Preventing Digital Threats,
Securing Your Business 24/7

CyStack enables early vulnerability detection, robust data protection, and secure operations - giving you the confidence to scale.

Years of Expertise

600+

Secured Clients Across Web2 & Web3

200.000+

Threats Prevented Before Exploitation

5.000+

Digital Assets Protected

24/7

Monitoring and Response

Cyber Risks Threaten Every Business

Every business depends on its data and systems, no matter its size. Threats can come from inside the organization or outside it.

Is Your System Secure? Run a Security Check

CyStack - Your Trusted Cybersecurity Partner

We provided end‑to‑end security for prevention, detection, and response - tailored to your business size.

Solutions For Businesses

Small & Medium

Security package by tiers
Data and systems protection
Deployment within 1-2 weeks
Simple & intuitive operation
Risk detection & response

Data & Device Protection

Vulnerabilities Testing & Scanning

Policy Consulting & Technical Support

Solutions For Businesses

Small & Medium

Solutions For Businesses

Large & Enterprise

Specialized products and services
24/7 monitoring and response
Detect complex security risks
Seamless integrate Jira/Slack/SSO/SIEM
Meet strict compliance & standards

Testing and Assessment

Data Protection

Secure System Operations

Pentest
Red Teaming
WhiteHub Bug Bounty

CyStack VulnScan
Infra/Cloud/Blockchain
Assessment

Solutions For Businesses

Large & Enterprise

Solutions For Businesses

Small & Medium

Security package by tiers
Data and systems protection
Deployment within 1-2 weeks
Simple & intuitive operation
Risk detection & response

Data & Device Protection

Vulnerabilities Testing & Scanning

Policy Consulting & Technical Support

Solutions For Businesses

Small & Medium

Solutions For Businesses

Large & Enterprise

Specialized products and services
24/7 monitoring and response
Detect complex security risks
Seamless integrate Jira/Slack/SSO/SIEM
Meet strict compliance & standards

Testing and Assessment

Data Protection

Secure System Operations

Pentest
Red Teaming
WhiteHub Bug Bounty

CyStack VulnScan
Infra/Cloud/Blockchain
Assessment

Solutions For Businesses

Large & Enterprise

What Makes CyStack Different?

We don't just test security, we understand how software is designed, developed and deployed - and how it gets exploited in the real world

Technology‑Driven Security Management

Centralized platform powering CyStack’s solution ecosystem, enabling real-time risk detection and tracking.

Learn more about CyStack Platform

Proven & Experienced
Expert Team

Speakers at top conferences; honored on the hall of fame of IBM, Microsoft, NASA...; multi-industry experience.

CyStack research

Hack and Dev Mindset

Understand systems as deeply as developers, identify real-world risks, propose optimal operational solutions and support patching.

Open‑source contributions

Community‑Based Security

Leverage the power of a community of 4,000+ bug bounty experts to detect and fix vulnerabilities up to 3.5 times more efficiently.

Learn more about WhiteHub

International Certifications & Standards

We adhere to leading security standards to ensure safety, consistency, and trust.

Continuously finding vulnerabilities
and helping protect global cybersecurity

CyStack security experts work with many large software vendors
and organizations worldwide to patch serious vulnerabilities.

CVE-2026-119085High8.8

Amazon Virtual Engineering Workbench Template Injection in Publishing Component Leading to Cross-Tenant Remote Code Execution (opens in a new tab)

CyStack researcher Trung Nguyen discovered a template injection flaw in the publishing component of Amazon Virtual Engineering Workbench (VEW). The component renders CloudFormation template bodies through a template engine without neutralizing the engine's own syntax, so any logged-in user can submit a product version whose template body carries template directives instead of plain CloudFormation, and those directives execute server-side. The attacker runs arbitrary code with the permissions of the publishing Lambda's IAM role - shared infrastructure, so this crosses the tenant boundary and exposes the data and AWS resources of every project on the deployment. It affects all commits before c146486 (PR #31); redeploying from the latest main branch of awslabs/virtual-engineering-workbench fixes it.

Amazon Virtual Engineering Workbench

Amazon Web Services

11/02/2026

CVE-2026-106581High7.3

Missing Package Signature Verification in Docker Desktop for Windows Installer Leads to LocalSystem Code Execution (opens in a new tab)

CyStack researcher Trung Nguyen discovered a privilege escalation flaw in Docker Desktop for Windows and proved it by running attacker-controlled installer actions with LocalSystem, the highest privilege on a Windows machine. The "Docker Desktop Installer.exe install -package" command installed whatever package it was given without verifying its signature, so a crafted package was trusted just like a genuine Docker one. Because the UAC prompt the user sees is signed by Docker, it looks legitimate, and a user who approves it hands full control of the machine to the attacker. It affects all versions before 4.92.0; upgrading to 4.92.0 fixes it.

