Remote Code Execution (RCE)
Remote Code Execution (RCE) is the ability for an attacker to execute arbitrary commands or code on a target machine or process. RCE vulnerabilities represent the most critical class of security bugs — they give an attacker the same level of control as a system administrator.
RCE can manifest through many different attack vectors. Command injection occurs when user input is passed unsanitized to system shell commands. Deserialization attacks exploit unsafe object reconstruction in languages like Java, PHP, Python, and .NET. Server-Side Template Injection (SSTI) allows code execution through template engines like Jinja2, Twig, or Freemarker. File upload vulnerabilities can lead to RCE when executable files bypass upload filters and are served by the web server.
In modern applications, RCE often appears in less obvious places: expression language injection in Java frameworks, prototype pollution leading to code execution in Node.js, unsafe use of eval() or dynamic code loading, and vulnerabilities in PDF generators, image processors, and other libraries that shell out to system commands.
RCE bugs consistently command the highest payouts in bug bounty programs because the impact is total system compromise. Chaining lower-severity bugs into RCE — such as SSRF to cloud metadata to code execution — is a common and highly rewarded approach.
This page collects RCE techniques, exploitation writeups, and research across all major platforms and languages.
From Wikipedia
Remote code execution is usually the end of a chain, not a bug you find
Direct, unauthenticated command injection on a modern target is rare enough to be newsworthy. What produces most real RCE is composition: a file upload that permits an unexpected extension, plus a directory the web server will execute from. A template field intended for personalization, in an engine that exposes object attributes. A deserialization endpoint, plus a library on the classpath with a usable gadget. An SSRF into an internal service that has an administrative API. The individual pieces are often rated low on their own, which is precisely why they survive to be chained.
That shapes how the material here is best read. Grouping it by language or by product is less useful than grouping it by primitive, because the primitive is what transfers. Command concatenation, unsafe deserialization, template injection, expression-language evaluation, unrestricted upload, path traversal into a writable executable location, prototype pollution reaching a sink, and memory-safety bugs in native components each recur across ecosystems with the same structure and different syntax.
Deserialization deserves particular emphasis because its severity is structural. In Java, .NET, PHP, Python and Ruby, reconstructing an object can invoke code during reconstruction; the attacker does not need to find a vulnerable function, only a chain of ordinary classes that together do something useful. The consequence is that the fix is architectural — do not deserialize untrusted data, and if you must, use a format that does not carry type information and an explicit allowlist. Blocklisting gadget classes has failed repeatedly and will continue to.
On impact and process: RCE reports pay the most and are also where responsible testing matters most, because proving execution and doing damage are separated by a very short distance. The good writeups below are careful about that boundary — a benign callback or a controlled identifier command establishes the finding without touching data. Read them for methodology as much as for technique.
| Date Added | Link | Excerpt |
|---|---|---|
| 2026-10-30 NEW 2026 | The Last Proof of Human Craft: Forging a Microsoft Edge Full Chain with Logic Bugs Only! advanced | Researchers demonstrated a novel exploit chain for Microsoft Edge, achieving full remote code execution (RCE) using only logic bugs. This "human craft" approach bypasses typical memory corruption vulnerabilities. The exploit's success highlights the continued threat posed by intricate logical flaws, even in sophisticated software. While the content focuses on the technical achievement, no specific bug bounty payout amount is mentioned. |
| 2026-10-30 NEW 2026 | TightVNC Viewer Pre-auth RCE news | A critical pre-authentication remote code execution (RCE) vulnerability has been discovered in TightVNC Viewer. This flaw allows an attacker to execute arbitrary code on a target system without requiring any prior authentication. Exploiting this vulnerability could lead to a complete compromise of the affected machine. Users are advised to update to the latest version of TightVNC Viewer to mitigate this security risk. |
