06:50:55.967885Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/pvynckier.bsky.social/post/3mkexpno2322x", "record": "CVE-2026-33626", "field": "creation_timestamp", "uuid": "afd2660d-ae1a-4bc7-b276-ee6abaa598fe", "url": "https://bsky.app/profile/pvynckier.bsky.social/post/3mkexpno2322x"}, {"timestamp": "2026-04-26T07:11:26.415Z", "date_only": false, "value": "2026-04-26T07:11:26.415954Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/clankussy.abu.guru/post/3mkeyugfefv2s", "record": "cve-2026-33626", "field": "creation_timestamp", "uuid": "4c258c51-afb1-45a0-b48b-6e39d0e9aba1", "url": "https://bsky.app/profile/clankussy.abu.guru/post/3mkeyugfefv2s"}, {"timestamp": "2026-04-26T18:48:40.524Z", "date_only": false, "value": "2026-04-26T18:48:40.524796Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/termsofsurrender.bsky.social/post/3mkg7t6ii2k2s", "record": "CVE-2026-33626", "field": "creation_timestamp", "uuid": "76dae10f-1656-45c6-b266-1e9bb4e759d2", "url": "https://bsky.app/profile/termsofsurrender.bsky.social/post/3mkg7t6ii2k2s"}, {"timestamp": "2026-04-26T22:00:00Z", "date_only": false, "value": "2026-04-26T22:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-1228", "record": "WID-SEC-W-2026-1228", "field": "document.tracking.revision_history.3.date"}, {"timestamp": "2026-04-27T05:53:13.816Z", "date_only": false, "value": "2026-04-27T05:53:13.816428Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/2rZiKKbOU3nTafniR2qMMSE0gwZ.activitypub.awakari.com.ap.brid.gy/post/3mkhex2ibkh22", "record": "CVE-2026-33626", "field": "creation_timestamp", "uuid": "957fdae2-d285-4763-8067-7934b375bafc", "url": "https://bsky.app/profile/2rZiKKbOU3nTafniR2qMMSE0gwZ.activitypub.awakari.com.ap.brid.gy/post/3mkhex2ibkh22"}, {"timestamp": "2026-04-27T22:00:00Z", "date_only": false, "value": "2026-04-27T22:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-1228", "record": "WID-SEC-W-2026-1228", "field": "document.tracking.revision_history.4.date"}, {"timestamp": "2026-04-28T16:12:05.051Z", "date_only": false, "value": "2026-04-28T16:12:05.051958Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/patrickcmiller/statuses/116483209581294061", "record": "cve-2026-33626", "field": "creation_timestamp", "uuid": "0ceac6fa-70de-4d7d-95cb-7bf3e0cc9037", "url": "https://infosec.exchange/users/patrickcmiller/statuses/116483209581294061"}, {"timestamp": "2026-04-28T22:00:00Z", "date_only": false, "value": "2026-04-28T22:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-1228", "record": "WID-SEC-W-2026-1228", "field": "document.tracking.revision_history.5.date"}, {"timestamp": "2026-04-28T23:12:07.589Z", "date_only": false, "value": "2026-04-28T23:12:07.589881Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/patrickcmiller.bsky.social/post/3mklpi3bfrf23", "record": "CVE-2026-33626", "field": "creation_timestamp", "uuid": "a195086e-4398-4058-ac67-853e7ac5a24f", "url": "https://bsky.app/profile/patrickcmiller.bsky.social/post/3mklpi3bfrf23"}, {"timestamp": "2026-05-03T22:00:00Z", "date_only": false, "value": "2026-05-03T22:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-1228", "record": "WID-SEC-W-2026-1228", "field": "document.tracking.revision_history.6.date"}, {"timestamp": "2026-05-04T22:00:00Z", "date_only": false, "value": "2026-05-04T22:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-1228", "record": "WID-SEC-W-2026-1228", "field": "document.tracking.revision_history.7.date"}, {"timestamp": "2026-05-05T22:00:00Z", "date_only": false, "value": "2026