A WordPress libheif RCE chain and its PoC are now public. The libheif vulnerability turns an HEIC upload into code execution. Patch to 1.23.3. Related Posts: CVE-2026-21589 Exploited in the Wild as Atlassian File Read Flaw Details and PoC Go Public Elastic Patches 14 Flaws in Elasticsearch, Kibana and Elastic Defend ASUS Patches Four Router Firmware Flaws, Including Two Critical Bugs Rated CVSS 9.3 The post Researchers Publish Full Details and PoC Exploit for a WordPress libheif RCE Chain app