| 2026-10-30 NEW 2026 | Axis Camera Station Deep-Dive: Unauth RCE to Decrypting Every Camera Credential (CVE-2025-30026/30023 + CVE-2026-63286) advanced | This research details critical vulnerabilities in Axis Camera Station, allowing unauthenticated remote code execution (RCE). Exploiting CVE-2025-30026/30023 enables attackers to gain RCE, leading to the decryption of all camera credentials stored within the system. CVE-2026-63286 further compounds these issues. The findings highlight a significant security risk for users of Axis Camera Station, potentially compromising the entire surveillance network. |
| 2026-10-30 NEW 2026 | TeamViewer RCE Vulnerability (CVE-2026-11585) news | A critical Remote Code Execution (RCE) vulnerability, tracked as CVE-2026-11585, has been discovered in TeamViewer. This flaw allows attackers to execute arbitrary code on vulnerable systems, posing a significant security risk. The exact impact and affected versions are still being investigated, but prompt patching and mitigation are strongly advised for all TeamViewer users to prevent exploitation. No bounty payout amount was specified in the provided content. |
| 2026-10-30 NEW 2026 | Chained PHP2Shell exploit roots 25 servers, including US Government servers advanced | A chained PHP2Shell exploit has compromised 25 servers, notably including US Government systems. This indicates a significant security vulnerability has been leveraged to gain root access across multiple platforms. The exploit's success highlights potential weaknesses in how PHP applications are secured and managed, posing a serious risk to sensitive data and infrastructure. No specific payout amount was mentioned for this exploit. |
| 2026-10-30 NEW 2026 | What are shell vulnerabilities? PHP2Shell, Node2Shell (HTTP2Shell), React2Shell and Log4Shell explained beginner | Shell vulnerabilities allow attackers to execute commands on a server. This guide explains common types: PHP2Shell, Node2Shell (HTTP2Shell), React2Shell, and Log4Shell. Understanding these vulnerabilities is crucial for managing and mitigating them. → aikido.dev |
| 2026-10-29 NEW 2026 | Turning the Valve - Exploiting RCE and LPE in the Steam Platform intermediate 23 min read AuthZ | Library detailing the exploitation of local privilege escalation (LPE) and remote code execution (RCE) vulnerabilities within the Steam platform. The research delves into the platform's architecture, specifically examining the communication mechanisms between the unprivileged client and the privileged service process via named pipes. It details vulnerabilities found in interfaces such as `IClientInstallUtils`, `IClientModuleManager`, `ISecure Desktop Capture`, and `BYOVD`, demonstrating how these flaws can be leveraged to gain elevated privileges or execute arbitrary code. |
| 2026-10-29 NEW 2026 | PHP2Shell Won't Be the Last. Here's Where the Next One Will Show Up First. news 7 min read Supply Chain | Library for assessing application security risks, focusing on threats like PHP2Shell. It details the discovery and exploitation of CVE-2026-109618 and CVE-2026-109619, highlighting how vulnerabilities in core engines like PHP can bypass application code. The library emphasizes the need for continuous outside-in testing, robust inventory management, and rapid response capabilities, especially in an era where AI accelerates vulnerability discovery and exploit development, demanding patch and mitigation timelines measured in hours. → snyk.io |
| 2026-10-28 NEW 2026 | Reviving GLPI Agent Abuse with ESC17 intermediate 8 min read | Library for exploiting GLPI Agent abuse using ESC17, enabling RCE on managed hosts without server compromise. The library, GLPwnIou, mimics the GLPI deploy mechanism, allowing attackers to deliver malicious commands and binaries. ESC17 empowers attackers to request certificates for server authentication, facilitating a man-in-the-middle position to trick GLPI agents into connecting to a rogue server, circumventing previous TLS certificate checking mitigations. |