-05-05T22:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-1228", "record": "WID-SEC-W-2026-1228", "field": "document.tracking.revision_history.8.date"}, {"timestamp": "2026-05-06T22:00:00Z", "date_only": false, "value": "2026-05-06T22:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-1228", "record": "WID-SEC-W-2026-1228", "field": "document.tracking.revision_history.9.date"}, {"timestamp": "2026-05-07T22:00:00Z", "date_only": false, "value": "2026-05-07T22:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-1228", "record": "WID-SEC-W-2026-1228", "field": "document.tracking.revision_history.10.date"}, {"timestamp": "2026-05-10T22:00:00Z", "date_only": false, "value": "2026-05-10T22:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-1228", "record": "WID-SEC-W-2026-1228", "field": "document.tracking.revision_history.11.date"}, {"timestamp": "2026-05-11T22:00:00Z", "date_only": false, "value": "2026-05-11T22:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-1228", "record": "WID-SEC-W-2026-1228", "field": "document.tracking.revision_history.12.date"}, {"timestamp": "2026-05-14T22:00:00Z", "date_only": false, "value": "2026-05-14T22:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-1228", "record": "WID-SEC-W-2026-1228", "field": "document.tracking.revision_history.13.date"}, {"timestamp": "2026-05-19T22:00:00Z", "date_only": false, "value": "2026-05-19T22:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-1228", "record": "WID-SEC-W-2026-1228", "field": "document.tracking.revision_history.14.date"}, {"timestamp": "2026-05-20T22:00:00Z", "date_only": false, "value": "2026-05-20T22:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-1228", "record": "WID-SEC-W-2026-1228", "field": "document.tracking.revision_history.15.date"}, {"timestamp": "2026-05-21T22:00:00Z", "date_only": false, "value": "2026-05-21T22:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-1228", "record": "WID-SEC-W-2026-1228", "field": "document.tracking.revision_history.16.date"}, {"timestamp": "2026-05-26T12:39:02.977Z", "date_only": false, "value": "2026-05-26T12:39:02.977862Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/boredchilada.bsky.social/post/3mmqz5tyqou26", "record": "CVE-2026-33626", "field": "creation_timestamp", "uuid": "d2cab5d2-d128-43a3-afc2-f38458edfb50", "content": "~Checkpoint~\nAI models are now actively deployed in live attacks, including government breaches, mass exploitation, and PhaaS platforms.\n-\nIOCs: CVE-2025-59536, CVE-2026-21852, CVE-2026-33626\n-\n#AI #CyberCrime #ThreatIntel", "url": "https://bsky.app/profile/boredchilada.bsky.social/post/3mmqz5tyqou26"}, {"timestamp": "2026-05-26T22:00:00Z", "date_only": false, "value": "2026-05-26T22:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-1228", "record": "WID-SEC-W-2026-1228", "field": "document.tracking.revision_history.17.date"}, {"timestamp": "2026-06-10T22:00:00Z", "date_only": false, "value": "2026-06-10T22:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-1228", "record": "WID-SEC-W-2026-1228", "field": "document.tracking.revision_history.18.date"}, {"timestamp": "2026-06-11T22:00:00Z", "date_only": false, "value": "2026-06-11T22:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-1228", "record": "WID-SEC-W-2026-1228", "field": "document.tracking.revision_history.19.date"}, {"timestamp": "2026-06-15T22:00:00Z", "date_only": false, "value": "2026-06-15T22:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-1228", "record": "WID-SEC-W-2026-1228", "field": "document.tracking.revision_history.20.date"}, {"timestamp": "2026-06-15T22:00:00Z", "date_only": false, "value": "2026-06-15T22:00:00.000+00:00", "kind": "other", "label": "Updated", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-1228", "record": "WID-SEC-W-2026-1228", "field": "document.tracking.current_release_date"}, {"timestamp": "2026-06-16T10:25:05.570Z", "date_only": false, "value": "2026-06-16T10:25:05.570+00:00", "kind": "other", "label": "Document