Remote Code Execution (RCE)
Remote Code Execution (RCE) is the ability for an attacker to execute arbitrary commands or code on a target machine or process. RCE vulnerabilities represent the most critical class of security bugs — they give an attacker the same level of control as a system administrator.
RCE can manifest through many different attack vectors. Command injection occurs when user input is passed unsanitized to system shell commands. Deserialization attacks exploit unsafe object reconstruction in languages like Java, PHP, Python, and .NET. Server-Side Template Injection (SSTI) allows code execution through template engines like Jinja2, Twig, or Freemarker. File upload vulnerabilities can lead to RCE when executable files bypass upload filters and are served by the web server.
In modern applications, RCE often appears in less obvious places: expression language injection in Java frameworks, prototype pollution leading to code execution in Node.js, unsafe use of eval() or dynamic code loading, and vulnerabilities in PDF generators, image processors, and other libraries that shell out to system commands.
RCE bugs consistently command the highest payouts in bug bounty programs because the impact is total system compromise. Chaining lower-severity bugs into RCE — such as SSRF to cloud metadata to code execution — is a common and highly rewarded approach.
This page collects RCE techniques, exploitation writeups, and research across all major platforms and languages.
From Wikipedia
| Date Added | Link | Excerpt |
|---|---|---|
| 2026-08-31 NEW 2026 | Microsoft Edge Multiple Vulnerabilities news | Microsoft Edge has multiple vulnerabilities identified. The provided link leads to further details about these security weaknesses. The content does not specify any bug bounty payout amounts. → hkcert.org |
| 2026-08-30 NEW 2026 | Indirect Calling of Nested Functions on GCC Without Executable Stack advanced | This research explores a vulnerability in GCC where indirect calls to nested functions can be achieved even when the stack is not executable. This bypasses common security measures. The vulnerability arises from how GCC handles nested function pointers and trampolines. The researchers demonstrate how to exploit this to execute arbitrary code, effectively gaining control of the system. The implications are significant for applications compiled with GCC that rely on non-executable stack protection. |
| 2026-08-29 NEW 2026 | A critical Gitea flaw is under active attack and 8300 servers are still exposed news 4 min read | Library for securing Gitea instances against CVE-2026-60004, a critical remote code execution flaw allowing attackers with repository write access to execute shell commands by abusing the diffpatch endpoint. Exploitation involves crafting a patch that triggers an add/add collision in Git's three-way fallback, enabling the execution of Git hooks. Versions 1.17 through 1.27.0 are vulnerable. The fix involves upgrading to Gitea 1.27.1 or later and disabling open registration. |
| 2026-08-29 NEW 2026 | Five Critical WordPress Plugin and Theme Flaws Enable Site Takeover or RCE news 2 min read | Writeup detailing critical WordPress plugin and theme vulnerabilities including CVE-2026-76581 (WPMU DEV Dashboard authentication bypass), CVE-2026-18431 (Avada theme arbitrary file write), CVE-2026-19632 (TranslatePress sensitive information exposure), CVE-2026-19598 (Pods privilege escalation), and CVE-2026-82222 (GiveWP remote code execution via PHP object injection). These flaws in plugins and themes like WPMU DEV Dashboard, Avada, TranslatePress, Pods, and GiveWP enable authentication bypass, account takeover, and arbitrary code execution. → thehackernews.com |
| 2026-08-28 NEW 2026 | Attackers Chain Two PaperCut Flaws to Execute Code Without Authentication news 3 min read | Library for detecting and remediating the chaining of CVE-2026-81578 (improper access control) and CVE-2026-82078 (unsafe dynamic class loading) in PaperCut NG and MF. Attackers exploit these vulnerabilities to bypass authentication and achieve arbitrary code execution, often using Base64-encoded commands for reconnaissance like "whoami & ver" and deploying Java .class files to fingerprint systems. Organizations are advised to patch immediately and restrict public exposure. → thehackernews.com |
| 2026-08-28 NEW 2026 | In Other News: Log4j RCE Scare Minimus Shutdown Iranian Hacker Sanctions news 3 min read | Survey of recent cybersecurity incidents, detailing the Log4j RCE vulnerability's downplayed impact, LockBit's ransomware claims against U.S. Bank, Minimus's shutdown and acquisition by Echo, Truffle Security and Intruder's credential leak findings, Zimperium's research on mobile banking malware and AI usage, Troy Hunt's analysis of the Carhartt breach data's synthetic nature, Akira ransomware's attack on Paylogix, leaked Bauman University records on Russian cyber training, the Manchester Airports Group cyberattack, and US sanctions against Iranian hackers tied to MOIS. → securityweek.com |
| 2026-08-28 NEW 2026 | Over 8300 Gitea servers vulnerable to code execution attacks news 2 min read | Writeup of CVE-2026-60004, a critical code injection vulnerability affecting over 8,300 Gitea servers. Exploitation, requiring only repository write access which can be obtained via Gitea's default open registration, allows authenticated attackers to execute arbitrary shell commands. Salesforce researcher Shai Rod reported the flaw, and Gitea has released version 1.27.1 to address it. The vulnerability has been added to CISA's actively exploited flaws catalog, and U.S. agencies are mandated to patch. → bleepingcomputer.com |
| 2026-08-28 NEW 2026 | Two Unitree G1 EDU Humanoid Robot Flaws Enable Root RCE One Starts Over Bluetooth news 2 min read | Writeup detailing two root RCE vulnerabilities in the Unitree G1 EDU humanoid robot, CVE-2026-76639 and CVE-2026-76640. CVE-2026-76639 involves a path traversal through chat_go to bashrunner. CVE-2026-76640 exploits a BLE path that accepts bootstrap without pairing, followed by a buffer overflow during Wi-Fi provisioning, enabled by a flaw in Unitree's cloud account ownership verification. → thehackernews.com |
| 2026-08-28 NEW 2026 | Hackers Actively Exploiting Pre-Auth RCE Flaw in PaperCut Print Software news 2 min read | Writeup of actively exploited pre-auth RCE in PaperCut NG and MF, detailing how attackers gain arbitrary code execution by bypassing authorization checks. This vulnerability allows for remote server control, with observed exploitation involving commands for system enumeration and the deployment of malicious Java .class files to profile hosts and cover tracks. Huntress reproduced the exploit, achieving SYSTEM-level privileges. Affected organizations are urged to apply emergency patches, restrict public exposure of the PaperCut Application Server, and monitor for indicators of compromise. |
| 2026-08-28 NEW 2026 | UniBLEed: Unauthenticated Root RCE on Any Unitree G1 Humanoid Robot Within Bluetooth Range news 69 min read | Writeup detailing UniBLEed, a wormable exploit chain providing unauthenticated root RCE on Unitree G1 humanoid robots. This chain leverages a BLE characteristic write without pairing, heredoc injection for WiFi hijacking, a path traversal in the AI chatbot to leak load addresses, and a BSS buffer overflow to execute system commands as root. The writeup covers CVE-2026-76639 and CVE-2026-76640, stemming from discoveries including the hardcoded AES key, unauthenticated cloud API decryption, and insecure WiFi configuration. |
| 2026-08-28 NEW 2026 | Inside 90 days of attacks on AI infrastructure news 7 min read AI | Analysis of active campaigns targeting AI infrastructure reveals exploitation of LiteLLM, MCP servers, and AI frameworks through remote code execution (RCE), blind prompt injection, and memory credential theft. Attackers leverage vulnerabilities like CVE-2026-59822 and CVE-2026-42271 in LiteLLM, and employ techniques such as DNS-based callbacks for blind prompt injection against agents utilizing tools like LangChain and Flowise. Post-exploitation efforts focus on extracting AI-specific credentials and configurations directly from memory and framework-specific file paths. → wiz.io |
| 2026-08-27 NEW 2026 | Unknown PaperCut NG/MF vulnerability is under active attack news 2 min read | Vulnerability affecting PaperCut NG/MF print management software is under active attack, with attackers exploiting a remotely exploitable flaw in the Application Server. PaperCut Software advises restricting web access to trusted IP addresses and monitoring for indicators of compromise such as suspicious `pc-app.exe` activity or unusual entries in `server.log`, including "No suitable driver found for jdbc:no:x" or "DatabaseUtils – Database error looking up cardID". This follows previous attacks in 2023 leveraging CVE-2023-27350 and CVE-2023-27351. Emergency patches are now available for versions 25 and 25. → helpnetsecurity.com |
| 2026-08-27 NEW 2026 | Next.js Patches Critical AVIF and Windows Flaws Enabling Unauthenticated RCE news 3 min read | Library patches address critical vulnerabilities in Next.js, including CVE-2026-75604, a Windows path traversal flaw allowing unauthenticated RCE, and a heap buffer overflow in libheif (GHSA-2xp9-vwfh-vxw4) triggered by crafted AVIF images, which can also lead to RCE. Affected versions of Next.js are 13.4 through 15.5.23 and 16.0 through 16.3.2. The fixes are available in Next.js 15.5.24 and 16.3.3. → thehackernews.com |
| 2026-08-27 NEW 2026 | CISA orders feds to patch Citrix NetScaler RCE flaw by Saturday news 2 min read | Order mandating federal agencies patch Citrix NetScaler RCE flaw, CVE-2026-8452, by August 29. The memory overflow vulnerability, impacting NetScaler ADC and Gateway appliances with Gateway VPN or AAA virtual servers, is actively exploited by attackers for remote code execution as root. This directive follows watchTowr's August disclosure of exploitation capabilities beyond denial-of-service, contrasting with earlier Citrix statements. CISA's inclusion on its Known Exploited Vulnerabilities Catalog highlights the urgency of patching against current threat actor activities. → bleepingcomputer.com |
| 2026-08-27 NEW 2026 | Update Chrome before you browse again news 2 min read | Reference detailing Chrome's update to version 152.0.7977.64/.65, addressing 327 security fixes including critical vulnerabilities like CVE-2026-79282 in ANGLE allowing code execution outside the sandbox, and CVE-2026-78899, a use-after-free in the V8 engine with a CVSS of 8.8, which enables arbitrary code execution inside the sandbox via crafted HTML. |
| 2026-08-27 NEW 2026 | CISA Adds Six Exploited Flaws to KEV Including NetScaler Linux and SQL Server Bugs news 2 min read | Catalog of CISA KEV additions: CVE-2019-1068 (Microsoft SQL Server RCE), CVE-2026-8452 (Citrix NetScaler DoS), CVE-2022-0995 (Linux Kernel OOB write), CVE-2015-5287 (Red Hat ABRT privilege escalation), CVE-2015-3246 (Red Hat libuser race condition), and CVE-2021-23758 (AjaxPro deserialization RCE). Active exploitation of CVE-2026-8452 is noted, with attackers dropping web shells. Cisco Talos reported a Chinese cybercrime group targeting Windows and Linux servers with several of these flaws. Injection weaknesses and memory safety issues dominate KEV entries, emphasizing the need for secure coding practices. → thehackernews.com |
| 2026-08-27 NEW 2026 | Chaining three public V8 bugs to escape the V8 sandbox and recover a real Google v8CTF flag advanced 17 min read | Library for chaining three public V8 bugs (CVE-2026-15903, CVE-2026-15776, and a third unnamed bug) to achieve a V8 sandbox escape and retrieve a real Google v8CTF flag. The exploit leverages an address oracle from the first bug, write capabilities from the second bug by exploiting a Garbage Collection mistake and creating a fake JavaScript array, and pivots native stack execution outside the V8 cage with the third bug. This enabled the recovery of a flag located at `/flag/flag` within the v8CTF environment, targeting Chrome 150.0.7871.46 with V8 15.0.245.13. |
| 2026-08-27 NEW 2026 | A GUID is Not a Credential: Unauthenticated RCE in Veeam Service Provider Console advanced 16 min read AuthZ | Tool for identifying unauthenticated RCE in Veeam Service Provider Console. This tool helps detect vulnerabilities like CVE-2026-58073, which allows impersonation of managed agents, and CVE-2026-58072, enabling arbitrary file writes. These flaws, when chained, permit unauthenticated remote code execution on the console responsible for managing tenant backups. The tool aids defenders in sweeping their environments for exploitation indicators. → bishopfox.com |
| 2026-08-27 NEW 2026 | Zimbra Multiple Vulnerabilities news | Writeup detailing multiple high-risk vulnerabilities in Zimbra servers, affecting versions prior to 10.1.20. Exploitable issues include cross-site scripting, sensitive information disclosure, security restriction bypass, and remote code execution. Mitigation requires applying the vendor-issued fix to version 10.1.20. → hkcert.org |