| 2026-10-28 NEW 2026 | From Arbitrary File Read to Shell: Yet Another RCE in Telerik intermediate 27 min read | Library for discovering vulnerabilities in Telerik UI for ASP.NET AJAX, leading to unauthenticated remote code execution. It chains an arbitrary file read in RadImageEditor (CVE-2026-18672) with an unrestricted file upload via RadEditor's file browser (CVE-2026-19219), contingent on specific `web.config` keys. The library details how to leverage these flaws by manipulating `_ClientState` and `dialogParametersHolder` form fields to read sensitive configuration and execute code. |
| 2026-10-28 NEW 2026 | A community translation can run attacker-chosen code in an exported Godot game intermediate 6 min read | Writeup detailing arbitrary GDScript execution in exported Godot games via manipulated .po translation files. Affected versions include Godot 4.1 onwards, where the `Plural-Forms` header is evaluated by a general expression evaluator. This allows attackers to inject malicious GDScript through the header, potentially leading to high-impact local attacks (CVSS 3.1 7.8). Developers can mitigate this by strictly validating the `Plural-Forms` header against the gettext grammar before loading untrusted .po files. |
| 2026-10-28 NEW 2026 | PHP2Shell: Exploitation Attempts and Remediation Trends intermediate 8 min read | Library detailing exploitation attempts and remediation trends for PHP2Shell vulnerabilities, including CVE-2026-109618 and CVE-2026-109619. It examines observed attack techniques, such as those using multipart bodies to exhaust memory, and analyzes why these attempts have failed, noting issues with request size limits and memory leak stages. The library also tracks remediation progress, indicating a decrease in vulnerable machines and affected organizations following disclosure. → wiz.io |
| 2026-10-28 NEW 2026 | Responder Guidance for PHP2Shell (CVE-2026-109618 and CVE-2026-109619) news 7 min read | Library for PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619, which enable unauthenticated remote code execution. These critical memory-corruption flaws affect the PHP core engine and are fixed in newer PHP versions. The guide details how exploitation works via out-of-memory corruption and stale global state, and discusses configuration factors like SAPI, opcache, and display_errors that influence reachability and execution. Partial mitigations are provided, but patching is strongly recommended as they do not offer a complete fix. → bishopfox.com |
| 2026-10-26 NEW 2026 | Breaking the AWS MCP Python Sandbox advanced 10 min read AI Python | Library for bypassing AWS MCP Python sandbox restrictions. This resource details how to exploit the `aws___run_script` tool by abusing Python's structural pattern matching (`match/case`) to bypass AST validation and runtime checks. By manipulating `__match_args__` and constructing dunder names using `chr()`, an attacker can achieve arbitrary attribute reads, ultimately leading to system command execution within the AWS Lambda sandbox. |
| 2026-10-26 NEW 2026 | Broccoli2Shell: Brotli decoder RCE in Node.js, Python and more intermediate 6 min read Deser Supply Chain | Library for detecting and mitigating Brotli decompression vulnerabilities, particularly the Broccoli2Shell RCE affecting Node.js, Python (including requests, urllib3, and aiohttp), and other software that uses the vulnerable C decoder (versions 1.0.3-1.2.0). It highlights how Brotli decompression can occur via HTTP responses, request bodies, and direct decoder calls, impacting applications that fetch URLs or accept encoded uploads. The library references CWE-252 and CWE-787 and points to specific fixes in Google's brotli repository and affected project versions. |
| 2026-10-26 NEW 2026 | Broccoli2shell: Everything You Need To Know About The Critical Brotli Decoder Vulnerability intermediate 3 min read Supply Chain | Writeup of CVE-2026-111497, dubbed Broccoli2Shell, detailing an out-of-bounds write vulnerability in the Brotli decoder. This flaw affects numerous technologies like Node.js, Bun, and Envoy Proxy, enabling remote code execution via crafted compressed data. Exploitation requires processing untrusted Brotli input, exposing cloud environments and internet-facing applications. Recommendations include applying security updates, identifying vulnerable workloads, and reviewing application exposure to Brotli-compressed data. → wiz.io |
| 2026-10-25 NEW 2026 | Full source release: autonomous root chain for TCL 50C721 Android TV via CVE-2022-22706 (Mali GPU page-cache write) advanced Mobile | This release provides the full source code for achieving an autonomous root chain on the TCL 50C721 Android TV. The exploit leverages CVE-2022-22706, a vulnerability related to a Mali GPU page-cache write. This allows for a complete takeover of the device's root privileges. No bug bounty payout amount is mentioned in the provided content. |
