[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fR6XHhvHrYQXz9WdSzdxA_Oxq5702noiRRM_sW1LKsj4":3},{"article":4,"iocs":55,"watch_terms":60,"solutions":61,"lesson":142},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":37},"79c08a84-dc56-4690-87e9-c74abaea2236","Ghostscript flaw lets hackers hijack servers via PDF uploads","ghostscript-flaw-lets-hackers-hijack-servers-via-pdf-uploads-521975","A critical heap buffer overflow vulnerability (CVE-2026-39919) in the Ghostscript interpreter and rendering engine could allow remote code execution through specially crafted PDF files. [...]","A critical heap buffer overflow vulnerability, CVE-2026-39919, in the Ghostscript interpreter could allow remote code execution through specially crafted PDF files. Discovered by Wordfence researchers, the flaw affects systems running Ghostscript versions 9.21 through 10.07.1, particularly impacting WordPress sites that process PDFs for previews or thumbnails. Artifex has released version 10.08.0 with a fix, and users are advised to upgrade or implement workarounds like blocking PDF uploads.","Ghostscript flaw CVE-2026-39919 allows RCE via crafted PDF uploads.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fghostscript-flaw-lets-hackers-hijack-servers-via-pdf-uploads\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2026\u002F10\u002F13\u002Fghostscript.jpg","2026-10-13T21:33:26+00:00","2026-10-13T22:00:04.817342+00:00",8,[17,20,22,24,27,30],{"name":18,"type":19},"Ghostscript","product",{"name":21,"type":19},"WordPress",{"name":23,"type":19},"ImageMagick",{"name":25,"type":26},"PDF","technology",{"name":28,"type":29},"Artifex","vendor",{"name":31,"type":29},"Wordfence","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":32,"icon":34,"name":35,"slug":36},null,"Vulnerabilities","vulnerabilities",[38,43,45,50],{"category":39},{"id":40,"icon":34,"name":41,"slug":42},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":44},{"id":32,"icon":34,"name":35,"slug":36},{"category":46},{"id":47,"icon":34,"name":48,"slug":49},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":51},{"id":52,"icon":34,"name":53,"slug":54},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[56],{"type":57,"value":58,"context":59},"cve","CVE-2026-39919","Heap buffer overflow vulnerability in Ghostscript",[28,31,18],{"controls":62,"vendors":141},[63,92,115],{"slug":64,"name":65,"problem":66,"products":67},"patch-management","Automated patch management","Known holes get closed in days, not months.",[68,76,84],{"vendor_slug":69,"vendor_name":70,"vendor_logo":71,"product_slug":72,"product_name":73,"url":74,"description":75},"action1","Action1","\u002Fvendor-logos\u002Faction1.png","action1-patch-management","Action1 Patch Management","https:\u002F\u002Fwww.action1.com\u002F","Cloud-native patch management for Windows, macOS and third-party applications.",{"vendor_slug":77,"vendor_name":78,"vendor_logo":79,"product_slug":80,"product_name":81,"url":82,"description":83},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"vendor_slug":85,"vendor_name":86,"vendor_logo":87,"product_slug":88,"product_name":89,"url":90,"description":91},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"slug":93,"name":94,"problem":95,"products":96},"application-allowlisting","Application allowlisting","Any program that reaches a computer can run, including ransomware and the remote-access tools attackers bring with them.",[97,105,110],{"vendor_slug":98,"vendor_name":99,"vendor_logo":100,"product_slug":101,"product_name":102,"url":103,"description":104},"threatlocker","ThreatLocker","\u002Fvendor-logos\u002Fthreatlocker.png","allowlisting","Allowlisting","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fallowlisting","Blocks any software that has not been approved, including ransomware and unapproved remote-access tools. A learning period builds the approved list first.",{"vendor_slug":85,"vendor_name":86,"vendor_logo":87,"product_slug":106,"product_name":107,"url":108,"description":109},"app-control-for-business","App Control for Business","https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fwindows\u002Fsecurity\u002Fapplication-security\u002Fapplication-control\u002Fapp-control-for-business\u002F","Application control built into Windows, formerly Windows Defender Application Control, with AppLocker as the older option. Policies can be managed through Intune.",{"vendor_slug":98,"vendor_name":99,"vendor_logo":100,"product_slug":111,"product_name":112,"url":113,"description":114},"ringfencing","Ringfencing","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fringfencing","Limits what approved applications may do, such as which files, network locations and other programs they can reach, so a compromised application cannot be turned against you.",{"slug":116,"name":117,"problem":118,"products":119},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[120,128,133],{"vendor_slug":121,"vendor_name":122,"vendor_logo":123,"product_slug":124,"product_name":125,"url":126,"description":127},"elastic","Elastic","\u002Fvendor-logos\u002Felastic.png","elastic-security","Elastic Security","https:\u002F\u002Fwww.elastic.co\u002Fsecurity","SIEM and endpoint security built on Elasticsearch, with open detection rules.",{"vendor_slug":85,"vendor_name":86,"vendor_logo":87,"product_slug":129,"product_name":130,"url":131,"description":132},"defender-for-endpoint","Microsoft Defender for Endpoint","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fendpoint-security\u002Fmicrosoft-defender-endpoint","Endpoint detection and response for Windows, macOS, Linux and mobile devices.",{"vendor_slug":134,"vendor_name":135,"vendor_logo":136,"product_slug":137,"product_name":138,"url":139,"description":140},"withsecure","WithSecure","\u002Fvendor-logos\u002Fwithsecure.png","elements-xdr","WithSecure Elements XDR","https:\u002F\u002Fwww.withsecure.com\u002Fen\u002Ffor-business\u002Fplatform\u002Fxdr\u002F","Endpoint detection and response with extended detection, on the Elements cloud platform.",[],{"slug":143,"title":144,"body":145,"framework_refs":146,"framework_notes":158},"critical-ghostscript-flaw-enables-rce-via-malicious-pdf-uploads","Critical Ghostscript Flaw Enables RCE via Malicious PDF Uploads","A heap buffer overflow vulnerability in the Ghostscript interpreter (CVE-2026-39919) allows attackers to achieve remote code execution simply by uploading a crafted PDF file to an affected system. The flaw impacts a wide range of Ghostscript versions (9.21–10.07.1), making unpatched WordPress sites and any application that processes PDFs particularly exposed. This matters because file upload functionality is ubiquitous, and a single malicious upload can result in full server compromise without requiring any authentication. The availability of a vendor patch (version 10.08.0) means that delayed patching is the primary risk factor — organizations running outdated versions remain unnecessarily vulnerable.",[147,148,149,150,151,152,153,154,155,156,157],"CIS Control 7: Continuous Vulnerability Management","CIS Control 2: Inventory and Control of Software Assets","CIS Control 13: Network Monitoring and Defense","NIST SP 800-40 Rev. 4: Guide to Enterprise Patch Management","NIST SI-2: Flaw Remediation","NIST SI-3: Malicious Code Protection","NIST RA-5: Vulnerability Monitoring and Scanning","OWASP Top 10 A06:2021 – Vulnerable and Outdated Components","OWASP File Upload Cheat Sheet","ITIL Change Management: Emergency Change Procedures","GDPR Article 32: Security of Processing (technical measures to ensure data integrity)",{}]