| 2026-08-26 NEW 2026 | Critical Avada WordPress theme flaw enables zero-click RCE news 2 min read | Writeup of CVE-2026-18431, a critical vulnerability chain affecting the Avada WordPress theme and Fusion Builder plugin, enabling unauthenticated, zero-click arbitrary PHP code execution. The exploit chains six security issues, including authorization, input-validation, trust-boundary, and file-handling weaknesses, requiring a specific execution order. This flaw, impacting Avada versions up to 7.16 and Fusion Builder up to 3.16, could lead to full website compromise. Researchers at Wordfence discovered the vulnerability using their Argus framework. → bleepingcomputer.com |
| 2026-08-26 NEW 2026 | WARNING: Critical Microsoft SharePoint Exploit Chain Discovered news | A critical exploit chain targeting Microsoft SharePoint has been discovered. The vulnerability allows for remote code execution, posing a significant security risk. Further details are available at the provided link, which indicates a severe threat to SharePoint environments. No specific bounty payout amount is mentioned in the provided content. |
| 2026-08-26 NEW 2026 | Hackers target Microsoft SharePoint RCE chain with PoC exploit news 2 min read | Library for detecting and defending against a chained attack on Microsoft SharePoint, combining CVE-2026-55040 (JWT authentication bypass) with CVE-2026-63520 (Business Connectivity Services RCE). This chain allows unauthenticated attackers to achieve arbitrary code execution on vulnerable servers, with publicly available proof-of-concept exploits weaponized by threat actors shortly after release. CISA has issued directives for federal agencies to secure their SharePoint instances against these and other actively exploited SharePoint vulnerabilities. → bleepingcomputer.com |
| 2026-08-26 NEW 2026 | Critical Unpatched Vulnerabilities in Kaltura mwEmbed Expose Organizations to Remote Code Execution and File Read Attacks (CVE-2026-19912 CVE-2026-19913) news 4 min read | Writeup detailing CVE-2026-19912 and CVE-2026-19913, two critical, unpatched vulnerabilities in Kaltura's mwEmbed (html5lib) player. These flaws allow unauthenticated attackers to perform arbitrary file reads via the `ServiceUrl` parameter and achieve remote code execution through directory traversal in the `uiconf_id` parameter. Exploitation leads to sensitive data exposure, including configuration files and credentials, and the deployment of web shells. Over 600 internet-facing instances are exposed, with no official patch available. → rescana.com |
| 2026-08-26 NEW 2026 | Unpatched Kaltura mwEmbed Flaws Could Let Remote Attackers Read Files and Run Code news 4 min read | Writeup of CVE-2026-19913 and CVE-2026-19912, two unpatched vulnerabilities in Kaltura's mwEmbed HTML5 video player library. These flaws, stemming from unsafe deserialization in mwEmbedLoader.php, allow unauthenticated remote attackers to read arbitrary server files and execute code. The issues affect various v2.x releases and could impact all tenants on shared Kaltura hosting. Mitigation advice includes restricting the endpoint, allow-listing ServiceUrl, rejecting malicious uiconf_id values, and denying PHP execution in cache directories. → thehackernews.com |
| 2026-08-26 NEW 2026 | Hackers now exploit critical Gitea flaw in code injection attacks news 2 min read | Vulnerability writeup detailing CVE-2026-60004, a critical code injection flaw in Gitea. This vulnerability, exploitable via the diffpatch API endpoint, allows authenticated users with repository write access, or even unauthenticated attackers on default-configured instances, to execute arbitrary shell commands. Gitea has released version 1.27.1 to patch this issue, and CISA has added it to its Known Exploited Vulnerabilities (KEV) catalog, mandating remediation for federal agencies. → bleepingcomputer.com |
| 2026-08-26 NEW 2026 | Critical Gitea RCE Actively Exploited as Reported Attack Drops Miner-Like Payload news 3 min read | Vulnerability describing CVE-2026-60004, a critical remote code execution flaw in Gitea, allows authenticated users with repository write access to execute arbitrary shell commands. This vulnerability, exploitable even by unauthenticated visitors if open registration is enabled, has been actively exploited in the wild, with one reported incident involving the deployment of a cryptocurrency-miner-like dropper that killed competing processes. Gitea versions prior to 1.27.1 are affected, and CISA has added it to its Known Exploited Vulnerabilities catalog. → thehackernews.com |
| 2026-08-26 NEW 2026 | CISA Warns of Exploited Gitea Vulnerability news 1 min read | Writeup on CVE-2026-60004, a critical code injection vulnerability in Gitea that allows an attacker with repository write access to execute shell commands as the Gitea service account by sending a malicious patch to the diffpatch API endpoint. This vulnerability, patched in Gitea version 1.27.1, has been added to CISA's Known Exploited Vulnerabilities (KEV) catalog, and federal agencies were mandated to patch it by August 28. This exploitation follows previous warnings about another Gitea flaw, CVE-2026-20896, which has not yet been added to the KEV catalog. → securityweek.com |
| 2026-08-26 NEW 2026 | Pwning Call of Duty 1: a 20-year-old RCE, found in an evening with AI advanced Talks | An AI was used to discover a 20-year-old Remote Code Execution (RCE) vulnerability in the original Call of Duty game. The vulnerability was found rapidly in an evening, highlighting the effectiveness of AI in modern cybersecurity research. This discovery demonstrates that even decades-old software can harbor exploitable security flaws. |
| 2026-08-26 NEW 2026 | From SQL Injection to Remote Code Execution: Following an Unexpected Attack Chain intermediate SQLi | This writeup details a vulnerability discovery, responsibly disclosed and patched. The author followed an unexpected attack chain, starting from SQL injection and escalating to Remote Code Execution. The content emphasizes illustrating the techniques used, not enabling exploitation, with sensitive information redacted. No specific bounty payout amount is mentioned. → infosecwriteups.com |
| 2026-08-26 NEW 2026 | Google Chrome Multiple Vulnerabilities news 4 min read | Library of CVEs detailing multiple vulnerabilities in Google Chrome, including CVE-2026-78891 through CVE-2026-79293. Exploitation could lead to remote code execution, elevation of privilege, security restriction bypass, denial of service, information disclosure, and data manipulation. Updates are available from Google for Linux, macOS, and Windows versions. → hkcert.org |
| 2026-08-26 NEW 2026 | Hackers breached over 270 Zimbra servers in ongoing attacks news 2 min read | Writeup on CVE-2026-73570, a high-severity command injection vulnerability affecting Zimbra Collaboration Suite (ZCS). This flaw allows unauthenticated remote code execution by exploiting the SNMP monitoring component when notifications are enabled. Over 270 Zimbra servers have already been compromised in ongoing attacks, with CERT Polska and CISA issuing warnings and mandates for patching. This vulnerability has been frequently exploited by various threat actors, including APT28 and APT29, to steal sensitive data. → bleepingcomputer.com |
| 2026-08-25 NEW 2026 | Severe vulnerability in Metal Gear Online 3: join the wrong lobby take a critical hit news | A severe vulnerability has been discovered in Metal Gear Online 3. By joining a specifically crafted, incorrect lobby, players can suffer a "critical hit," indicating a significant system compromise or disruption. The exact nature and impact of this vulnerability are not detailed, but it poses a serious risk to users of the game. → cybernews.com |
| 2026-08-25 NEW 2026 | Google Chrome Multiple Vulnerabilities news | Bulletin detailing multiple vulnerabilities in Google Chrome. Exploits can lead to remote code execution, elevation of privilege, and security restriction bypass. Affected versions include those prior to 151.0.7922.173 on Android, Linux, Mac, and Windows, and prior to 151.0.7922.174 on Mac and Windows. Users should update to the latest vendor-released versions. → hkcert.org |
| 2026-08-25 NEW 2026 | Microsoft Discloses CVSS 10.0 Vulnerability in Entra IDWhy It Went Public Despite No User Action Required news 2 min read | Analysis of CVE-2026-69836, a critical remote code execution vulnerability in Microsoft Entra ID, highlights Microsoft's policy of public disclosure for transparency even when service-side mitigations negate user action. This vulnerability, stemming from insecure deserialization, allowed unauthenticated attackers network code execution, though exploitation was not observed. Separately, a Windows 11 August update introduced a `System.IO.FileFormatException` in WPF applications using specific fonts like Calibri and Cambria when printing or generating PDFs/XPS, with a workaround that compromises a security feature. |
| 2026-08-25 NEW 2026 | QiAnXin Discloses Critical Remote-Code-Execution Flaw in DeepSeek Harness news | QiAnXin has disclosed a critical remote-code-execution (RCE) vulnerability in DeepSeek Harness. This flaw allows attackers to potentially execute arbitrary code on affected systems. Further details on the specific nature of the vulnerability and its impact are available via the provided link. No payout amount was mentioned in the content. |
| 2026-08-25 NEW 2026 | Technical Analysis of Microsoft SharePoint Remote Code Execution vulnerability CVE-2026-63520 news 9 min read | Analysis of CVE-2026-63520 reveals a remote code execution vulnerability in Microsoft SharePoint's Business Data Connectivity subsystem. This flaw stems from unrestricted .NET type instantiation within the DbTypeReflector class, allowing an authenticated attacker to upload a malicious .bdcm model file. By triggering entity execution, an attacker can instantiate arbitrary .NET types, manipulate properties, and achieve OS command execution, potentially leveraging gadget chains like System.Windows.Data.ObjectDataProvider to execute commands, similar to techniques used in CVE-2019-1257. When combined with CVE-2026-55040, an authentication bypass, this vulnerability can lead to unauthenticated RCE. → rapid7.com |
| 2026-08-24 NEW 2026 | CISA orders urgent patching of actively exploited Zimbra flaw news 2 min read | Writeup of CVE-2026-73570, an actively exploited command injection vulnerability in Zimbra Collaboration Suite (ZCS). This flaw allows unauthenticated attackers to achieve remote code execution by exploiting improper input sanitization in the SNMP monitoring component when notifications are enabled. CISA has ordered urgent patching for U.S. government agencies, and CERT Polska has observed in-the-wild exploitation. The vulnerability affects ZCS version 10.1.20 and earlier, with successful exploitation potentially leading to the execution of arbitrary operating system commands. → bleepingcomputer.com |
| 2026-08-24 NEW 2026 | Microsoft warns of max severity Entra ID flaw exploited in attacks news 2 min read | Advisory regarding maximum-severity vulnerabilities in Microsoft Entra ID, Azure Arc, and Exchange Online, including CVE-2026-69836 (untrusted data deserialization for RCE), CVE-2026-65816 and CVE-2026-69555 (privilege escalation on Azure Arc), and CVE-2026-65801 (privilege escalation on Exchange Online). Also notes CVE-2026-65770 for RCE on Azure Managed Instance for Apache Cassandra, and a prior Entra ID privilege escalation flaw CVE-2025-55241. → bleepingcomputer.com |
| 2026-08-23 2026 | Prompt Injection Is Now an RCE Primitive advanced | Prompt injection, a security vulnerability, has evolved into a Remote Code Execution (RCE) primitive. This means attackers can now exploit prompt injection flaws to execute arbitrary code on a victim's system. The provided link offers further details on this emerging threat, highlighting its potential for serious security breaches. → hackernoon.com |
| 2026-08-23 2026 | Microsoft Entra ID vulnerability scores a perfect 10.0 severity rating news | A critical vulnerability in Microsoft Entra ID has received a perfect 10.0 CVSS score, indicating maximum severity. This flaw could allow attackers to gain elevated privileges within Entra ID. While the article highlights the severity, it does not mention any specific bug bounty payout amounts. The vulnerability underscores the importance of robust security measures for identity and access management systems like Entra ID. |
| 2026-08-23 2026 | Microsoft Confirms Maximum-Severity Entra ID Vulnerability Exploited In Attacks news | Microsoft has confirmed a critical vulnerability in Entra ID (formerly Azure Active Directory) that has been actively exploited in attacks. The flaw, identified as CVE-2024-29988, allows authenticated attackers to bypass multi-factor authentication (MFA) and gain unauthorized access to user accounts. While the full scope of the exploitation and the potential impact are still being assessed, Microsoft has released guidance for mitigation and is urging customers to implement the suggested measures to protect their environments. No specific bounty payout amount is mentioned in this content. |