| 2026-10-24 NEW 2026 | Imperia CMS SiteActive TEMPLATE Unauthenticated SSTI Remote Code Execution (CVE-2026-110355) news 4 min read SSTI | Writeup detailing CVE-2026-110355, an unauthenticated Server-Side Template Injection (SSTI) leading to Remote Code Execution in Imperia CMS's SiteActive component. The vulnerability, present in versions 11.7.2 and below on CGI-enabled installations, allows an attacker to inject PHP code via the `TEMPLATE` parameter in `/cgi-bin/site_active.pl`. This injected code is then processed by the `Imperia::Template::Convert` module and executed via the `PHPExec` plugin, enabling arbitrary command execution. The vendor patched this in Imperia CMS 11.8.0. |
| 2026-10-24 NEW 2026 | Evolving Threat: http2shell is an RCE in Node, Python, and more news Python | A new vulnerability, http2shell, has been discovered, posing a significant threat as it allows for Remote Code Execution (RCE) across multiple platforms including Node.js and Python. This exploit targets implementations of the HTTP/2 protocol, enabling attackers to gain unauthorized control over affected systems. Details on specific affected versions or potential mitigations are not provided in this brief summary, but the discovery highlights a critical security concern for applications using HTTP/2. The payout amount for reporting this vulnerability is not stated. |
| 2026-10-24 NEW 2026 | Understanding PHP2Shell: Everything you need to know about CVE-2026-109618 & CVE-2026-109619 news 8 min read | Writeup detailing PHP2Shell, a critical remote code execution vulnerability impacting approximately 70% of web servers. This analysis covers CVE-2026-109618 and CVE-2026-109619, which exploit PHP's memory management and error handling subsystems, allowing for full code execution or memory disclosure. It outlines four attack chains, including OOM corruption via mod_php, stale global state via fatal-error backtrace, stale session state via upload progress, and memory disclosure. Recommendations include updating PHP, applying WAF rules from vendors like Akamai and Cloudflare, and maintaining an asset inventory. → intigriti.com |
| 2026-10-24 NEW 2026 | Node2Shell evolves to HTTP2Shell. Brotli flaw (CVE-2026-111497) blast radius affects many libraries & apps using HTTPs. news 10 min read | Library addressing CVE-2026-111497, a critical out-of-bounds write in Google's Brotli decoder affecting versions 1.0.3 through 1.2.0. This vulnerability, also known as "Node2Shell," can lead to memory leaks, crashes, or arbitrary code execution for attackers sending crafted Brotli-compressed streams. The flaw impacts Node.js, Python packages like requests and httpx, curl, Bun, and Envoy, among others. Patches are available for libbrotli, Python, and various runtimes, with recommendations including upgrading affected libraries or disabling Brotli decoding as a workaround. → aikido.dev |
| 2026-10-23 NEW 2026 | Reversing a DPRK-linked toolkit that backdoors VS Code, Cursor, Discord and npm, with an Ethereum dead-drop C2 and a DEV#POPPER variant advanced Supply Chain | This content details a sophisticated toolkit, linked to North Korea (DPRK), that compromises popular developer tools like VS Code, Cursor, Discord, and npm. The toolkit establishes a command and control (C2) channel using an Ethereum "dead-drop" mechanism, a novel approach for covert communication. Furthermore, it incorporates a variant of the DEV#POPPER malware. The summary focuses on the identification of the threat actor, the targeted software, the unique C2 infrastructure, and the specific malware variant identified. |
| 2026-10-23 NEW 2026 | Markdown Is the New Executable: Attackers Are Dropping Agent Instructions Into Your Downloads Folder From the Web intermediate 15 min read | Library for detecting and preventing a novel attack vector where malicious `AGENTS.md` files, disguised as ordinary instructions, are dropped into user download folders by visiting websites. These files trick AI coding assistants like OpenAI Codex and Claude Code into executing arbitrary code or exfiltrating credentials by abusing the assistants' trust in files within their operating directories, exemplified by the exploitation of the `function-color` npm package. |