generated", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-1228", "record": "WID-SEC-W-2026-1228", "field": "document.tracking.generator.date"}, {"timestamp": "2026-06-17T10:37:48.497Z", "date_only": false, "value": "2026-06-17T10:37:48.497", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-33626", "record": "FKIE_CVE-2026-33626", "field": "lastModified"}, {"timestamp": "2026-06-19T12:45:34.335Z", "date_only": false, "value": "2026-06-19T12:45:34.335793Z", "kind": "sighting", "label": "Exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/fcaa7d72-984e-4987-b627-c12a81ac6572", "record": "CVE-2026-33626", "field": "creation_timestamp", "uuid": "5e4161dc-f4a4-441e-acec-269def399a9e", "url": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/fcaa7d72-984e-4987-b627-c12a81ac6572"}, {"timestamp": "2026-07-13T15:02:52.394Z", "date_only": false, "value": "2026-07-13T15:02:52.394411Z", "kind": "milestone", "label": "Published", "source": "pysec \u00b7 PYSEC-2026-2607", "record": "PYSEC-2026-2607", "field": "published"}, {"timestamp": "2026-07-13T16:04:42.331Z", "date_only": false, "value": "2026-07-13T16:04:42.331391Z", "kind": "other", "label": "Updated", "source": "pysec \u00b7 PYSEC-2026-2607", "record": "PYSEC-2026-2607", "field": "modified"}, {"timestamp": "2026-07-19T16:00:05.728Z", "date_only": false, "value": "2026-07-19T16:00:05.728432Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/MalaysiaHacktivistz/21104", "record": "CVE-2026-33626", "field": "creation_timestamp", "uuid": "b6b635ab-a463-4046-85cf-6a07ca1920a6", "content": "LMDeploy CVE-2026-33626 Flaw Exploited Within 13 Hours of Disclosure \u2013 thehackernews.com\n\nFri, 24 Apr 2026 15:24:00", "url": "https://t.me/MalaysiaHacktivistz/21104"}, {"timestamp": "2026-07-19T16:00:09.258Z", "date_only": false, "value": "2026-07-19T16:00:09.258760Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/critical_bug/1752", "record": "CVE-2026-33626", "field": "creation_timestamp", "uuid": "340d49e2-60ab-41ad-bd7b-5a5a17b11dc3", "content": "\ud83d\udcc4 \u041f\u043e\u043b\u043d\u044b\u0439 \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0440\u0430\u0437\u0431\u043e\u0440 CVE-2026-33626 \u0432 PDF", "url": "https://t.me/critical_bug/1752"}, {"timestamp": "2026-07-19T16:00:09.305Z", "date_only": false, "value": "2026-07-19T16:00:09.305016Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/critical_bug/1753", "record": "CVE-2026-33626", "field": "creation_timestamp", "uuid": "3becc33c-df12-4d21-8ae3-1151658516bc", "content": "\ud83d\udc31 hacker voice: I'M IN YOUR AI SERVER \ud83d\udd34\n\n\ud83d\udd25 CVE-2026-33626: \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f SSRF \u0432 LMDeploy\n\u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u043d\u0430\u0447\u0430\u043b\u0430\u0441\u044c \u0447\u0435\u0440\u0435\u0437 12 \u0447\u0430\u0441\u043e\u0432 \u043f\u043e\u0441\u043b\u0435 \u0440\u0430\u0441\u043a\u0440\u044b\u0442\u0438\u044f \ud83d\ude31\n\n\u0427\u0438\u0442\u0430\u0439 \u043f\u043e\u043b\u043d\u044b\u0439 \u0440\u0430\u0437\u0431\u043e\u0440 \u043d\u0438\u0436\u0435 \ud83d\udc47", "url": "https://t.me/critical_bug/1753"}, {"timestamp": "2026-07-19T16:00:09.341Z", "date_only": false, "value": "2026-07-19T16:00:09.341924Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/critical_bug/1754", "record": "CVE-2026-33626", "field": "creation_timestamp", "uuid": "f4a22dbf-14de-47ba-829f-d389f84c0716", "content": "\ud83d\udd25 CVE-2026-33626: \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f SSRF \u0432 LMDeploy \u2014 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0447\u0435\u0440\u0435\u0437 12 \u0447\u0430\u0441\u043e\u0432 \u043f\u043e\u0441\u043b\u0435 \u0440\u0430\u0441\u043a\u0440\u044b\u0442\u0438\u044f\n\nCVSS: 7.5 High | \u0410\u043a\u0442\u0438\u0432\u043d\u0430\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0432 \u0434\u0438\u043a\u043e\u0439 \u043f\u0440\u0438\u0440\u043e\u0434\u0435 \ud83d\ude31\n\nLMDeploy \u2014 \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u044b\u0439 open-source \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u0439 \u0434\u043b\u044f \u0437\u0430\u043f\u0443\u0441\u043a\u0430 LLM \u0438 VLM \u043c\u043e\u0434\u0435\u043b\u0435\u0439 \u043e\u0442 Shanghai AI Laboratory (InternLM). \u0415\u0441\u043b\u0438 \u0432\u0430\u0448 AI-\u0441\u0435\u0440\u0432\u0435\u0440 \u0441\u043c\u043e\u0442\u0440\u0438\u0442 \u0432 \u0438\u043d\u0442\u0435\u0440\u043d\u0435\u0442 \u2014 \u0447\u0438\u0442\u0430\u0439\u0442\u0435 \u0432\u043d\u0438\u043c\u0430\u0442\u0435\u043b\u044c\u043d\u043e.\n\n\ud83d\udca5 \u0421\u0443\u0442\u044c \u0431\u0430\u0433\u0430:\n\u0424\u0443\u043d\u043a\u0446\u0438\u044f load_image() \u043f\u0440\u0438\u043d\u0438\u043c\u0430\u0435\u0442 \u043b\u044e\u0431\u043e\u0439 URL \u0432 \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u0435 image_url \u0431\u0435\u0437 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u043d\u0430 \u043f\u0440\u0438\u0432\u0430\u0442\u043d\u044b\u0435 \u0430\u0434\u0440\u0435\u0441\u0430. \u042d\u0442\u043e \u043a\u043b\u0430\u0441\u0441\u0438\u0447\u0435\u0441\u043a\u0438\u0439 SSRF: \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0439 \u0437\u0430\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 \u0441\u0435\u0440\u0432\u0435\u0440 \u0434\u0435\u043b\u0430\u0442\u044c \u0437\u0430\u043f\u0440\u043e\u0441\u044b \u043a\u0443\u0434\u0430 \u0443\u0433\u043e\u0434\u043d\u043e \u2014 \u0432 \u0442\u043e\u043c \u0447\u0438\u0441\u043b\u0435 \u043d\u0430 169.254.169.254 (AWS IMDS) \u0438 \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u0438\u0435 \u0441\u0435\u0440\u0432\u0438\u0441\u044b.\n\n\ud83d\udea8 \u0427\u0435\u043c \u044d\u0442\u043e \u043e\u043f\u0430\u0441\u043d\u043e?\n\u2014 \u041a\u0440\u0430\u0436\u0430 IAM-\u0442\u043e\u043a\u0435\u043d\u043e\u0432 \u0438\u0437 AWS Instance Metadata Service\n\u2014 \u0421\u043a\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u0435\u0439 \u0441\u0435\u0442\u0438 (Redis, MySQL, \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u0438\u0435 API)\n\u2014 \u0420\u0430\u0437\u0440\u0443\u0448\u0435\u043d\u0438\u0435 \u043a\u043b\u0430\u0441\u0442\u0435\u0440\u0430 \u0447\u0435\u0440\u0435\u0437 /distserve/p2p_drop_connect\n\u2014 Lateral movement \u0432\u043e \u0432\u0441\u044e \u043e\u0431\u043b\u0430\u0447\u043d\u0443\u044e \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0443\n\n\ud83d\udcca \u0420\u0435\u0430\u043b\u044c\u043d\u0430\u044f \u0430\u0442\u0430\u043a\u0430 (\u0434\u0430\u043d\u043d\u044b\u0435 