| 2026-08-23 2026 | Microsoft Entra ID Vulnerability Fix Secures Enterprise Logins news 4 min read | Vulnerability analysis of CVE-2026-69836, a critical remote code execution flaw in Microsoft Entra ID, detailing its severity (CVSS 10.0), root cause (deserialization of untrusted data), and exploitability (network-based, no privileges or user interaction required). Microsoft has patched this issue, confirming it was not exploited in the wild, and highlighting the increasing role of AI in vulnerability discovery. |
| 2026-08-23 2026 | Microsoft Patches Critical Entra ID Flaw Rated a Perfect 10 on Severity Scale news 3 min read | Writeup on CVE-2026-69836, a critical Entra ID vulnerability rated 10.0 CVSS, allowing unauthenticated remote code execution via deserialization of untrusted data (CWE-502). This flaw, impacting Microsoft's identity platform, shares similarities with past Entra ID deserialization issues like CVE-2026-50652 and CVE-2026-57969. Microsoft has patched the issue server-side without requiring customer action, though transparency concerns regarding independent verification of fixes remain. |
| 2026-08-22 2026 | No Crash Required: Verifying the Citrix NetScaler SAML Patch for CVE-2026-8452 intermediate 14 min read AuthN | Tool for verifying the Citrix NetScaler SAML patch for CVE-2026-8452, a heap overflow vulnerability that can lead to remote code execution. This tool allows external verification of the patch status without causing disruption or crashes, by analyzing SAML requests and responses. It aids in identifying exploitation indicators and confirming patch implementation on Gateway and AAA virtual servers, also accounting for sibling vulnerabilities CVE-2026-8451 and CVE-2026-19490. → bishopfox.com |
| 2026-08-22 2026 | Microsoft Patches Entra ID RCE Vulnerability Exploited in Attacks news 3 min read | Library of security advisories detailing CVE-2026-69836, a maximum-severity vulnerability in Microsoft Entra ID. This deserialization flaw allowed unauthenticated remote code execution and was exploited in attacks before Microsoft mitigated the issue. While customers need no immediate action, security teams should review Entra ID environments for signs of compromise, focusing on privileged activity, application changes, and suspicious sessions, and implement Zero Trust principles to mitigate identity-based risks. → esecurityplanet.com |
| 2026-08-21 2026 | Microsoft Rolls Out 22 Fresh Security Patches news 2 min read | Updates from Microsoft address 22 security vulnerabilities, including a critical Entra ID zero-day (CVE-2026-69836) exploited for remote code execution. Other critical flaws patched include elevation-of-privilege bugs in Azure SQL Database (CVE-2026-69502, CVE-2026-68782, CVE-2026-68789, CVE-2026-66309), Azure Arc (CVE-2026-69555, CVE-2026-65816), and Exchange Online (CVE-2026-65801), along with RCE in Azure Managed Instance for Apache Cassandra (CVE-2026-65770). Additionally, Microsoft patched ShieldBreak (CVE-2026-69414), a Defender elevation-of-privilege vulnerability. → securityweek.com |
| 2026-08-21 2026 | Microsoft confirms maximum severity flaw in Entra ID targeted for exploitation news | Microsoft has confirmed a maximum severity vulnerability in Entra ID (formerly Azure AD) is actively being exploited. The flaw, classified as critical, poses a significant risk to organizations using the identity and access management service. While the exact impact and scope are still under investigation, the active exploitation suggests immediate attention is required for any entities relying on Entra ID. Further details on the vulnerability and mitigation steps are expected from Microsoft. → cybersecuritydive.com |
| 2026-08-21 2026 | Critical Isolated-vm Vulnerability Leads to RCE on Host news 2 min read | Library advisory detailing a critical type confusion vulnerability in `isolated-vm`'s `ExternalCopy` function. This bug, a TOCTOU weakness in data transfer between JavaScript Isolates, allows attackers to hijack control flow and achieve RCE on the host system. Patches are available in `isolated-vm` versions 6.2.0 and 7.0.1. → securityweek.com |
| 2026-08-21 2026 | U.S. CISA adds TrueConf Server flaws to its Known Exploited Vulnerabilities catalog news 2 min read | Catalog entry listing CVE-2026-72529 and CVE-2026-72530, two critical vulnerabilities affecting TrueConf Server. CVE-2026-72529 is a remote code execution flaw exploitable via TCP port 4307, allowing unauthenticated attackers to execute arbitrary scripts. CVE-2026-72530 is a sandbox escape vulnerability on the same port, enabling attackers to break out of isolation and execute arbitrary code on the host system. These flaws, discovered by Vyacheslav Kopeytsev, have been added to CISA's Known Exploited Vulnerabilities catalog, mandating action for federal agencies. → securityaffairs.com |
| 2026-08-21 2026 | Critical Microsoft Entra ID vulnerability exploited in the wild (CVE-2026-69836) news | Writeup of CVE-2026-69836, a critical remote code execution flaw in Microsoft Entra ID exploited in the wild. Discovered by Microsoft Principal Security Engineer Robert Fitzpatrick, this deserialization vulnerability carried a CVSS score of 10.0 and allowed unauthenticated attackers to execute code over a network. Microsoft has fully mitigated the vulnerability, requiring no customer action. The exploit's origin, timeline, impact, and attacker actions remain undisclosed. → helpnetsecurity.com |
| 2026-08-21 2026 | Microsoft Entra ID Flaw (CVSS 10.0) Exploited in Wild Allows Remote Code Execution news 2 min read | Vulnerability CVE-2026-69836 is a critical (CVSS 10.0) remote code execution flaw in Microsoft Entra ID, arising from deserialization of untrusted data. While initially reported as exploited in the wild, Microsoft later corrected this, stating it was not exploited. The issue, discovered by Robert Fitzpatrick, allowed unauthorized attackers to execute code over a network. Microsoft has since fully mitigated the vulnerability, requiring no customer action. → thehackernews.com |
| 2026-08-21 2026 | CISA Gives Agencies Three Days to Patch a Critical Flaw in Ray news 4 min read | Library for patching CVE-2025-62593, a critical remote code execution flaw in the Ray distributed computing framework. Versions prior to 2.52.0 are exploitable via DNS rebinding combined with a weak User-Agent header check, allowing attackers to execute arbitrary commands with Ray process privileges. This vulnerability was added to CISA's Known Exploited Vulnerabilities catalog, mandating a three-day patching deadline for federal agencies under Binding Operational Directive 26-04. |
| 2026-08-20 2026 | UAT-10147: Chinese-speaking adversary integrates agentic AI into post-compromise operations news 15 min read | Toolchain detailing how the Chinese-speaking UAT-10147 adversary integrates agentic AI into post-compromise operations. The group leverages publicly disclosed vulnerabilities for initial access and employs AI-driven tooling for reconnaissance, exploit automation, payload generation, validation, and persistence. Observed offensive frameworks include Metasploit, ysoserial, PentestGPT, and DeepAudit, with specific Linux privilege escalation exploits like CVE-2022-0995 and CVE-2021-3156 also noted. This approach allows for efficient scaling of complex attacks and reduces the expertise required for advanced post-compromise activities. → blog.talosintelligence.com |
| 2026-08-20 2026 | Critical flaw patched in popular JavaScript sandbox used in AI projects news 1 min read | Library for running JavaScript code safely within an isolated process. This popular resource, used in AI agent automation frameworks like n8n and Activepieces, recently patched a critical sandbox escape vulnerability. The flaw, a type confusion in the C++ glue code binding to V8's Isolate feature, could have allowed attackers to hijack host control flow and achieve remote code execution. Developers promptly addressed the issue in versions 7.0.1 and 6.2.0. → csoonline.com |
| 2026-08-20 2026 | Critical Flaw in isolated-vm Can Lead to Sandbox Escape RCE Threat news 5 min read | Library flaw in isolated-vm allows sandbox escape RCE. A time-of-check to time-of-use vulnerability in the ExternalCopy mechanism, tracked as GHSA-864f-rcv7-6rh4, enables malicious code within a Node.js sandbox to corrupt host process memory. This critical bug, affecting a library used by over a million projects weekly, can lead to host process hijacking and remote code execution. Developers should upgrade to isolated-vm versions 7.0.1 or 6.2.0. → devops.com |
| 2026-08-20 2026 | ThreatsDay: Gogs 10.0 RCE n8n Workflow-to-RCE $10M Reward GLM-5.3 AI Exploit and More news 11 min read | Library for identifying threats, including signed driver abuse via Microsoft Defender's BTR.sys, Iran-based Mabna Institute's $10 million reward for data theft, Grandoreiro malware's DLL sideloading campaign using Duplicate Files Finder, ClickFix campaigns leveraging DCRCVDrv.sys for BYOVD attacks, and guardrail-free AI services like Kriminal AI. → thehackernews.com |
| 2026-08-20 2026 | Critical Elementor Pro bug exposes WordPress sites to RCE attacks news 3 min read | Writeup of CVE-2026-32475, a critical RCE vulnerability in Elementor Pro versions prior to 4.2.2. The flaw arises from the File Upload module's differing handling of empty filename uploads between validation and processing loops, allowing attackers to craft multipart uploads containing malicious PHP payloads. Exploitation requires a published Elementor form with a File Upload field and the multiple file upload option enabled. Attackers can determine the uploaded payload's filename via timing brute-force or autoresponder emails and trigger its execution by requesting its URL, granting arbitrary code execution. Patchstack, who identified the vulnerability, recommends updating Elementor Pro and thoroughly checking the `wp-content/uploads/elementor/forms/` directory for rogue files. → bleepingcomputer.com |
| 2026-08-20 2026 | Isolated-vm Flaw Lets Sandboxed JavaScript Escape to Host for Potential RCE news 2 min read | Library flaw in isolated-vm, specifically a type confusion in ExternalCopy's handling of the transferList option, enables guest-to-host sandbox escapes. This vulnerability (GHSA-864f-rcv7-6rh4) affects versions prior to 7.0.0 and can lead to memory corruption, denial-of-service via segmentation faults, and potential remote code execution in the host process. The issue stems from flaws in the C++ binding layer, not V8's core isolation. → thehackernews.com |
| 2026-08-20 2026 | Attackers Exploit Zimbra SNMP Flaw for Unauthenticated Remote Code Execution news 1 min read | Writeup on CVE-2026-73570, an unauthenticated command injection flaw in Zimbra Collaboration (ZCS) affecting the zimbra-snmp package. Exploited in the wild, the vulnerability allows remote code execution as the Zimbra user via crafted SMTP requests. CERT Polska advises checking logs for suspicious service restarts and file creations in `/opt/zimbra/jetty/webapps/`, `/opt/zimbra/jetty_base/webapps/`, and `/tmp/`. This follows previous Zimbra targeting, including APT29's use of CVE-2025-66376 for XSS to deploy the ZimReaper payload. → thehackernews.com |
| 2026-08-20 2026 | Critical Zimbra RCE flaw now actively exploited in attacks news 2 min read | Writeup on CVE-2026-73570, a critical command injection vulnerability in Zimbra Collaboration Suite that allows unauthenticated attackers to execute arbitrary operating system commands. This flaw, patched in version 10.1.20, has been actively exploited in the wild. CERT Polska has observed malicious activity, including suspicious file creation and service restarts, and advises administrators to check logs for indicators of compromise. Past Zimbra vulnerabilities have been exploited by threat actors like Vivern, APT29, and APT28. → bleepingcomputer.com |
| 2026-08-20 2026 | Elementor Pro Flaw Could Let Unauthenticated Attackers Upload PHP and Execute Code news 3 min read | Writeup detailing CVE-2026-32475, a critical vulnerability in Elementor Pro versions prior to 4.2.2, enabling unauthenticated remote code execution. This unrestricted file upload flaw within the Forms module's File Upload field allows attackers to bypass extension checks by submitting dual file parts, resulting in a PHP file being written to a public directory. Exploitation requires a published Elementor page with a Form widget and a File Upload field, a common configuration across many WordPress sites. → thehackernews.com |
| 2026-08-20 2026 | I escaped the WebAssembly's sandbox and got arbitrary shell execution on the host. advanced 7 min read | Library enabling WebAssembly modules to be compiled into C via wasm2c. This library's table allocator contains an unchecked `calloc` that, when it returns `NULL` due to allocation failure (e.g., due to address space limits), allows a guest module to write to arbitrary host memory. This vulnerability, dating back to commit `ab9e0b55`, can be exploited to leak libc addresses, forge table entries, and ultimately achieve arbitrary shell execution via `system()`, demonstrated by a proof-of-concept on Linux. |