| 2026-10-23 NEW 2026 | [tl;dr sec] #351 - PHP2Shell, Autopatching Skills, AWS Pathrunner intermediate 9 min read AuthZ | Tool for automating AWS IAM privilege escalation, the modular framework pathrunner leverages the pathfinding.cloud catalog and manages identities as first-class objects. It deploys attacker infrastructure and generates HTML reports mapping exploitation steps to CloudTrail events. → tldrsec.com |
| 2026-10-23 NEW 2026 | Node2Shell: Node.js Brotli vulnerability allows remote code execution (CVE-2026-111497) news 6 min read Supply Chain | Library for Node.js and Bun addressing CVE-2026-111497, the Node2Shell vulnerability. This flaw in the Brotli decoder allows for remote code execution by malformed compressed input when an application decompresses Brotli data from an attacker-controlled source, affecting servers accepting requests, apps calling other servers, or code using `node:zlib` directly. → aikido.dev |
| 2026-10-22 2026 | PHP2Shell - quick mitigation pre-patch intermediate | PHP2Shell is a technique that allows attackers to execute arbitrary code on a server by exploiting vulnerabilities in how PHP handles shell commands. This exploit can be used to gain control of the system before official patches are available. The provided information likely discusses methods for detecting and mitigating PHP2Shell attacks by implementing security measures that prevent or limit the execution of malicious shell commands, even in the absence of vendor patches. |
| 2026-10-22 2026 | CVE-2026-109618 and CVE-2026-109619 Are Two Directions Through the Same Pre-RINIT Window news 8 min read | Writeup on CVE-2026-109618 and CVE-2026-109619 detailing how the PHP session.upload_progress feature's callback, executed before module RINIT during multipart form data parsing, interacts with the basic extension's serializer state. This interaction, particularly when memory errors trigger `longjmp`, can lead to use-after-free vulnerabilities (CWE-416) by leaving the serializer's working state corrupted. The patch in PHP 8.5.12 mitigates this by introducing an early RINIT for specific globals and modifying serializer behavior for incomplete classes. |
| 2026-10-22 2026 | PHP2Shell (CVE-2026-109618/109619): first exploit requests arrived 5.5 hours before PHP shipped the fix, and the "scanners" carry Mirai-style loaders news 25 min read | Library detailing CVE-2026-109618 and CVE-2026-109619, two critical, unauthenticated RCE flaws in PHP core, nicknamed PHP2Shell. These vulnerabilities allow for remote code execution before application code even runs, with exploitation observed hours before official patches were released. The article details the technical specifics of each bug, including OOM corruption for CVE-2026-109618 and stale global state for CVE-2026-109619, and provides remediation steps such as patching to specific PHP versions (8.2.35, 8.3.36, 8.4.27, 8.5.12) or temporary workarounds like disabling upload progress. It also analyzes observed attack tooling, noting the use of Mirai-style loaders and attempts to exploit the vulnerabilities using leaked exploit details. |
| 2026-10-22 2026 | PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet news 11 min read | Writeup on PHP2Shell, an exploit chain demonstrating remote code execution and memory disclosure in core PHP, affecting versions dating back to 5.4. Developed using frontier AI models like Gemini 4 Argon, these vulnerabilities, grouped under CVEs with a CVSS score of 9.2, exploit memory-safety issues stemming from fatal error handling. The PHP2Shell exploit impacts widely used CMS platforms like WordPress, Drupal, and Joomla, as well as any application running on affected PHP versions, highlighting a potential turning point for AI-assisted vulnerability exploitation. → wiz.io |
| 2026-10-22 2026 | “Next Exploit Opportunities”: How a Threat Actor Used AI to Help Plan and Execute Multiple Types of Cybercrime Activities news 11 min read AI Secrets | Analysis of a threat actor, BUGSTER, details the weaponization of AI for cybercrime, including credential theft, VoIP fraud, Wi-Fi password cracking, and cryptocurrency reconnaissance. The actor leveraged AI-assisted scripts and reconnaissance reports, bypassing technical skill requirements, and successfully exfiltrated thousands of student records from an Indian university. The actor also planned VoIP fraud operations with AI guidance, utilizing the Hermes Agent framework and DeepSeek V4. This report highlights an emerging toolchain for cybercriminals adopting AI-enabled capabilities, driven by low cost and ease of access to such models. → unit42.paloaltonetworks.com |
