/Hive Five #260 · Feb 2, 2026
The Rise of Agent Social Networks
/The Bee's Knees 🐝
The headline picks from this issue. The full issue has more.
-
SmarterMail Auth Bypass Under Active Exploitation
watchTowr discovered WT-2026-0001, an authentication bypass letting anyone reset the SmarterMail admin password via an unauthenticated API endpoint that never validates the old password. Attackers reverse-engineered the patch within two days of release and began exploiting it in the wild.
Read : SmarterMail Auth Bypass Under Active Exploitation -
Cloudflare Zero-Day: Accessing Any Host Globally
FearsOff researchers found a zero-day in Cloudflare's ACME implementation that allowed accessing any host globally. The vulnerability has since been addressed by Cloudflare.
Read : Cloudflare Zero-Day: Accessing Any Host Globally -
Hacking an AI Children's Toy: Remote Access to Every Conversation
Security researchers found Bondu's AI toy admin panel was accessible to anyone with a Google account, exposing tens of thousands of children's conversations, family data, and full device control. The company fixed it within 10 minutes of disclosure.
Read : Hacking an AI Children's Toy: Remote Access to Every Conversation -
React Server Components CVE-2026-23864
Multiple high-severity DoS vulnerabilities in React Server Components affect Next.js 13-16 and other frameworks. Specially crafted HTTP requests to Server Function endpoints can crash servers or cause OOM exceptions. Upgrade immediately.
Read : React Server Components CVE-2026-23864 -
Samsung MagicINFO 9 Server RCE Chain
Steven Seeley walks through chaining multiple vulnerabilities in Samsung's MagicINFO digital signage server, from license check bypasses and hardcoded credentials to Java deserialization, achieving pre-auth remote code execution on ~6,600 exposed servers.
Read : Samsung MagicINFO 9 Server RCE Chain