| 2026-08-20 2026 | Yet another RCE in Gogs, but it's fixed this time! news 15 min read | Library for identifying Remote Code Execution vulnerabilities, including CVE-2026-52813 and CVE-2026-52810, within the Gogs Git hosting platform. It details a path traversal flaw in organization name handling, allowing the creation of bare repositories in arbitrary locations, and explains how this can be leveraged with Git hooks for RCE. The library also addresses an XSS vulnerability in Gogs' Jupyter rendering library (GHSA-6vxv-wg6j-5qwp). → aikido.dev |
| 2026-08-19 2026 | Moroccos DGSSI Warns of Critical Apple Vulnerabilities news 1 min read | Advisory from Morocco's DGSSI warns of critical vulnerabilities in iOS, iPadOS, and macOS. Attackers could exploit these flaws to execute remote code, access confidential data, or elevate privileges. CVE-2026-3783 is noted as actively exploited. Vulnerabilities primarily affected WebKit, with others in ImageIO, audio processing, the kernel, and telephony on iOS, impacting versions prior to iOS/iPadOS 26.6.1 and 18.7.10, and macOS Tahoe 26.6.2. |
| 2026-08-19 2026 | CISA Urges Immediate Patching of Exploited Microsoft VMware Apple Vulnerabilities news 1 min read | Reference of CISA's urging for immediate patching of four actively exploited vulnerabilities affecting Microsoft, VMware, and Apple products. This includes CVE-2026-33824 (Windows IKE double free), CVE-2026-55040 (SharePoint weak authentication), CVE-2026-59310 (VMware vCenter code execution), and CVE-2026-65400 (macOS Screen Sharing authentication bypass). Exploitation of these flaws has been observed in autonomous hacking campaigns, manual targeting, and for deploying malware like Monero miners. → securityweek.com |
| 2026-08-19 2026 | Yet another RCE in Gogs but it's fixed this time! news 15 min read | Library for discovering and patching application vulnerabilities, detailing RCE via path traversal in Gogs (CVE-2026-52813). The library highlights a path traversal vulnerability in Gogs' organization creation endpoint, allowing attackers to write bare Git repositories to arbitrary filesystem locations. This technical deep dive, including manual code patching for an unpatched bypass, also addresses a logic bug (CVE-2026-52810) and an XSS vulnerability in a Jupyter rendering library (GHSA-6vxv-wg6j-5qwp). → aikido.dev |
| 2026-08-19 2026 | Critical RCE flaw in Windows IKE Extension now actively exploited news 2 min read | Vulnerability CVE-2026-33824, a critical remote code execution flaw in Windows IKE Extension, is actively exploited by attackers. This "double free" issue allows unauthenticated adversaries to achieve code execution by sending crafted packets via UDP ports 500 or 4500 to unpatched Windows systems. CISA has added this vulnerability to its actively exploited catalog and mandated urgent patching for federal agencies, recommending traffic blocking or firewall rule configuration for those unable to update immediately. → bleepingcomputer.com |
| 2026-08-19 2026 | Hacking your life with AI can get you hacked: How AI orchestration platforms ship RCE by design intermediate 7 min read AI | Writeup on critical vulnerabilities in AI orchestration platforms like NocoBase, Flowise, Langflow, Dify, Activepieces, Kestra, and Apache Airflow. These platforms, widely used for building AI agents and automating workflows, suffer from a fundamental security flaw: assuming any user interacting with a workflow can be trusted to run code on the host. The research uncovered numerous vulnerabilities including shell injection, prompt injection leading to RCE, and sandbox bypasses, with some exploitable by unauthenticated users. Vendors often viewed these findings as "working as designed," as code execution is central to their functionality, but the lack of robust defenses means inherent permissive threat models are passed to users, exposing sensitive data. → endorlabs.com |
| 2026-08-19 2026 | Oracle Products Multiple Vulnerabilities news | Analysis of multiple vulnerabilities affecting Oracle Products including Oracle Database, Oracle E-Business Suite, Oracle Java SE, Oracle MySQL, Oracle Virtualization, and Oracle WebLogic Server. These flaws can lead to remote code execution, elevation of privilege, denial of service, spoofing, security restriction bypass, data manipulation, sensitive information disclosure, and cross-site scripting. Users should consult Oracle's official website for available fixes and mitigation strategies. → hkcert.org |
| 2026-08-19 2026 | Mozilla Products Multiple Vulnerabilities news 1 min read | Writeup of multiple vulnerabilities in Mozilla Products including Firefox and Thunderbird. Exploitation could lead to remote code execution, security restriction bypass, information disclosure, denial of service, elevation of privilege, and spoofing. Affected versions include Firefox prior to 154, Firefox ESR prior to 153.1 and 140.14, and Thunderbird prior to 140.14, 153.1, and 154. Specific CVEs include CVE-2026-74934 through CVE-2026-75874. → hkcert.org |
| 2026-08-18 2026 | Palo Alto Products Multiple Vulnerabilities news 1 min read | Writeup detailing multiple vulnerabilities in Palo Alto Products, including Cloud NGFW, GlobalProtect App (versions 6.0, 6.2, 6.3), PAN-OS (versions 10.2, 11.1), and Prisma Access (version 10.2). Exploitation can lead to elevation of privilege, security restriction bypass, information disclosure, remote code execution, and data manipulation. Specific CVEs mentioned are CVE-2026-0301, CVE-2026-0297, CVE-2026-0296, CVE-2026-0299, CVE-2026-0298, and CVE-2026-0295. → hkcert.org |
| 2026-08-18 2026 | 300000 WordPress Sites Potentially Exposed to Hacking Due to Form Plugin Flaw news 1 min read | Writeup of CVE-2026-15748 in Forminator Forms, a critical arbitrary file upload vulnerability impacting over 300,000 WordPress sites. This flaw, with a CVSS score of 9.8, allows unauthenticated attackers to achieve remote code execution by bypassing file type validation in the `handle_file_upload` function and leveraging custom file upload storage configurations. The vulnerability affects versions up to 1.56.1 and was patched in 1.56.2. → securityweek.com |
| 2026-08-18 2026 | CISA gives feds 3 days to fix actively exploited Ray RCE bug news | CISA has issued a directive demanding federal agencies patch a critical Remote Code Execution (RCE) vulnerability in Ray within three days. The bug is currently being exploited in the wild, posing a significant security risk. Agencies must identify affected systems and apply necessary updates to mitigate the threat. This urgent action highlights the severity of the vulnerability and CISA's commitment to protecting federal networks from active exploitation. → theregister.com |
| 2026-08-18 2026 | U.S. CISA adds a Ray-Project Ray flaw to its Known Exploited Vulnerabilities catalog news 1 min read | Writeup of CVE-2025-62593, a critical remote code execution vulnerability in Progress LoadMaster's Ray AI compute engine. CISA added this flaw to its Known Exploited Vulnerabilities catalog due to its exploitable nature via DNS rebinding attacks, allowing attackers to execute arbitrary code on developer machines. The vulnerability, present in versions before 2.52.0, stems from insufficient protection against browser-based attacks relying on the User-Agent header. Ray 2.52.0 addresses this issue. → securityaffairs.com |
| 2026-08-18 2026 | CISA Flags Actively Exploited Ray Flaw That Can Trigger Browser-Based RCE news 2 min read | Writeup on CVE-2025-62593, an actively exploited Ray vulnerability, detailing how DNS rebinding attacks on browsers like Firefox and Safari can lead to remote code execution, particularly impacting developers. This flaw, stemming from a lack of authentication on critical endpoints, allows attackers to execute arbitrary shell code by tricking users into visiting malicious websites or viewing ads. Unpatched Ray instances are also targeted by the RondoDox botnet and for cryptocurrency mining in the ShadowRay 2.0 campaign. The vulnerability has been addressed in Ray version 2.52.0. → thehackernews.com |
| 2026-08-18 2026 | Unauthenticated RCE in CircleCI's MCP server: Host/Origin allowlist bypassed by any non-browser client (GHSA-xv5j-cwgj-22r4) news 4 min read AuthZ | Writeup on GHSA-xv5j-cwgj-22r4 detailing an unauthenticated RCE vulnerability in CircleCI's MCP server. Attackers can bypass Host/Origin header validation by sending a simple HTTP request with "Host: localhost" and no Origin header, gaining full control over CI/CD pipelines, build secrets, and cloud identities. The writeup highlights the inherent security risks in the MCP ecosystem and praises CircleCI's swift and professional handling of the disclosure. |
| 2026-08-17 2026 | Video Call Exploit Chains Two Flaws in Unisoc Modems news | A security vulnerability has been discovered in Unisoc modems that can be exploited during video calls. This exploit chains together two separate flaws, allowing an attacker to potentially gain unauthorized access or control. The specific details of how the exploit works are not provided, but it highlights a security risk within the modem's video calling functionality. Further information and the full technical analysis are available at the provided link. → darkreading.com |
| 2026-08-17 2026 | Forminator WordPress Flaw Can Enable Unauthenticated RCE via Malicious PHP Uploads news 3 min read | Library for securing WordPress sites against critical vulnerabilities including CVE-2026-15748 in Forminator Forms, which allows unauthenticated arbitrary PHP file uploads via crafted forms with File Upload and Select fields, and CVE-2026-15826 in User Profile Builder, enabling unauthenticated administrator takeover through a flawed login function and username validation bypass. → thehackernews.com |
| 2026-08-17 2026 | UNISOC Modem Flaw Enables Remote Code Execution via Video Calls news 2 min read | Analysis of UNISOC modem vulnerability, CWE-1189 (Improper Isolation of Shared Resources), demonstrates how a flaw in modem firmware can lead to kernel-level remote code execution. This research, by SSD Secure Disclosure, details an exploit chain where modem code execution bypasses memory protection units and accesses Android kernel memory. The vulnerability was exploited by placing a video call over VoLTE on affected devices like the Xiaomi Redmi A5 and Motorola E13, enabling modification of kernel code. → infosecurity-magazine.com |
| 2026-08-17 2026 | Unisoc VoLTE Video Call Exploit Chain Can Give Attackers Full Android Kernel Access news 3 min read | Writeup of a two-stage exploit chain for Unisoc modem firmware, enabling full Android kernel access via a VoLTE video call. This chain, building on a previous March 2026 RCE vulnerability, requires attacker control of a private 4G network and the victim answering the call. The privilege-escalation flaw, CWE-1189, exploits shared physical memory between the modem and application processors to modify kernel memory, confirmed on devices like Motorola E13 and Xiaomi Redmi A5. No fix has been released by Unisoc, and it is distinct from CVE-2025-31718. → thehackernews.com |
| 2026-08-17 2026 | Evooo1Bot Linux Botnet Exploits Known Flaws to Turn Edge Devices Into SOCKS5 Proxies news 2 min read | Library for detecting and understanding the Evooo1Bot Linux botnet, which leverages the Mirai source code to turn edge devices into SOCKS proxies. Evooo1Bot features encrypted C2 communications, an SSH brute-force scanner, and an exploit arsenal targeting numerous known vulnerabilities, including CVE-2007-3010, CVE-2016-6277, CVE-2018-14558, CVE-2019-14931, CVE-2020-10987, CVE-2021-46422, CVE-2022-37055, CVE-2024-29269, CVE-2025-10123, CVE-2025-55583, CVE-2021-36260, CVE-2022-26134, CVE-2022-29464, CVE-2022-30525, CVE-2023-1389, CVE-2024-4577, CVE-2024-10914, CVE-2025-1974. → thehackernews.com |
| 2026-08-17 2026 | CVE-2026-6837: Command Injection in Zyxel export-cgi PKCS#12 Export Handling news 4 min read | Writeup of CVE-2026-6837, a command injection vulnerability in Zyxel's export-cgi script, specifically within the PKCS#12 export handling. The vulnerability arises from unsanitized input being passed to a `system()` call, allowing attackers to execute arbitrary commands. The exploit chain was developed using emulation with tools like QEMU and Bubblewrap, and demonstrated via crafted `curl` requests. Zyxel has released an advisory listing 18 affected AP models. |
| 2026-08-17 2026 | AMA with Black Hat Speakers Lidor B. & Elad Meged (Pre-Auth RCE in Enterprise Java, Hijacking AI Coding Agents) news 5 min read AI Talks | AMA with Black Hat speakers Lidor B. and Elad Meged, covering pre-auth remote code execution in enterprise Java via routing logic, unsafe deserialization, and template evaluation. The discussion also delves into hijacking AI coding agents like Claude Code, Gemini CLI, and Codex by exploiting a single GitHub issue, leading to RCE and credential theft. The speakers will share insights into the future of offensive security with AI and their experiences in vulnerability research. |