| 2026-10-21 2026 | CVE-2026-46633: Proving exploitability of Twig sandbox bypass intermediate 9 min read SSTI | Writeup detailing exploit development for CVE-2026-46633, a Twig sandbox bypass. This research provides payloads for Error-Based, Time-Based Blind, Rendered, and Boolean Error-Based Blind exploitation, applicable to various Twig versions. It covers techniques such as leveraging traits and overriding class methods like `getSourceContext()` for code injection and achieving RCE, and includes corresponding SSTImap modules. |
| 2026-10-21 2026 | CVE-2026-106173 Deep-Dive: Fortinet FortiSIEM gRPC Path Traversal File Write to RCE advanced 4 min read | Writeup of CVE-2026-106173 details a critical arbitrary file write vulnerability in Fortinet FortiSIEM, exploitable via an unauthenticated gRPC service on port 27918. Attackers can leverage path traversal and null byte injection to overwrite critical system files, such as `/opt/charting/redishb.sh`, ultimately leading to remote code execution by manipulating files executed by cron jobs. → horizon3.ai |
| 2026-10-21 2026 | PHP rce CVE-2026-109618 news 2 min read | Writeup on CVE-2026-109618 and CVE-2026-109619, two PHP remote code execution vulnerabilities affecting versions 5, 7, and 8. Exploitation has been observed in the wild. These vulnerabilities, also known as "php2shell", allow unauthenticated attackers to execute code on a server. No official vendor advisory or patch is currently available, and organizations running PHP should prepare for rapid updates once a fix is confirmed. |
| 2026-10-21 2026 | What you need to know about PHP2shell. Critical vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619) news 3 min read | Library provides critical information on CVE-2026-109618 and CVE-2026-109619, two remote code execution vulnerabilities affecting all unpatched PHP versions. Patches are available for PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35, with exploitation already reported. The document details mitigation strategies, including updating PHP, using patched Aikido Images, and temporary workarounds like disabling `session.upload_progress.enabled` and setting `memory_limit = -1`. It also outlines signs of compromise and post-patch verification steps. → aikido.dev |
| 2026-10-20 2026 | CVE-2026-108097 Deep Dive: Turning a Drupal Field UI Callback Into RCE advanced | This content details a deep dive into CVE-2026-108097, a vulnerability in Drupal. The analysis reveals how a weakness in the Field UI callback can be exploited to achieve Remote Code Execution (RCE). The document likely explores the technical intricacies of the vulnerability, the methods used for exploitation, and potentially mitigation strategies for Drupal users. No specific bug bounty payout amount is mentioned in the provided title or content. |
| 2026-10-19 2026 | One parser, two bugs, many routers: Exploiting Broadcom WiFi across eCos, Linux advanced 5 min read | Writeup detailing remote code execution vulnerabilities in Broadcom's 802.11 implementation. Affecting millions of routers globally, these bugs enable unauthenticated attacks, information disclosure, and network key exfiltration. The analysis includes exploitation primitives, supply chain security concerns, and fingerprinting scripts for identifying affected devices, demonstrating the exploitable WPS EAP reassembly overflow on eCos and Linux platforms. |
| 2026-10-18 2026 | PhantomBuffer: Effective EDR Evasion Through Stealth Injection advanced 5 min read | Library for EDR evasion that utilizes stealth injection by leveraging Windows messages. PhantomBuffer bypasses traditional detection methods by employing `SendMessageW` with the `WM_SETTEXT` message to write payloads into target processes, avoiding the `WriteProcessMemory` API. This technique further enhances stealth by delegating thread execution redirection to the `cdb.exe` debugger, circumventing common EDR monitoring of `SetThreadContext` and `NtSetContextThread` APIs. |
| 2026-10-16 2026 | Wanted to download an ISO, ended up writing a kernel exploit advanced 13 min read | Library for kernel exploit development, enabling root access on TP-Link EAP770 Wi-Fi 7 access points. This writeup details a path to disable flawed hardware offloading features, bypassing privilege restrictions. The exploit chain leverages CVE-2022-0185, an integer underflow vulnerability, combined with pipe-buffer manipulation to achieve arbitrary write capabilities in the kernel, requiring root privileges to execute. |