Docker Desktop

Docker

10/09/2026

CVE-2026-76454Critical9.1

Cisco License (Smart Software Manager) On-Prem Unauthenticated Arbitrary File Write via Smart Licensing Utility API (opens in a new tab)

CyStack researcher Trung Nguyen discovered a critical flaw in the Smart Licensing Utility API of Cisco License On-Prem, the on-premises licensing server formerly known as Cisco Smart Software Manager On-Prem. The management API is reachable without any authentication at all and does not properly validate the input it receives, so a single crafted HTTP request from anywhere on the network lets an attacker write files of their choosing onto the appliance - overwriting system files - or knock the service offline in a denial of service. Because the licensing server is the component that authorises software on the Cisco devices around it, and because no login or user interaction is required, Cisco rated this 9.1 out of 10 and states there is no workaround. It affects Cisco License On-Prem releases 9-202601 and earlier as well as every release before 10-202608; upgrading to 10-202608 or later fixes it.

Cisco License On-Prem

Cisco

10/07/2026

GHSA-x4c7-fpcx-w9q6High8.7

SAML Identity-Provider Confusion in ZITADEL Leads to Account Takeover (opens in a new tab)

CyStack researcher Trung Nguyen discovered an account takeover flaw in ZITADEL and proved it by logging in as another organisation's user without any interaction from the victim. ZITADEL's SAML login callback checked the signature against the identity provider named in the request URL, but picked the user account from the login that had been started against a different identity provider, and never checked that the two matched. An attacker who registers their own SAML identity provider with a signing key they control can therefore sign an assertion themselves and obtain a session as any user linked to another SAML provider on the same instance, across organisations. On self-hosted instances with public organisation registration enabled, even an unauthenticated attacker can get the needed admin rights by simply creating an organisation. It affects 3.0.0 through 3.4.15 and 4.0.0 through 4.19.1; upgrading to 4.19.2 fixes it (3.x is end-of-life and gets no fix).

ZITADEL

09/28/2026

CVE-2026-77524Critical9.9

Privilege Escalation from Namespace Admin to Cluster Admin via KEDA TriggerAuthentication (opens in a new tab)

CyStack researcher Trung Nguyen discovered a critical privilege escalation flaw in KEDA, the standard Kubernetes autoscaler, and proved it by taking over an entire cluster from an ordinary tenant account. KEDA never validated the HashiCorp Vault address a tenant sets in a TriggerAuthentication object, so a tenant could point it at a fake Vault server in their own namespace and make the operator send its own ServiceAccount token there. That token reads every Secret in every namespace, creates jobs cluster-wide and rewrites admission control, turning a namespace tenant into an effective cluster admin. The earlier fix for CVE-2025-68476 did not stop this: it only checked that the leaked credential looked like a ServiceAccount token, which the operator's own token does by definition. It affects all versions up to 2.20.2; upgrading to 2.21.0 fixes it.

KEDA

09/23/2026

CVE-2026-91098High8.6

HP Linux Imaging and Printing (HPLIP) Heap-Based Buffer Overflow Enables Remote Code Execution (opens in a new tab)

CyStack researcher Trung Nguyen discovered a heap-based buffer overflow (CWE-122) in HP Linux Imaging and Printing (HPLIP), the driver and management suite that Linux distributions ship for HP printers and scanners, and reported it to HP PSRT, which fixed it under security bulletin HPSBPI04151. The flaw is reachable over the network without authentication and needs only a user action, such as letting the affected HPLIP component process attacker-supplied data. Overflowing the heap buffer corrupts adjacent memory and can be turned into code execution with the HPLIP process's privileges, giving the attacker full control of the affected workstation or print server and the print and scan data, credentials, and files it holds. HP rates the issue High (CVSS 4.0 score 8.6, with high confidentiality, integrity, and availability impact). It affects all HPLIP versions before 3.26.6; upgrading to 3.26.6 fixes it.

