VulnSocial

CVE-2026-40044Disclosure

LOWCVSS 9.3 · CRITICAL

Signal is active with 2 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Pachno 1.0.6 contains a deserialization vulnerability that allows unauthenticated attackers to execute arbitrary code by injecting malicious serialized objects into cache files. Attackers can write PHP object payloads to world-writable cache files with predictable names in the cache directory, which are unserialized during framework bootstrap before authentication checks occur.

Back to dashboard
0.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-502

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

STABLE

Threat summary

  • 4 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Technical details provided in 4 signals
  • Disclosure: 4 classified signals
  • Peaked 1d ago at 2 mentions (2026-04-13); latest day: 2
  • 4 total mentions across 2 days

Deep dive

Activity timeline4 mentions / 2d
01122Mentions · 2026-04-13: 2Mentions · 2026-04-14: 2Technical Details · 2026-04-13: 2Technical Details · 2026-04-14: 204-1304-14
Signal classification1 categories
Disclosure
4100.0%
Referenced assets4 URLs
Full discourse4 posts
  • Infoflowcloud@infoflowcloud
    Disclosure

    🚨*CVE* CVE-2026-40044 Pachno 1.0.6 contains a deserialization vulnerability that allows unauthenticated attackers to execute arbitrary code by injecting malicious serialized objects into c… https://www.cve.org/CVERecord?id=CVE-2026-40044 ----- Traducción: CVE-2026-40044 Pac… http://infoflow.cloud`

    Post summary

    The message announces a new CVE-2026-40044 in Pachno 1.0.6, describing a deserialization flaw that permits unauthenticated remote code execution through malicious serialized objects.

    0000022
    71 followersView on X
  • CVE@CVEnew
    Disclosure

    CVE-2026-40044 Pachno 1.0.6 contains a deserialization vulnerability that allows unauthenticated attackers to execute arbitrary code by injecting malicious serialized objects into c… https://www.cve.org/CVERecord?id=CVE-2026-40044

    Post summary

    The disclosure reveals a deserialization vulnerability in Pachno 1.0.6 that permits unauthenticated remote code execution through malformed serialized objects; no exploit code, mitigation, or active attack evidence is provided.

    00000151
    57.2K followersView on X
  • CVEFind.com@CveFindCom
    Disclosure

    [CVE-2026-40044: CRITICAL] Pachno 1.0.6 has a serious deserialization flaw allowing remote attackers to run code by injecting malicious serialized objects into cache files.#cve,CVE-2026-40044,#cybersecurity https://cvefind.com/CVE-2026-40044

    Post summary

    CVE‑2026‑40044 is disclosed as a critical deserialization flaw in Pachno 1.0.6 that permits remote code execution by injecting malicious serialized objects into cache files.

    0000033
    620 followersView on X
  • 0day Signal@0dayPublishing
    Disclosure

    🚨 CVE-2026-40044: Pachno... World-writable cache files + predictable names + pre-auth deserialization = instant RCE against any Pachno instance. #RCE #deserialization #0day. https://zerodaysignal.com/vulnerability/CVE-2026-40044 #netsec #vulnerability #CVE #sysadmin #zeroday

    Post summary

    The tweet announces CVE-2026‑40044 as a pre‑authentication deserialization flaw in Pachno that allows instant RCE via world‑writable cache files, but provides no PoC, exploit code, or patch details.

    00000100
    218 followersView on X

Explore more

Back to dashboard