| 2026-08-17 2026 | CVE-2026-33696: From a Schema Name to RCE in n8n news 3 min read | Writeup detailing CVE-2026-33696, a prototype pollution vulnerability in n8n's GSuiteAdmin node. This flaw allows an attacker with editor access to craft a malicious payload that pollutes `Object.prototype` with properties like `GIT_SSH_COMMAND`. This pollution can then be exploited via the Git node's clone operation to achieve remote code execution as the n8n process user, or cause a denial of service by crashing TypeORM. |
| 2026-08-17 2026 | When Filenames Become Attack Surfaces: Weaponizing NASA's CFITSIO Extended Filename Syntax advanced 12 min read Fuzzing | Library for weaponizing NASA's CFITSIO Extended Filename Syntax (EFS), allowing arbitrary file copies, forced downloads, and Server-Side Request Forgery (SSRF) by leveraging EFS features like the outfile clause and protocol handlers for HTTP, FTP, and other network protocols. The library also enables HTTP header injection by exploiting unescaped filename components in the HTTP driver. A Docker playground is available for reproducing these findings. → blog.doyensec.com |
| 2026-08-16 2026 | macOS Screen Sharing Vulnerability Exploited for Crypto Mining intermediate 4 min read | Library for securing macOS Screen Sharing by addressing CVE-2026-65400, a vulnerability allowing unauthenticated remote code execution. This flaw, exploitable when port 5900 is internet-facing, grants attackers root access to install Monero crypto miners. Apple has released patches for macOS Tahoe, Sequoia, and Sonoma. Users are advised to disable Screen Sharing when not in use and ensure systems are updated. |
| 2026-08-15 2026 | I went looking for a managed-Postgres provider. Instead, I found a vulnerability in a 4-star PostgreSQL extension available everywhere! and turned it into code execution at NeonDB, Supabase, Xata and many other PostgreSQL service companies advanced 29 min read Supply Chain | Library for discovering and exploiting vulnerabilities in managed PostgreSQL instances. It details a memory corruption bug in the popular PostGIS extension's `address_standardizer` function, chaining it with a separate memory disclosure to achieve RCE on providers like NeonDB, Supabase, and Xata. The research also encompasses broader systemic risks within the managed PostgreSQL industry, including further extension vulnerabilities and core PostgreSQL RCEs. |
| 2026-08-15 2026 | You’re Back In The Room (Citrix NetScaler Pre-Auth RCE CVE-2026-8452(?)) - watchTowr Labs news 18 min read | Writeup of a heap overflow vulnerability in Citrix NetScaler, potentially CVE-2026-8452, that allows unauthenticated remote code execution. The vulnerability arises during SAML signature validation when the NetScaler appliance copies attacker-controlled data from the `ds:SignedInfo` element into a fixed-size buffer without proper size checks, leading to memory corruption within the packet-processing engine. → labs.watchtowr.com |
| 2026-08-15 2026 | Escalating a Blind Upload to RCE via Path Traversal into Cron and DNS-Restricted Callback Bypass advanced AuthZ | A researcher discovered an unauthenticated blind file upload vulnerability on a bug bounty target. The vulnerability allowed controlling both the uploaded file content and its destination directory, enabling path traversal to sensitive server locations. While this initially seemed like a path to Remote Code Execution (RCE), the typical exploitation methods were blocked. The content ends before detailing how RCE was ultimately achieved or if any bounty was awarded. → infosecwriteups.com |
| 2026-08-14 2026 | Youre Back In The Room (Citrix NetScaler Pre-Auth RCE CVE-2026-8452(?)) news 18 min read | Library for analyzing the CVE-2026-8452 vulnerability in Citrix NetScaler ADC and Gateway, a heap overflow that allows unauthenticated remote code execution. This vulnerability occurs when the appliance is configured to use SAML, and an oversized `ds:SignedInfo` element in a SAML message causes a buffer overflow during signature canonicalization. The analysis details the `nsppe` binary, SAML structure, and the canonicalization process leading to the memory corruption. → labs.watchtowr.com |
| 2026-08-14 2026 | Ruby 4.0 Universal RCE Deserialization Gadget Chain - elttam intermediate 12 min read Deser | Library releasing a new universal RCE deserialization gadget chain for Ruby 4.0.6, building on research into previous Ruby on Rails vulnerabilities. This chain targets `Marshal.load` and leverages gadgets from `Gem::SpecFetcher`, `Gem::Specification`, and `Gem::StubSpecification` to achieve command execution by controlling file content written to disk via `Gem::URI::Generic` and triggering `eval`. The exploit is designed to bypass recent patches in RubyGems, specifically those addressing `Gem::Version` and `Gem::Source::Git` exploits. → elttam.com |
| 2026-08-13 2026 | Unpatched GeoServer Zero-Day Targeted in Active Exploitation Attempts Can Lead to RCE news 1 min read | Library detailing an unpatched GeoServer zero-day SQL injection vulnerability, allowing for remote code execution (RCE). This flaw, disclosed on August 12, 2026, is actively being exploited and remains unfixed, with hundreds of probing attempts observed. Previous GeoServer vulnerabilities, including CVE-2024-36401, have also been actively exploited for malicious purposes. → thehackernews.com |
| 2026-08-13 2026 | Critical VMware vCenter RCE flaw exploited for reverse SSH access news 2 min read | Writeup on CVE-2026-59310, a critical directory traversal vulnerability in VMware vCenter Syslog Server, actively exploited for arbitrary code execution. Attackers leverage this flaw to deploy the open-source `reverse_ssh` framework for persistence and remote access, establishing outbound command-and-control channels. QUIRSO has released a YARA rule to detect `reverse_ssh` client binaries. The campaign has targeted systems across 47 countries, with significant activity observed in Germany, the U.S., Turkey, Iran, and France. → bleepingcomputer.com |
| 2026-08-13 2026 | Critical VMware vCenter Vulnerability in Attackers Crosshairs news 2 min read | Writeup detailing the exploitation of CVE-2026-59310, a critical directory traversal vulnerability in VMware vCenter's Syslog server, which enables remote code execution. Threat actors, including an APT group, are actively targeting vulnerable vCenter instances, using a reverse shell framework called `reverse_ssh` for persistent access. Quirso has developed a YARA rule to help detect `reverse_ssh` artifacts, recommending validation through checks for unauthorized installations and unexpected outbound connections. → securityweek.com |
| 2026-08-13 2026 | CVE-2026-53360: KVM SEV-SNP guest-to-host heap OOB and analysis of the upstream fix advanced 20 min read | Analysis of CVE-2026-53360 in KVM's SEV-SNP demonstrates a heap out-of-bounds read/write vulnerability. A malicious guest VM can exploit the Page State Change handler by providing a crafted buffer size and entry count, leading to host kernel heap corruption and memory layout leakage. The vulnerability, fixed in mainline commit db3f2195d293 and patched in kernel versions v7.0.12, v6.18.35, and v6.12.93, arises from insufficient bounds checking against the allocated buffer size when processing PSC entries, allowing reads and writes far beyond the intended 2032-byte GHCB Shared Buffer. |
| 2026-08-12 2026 | Zoom Zero-Click RCE: AI Helped Build an Exploit in Under 24 Hours news 5 min read | Writeup on the ZOOMSDAY exploit chain, detailing a zero-click RCE vulnerability affecting Zoom clients across Windows, macOS, iOS, and Android. The chain, involving CVE-2026-53413, CVE-2026-53414, and CVE-2026-53415, leveraged memory corruption in the annotation feature. Researchers developed a working exploit in under 24 hours with AI assistance, highlighting the collapsing barrier for offensive security research and the potential impact on collaboration platforms. → techrepublic.com |
| 2026-08-12 2026 | Zoom Flaws Facilitate Zero-Click Remote Code Execution news 3 min read | Writeup of "Zoomsday" vulnerabilities (CVE-2026-53415, CVE-2026-53413, CVE-2026-53414) in Zoom's annotation feature, enabling zero-click remote code execution. Exploits targeting memory corruption flaws allow attackers to take complete control of a victim's device during calls, steal data, or spy. While Zoom has patched these issues, users must update their clients, as server-side mitigations are ineffective with end-to-end encryption enabled. Reducing attack surface through meeting access controls and validating endpoint controls are recommended defenses. → bankinfosecurity.com |
| 2026-08-12 2026 | Adobe Patches Three CVSS 10.0 ColdFusion and Campaign Classic Flaws news 2 min read | Patches address multiple critical vulnerabilities in Adobe ColdFusion, Commerce, and Campaign Classic, including CVSS 10.0 flaws like CVE-2026-48362 (OS command injection) and CVE-2026-71398 and CVE-2026-27302 (incorrect authorization leading to arbitrary code execution). Other notable vulnerabilities include CVE-2026-48273 (eval injection) and CVE-2026-71362 (incorrect authorization in Commerce, reportedly exploited by threat actors). Adobe recommends immediate installation of updates for affected products. → thehackernews.com |
| 2026-08-12 2026 | SAP Commerce Cloud Flaw Could Let Unauthenticated Attackers Execute Arbitrary Code news 2 min read | Writeup of CVE-2026-58231, a maximum-severity flaw in SAP Commerce Cloud's Data Hub Adapter, enabling unauthenticated attackers to achieve arbitrary code execution through insufficient authorization and validation. This critical vulnerability, alongside three others (CVE-2026-44772, CVE-2026-34265, CVE-2026-44758) impacting Manufacturing Integration and Intelligence and Application Server ABAP, was patched by SAP. Onapsis recommends patching and specific configurations, such as IP filtering and secure transformer properties, to mitigate risks including server-side template injection and request forgery. → thehackernews.com |
| 2026-08-12 2026 | CopyEscape: Container-to-host arbitrary file write via docker cp (CVE-2026-17106) news 11 min read | Writeup of CVE-2026-17106, a container-to-host arbitrary file write vulnerability in Docker's `docker cp` command, allows attackers to overwrite host files or achieve code execution. The exploit chains a filesystem race in the archive pipeline, enabling a running container to produce an inconsistent tar archive, with an extraction flaw that allows the Docker CLI to follow a planted symlink outside the intended destination. This impacts CI systems, developer workstations, and AI-agent workflows utilizing Docker Sandboxes. → imperva.com |
| 2026-08-11 2026 | Microsoft Patch Tuesday for August 2026 Snort rules and prominent vulnerabilities news 10 min read | Ruleset for Microsoft's August 2026 Patch Tuesday, detailing 421 vulnerabilities including 62 critical ones. Highlights include CVE-2026-62893 (Windows Deployment Services TFTP Server RCE), CVE-2026-65657 (Microsoft SharePoint Server RCE), CVE-2026-62823 (Windows DHCP Server RCE), and CVE-2026-68820 (Windows Ancillary Function Driver for WinSock EoP). The ruleset addresses a range of vulnerability types like Use After Free, Deserialization of Untrusted Data, Heap-based Buffer Overflow, and Integer Overflow. → blog.talosintelligence.com |
| 2026-08-11 2026 | Zoom Patches Zero-Click Code Execution Vulnerability news 2 min read | Writeup of Zoomsday (CVE-2026-53413), a zero-click RCE vulnerability in Zoom's annotator function. A Security discovered that a missing bound check allowed specially crafted messages sent over Zoom's proprietary annotator protocol to corrupt memory, leading to code execution on other meeting participants' machines. The exploit enables attackers to gain control of a victim's machine without any user interaction or visual indication. Patches are available in Zoom clients and SDK versions 7.1.5 and 7.0.6 for affected platforms. → securityweek.com |
| 2026-08-11 2026 | Rapid7 and Microsoft disclose CVE-2026-63520 a new SharePoint Remote Code Execution vulnerability news 6 min read | Writeup of CVE-2026-63520, a critical unauthenticated RCE vulnerability in Microsoft SharePoint discovered by Rapid7 Labs. This vulnerability, caused by an unsafe .NET type instantiation in Business Connectivity Services, can be chained with CVE-2026-55040 to achieve arbitrary code execution on affected servers. The research also explored the use of AI models in vulnerability discovery against complex enterprise targets like SharePoint. → rapid7.com |