| 2026-10-15 2026 | AhsayCBS Deep-Dive: Auth Bypass to RCE intermediate 5 min read AuthZ | Writeup of CVE-2026-105133 and CVE-2026-105134, detailing an authentication bypass vulnerability in AhsayCBS API components and a file write path traversal leading to remote code execution. Attackers can chain these flaws to write webshells into the application's filesystem, enabling SYSTEM and root command execution. The analysis unpacks the Java application's structure, identifies the authentication bypass in the `JSONApi.execute()` method via the "FromServlet":"Y" flag, and explains how `AddSysUser` allows creating new administrators without verification. It further details the path traversal in `FileService.a()` and `getReplicatedPath()`, demonstrating how to write malicious `.jsp` files into web-served directories, ultimately leading to webshell execution. → horizon3.ai |
| 2026-10-15 2026 | Artifactory Under Attack: In-the-Wild Exploitation of CVE-2026-42016, CVE-2026-42018 & CVE-2026-82329 news 12 min read AuthZ | Analysis of CVE-2026-42016, CVE-2026-42018, and CVE-2026-82329 impacting JFrog Artifactory details how attackers chain these vulnerabilities to bypass authentication and achieve administrative control. Exploitation involves gaining an anonymous user token via CVE-2026-42018, escalating privileges with CVE-2026-42016, or directly obtaining admin access through CVE-2026-82329. Post-exploitation activities include creating persistent admin accounts, deploying malicious Groovy plugins, and installing Rust-based backdoors for C2 communication. → wiz.io |
| 2026-10-15 2026 | Unit 42 Uncovers PEERSTITCH, a Stealthy FortiGate Implant news 12 min read Mobile | Library for detecting PEERSTITCH, a stealthy ARM64 malware, which exploits CVE-2024-47575 on FortiManager and CVE-2025-61624 on FortiOS. PEERSTITCH operates in memory, communicating through legitimate process traffic, evading conventional detection. The attack chain involves exfiltrating configurations and credentials from over 500 FortiGate firewalls, enabling long-term access, traffic interception, and backdoor deployment. → unit42.paloaltonetworks.com |
| 2026-10-15 2026 | Submit and Execute: Weaponizing Reflected XSS in Siemens Teamcenter's Login Redirect (CVE-2026-58113) intermediate 12 min read XSS | Library for demonstrating CVE-2026-58113, a reflected XSS vulnerability in Siemens Teamcenter's login redirect. This flaw allows an attacker to craft a link that, when opened by an authenticated user, executes JavaScript without any further user interaction. The vulnerability leverages the redirect page's automatic form submission and the `onformdata` event handler to achieve zero-interaction code execution, which can then be used to perform state-changing actions on behalf of the victim. → bishopfox.com |
| 2026-10-14 2026 | Vghost (CVE-2026-74580): Linux kernel vhost stale IOTLB cache leading to universal LPE and Guest-to-Host escape vector advanced 3 min read | Library describing Vghost (CVE-2026-74580), a Linux kernel vhost vulnerability. This defect stems from a stale IOTLB cache, enabling local privilege escalation to root via arbitrary kernel read/write or a guest escape through QEMU heap overwrite and control-flow hijacking when using vIOMMU and iommu_platform. The vulnerability was reproduced on Ubuntu, RHEL, Amazon Linux, Azure Linux, and Oracle Linux distributions, with fixes available in newer kernel versions. |
| 2026-10-14 2026 | We Let AI Fuzz Adobe Reader for a Week. It Found a Critical Zero-Day CVE-2026-81983 news 7 min read Fuzzing | Writeup detailing CVE-2026-81983, a critical integer overflow vulnerability in Adobe Acrobat's image pipeline. This vulnerability, discovered by an LLM-generated fuzzer, allows an out-of-bounds write by crafting a 16-bit image within a PDF. The bug stems from a 32-bit multiplication for a byte-swap loop that incorrectly calculates the buffer size, leading to an overrun. Adobe's patch implements a 64-bit range check to prevent this overflow. |
| 2026-10-14 2026 | Playing It SFAPE: Code Execution in Isolated User Mode advanced 16 min read | Library for exploring code execution within Windows Virtualization-Based Security (VBS) enclaves, specifically focusing on Isolated User Mode (IUM). This library details vulnerabilities like CVE-2023-36880 and CVE-2024-21423 found in `prefs_enclave_x64.dll`, demonstrating how memory corruption within an enclave can lead to full control. It highlights the potential for VTL1 code reuse, similar to techniques used in projects like Mirage and Outflank's sleepmask, for advanced operating system attacks. → blog.doyensec.com |
