https://feed.craftedsignal.io/products/tastyigniter-through-4.4.5/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 22 Oct 2026 03:52:08 +0000https://feed.craftedsignal.io/favicon-32x32.pnghttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svghttps://feed.craftedsignal.io/briefs/2026-10-tastyigniter-php-injection/Thu, 22 Oct 2026 03:52:08 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-tastyigniter-php-injection/TastyIgniter through 4.4.5 contains a PHP object injection vulnerability that allows authenticated administrators to achieve arbitrary operating-system command execution.<p>TastyIgniter through 4.4.5 contains a PHP object injection vulnerability. Authenticated administrators can submit a serialized PHP object as a settings value, which is stored unsanitized and later unserialized by <code>getValueAttribute()</code> when the setting is read. This allows for the submission of a serialized gadget chain to achieve arbitrary operating-system command execution as the PHP application process user. The impact persists until the setting value is overwritten.</p> highadvisory