| 2026-08-11 2026 | Researchers Disclose AI-Assisted SharePoint Exploit Chain Reaching Unauthenticated RCE intermediate 3 min read | Writeup detailing CVE-2026-55040 and CVE-2026-63520, an AI-assisted exploit chain for unauthenticated RCE in SharePoint Server Subscription Edition, 2019, and 2016. The chain bypasses authentication by assuming a target user's identity and then leverages an unsafe .NET type instantiation vulnerability. Researchers used an AI agent to discover the exploit path, though human guidance was essential. July updates are stated to break the chain, with August updates expected to fully remediate. → thehackernews.com |
| 2026-08-11 2026 | Python Software Foundation - Python 3.11.0a3 to 3.15.0b2 news 12 min read Python | Writeup detailing CVE-2026-12003, an Uncontrolled Search Path Element vulnerability in Python versions 3.11.0a3 to 3.15.0b2. This vulnerability, affecting Windows installations, allows low-privilege users to escalate privileges by manipulating file paths to achieve arbitrary code execution when a privileged user or service account launches an affected Python interpreter. Exploitation requires a Windows environment, specific directory creation permissions for low-privilege users, and a privileged user executing Python post-manipulation. → bishopfox.com |
| 2026-08-09 2026 | Analyzing a Multi-Stage PowerShell Payload Chain advanced 6 min read | Writeup of a multi-stage PowerShell payload chain involving Vercel-hosted infrastructure. The analysis details the retrieval and execution of ZIP archives containing executables, employing techniques like dynamic IEX, Base64, and repeating-key XOR obfuscation with the key "write." The process includes downloading payloads such as Grape2.zip, UltraToolliteSetup.exe, and draw.zip, with decoy "Verification complete!" messages observed. |
| 2026-08-09 2026 | Write Once, Shell Everywhere - Turning Arbitrary File Writes into RCE (DEF CON Bug Bounty Village) intermediate 20 min read Talks | Library of techniques for escalating arbitrary file writes to remote code execution, detailing the current state of the art across operating systems and language runtimes. It catalogues existing methods and introduces new techniques for stripped-down containers, focusing on environmental fingerprinting and exploitation strategies against common execution sinks, such as `/etc/ld.so.preload`. |
| 2026-08-09 2026 | DEF CON talk: 8 in 10 Banks in Belgium HATE This One Weird eID RCE news 13 min read Talks | Talk slides from DEF CON detail critical vulnerabilities in the Connective signing extension, impacting over 2 million users primarily in Belgium. Researchers discovered that any website could extract users' eID PINs and Maestro card data, and crucially, trigger remote code execution (RCE) by exploiting how the native binary loaded attacker-supplied libraries, effectively bypassing user consent for sensitive operations like eIDAS qualified signatures. |
| 2026-08-08 2026 | Progress Kemp LoadMaster Flaw Hits CISA KEV After 792 Reported Exploit Attempts news 1 min read | Writeup on CVE-2026-8037, a critical command injection vulnerability in Progress Kemp LoadMaster. This flaw, with a CVSS score of 9.6, allows unauthenticated attackers to execute arbitrary commands by exploiting unsanitized input in multiple command endpoints, as analyzed by watchTowr Labs and highlighted by CISA's addition to the KEV catalog. Over 792 exploitation attempts have been observed from 18 countries, prompting urgent patching recommendations for federal agencies. → thehackernews.com |
| 2026-08-08 2026 | SCTPhantom: An 18-Year-Old SCTP ASCONF Transport Use-After-Free · Tencent Zhuque Lab news | Tencent Zhuque Lab discovered SCTPhantom, a use-after-free vulnerability in the SCTP ASCONF transport protocol, which has existed for approximately 18 years. This flaw could allow attackers to exploit memory corruption issues, potentially leading to system instability or unauthorized access. The researchers highlighted the long-standing nature of this bug, underscoring the importance of ongoing security audits for even mature protocols. No specific bounty payout amount was mentioned. |
| 2026-08-07 2026 | Rapid7 Analysis of CVE-2026-63077 an unauthenticated Remote Code Execution vulnerability in JetBrains TeamCity news 14 min read | Analysis of CVE-2026-63077, an unauthenticated RCE vulnerability in JetBrains TeamCity, reveals an unsafe deserialization flaw in the agent polling protocol. The vulnerability arises from an overly permissive XStream allowlist that fails to clear default permissions, allowing the deserialization of dangerous Java classes like `Map` and `Throwable`. A patched TeamCity server remediates this by adding `NoTypePermission.NONE` to clear existing permissions before applying its own allowlist, effectively creating a deny-by-default baseline. This fix prevents attackers from exploiting the flaw to execute arbitrary operating system commands. → rapid7.com |
| 2026-08-07 2026 | New WordPress Pre-Auth XSS Could Lead to PHP Code Execution news 4 min read | Library for identifying and mitigating a critical pre-authentication reflected XSS vulnerability (CVE-2026-64638) in WordPress, which can be chained to achieve PHP code execution. The vulnerability, discovered by pwn.ai, affects all versions of WordPress and allows attackers to exploit crafted usernames to inject JavaScript on the failed-login error page, leading to potential RCE through techniques like Application Password creation and plugin upload. The library likely aids in detecting this specific flaw and understanding its exploitation path, building upon prior research such as Paulos Yibelo's SOME technique. → thehackernews.com |
| 2026-08-07 2026 | Zbtlink Routers Contain rctl Backdoor news 8 min read | Writeup on ENDLESSDOORS, a backdoor found in Zbtlink and other white-labeled routers. This implant, a customized version of the rctl tool, allows for remote command execution and reverse shell capabilities by exploiting a vulnerability present in numerous firmware images across models like Z8102AX-2DSIM and WG3526. The backdoor phones home to specific endpoints, enabling attackers to hijack communications and gain root access without inbound connectivity. Affected devices should be identified by model number and checked for the presence of the 'kworker' process and associated files. |
| 2026-08-07 2026 | Claude Code RCE: How a Malicious PR Triggers Code Execution news 9 min read | Writeup detailing a Claude Code RCE vulnerability, triggered by a malicious pull request that exploits the `.mcp.json` configuration file. When a developer trusts a repository and opens Claude, the tool automatically executes commands defined in `.mcp.json` to enumerate MCP servers. Attackers can place malicious commands within this file, leading to arbitrary code execution, secret exfiltration, and reverse shells on the developer's host, leveraging tools like `netcat`, `npx`, or `docker` for execution. |
| 2026-08-07 2026 | Critical RCE in IBM Langflow Triggers CISA Emergency Deadline news 2 min read | Writeup of CVE-2026-9198, a critical RCE in IBM Langflow exploited by unauthenticated callers to mint SUPERUSER tokens and execute arbitrary Python code. This vulnerability, rated CVSS 9.8, triggered a CISA emergency deadline for federal agencies, requiring remediation to Langflow 1.10.2, disabling `LANGFLOW_AUTO_LOGIN`, and restricting API access. Recurring severe vulnerabilities like CVE-2026-33017 and CVE-2026-55255 highlight ongoing security risks in AI agent infrastructure. → cryptorank.io |
| 2026-08-07 2026 | Critical Gitea Flaw Let Unauthenticated Attackers Read Server Files via Org-Mode Markup news 2 min read | Library update patching Gitea versions 1.22.1 through 1.27.0 addresses CVE-2026-59774, a Critical file-read vulnerability. Unauthenticated attackers could exploit this via crafted Org-mode markup with #+INCLUDE directives to read any file accessible by the Gitea service account, potentially escalating to remote code execution by reading app.ini and exfiltrating INTERNAL_TOKEN. The vulnerability, found by XBOW Security and Guido Leo, and independently by Shai Rod, is fixed in Gitea 1.27.1, which also patches CVE-2026-60004. → thehackernews.com |
| 2026-08-06 2026 | Critical Paperclip Flaw Allowed Admin Access Code Execution news 2 min read | Writeup on CVE-2026-41679, a critical authorization bypass in the Paperclip AI management platform. This vulnerability, with a CVSS score of 10, allowed unauthenticated remote attackers to gain arbitrary code execution with server permissions. Exploitation involved self-registering an account, approving a CLI challenge, and then importing a crafted YAML file to deploy an agent that executes commands as the Paperclip server process. The flaw was patched by implementing authorization checks in import flows and tightening company scoping. → securityweek.com |
| 2026-08-06 2026 | Active Exploitation Alert: Critical Gitea CVE-2026-59774 Lets Unauthenticated Attackers Read Server Files and Gain RCE news 4 min read | Writeup of CVE-2026-59774, a critical Gitea vulnerability allowing unauthenticated attackers to perform arbitrary file reads and potentially achieve RCE via Org-mode markup injection. Exploitation involves crafting payloads for the `/markup` endpoint, affecting Gitea versions v1.22.1 through v1.27.0. This path traversal flaw (CWE-22) is actively exploited in the wild, enabling access to sensitive files like `app.ini` and subsequent command execution through Git hook manipulation. → rescana.com |
| 2026-08-05 2026 | Pre-auth RCE in enterprise Java hits Bonita and OFBiz servers news 4 min read | Writeup of CVE-2026-31986, detailing pre-authentication remote code execution in Bonita and Apache OFBiz enterprise Java applications. Attackers exploit chained vulnerabilities, including improper path handling, insecure deserialization via XStream, and forged single sign-on tokens, to achieve code execution without authentication. These flaws were discovered by Novee researchers and presented at Black Hat USA 2026, with vendors releasing patched versions. → helpnetsecurity.com |
| 2026-08-05 2026 | Code Execution via Provisioning Packages intermediate 5 min read | Library for abusing Windows Provisioning Packages (.ppkg) to execute arbitrary code. Threat actors can disguise malicious payloads within these containers, which are used by administrators for device configuration. The library leverages the Windows Imaging and Configuration Designer (ICD.exe) to create malicious packages, with extracted commands residing in `customizations.xml` and executable via `provtool.exe`. Detection methods include monitoring the Microsoft-Windows-Provisioning-Diagnostics-Provider event log (event ID 20 for package application, event ID 10 for associated file information) and auditing file system access to `C:\ProgramData\Microsoft\Provisioning` and temporary staging directories. |
| 2026-08-05 2026 | HEVD: From Stack Overflows to Modern Pool Grooming advanced 1 min read | Library containing C++ source code and exploit scripts for the HackSys Extreme Vulnerable Driver (HEVD) on modern x64 Windows 11. This four-part series details the evolution of Ring 0 exploitation, covering stack buffer overflows with SMEP bypass and DKOM token stealing, arbitrary writes with stack pivoting and kernel stack reconstruction, kernel pool grooming for data-only attacks using out-of-bounds reads and named pipes, and weaponizing npfs.sys with double-pipe grooming for _EPROCESS token swaps, achieving stable local privilege escalation. |
| 2026-08-05 2026 | Hardware Hacking: From zero to a Pre-Auth Stack Buffer Overflow on Amazon's best-selling router advanced 13 min read | Library detailing hardware hacking techniques applied to the Mercusys MB115-4G router, culminating in a pre-authentication stack buffer overflow. The resource covers identifying UART interfaces, extracting firmware with binwalk, analyzing boot scripts, and cracking weak MD5-hashed passwords like "1234" found in `passwd.bak`. It also discusses component identification, including Ethernet transformers, SPI flash memory, and the 4G LTE module, offering a practical approach to gaining root shell access and performing static analysis on embedded devices. |
| 2026-08-04 2026 | Before the first prompt: Code execution paths in trusted coding-agent projects advanced 6 min read AI | Library for identifying code execution paths in trusted coding-agent projects, demonstrating how configurations like Codex's Model Context Protocol (MCP) and Claude Code's project-controlled PATH can trigger attacker-controlled processes before the first user prompt, bypassing typical hook reviews. The library highlights that vulnerabilities extend beyond malicious hooks and skills, encompassing editor tasks, environment settings, and runtime startup files. → securitylabs.datadoghq.com |
| 2026-08-04 2026 | Cruising for Shells in Flowise - elttam intermediate 25 min read API Sec | Tool for analyzing and exploiting Remote Code Execution (RCE) vulnerabilities in Flowise, a generative AI development platform. It details findings including RCE via pandas in the CSVAgent node, arbitrary file writes in SQL Database Chain and SQLite Record Manager nodes, and bypasses for the `validatePythonCodeForDataFrame` function. The analysis covers multiple CVEs and GHSA identifiers, demonstrating how attackers can leverage insecure Python code execution and TypeORM DataSource initialization to gain shell access. → elttam.com |