Sysdig TRT):\n\u0427\u0435\u0440\u0435\u0437 12 \u0447 31 \u043c\u0438\u043d \u043f\u043e\u0441\u043b\u0435 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438 advisory \u0437\u0430\u0444\u0438\u043a\u0441\u0438\u0440\u043e\u0432\u0430\u043d\u0430 \u043f\u0435\u0440\u0432\u0430\u044f \u0430\u0442\u0430\u043a\u0430 \u0441 IP 103.116.72.119 (\u0413\u043e\u043d\u043a\u043e\u043d\u0433). \u0417\u0430 8 \u043c\u0438\u043d\u0443\u0442 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0439 \u043f\u0440\u043e\u0432\u0451\u043b 10 \u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432 \u0432 3 \u0444\u0430\u0437\u044b: IMDS \u2192 Redis \u2192 \u0441\u043a\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 localhost.\n\n\ud83d\udee1 \u0427\u0442\u043e \u0434\u0435\u043b\u0430\u0442\u044c \u043f\u0440\u044f\u043c\u043e \u0441\u0435\u0439\u0447\u0430\u0441:\n1\ufe0f\u20e3 \u041e\u0431\u043d\u043e\u0432\u0438\u0442\u044c LMDeploy \u0434\u043e v0.12.3 \u0438\u043b\u0438 \u043d\u043e\u0432\u0435\u0435\n2\ufe0f\u20e3 \u0412\u043a\u043b\u044e\u0447\u0438\u0442\u044c IMDSv2 \u043d\u0430 GPU-\u0438\u043d\u0441\u0442\u0430\u043d\u0441\u0430\u0445 (httpTokens=required)\n3\ufe0f\u20e3 \u0417\u0430\u043a\u0440\u044b\u0442\u044c \u0438\u0441\u0445\u043e\u0434\u044f\u0449\u0438\u0439 \u0442\u0440\u0430\u0444\u0438\u043a \u0441 \u0438\u043d\u0444\u0435\u0440\u0435\u043d\u0441-\u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432 \u043d\u0430 \u0443\u0440\u043e\u0432\u043d\u0435 VPC\n4\ufe0f\u20e3 \u0420\u043e\u0442\u0438\u0440\u043e\u0432\u0430\u0442\u044c IAM-\u043a\u0440\u0435\u0434\u044b, \u0435\u0441\u043b\u0438 \u0441\u0435\u0440\u0432\u0435\u0440 \u0431\u044b\u043b \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u0435\u043d\n\n\ud83d\udcc4 \u041f\u043e\u043b\u043d\u044b\u0439 \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0440\u0430\u0437\u0431\u043e\u0440 \u2014 \u0432 PDF \u0432\u044b\u0448\u0435 \ud83d\udc46\n\n\ud83d\udc8e \u0411\u043e\u043b\u044c\u0448\u0435 \u044d\u043a\u0441\u043a\u043b\u044e\u0437\u0438\u0432\u043d\u044b\u0445 \u0440\u0430\u0437\u0431\u043e\u0440\u043e\u0432 \u0438 0-day \u0440\u0430\u043d\u044c\u0448\u0435 \u0432\u0441\u0435\u0445: VIP-\u0432\u0435\u0440\u0441\u0438\u044f \u043a\u0430\u043d\u0430\u043b\u0430 \ud83d\ude80\n\n#LMDeploy #SSRF #CVE #AI #LLM #CyberSecurity #Infosec #critical_bug", "url": "https://t.me/critical_bug/1754"}, {"timestamp": "2026-07-20T00:00:08.202Z", "date_only": false, "value": "2026-07-20T00:00:08.202862Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/critical_bug/1754", "record": "CVE-2026-33626", "field": "creation_timestamp", "uuid": "9999be3c-3408-4df2-adfe-07c4ca08b20e", "content": "\ud83d\udd25 CVE-2026-33626: \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f SSRF \u0432 LMDeploy \u2014 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0447\u0435\u0440\u0435\u0437 12 \u0447\u0430\u0441\u043e\u0432 \u043f\u043e\u0441\u043b\u0435 \u0440\u0430\u0441\u043a\u0440\u044b\u0442\u0438\u044f\n\nCVSS: 7.5 High | \u0410\u043a\u0442\u0438\u0432\u043d\u0430\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0432 \u0434\u0438\u043a\u043e\u0439 \u043f\u0440\u0438\u0440\u043e\u0434\u0435 \ud83d\ude31\n\nLMDeploy \u2014 \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u044b\u0439 open-source \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u0439 \u0434\u043b\u044f \u0437\u0430\u043f\u0443\u0441\u043a\u0430 LLM \u0438 VLM \u043c\u043e\u0434\u0435\u043b\u0435\u0439 \u043e\u0442 Shanghai AI Laboratory (InternLM). \u0415\u0441\u043b\u0438 \u0432\u0430\u0448 AI-\u0441\u0435\u0440\u0432\u0435\u0440 \u0441\u043c\u043e\u0442\u0440\u0438\u0442 \u0432 \u0438\u043d\u0442\u0435\u0440\u043d\u0435\u0442 \u2014 \u0447\u0438\u0442\u0430\u0439\u0442\u0435 \u0432\u043d\u0438\u043c\u0430\u0442\u0435\u043b\u044c\u043d\u043e.