As you’ve all probably heard by now, on October 20, details of two critical remote code execution (RCE) vulnerabilities in PHP, CVE-2026-109618 and CVE-2026-109619, leaked online before their coordinated disclosure and before patches were released. PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two critical vulnerabilities that can allow unauthenticated remote code execution. All PHP users are...
If you’re watching the Snipe-IT repo closely (which it’s totally fine if you aren’t – go be a normal person! Do normal people stuff!), you will have noticed some changes recently. Lots of older issues being closed, lots of them being resurfaced, lots of new categorizing of things, etc. We’ve decided to try something new for us. It’s going to get weird, a little...
Just a few days ago, a patch for CVE-2024-52301 was to Laravel’s core, Laravel being the PHP framework we use here at Grokability for Snipe-IT. The patch for this security flaw was released in v7.1.14 earlier today. While hosted customers were NOT affected (we do not have register_argc_argv enabled on any of our servers), self-hosted community users and support-only customers are...
The long-awaited Snipe-IT v7 launch looms nearer, so we wanted to loop you in on where we’re at. We had planned on launching v7 in early November, to coincide with Snipe-IT’s ten-year anniversary (!!) but between holidays schedules and the framework upgrade (with dependencies), it’s been taking a little longer than we had hoped. Dependency management means testing each library...
The internet is alight this week with news of a widespread vulnerability in the Linux “policy kit” framework, specifically a root compromise via the pkexec program, designated CVE-2021-4034. Most of our systems do not fall under this advisory, and the ones that do have been fully patched. Of note, our Snipe-IT hosting systems were completely unaffected by this advisory.As always, we...