| 2026-08-04 2026 | Rapid7 Analysis: KindaRails2Shell (CVE-2026-66066) news 14 min read | Analysis of CVE-2026-66066 reveals an arbitrary file read vulnerability in Ruby on Rails Active Storage when using the Vips image processor with untrusted uploads. Versions of Active Storage < 7.2.3.2, >= 8.0, < 8.0.5.1, and >= 8.1, < 8.1.3.1 are affected. The exploit involves crafting a MAT/HDF5 file disguised as an image (e.g., `image/png`) and submitting it via direct upload. A legitimate `variation_key` from the same application can then be reused to trigger libvips' `matload` function, leading to arbitrary file reads and potentially remote code execution (RCE) through `Kernel#spawn` or `Kernel#eval`. → rapid7.com |
| 2026-08-03 2026 | Hugging Face Diffusers Flaws Could Let Model Repositories Execute Arbitrary Code news 3 min read | Library of flaws named FaceHugger in Hugging Face's Diffusers allows crafted model repositories to execute arbitrary code, bypassing the `trust_remote_code` safeguard. Three high-severity vulnerabilities, CVE-2026-44827, CVE-2026-45804, and CVE-2026-44513, exploit TOCTOU race conditions and code injection through custom pipelines and configuration files. These flaws present a significant AI supply chain risk, enabling initial access through model loading processes. The issues were patched in Diffusers version 0.38.0. → thehackernews.com |
| 2026-08-03 2026 | Ruby on Rails Patches Critical Active Storage Vulnerability Affecting Image Processing news 2 min read | Library update addressing CVE-2026-66066, a critical Ruby on Rails Active Storage vulnerability affecting image processing with libvips. This flaw allows unauthenticated attackers to read arbitrary files, potentially exposing sensitive data like `secret_key_base` and credentials, leading to remote code execution or lateral movement. Users must upgrade Active Storage, ensure libvips is 8.13+, and rotate all compromised secrets. → securityaffairs.com |
| 2026-08-01 2026 | Full Rails RCE technical writeup... KindaRails2Shell: How a MATLAB file reads your secrets and pops a shell on Ruby on Rails | Ethiack intermediate 11 min read Secrets | Library analyzing an arbitrary file read to RCE chain in Ruby on Rails applications, dubbed KindaRails2Shell (CVE-2026-66066). It details how crafting a specially formatted MATLAB .mat file, leveraging HDF5 external datasets and ActiveStorage content-type confusion, allows an attacker to trick libvips into reading sensitive files like `/etc/passwd` and ultimately achieve remote code execution. |
| 2026-08-01 2026 | Intigriti Bug Bytes #238 - July 2026 🚀 news 10 min read Bug Bounty Burp Secrets | Survey of AI security challenges, including RAG poisoning and the "lethal trifecta" of AI risks, alongside discussions on reconnaissance for exposure management, exploiting insecure cookie policies, and bypassing Content Security Policy. This entry also highlights the P4RS3LT0NGV3 toolkit for LLM red teaming and the Graphw00f tool for GraphQL endpoint identification. → intigriti.com |
| 2026-07-31 2026 | KindaRails2Shell: arbitrary file read to RCE in Rails Active Storage via libvips (CVE-2026-66066) advanced 3 min read | Writeup on KindaRails2Shell (CVE-2026-66066), a vulnerability in Rails Active Storage utilizing the libvips processor. This flaw allows for arbitrary file reads and potential remote code execution when applications accept untrusted image uploads, particularly affecting Rails 7.x/8.x and certain Rails 6.x configurations. Mitigation involves upgrading Rails and libvips to specific patched versions, setting the `VIPS_BLOCK_UNTRUSTED` environment variable, or calling `Vips.block_untrusted(true)` in an initializer. |
| 2026-07-30 2026 | KindaRails2Shell: CVE-2026-66066 Critical Arbitrary File Read and Possible Remote Code Execution in Ruby on Rails news 3 min read | Writeup of CVE-2026-66066, a critical vulnerability in Ruby on Rails Active Storage and libvips, allows unauthenticated attackers to read application files. Affecting Rails 7.0+ with libvips as the default processor, this CWE-1188 flaw enables potential remote code execution. Remediation requires upgrading Active Storage and libvips to specific versions or applying workarounds like disabling untrusted operations. → rapid7.com |
| 2026-07-30 2026 | Your House Has an FFmpeg Problem - elttam news 8 min read Fuzzing | Writeup detailing an argument injection vulnerability in ffmpeg within Home Assistant. This vulnerability, discovered while searching for attack primitives, allowed for the exfiltration of sensitive files like `/proc/self/environ` by exploiting ffmpeg's pseudo-protocols, including `concat:` and `file:`, to craft synthetic audio headers from binary data. The exploit chain ultimately led to remote code execution by leveraging the exposed `SUPERVISOR_TOKEN`. → elttam.com |
| 2026-07-30 2026 | How I Found a High-Severity Directory Traversal in Flask-Admin intermediate 4 min read Python | Writeup detailing a high-severity directory traversal vulnerability discovered in Flask-Admin. The vulnerability arose from an incorrect filesystem boundary check using `startswith()`, allowing attackers to access files and perform operations outside the configured root directory, impacting download, upload, rename, delete, and directory creation functionalities. The author tested the issue by crafting paths like `../uploads_secret/flag.txt`. → infosecwriteups.com |
| 2026-07-29 2026 | CVE-2026-63077: Critical unauthenticated remote code execution in JetBrains TeamCity news 1 min read | Writeup detailing CVE-2026-63077, a critical unauthenticated remote code execution vulnerability in JetBrains TeamCity. This deserialization flaw allows attackers to execute arbitrary OS commands by exploiting the agent polling protocol. Affected versions require urgent updates to TeamCity 2025.11.7 or 2026.1.3, or application of the security patch plugin for older versions. Network access restriction to TeamCity servers is recommended as a defense-in-depth measure. → rapid7.com |
| 2026-07-29 2026 | Critical CVE-2026-63077: Unauthenticated Remote Code Execution Vulnerability in JetBrains TeamCity On-Premises news 3 min read | Writeup on CVE-2026-63077, an unauthenticated remote code execution vulnerability in JetBrains TeamCity On-Premises. This critical flaw, affecting versions prior to 2025.11.7 and 2026.1.3, allows attackers to execute arbitrary OS commands over HTTP(S) by exploiting the agent polling protocol. While no exploitation is currently reported, immediate upgrades or applying JetBrains' patch plugin are strongly recommended to mitigate this CVSS 9.8 severity vulnerability. → rescana.com |
| 2026-07-29 2026 | Active Exploitation Alert: Critical FastJson CVE-2026-16723 Zero-Day RCE Targeting US Organizations in Spring Boot Applications news 4 min read | Writeup detailing CVE-2026-16723, a critical FastJson zero-day RCE vulnerability actively exploited against US organizations, particularly in Spring Boot applications. This flaw enables arbitrary code execution via malicious JSON payloads exploiting type resolution logic, even with AutoType disabled. Exploitation is widespread, opportunistic, and ongoing, targeting sectors like finance and healthcare. Mitigation involves upgrading FastJson to fastjson2, enabling SafeMode, input validation, and enhanced log monitoring. → rescana.com |
| 2026-07-29 2026 | Simple Job Board ≤ 2.11.0 - Unauthenticated RCE (CVE-2024-1813) news 5 min read | Writeup detailing CVE-2024-1813, an unauthenticated RCE vulnerability in Simple Job Board ≤ 2.11.0. This flaw stems from a double PHP object deserialization, triggered when an administrator views candidate applications. Exploitation requires a vulnerable version, a published job offer, a POP gadget chain from a third-party plugin like All In One SEO (leveraging Monolog), and admin interaction to open the candidate list. The writeup includes techniques to bypass WAFs by altering serialized data syntax. |
| 2026-07-29 2026 | Koollab LMS - Multiple Vulnerabilities including Remote Code Execution SQL Injection and Authentication Bypass news 3 min read | Writeup detailing multiple vulnerabilities in Koollab LMS, including critical remote code execution via unrestricted SCORM and image uploads (CVE-2026-63227, CVE-2026-63228), pre-authentication blind and error-based SQL injection (CVE-2026-63229, CVE-2026-63230), and post-authentication SQL injection (CVE-2026-63231). Further critical flaws include SQL injection combined with unsafe deserialization for RCE (CVE-2026-63232 through CVE-2026-63234), authentication bypass via TOTP and UUID (CVE-2026-63237, CVE-2026-63238), and hard-coded AWS IAM credentials (CVE-2026-63239). |
| 2026-07-29 2026 | The risk hiding behind exposed MCP servers intermediate 6 min read AI | Analysis of exposed Model Context Protocol (MCP) servers reveals widespread vulnerabilities, with approximately 1 in 6 cloud environments exposing unauthenticated servers. These servers, often running older protocol versions predating authentication, grant anonymous callers access to sensitive data, including PII and internal business records. Exploitation can also lead to write/delete operations on production systems, code execution, and even access to cloud credentials via SSRF attacks against metadata endpoints. The inherent self-describing nature of MCP and the ease of generic client communication amplify these risks. → wiz.io |
| 2026-07-29 2026 | The Invisible Hack: How a Linux Bug Lets Anyone Become Root — Without Leaving a Single Trace news 9 min read | Writeup on CVE-2026–31431, a critical Linux kernel vulnerability nicknamed "Copy Fail." This bug allows an unprivileged user to silently elevate to root by exploiting a memory handling flaw in the cryptography module, overwriting the in-memory page cache copy of setuid binaries like `/usr/bin/su` with just two bytes to bypass authentication checks. The exploit is forensically undetectable by conventional means as it leaves no trace on disk or in system logs, and even impacts containerized environments by compromising the shared host kernel memory. → infosecwriteups.com |
| 2026-07-28 2026 | Technical Advisory: wp2shell Unauthenticated Remote Code Execution and Full Site Takeover in WordPress Core news 9 min read | Advisory detailing the wp2shell vulnerability chain in WordPress Core, comprising CVE-2026-63030 (REST API batch endpoint flaw) and CVE-2026-60137 (SQL injection via post query). This chain allows unauthenticated attackers to achieve remote code execution and full site takeover on affected versions (6.9.0-6.9.4, 7.0.0-7.0.1). Active exploitation is confirmed, with a proof-of-concept exploit automating the initial access, including unauthorized administrator account creation and webshell deployment. Patching to 6.9.5 or 7.0.2 is critical, with blocking anonymous access to /wp-json/batch/v1 as a temporary mitigation. |
| 2026-07-28 2026 | Critical TeamCity Flaw Could Let Attackers Run OS Commands Without Logging In news 1 min read | Writeup on CVE-2026-63077, a critical vulnerability in TeamCity On-Premises versions enabling unauthenticated attackers to execute arbitrary OS commands. This flaw, with a CVSS score of 9.8, bypasses authentication via the agent polling protocol and can lead to data exposure, credential compromise, or server state modification. JetBrains released patches and a security plugin for older versions, urging users to update or apply the plugin. → thehackernews.com |
| 2026-07-28 2026 | New vBulletin Vulnerability! news | New vBulletin Vulnerability! |
| 2026-07-28 2026 | How I Found a Bug Worth $3,500 — In a Feature Nobody Was Watching. beginner 6 min read Bug Bounty XSS | Writeup detailing the discovery of a storage-exhaustion flaw (CWE-434, CWE-770) and a stored XSS vulnerability (CWE-79) within a B2B SaaS platform's file upload feature. The storage exhaustion occurred due to a spoofed file size field, allowing for resource consumption. The XSS vulnerability leveraged an unsanitized filename that executed within an admin's browser, leading to potential session hijacking and platform compromise. The report emphasizes the importance of scrutinizing metadata, understanding the downstream impact of vulnerabilities, and re-testing "boring" features. → infosecwriteups.com |
| 2026-07-27 2026 | Technical Advisory: wp2shell Unauthenticated Remote Code Execution and Full Site Takeover in WordPress Core news 9 min read | Advisory on CVE-2026-63030 and CVE-2026-60137, two chained WordPress Core vulnerabilities enabling unauthenticated remote code execution and full site takeover. Active exploitation targets versions 6.9.0-6.9.4 and 7.0.0-7.0.1. The exploit chain, publicly detailed in an Icex0 proof-of-concept, leverages a REST API batch endpoint desynchronization and a SQL injection vulnerability in the post query layer. CISA has added these to its Known Exploited Vulnerabilities catalog. Patching to 6.9.5 or 7.0.2 is critical. |