\n\n\ud83d\udca5 \u0421\u0443\u0442\u044c \u0431\u0430\u0433\u0430:\n\u0424\u0443\u043d\u043a\u0446\u0438\u044f load_image() \u043f\u0440\u0438\u043d\u0438\u043c\u0430\u0435\u0442 \u043b\u044e\u0431\u043e\u0439 URL \u0432 \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u0435 image_url \u0431\u0435\u0437 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u043d\u0430 \u043f\u0440\u0438\u0432\u0430\u0442\u043d\u044b\u0435 \u0430\u0434\u0440\u0435\u0441\u0430. \u042d\u0442\u043e \u043a\u043b\u0430\u0441\u0441\u0438\u0447\u0435\u0441\u043a\u0438\u0439 SSRF: \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0439 \u0437\u0430\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 \u0441\u0435\u0440\u0432\u0435\u0440 \u0434\u0435\u043b\u0430\u0442\u044c \u0437\u0430\u043f\u0440\u043e\u0441\u044b \u043a\u0443\u0434\u0430 \u0443\u0433\u043e\u0434\u043d\u043e \u2014 \u0432 \u0442\u043e\u043c \u0447\u0438\u0441\u043b\u0435 \u043d\u0430 169.254.169.254 (AWS IMDS) \u0438 \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u0438\u0435 \u0441\u0435\u0440\u0432\u0438\u0441\u044b.\n\n\ud83d\udea8 \u0427\u0435\u043c \u044d\u0442\u043e \u043e\u043f\u0430\u0441\u043d\u043e?\n\u2014 \u041a\u0440\u0430\u0436\u0430 IAM-\u0442\u043e\u043a\u0435\u043d\u043e\u0432 \u0438\u0437 AWS Instance Metadata Service\n\u2014 \u0421\u043a\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u0435\u0439 \u0441\u0435\u0442\u0438 (Redis, MySQL, \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u0438\u0435 API)\n\u2014 \u0420\u0430\u0437\u0440\u0443\u0448\u0435\u043d\u0438\u0435 \u043a\u043b\u0430\u0441\u0442\u0435\u0440\u0430 \u0447\u0435\u0440\u0435\u0437 /distserve/p2p_drop_connect\n\u2014 Lateral movement \u0432\u043e \u0432\u0441\u044e \u043e\u0431\u043b\u0430\u0447\u043d\u0443\u044e \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0443\n\n\ud83d\udcca \u0420\u0435\u0430\u043b\u044c\u043d\u0430\u044f \u0430\u0442\u0430\u043a\u0430 (\u0434\u0430\u043d\u043d\u044b\u0435 Sysdig TRT):\n\u0427\u0435\u0440\u0435\u0437 12 \u0447 31 \u043c\u0438\u043d \u043f\u043e\u0441\u043b\u0435 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438 advisory \u0437\u0430\u0444\u0438\u043a\u0441\u0438\u0440\u043e\u0432\u0430\u043d\u0430 \u043f\u0435\u0440\u0432\u0430\u044f \u0430\u0442\u0430\u043a\u0430 \u0441 IP 103.116.72.119 (\u0413\u043e\u043d\u043a\u043e\u043d\u0433). \u0417\u0430 8 \u043c\u0438\u043d\u0443\u0442 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0439 \u043f\u0440\u043e\u0432\u0451\u043b 10 \u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432 \u0432 3 \u0444\u0430\u0437\u044b: IMDS \u2192 Redis \u2192 \u0441\u043a\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 localhost.