Firm to Release Database & Web Server 0days

Summary: Evgeny Legerov, founder of Moscow-based Intevydis, said he plans to publish previously undocumented vulnerabilities and in some cases working exploits in widely used commercial software between January 11 and February 1, with the final list still in flux. The likely targets include Web servers such as Zeus Web Server and Sun Web Server (pre-authentication buffer overflows), databases including MySQL, IBM DB2, Lotus Domino and Informix, and directory servers such as Novell eDirectory, Sun Directory and Tivoli Directory. Legerov said he no longer contacts vendors and does not support 'responsible disclosure,' and McAfee's Dmitri Alperovitch called the planned disclosure 'irresponsible.'
What's compelling: Legerov said he has had no contact with the vendors except Zeus.com, which he said is likely to ship a fix the day he details the flaw, leaving administrators of the other affected Web, database and directory servers to defend against flaws they will learn about only when the exploits appear.

Read the original at Krebs on Security ↗

Topics: Vulnerabilities & Patching
Related: Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026
PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026