HP Linux Imaging and Printing

09/16/2026

CVE-2026-91097High7.0

HP Linux Imaging and Printing (HPLIP) Out-of-Bounds Write Enables Remote Memory Corruption (opens in a new tab)

CyStack researcher Trung Nguyen discovered an out-of-bounds write flaw (CWE-787) in HP Linux Imaging and Printing (HPLIP), the driver and management suite that Linux distributions ship for HP printers and scanners, and reported it to HP PSRT, which fixed it under security bulletin HPSBPI04151. The flaw is reachable over the network without authentication and needs only a user action, such as letting the affected HPLIP component process attacker-supplied data. A successful write outside the intended buffer corrupts the process's memory, letting the attacker crash it or tamper with its data and potentially run code with its privileges on the workstation or print server. HP rates the issue High (CVSS 4.0 score 7.0, with high integrity impact). It affects all HPLIP versions before 3.26.6; upgrading to 3.26.6 fixes it.

HP Linux Imaging and Printing

09/16/2026

CVE-2026-94609High8.8

Privilege Escalation to Superuser via Group Hierarchy in authentik (opens in a new tab)

CyStack researcher Trung Nguyen discovered a privilege escalation flaw in authentik, the open-source identity provider used for single sign-on, and proved that a low-level helpdesk-style account could grant itself full administrator power. In authentik, superuser status is inherited down the group hierarchy, so a group can confer it without holding it. The checks on group membership and hierarchy either ignored inherited superuser status or looked only at the group's own setting, and nothing checked the permission needed to assign a role to a group. An account delegated just one group or one user could therefore make any account - including its own - a superuser, which in an identity provider means control over every application behind the single sign-on. It affects versions up to 2026.2.6, 2026.5.6 and 2026.8.1; upgrading to 2026.2.7, 2026.5.7 or 2026.8.2 fixes it.

authentik

Authentik Security

09/09/2026

CVE-2026-84637Critical9.8

Thunderbird Calendar Invitation Attachments Can Launch Local Executables (opens in a new tab)

CyStack researcher Trung Nguyen discovered a flaw in how Mozilla Thunderbird handles calendar invitation attachments. On Windows, a malicious invitation can use a file URI attachment to launch a local or network-hosted executable, bypassing Thunderbird's normal protections against executable attachments. With the new invitation display enabled, the attachment can also be shown under a misleading filename, making the lure more convincing. An attacker who gets a victim to open a crafted invitation can thus run arbitrary programs on their machine. It affects Thunderbird before 153.2; upgrading to 153.2 or 154 fixes it.

Thunderbird

Mozilla

09/01/2026

GHSA-fq2f-crmw-q97rHigh8.8

Valkey Lua Script Debugger Use-After-Free via SCRIPT FLUSH ASYNC Enables Server Crash and Potential Code Execution (opens in a new tab)

CyStack researchers Trung Nguyen and Phuc Nguyen discovered a use-after-free flaw in Valkey's Lua script debugger, and proved it by reliably crashing the server with a short sequence of ordinary scripting commands. Since the Lua engine became a module in the 9.1 line, the debugger builds its command table once and caches a raw pointer to the current Lua interpreter state, and that cache is never invalidated. `SCRIPT FLUSH ASYNC` recreates the engine and frees the old interpreter, so the next `SCRIPT DEBUG` command dereferences freed heap memory. An attacker who reclaims that chunk with a counterfeit interpreter state can make the interpreter call an allocator function pointer they control, turning the crash into a path toward code execution inside the database process. A second use-after-free in the debugger's log handling is fixed in the same change. The risk is realistic because any client allowed to run scripting commands can trigger it, and many Valkey deployments run without authentication on internal networks. The flaw affects Valkey 9.1.0 and 9.1.1 (8.x and 9.0.x are not affected); upgrading to 9.1.2 fixes it, and restricting `SCRIPT DEBUG` via ACLs is a temporary mitigation.

Valkey

08/31/2026

CyStack Secures Leading Organizations Across Industries

View Our Customer Stories

Risk Detection

Data Protection

Standards Compliance

Consulting & Training

Blockchain Security

Detecting Vulnerabilities in VinID & VinShop With Bug Bounty Program

Learn More

To stay competitive, we needed to ship faster. CyStack’s community‑driven security on WhiteHub helped us improve platform safety at scale - without slowing development.

Tung Nguyen

Head of Product Security, One Mount

Detecting Vulnerabilities in VinID & VinShop With Bug Bounty Program

Learn More

To stay competitive, we needed to ship faster. CyStack’s community‑driven security on WhiteHub helped us improve platform safety at scale - without slowing development.

Tung Nguyen

Head of Product Security, One Mount

Secure, Global-Compliance Password Management With Locker for VinCSS

Learn more

CyStack delivered the project with strong professionalism and clear execution. Locker is a competitive solution with accessible pricing, and we confidently recommend it for protecting sensitive credentials.