\n\n\ud83d\udee1 \u0427\u0442\u043e \u0434\u0435\u043b\u0430\u0442\u044c \u043f\u0440\u044f\u043c\u043e \u0441\u0435\u0439\u0447\u0430\u0441:\n1\ufe0f\u20e3 \u041e\u0431\u043d\u043e\u0432\u0438\u0442\u044c LMDeploy \u0434\u043e v0.12.3 \u0438\u043b\u0438 \u043d\u043e\u0432\u0435\u0435\n2\ufe0f\u20e3 \u0412\u043a\u043b\u044e\u0447\u0438\u0442\u044c IMDSv2 \u043d\u0430 GPU-\u0438\u043d\u0441\u0442\u0430\u043d\u0441\u0430\u0445 (httpTokens=required)\n3\ufe0f\u20e3 \u0417\u0430\u043a\u0440\u044b\u0442\u044c \u0438\u0441\u0445\u043e\u0434\u044f\u0449\u0438\u0439 \u0442\u0440\u0430\u0444\u0438\u043a \u0441 \u0438\u043d\u0444\u0435\u0440\u0435\u043d\u0441-\u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432 \u043d\u0430 \u0443\u0440\u043e\u0432\u043d\u0435 VPC\n4\ufe0f\u20e3 \u0420\u043e\u0442\u0438\u0440\u043e\u0432\u0430\u0442\u044c IAM-\u043a\u0440\u0435\u0434\u044b, \u0435\u0441\u043b\u0438 \u0441\u0435\u0440\u0432\u0435\u0440 \u0431\u044b\u043b \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u0435\u043d\n\n\ud83d\udcc4 \u041f\u043e\u043b\u043d\u044b\u0439 \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0440\u0430\u0437\u0431\u043e\u0440 \u2014 \u0432 PDF \u0432\u044b\u0448\u0435 \ud83d\udc46\n\n\ud83d\udc8e \u0411\u043e\u043b\u044c\u0448\u0435 \u044d\u043a\u0441\u043a\u043b\u044e\u0437\u0438\u0432\u043d\u044b\u0445 \u0440\u0430\u0437\u0431\u043e\u0440\u043e\u0432 \u0438 0-day \u0440\u0430\u043d\u044c\u0448\u0435 \u0432\u0441\u0435\u0445: VIP-\u0432\u0435\u0440\u0441\u0438\u044f \u043a\u0430\u043d\u0430\u043b\u0430 \ud83d\ude80\n\n#LMDeploy #SSRF #CVE #AI #LLM #CyberSecurity #Infosec #critical_bug", "url": "https://t.me/critical_bug/1754"}, {"timestamp": "2026-07-20T00:00:08.237Z", "date_only": false, "value": "2026-07-20T00:00:08.237041Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/critical_bug/1753", "record": "CVE-2026-33626", "field": "creation_timestamp", "uuid": "a4f88d65-f661-4355-8445-b04c43cce2a0", "content": "\ud83d\udc31 hacker voice: I'M IN YOUR AI SERVER \ud83d\udd34\n\n\ud83d\udd25 CVE-2026-33626: \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f SSRF \u0432 LMDeploy\n\u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u043d\u0430\u0447\u0430\u043b\u0430\u0441\u044c \u0447\u0435\u0440\u0435\u0437 12 \u0447\u0430\u0441\u043e\u0432 \u043f\u043e\u0441\u043b\u0435 \u0440\u0430\u0441\u043a\u0440\u044b\u0442\u0438\u044f \ud83d\ude31\n\n\u0427\u0438\u0442\u0430\u0439 \u043f\u043e\u043b\u043d\u044b\u0439 \u0440\u0430\u0437\u0431\u043e\u0440 \u043d\u0438\u0436\u0435 \ud83d\udc47", "url": "https://t.me/critical_bug/1753"}, {"timestamp": "2026-07-20T00:00:08.346Z", "date_only": false, "value": "2026-07-20T00:00:08.346186Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/critical_bug/1752", "record": "CVE-2026-33626", "field": "creation_timestamp", "uuid": "2fdb2ee1-2ae8-4f7a-8f28-b3e2f75f2809", "content": "\ud83d\udcc4 \u041f\u043e\u043b\u043d\u044b\u0439 \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0440\u0430\u0437\u0431\u043e\u0440 CVE-2026-33626 \u0432 PDF", "url": "https://t.me/critical_bug/1752"}, {"timestamp": "2026-07-20T00:00:21.589Z", "date_only": false, "value": "2026-07-20T00:00:21.589250Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/MalaysiaHacktivistz/21104", "record": "CVE-2026-33626", "field": "creation_timestamp", "uuid": "c8a7d545-6eb3-4ed6-89cb-c13dee51452a", "content": "LMDeploy CVE-2026-33626 Flaw Exploited Within 13 Hours of Disclosure \u2013 thehackernews.com\n\nFri, 24 Apr 2026 15:24:00", "url": "https://t.me/MalaysiaHacktivistz/21104"}, {"timestamp": "2026-09-23T08:35:02.829Z", "date_only": false, "value": "2026-09-23T08:35:02.829216Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://github.com/InternLM/lmdeploy/security/advisories/GHSA-6w67-hwm5-92mq", "record": "CVE-2026-33626", "field": "creation_timestamp", "uuid": "5f49d17b-eee0-4f58-8104-bded1e119c94", "url": "https://github.com/InternLM/lmdeploy/security/advisories/GHSA-6w67-hwm5-92mq"}]}