| 2026-10-13 2026 | LG webOS sync-demo Preauth RCE news | This content describes a critical Pre-authentication Remote Code Execution (RCE) vulnerability found in LG's webOS operating system, specifically within the `sync-demo` component. This means an attacker could potentially execute arbitrary code on a vulnerable LG smart TV without needing any prior authentication. The summary title itself highlights the severity of this security flaw. No bug bounty payout amount is mentioned in the provided text. |
| 2026-10-13 2026 | CVE-2026-91768: FastCGI allowed_clients compared only 96 of an IPv6 address's 128 bits news 5 min read | Writeup of CVE-2026-91768, a partial comparison vulnerability in PHP-FPM's `listen.allowed_clients` directive that allowed connections from 4,294,967,296 IPv6 addresses when only one was specified. Introduced in 2014, the flaw persisted until September 2026 due to incomplete IPv6 address comparisons within the `fcgi_is_allowed` function. The vulnerability, which could be exploited remotely without authentication, allowed bypassing access controls by comparing only 12 out of 16 bytes of IPv6 addresses, effectively treating an exact match as a /96 prefix match. |
| 2026-10-13 2026 | I Found a $90k Remote Code Execution Vulnerability in Google news 4 min read Deser | Writeup detailing a $90,000 RCE vulnerability discovered in Google's DevSite OAuth flow. The vulnerability arose from a Flask session cookie containing a pickle-serialized object that included the OAuth client secret. This secret was reused as the Flask `SECRET_KEY`, allowing an attacker to forge session cookies and execute arbitrary Python code via the `pickle.loads` function during the OAuth callback processing. The writeup covers session cookie analysis, pickle deserialization vulnerabilities, and the chain from exposed secrets to unauthenticated RCE, highlighting specific affected Google domains. |
| 2026-10-12 2026 | Telegram Desktop vulnerability allowed any user file to be stolen news 10 min read | Library for understanding a Telegram Desktop vulnerability that enables arbitrary file reads. The attack chain exploits a local socket communication flaw, allowing command injection and the use of an internal `interpret://` URI scheme. This scheme, intended for release publishing, reads specified files and sends them to a channel without authorization checks, enabling theft of sensitive user data like session keys. |
| 2026-10-10 2026 | A JPEG, a Race, and a Ghost: Breaking Discourse's Image Pipeline intermediate 12 min read | Library detailing two vulnerabilities in Discourse's default configuration: a cache poisoning attack leading to CSP bypass and JavaScript execution for anonymous users via a modified `color_scheme_id` cookie, and an arbitrary file read stemming from a TOCTOU race condition in the image upload pipeline, exploitable with Trust Level 0 and involving ImageMagick and GhostScript. → slcyber.io |
| Browse all 838 Remote Code Execution (RCE) resources → | ||
Frequently Asked Questions
- What is remote code execution?
- Remote Code Execution (RCE) is a vulnerability that allows an attacker to run arbitrary commands or code on a target system. It is the most critical class of security vulnerability because it gives the attacker the same level of access as the application or server process, often leading to complete system compromise.
- What are common RCE attack vectors?
- Common vectors include command injection (unsanitized input passed to shell commands), unsafe deserialization (Java, PHP, Python, .NET), Server-Side Template Injection (Jinja2, Twig, Freemarker), file upload bypasses that execute uploaded code, expression language injection in Java frameworks, and prototype pollution in Node.js leading to code execution.
- Why does RCE pay the highest bug bounties?
- RCE represents total system compromise — an attacker can read all data, modify the application, pivot to internal networks, and potentially access cloud infrastructure. The impact is maximum, so bounty programs consistently pay their highest rewards for RCE findings, often ranging from $10,000 to $100,000+ depending on the target.
Weekly AppSec Digest
Get new resources delivered every Monday.