Trac Do

Chief Executive Officer, VinCSS

Meeting Partner Security Requirements and Standardizing Controls Quickly

Learn more

We had to address 17 outstanding security control items under partner pressure. CyStack helped us resolve them in a quarter of the expected time, without compromising quality, so we could move forward with the deal.

Tuan Anh Le

Chief Technology Officer, VietnamCredit

Security Architecture Consulting for a Global Card Issuing Platform

Learn more

CyStack showed strong expertise in securing our critical EMV card issuing platform. Their specialized solutions met strict technical and business requirements, and we confidently recommend them.

Sutat Suksawat

Chief Executive Officer, DZ Solution (dzcard)

Complex Layer‑1 Testing Two Weeks Completion Before Mainnet

Learn more

We had difficulty finding a security partner because a two-week deadline for such a complex system was something most parties were reluctant to accept. CyStack demonstrated superior capability by taking on and smoothly handling this challenge. The excellent results they delivered truly exceeded our expectations.

Dmitriy Gerasimov

Chief Executive Officer, Cellframe

Resources & Research from CyStack

News & Events

Reports & Research

Guides & Insights

Expert Q&A

Checklist & Documents

View all articles

Turn Information Security Into Your Core Competitive Advantage

Let your teams focus on growth. CyStack experts will take care of securing your systems.

Preventing Digital Threats, Securing Your Business 24/7

24/7

Cyber Risks Threaten Every Business

Is Your System Secure? Run a Security Check

CyStack - Your Trusted Cybersecurity Partner

Solutions For Businesses

Small & Medium

Solutions For Businesses

Small & Medium

Solutions For Businesses

Large & Enterprise

Solutions For Businesses

Large & Enterprise

Solutions For Businesses

Small & Medium

Solutions For Businesses

Small & Medium

Solutions For Businesses

Large & Enterprise

Solutions For Businesses

Large & Enterprise

What Makes CyStack Different?

Technology‑Driven Security Management

Proven & Experienced Expert Team

Hack and Dev Mindset

Community‑Based Security

International Certifications & Standards

Continuously finding vulnerabilities and helping protect global cybersecurity

CyStack Secures Leading Organizations Across Industries

Detecting Vulnerabilities in VinID & VinShop With Bug Bounty Program

Detecting Vulnerabilities in VinID & VinShop With Bug Bounty Program

Secure, Global-Compliance Password Management With Locker for VinCSS

Meeting Partner Security Requirements and Standardizing Controls Quickly

Security Architecture Consulting for a Global Card Issuing Platform

Complex Layer‑1 Testing Two Weeks Completion Before Mainnet

Resources & Research from CyStack

Turn Information Security Into Your Core Competitive Advantage

Preventing Digital Threats, Securing Your Business 24/7

24/7

Cyber Risks Threaten Every Business

Is Your System Secure? Run a Security Check

CyStack - Your Trusted Cybersecurity Partner

Solutions For Businesses

Small & Medium

Solutions For Businesses

Small & Medium

Solutions For Businesses

Large & Enterprise

Solutions For Businesses

Large & Enterprise

Solutions For Businesses

Small & Medium

Solutions For Businesses

Small & Medium

Solutions For Businesses

Large & Enterprise

Solutions For Businesses

Large & Enterprise

What Makes CyStack Different?

Technology‑Driven Security Management

Proven & Experienced Expert Team

Hack and Dev Mindset

Community‑Based Security

International Certifications & Standards

Continuously finding vulnerabilities and helping protect global cybersecurity

CyStack Secures Leading Organizations Across Industries

Detecting Vulnerabilities in VinID & VinShop With Bug Bounty Program

Detecting Vulnerabilities in VinID & VinShop With Bug Bounty Program

Secure, Global-Compliance Password Management With Locker for VinCSS

Meeting Partner Security Requirements and Standardizing Controls Quickly

Security Architecture Consulting for a Global Card Issuing Platform

Complex Layer‑1 Testing Two Weeks Completion Before Mainnet

Resources & Research from CyStack

Turn Information Security Into Your Core Competitive Advantage

Preventing Digital Threats,
Securing Your Business 24/7

Proven & Experienced
Expert Team

Continuously finding vulnerabilities
and helping protect global cybersecurity

Preventing Digital Threats,
Securing Your Business 24/7

Proven & Experienced
Expert Team

Continuously finding vulnerabilities
and helping protect global cybersecurity