--- title: "404 Founders (@404-founders) | Hashnode" description: "Error-proof Cyber Solutions. Read the latest articles by 404 Founders on Hashnode." url: "https://hashnode.com/@404-founders" --- @404-founders # 404 Founders @404-founders · Bosnia and Herzegovina, Estonia · Joined December 2025 Error-proof Cyber Solutions ### [MongoDB CVE-2026-118383: Pre-Auth Flaw Hits on Failover](https://404-founders.com/blog/rapid-mongodb-cve-2026-118383-pre-auth-flaw-hits-on-failover?utm_source=hashnode&utm_medium=feed) An unauthenticated attacker can send two requests to a MongoDB Server replica set member that trigger a crash on the database server. The crash happens only if that server is later chosen to take over 3 min read · [404-founders.com](https://404-founders.com/blog/rapid-mongodb-cve-2026-118383-pre-auth-flaw-hits-on-failover?utm_source=hashnode&utm_medium=feed) [11h ago](https://hashnode.com/posts/rapid-mongodb-cve-2026-118383-pre-auth-flaw-hits-on-failover/6af658bfdfd10c303b1ff6a1) ### [GPUStack Authentication Bypass: 101 Days Before Scanners Knew](https://404-founders.com/blog/gpustack-authentication-bypass-cve-2026-102895?utm_source=hashnode&utm_medium=feed) GPUStack authentication bypass CVE-2026-102895: how a loopback header grants admin, who is exposed, detection, and why scanners missed it. 15 min read · [404-founders.com](https://404-founders.com/blog/gpustack-authentication-bypass-cve-2026-102895?utm_source=hashnode&utm_medium=feed) [11h ago](https://hashnode.com/posts/gpustack-authentication-bypass-cve-2026-102895/6af658dd1f1a632ca376b662) ### [wfx-loot: GitHub Actions Secret Stealer in 1,806 Repos](https://404-founders.com/blog/rapid-wfx-loot-github-actions-secret-stealer-in-1-806-repos?utm_source=hashnode&utm_medium=feed) Since 2026-11-10, an attacker has used stolen credentials for 4,837 GitHub accounts to push a credential stealer into repositories those accounts can write to. Aikido Security named the campaign wfx-l 4 min read · [404-founders.com](https://404-founders.com/blog/rapid-wfx-loot-github-actions-secret-stealer-in-1-806-repos?utm_source=hashnode&utm_medium=feed) [15h ago](https://hashnode.com/posts/rapid-wfx-loot-github-actions-secret-stealer-in-1-806-repos/6af61f707a52329c2b5e59dd) ### [Zoom Workplace for Windows CVE-2026-108186: Critical EoP](https://404-founders.com/blog/rapid-zoom-workplace-for-windows-cve-2026-108186-critical-eop?utm_source=hashnode&utm_medium=feed) Zoom has released security updates that fix two vulnerabilities in Zoom Workplace for Windows. The more serious one, CVE-2026-108186, is rated critical and could let an unauthenticated attacker escala 3 min read · [404-founders.com](https://404-founders.com/blog/rapid-zoom-workplace-for-windows-cve-2026-108186-critical-eop?utm_source=hashnode&utm_medium=feed) [15h ago](https://hashnode.com/posts/rapid-zoom-workplace-for-windows-cve-2026-108186-critical-eop/6af61f937a52329c2b5eb2d7) ### [GPUStack CVE-2026-102895: Spoofed Header Grants Admin](https://404-founders.com/blog/rapid-gpustack-cve-2026-102895-spoofed-header-grants-admin?utm_source=hashnode&utm_medium=feed) Attackers are sending requests with a spoofed loopback header to reach GPUStack instances, and that header bypasses authentication in all versions before 2.2.0. CISA added the flaw to its Known Exploi 3 min read · [404-founders.com](https://404-founders.com/blog/rapid-gpustack-cve-2026-102895-spoofed-header-grants-admin?utm_source=hashnode&utm_medium=feed) [15h ago](https://hashnode.com/posts/rapid-gpustack-cve-2026-102895-spoofed-header-grants-admin/6af61fa97a52329c2b5eefec)