| 2026-07-26 2026 | AI-Enabled Security Researchers Discover How a Crafted Video Can Provide Attackers Access to Your PC advanced 3 min read | Writeup of CVE-2026-8461, "PixelSmash," a critical FFmpeg vulnerability allowing Remote Code Execution and Denial of Service. This heap out-of-bounds write, present for sixteen years in the MagicYUV decoder, affects numerous applications including media players, file managers, and cloud services. Exploitation requires only uploading a crafted media file, with demonstrated RCE on Jellyfin and Nextcloud. Mitigation involves updating FFmpeg or rebuilding without the MagicYUV decoder. → infoq.com |
| 2026-07-26 2026 | Active Exploitation Alert: Unpatched Fastjson 1.x RCE Vulnerability Threatens Spring Boot Fat-JAR Applications news 4 min read | Writeup detailing active exploitation of the Fastjson 1.x RCE vulnerability, tracked as CVE-2026-16723. Unpatched versions 1.2.68 through 1.2.83, especially within Spring Boot fat-JARs, are susceptible to arbitrary code execution via crafted JSON payloads. ThreatBook and Imperva have observed exploitation attempts targeting financial, healthcare, and retail sectors, primarily in the US, using Ruby and Go frameworks. Mitigation includes enabling SafeMode, using a restricted build, or migrating to Fastjson2. → rescana.com |
| 2026-07-26 2026 | Week in review: ServiceNow pre-auth RCE exploited in the wild Hugging Face breached news 15 min read | Tool **Snowpick** identifies unauthorized access to ServiceNow instances by scanning for exposures. The article also highlights the exploitation of critical vulnerabilities including ServiceNow's pre-auth RCE (CVE-2026-6875), SonicWall SMA zero-days (CVE-2026-15409, CVE-2026-15410), and Check Point's authentication bypass flaw (CVE-2026-16232). It further discusses AI-driven threats such as the Hugging Face breach by an autonomous AI agent, JadePuffer's ransomware targeting AI infrastructure, and malicious Claude download pages. → helpnetsecurity.com |
| 2026-07-26 2026 | Cl0p Ransomware Actively Exploiting Critical Unauthenticated RCE in PTC Windchill and FlexPLM Systems news 5 min read | Writeup detailing a critical unauthenticated RCE in PTC Windchill and FlexPLM systems, actively exploited by Cl0p ransomware. The attack chain leverages CVE-2026-12569 and an information disclosure flaw, enabling persistent web shells, data exfiltration, and double extortion. Targets include manufacturing, automotive, aerospace, and retail sectors globally. Mitigation involves patching, eliminating internet exposure, and monitoring for indicators like hex-named JSP web shells and malicious IP connections. → rescana.com |
| 2026-07-24 2026 | Kimi K3 Agents Found Redis Zero-Days and Built RCE Exploit Researchers Say news 3 min read | Library patches address seven Redis zero-days discovered by Kimi K3 agents, including authenticated RCE exploits for versions 6.2.22, 7.4.9, 8.6.4, and 8.8.0. The vulnerabilities, related to the RESTORE command, involve a Streams shared-NACK use-after-free and RedisBloom TDigest out-of-bounds writes. While no new CVEs were immediately assigned, the flaws allow arbitrary memory access and lead to remote code execution. Users should upgrade to fixed releases and consider revoking RESTORE privileges from non-essential accounts. → thehackernews.com |
| 2026-07-24 2026 | Escaping Claude Cowork’s local VM sandbox via CVE-2026-46331 news 7 min read | Writeup detailing CVE-2026-46331 exploitation within Claude Cowork's local VM sandbox, named "SharedRoot." This vulnerability allows an unprivileged agent to gain root privileges within the Linux VM by abusing the `act_pedit` kernel module's COW vulnerability, subsequently accessing and manipulating the host macOS filesystem. The exploit chain leverages unprivileged user namespaces and a permissive seccomp filter, demonstrating how multiple security layers must align for such an escape to occur. The author suggests several hardening measures to prevent similar exploits, including disabling unprivileged user namespaces, stricter seccomp filtering, preventing module autoloading, and crucially, limiting host filesystem sharing. |
| 2026-07-24 2026 | XBOW Agents found three RCEs as SYSTEM (and root) on Bing Image Search news | XBOW Agents discovered three critical Remote Code Execution (RCE) vulnerabilities on Bing Image Search. These vulnerabilities allowed for execution with the highest system privileges (SYSTEM and root), posing a significant security risk. |
| 2026-07-23 2026 | Critical Redis Vulnerability CVE-2024-27348 Enables Remote Code Execution via RESTORE Command: Risk Analysis and Mitigation Strategies news 8 min read | Analysis of CVE-2026-25243, a critical RCE vulnerability in Redis, details how authenticated attackers can exploit the RESTORE command via crafted serialized payloads. This weakness, classified as CWE-122 (Heap-Based Buffer Overflow), requires authentication and RESTORE command permissions, but its impact is significant, potentially allowing arbitrary code execution and lateral movement within affected environments. Patches are available for Redis Community Edition and Redis Software, and interim mitigation involves restricting RESTORE command access via ACLs. → rescana.com |
| 2026-07-23 2026 | AWS Kiro Flaw Let a Poisoned Web Page Rewrite Its Config and Run Code news 5 min read | Library for securing AWS Kiro, an agentic coding IDE, addressing CVE-2026-10591 where a poisoned web page could rewrite Kiro's `mcp.json` configuration file and execute arbitrary code without explicit approval. This vulnerability allowed attackers to bypass Kiro's safety model, which typically relies on developer approval before running risky commands. The flaw, found by Intezer and Kodem Security, enabled prompt injection to plant malicious server configurations that would automatically load and execute code upon Kiro's file reload. → thehackernews.com |
| 2026-07-22 2026 | 7-Zip CVE-2026-14266 RCE Risk Explained news 4 min read | Writeup on CVE-2026-14266, a heap-based buffer overflow vulnerability in 7-Zip's XZ decompression logic. Exploitation requires user interaction, such as opening crafted compressed content, and could lead to remote code execution within the current process. This vulnerability affects 7-Zip versions prior to 26.02, which is the patched version. Mitigation involves updating 7-Zip, confirming installations through inventory, reducing archive-handling exposure, and monitoring for suspicious 7-Zip activity. → socradar.io |
| 2026-07-21 2026 | Public PoC triggers active exploitation of critical SharePoint RCE vulnerability CVE-2026-50522 news 2 min read | Writeup of CVE-2026-50522, a critical Microsoft SharePoint RCE vulnerability actively exploited after a public PoC. This deserialization flaw, patched by Microsoft, allows authenticated attackers with Site Owner privileges to execute arbitrary code. watchTowr researchers observed attackers stealing SharePoint machine keys in a single request, necessitating credential rotation beyond patching. Defused Cyber also noted attacks delivering .NET deserialization payloads through a SharePoint sign-in endpoint. The article also briefly mentions other SharePoint vulnerabilities added to CISA's KEV catalog: CVE-2026-58644, CVE-2026-45659, CVE-2026-32201, and CVE-2026-20963. → securityaffairs.com |
| 2026-07-21 2026 | Hackers Exploit WP2Shell WordPress Flaws for Unauthenticated Remote Code Execution news 2 min read | Writeup on CVE-2026-60137 and CVE-2026-63030, termed "WP2Shell," detailing how hackers exploit these chained WordPress core vulnerabilities for unauthenticated remote code execution. Affecting versions 6.8 through 7.0.1 and the 7.1 beta, the attack targets the REST API and can be compounded by a separate SQL injection bug. Exploitation is occurring in the wild, with WordPress issuing emergency releases and enabling forced updates for mitigation. Cloudflare has also deployed WAF protections. |
| 2026-07-21 2026 | Critical SharePoint RCE CVE-2026-50522 Under Active Exploitation After Public PoC news 2 min read | Writeup on CVE-2026-50522, a critical deserialization vulnerability in Microsoft SharePoint Server, rated 9.8 CVSS, is under active exploitation. Attackers are using this network-exploitable flaw, discovered by DEVCORE's "splitline," to achieve remote code execution and steal machine keys for persistence. Exploitation complexity is low and authenticated as a Site Owner allows arbitrary code injection. This follows other exploited SharePoint vulnerabilities like CVE-2026-56164 and CVE-2026-58644. → thehackernews.com |
| 2026-07-21 2026 | Attackers Exploit Critical ServiceNow RCE Flaw CVE-2026-6875 news 3 min read | Writeup of CVE-2026-6875 details a critical pre-authentication RCE in ServiceNow's AI Platform, allowing full instance compromise and connected server access. Attackers exploit the GlideRecord query API's `javascript:` prefix feature to inject code, bypassing ServiceNow's script sandbox through a complex escape mechanism involving overriding `Object.clone` and manipulating `AbstractAjaxProcessor.prototype`. The vulnerability, initially reported by Searchlight Cyber and actively exploited in the wild, targets endpoints like `/assessment_thanks.do`. → securityaffairs.com |
| 2026-07-21 2026 | Escalating All The Privileges With Foxit PDF Reader (CVE-2026–57239) news 14 min read AuthZ | Writeup of CVE-2026–57239 detailing privilege escalation within Foxit PDF Reader. The vulnerability allows an unprivileged user to achieve NT AUTHORITY\SYSTEM privileges. Exploitation requires initial code execution and leverages DLL sideloading of WINSPOOL.DRV alongside a writable log file path to trigger the elevated execution of a chosen binary, ultimately chaining into the FoxitPDFReaderUpdateService.exe process to duplicate tokens and spawn a SYSTEM process. |
| 2026-07-21 2026 | I found a WordPress RCEs with GPT5.6 and $25 intermediate 23 min read AI | Tool that leverages GPT5.6 Sol Ultra to discover RCE vulnerabilities in WordPress, demonstrated by finding a pre-authentication SQL injection that escalates to RCE. The process involved adapting a prompt designed for mathematical conjecture solving to analyze WordPress source code, utilizing multi-agent exploration for six hours, and costing approximately $25 in LLM usage. The tool is available at wp2shell.com for users to check their WordPress instances. |
| 2026-07-21 2026 | Exploitation in the Wild of wp2shell news 3 min read API Sec | Writeup of wp2shell, a critical pre-authentication RCE vulnerability chain in WordPress Core (CVE-2026-63030 & CVE-2026-60137), details observed exploitation including malicious plugin uploads, user enumeration, LFI attempts, and admin panel access. Attackers are deploying both minimal one-liner webshells and sophisticated 150KB "CMSmap" webshells with extensive attack platform capabilities, alongside custom REST API webshells. Temporary mitigation involves blocking the WordPress Batch API at the WAF or disabling anonymous REST API access. → wiz.io |
| 2026-07-20 2026 | WordPress Remote Code Execution Flaws Get Public Exploits news 3 min read | Library for WordPress security updates, addressing the wp2shell attack chain that chains CVE-2026-63030 (REST API batch-route confusion) and CVE-2026-60137 (SQL injection in WP_Query) for pre-authentication remote code execution in versions 6.9.x and 7.0.x. Public proof-of-concept exploits are available, demonstrating multiple attack paths including credential theft and arbitrary command execution. Immediate patching is critical to mitigate risks. → esecurityplanet.com |
| 2026-07-20 2026 | Researchers Build WordPress Exploit Using OpenAI's GPT intermediate 3 min read | Library for developing exploits, demonstrating the use of OpenAI's GPT5.6 Sol Ultra to chain WordPress Core vulnerabilities CVE-2026-63030 and CVE-2026-60137. This technique achieved pre-authentication remote code execution, showcasing AI's capability in discovering complex attack chains, such as the 'WP2Shell' exploit which bypasses typical security measures. A related scanning tool, wp2shell.com, is also available. → infosecurity-magazine.com |
| 2026-07-20 2026 | CVE-2026-14266: Critical 7-Zip XZ Archive Decoder Vulnerability Enables Remote Code Execution (Patch in 26.02) news 3 min read | Writeup detailing CVE-2026-14266, a critical heap-based buffer overflow in 7-Zip's XZ archive decoder. This vulnerability, present in versions 21.07 through 26.01, allows for remote code execution when users open specially crafted XZ archives. The flaw lies in the decompression logic, leading to an out-of-bounds write. While no exploitation in the wild is reported, the attack vector aligns with phishing and malicious attachment tactics. Updating to 7-Zip version 26.02 is the recommended mitigation. → rescana.com |
| 2026-07-20 2026 | Patch now: WordPress REST API bug allows remote code execution news 2 min read | Writeup of wp2shell, a pre-authentication RCE vulnerability in WordPress' REST Batch API affecting versions 6.9.0-6.9.4 and 7.0.0-7.0.1. An indexing mismatch in the "batch/v1" endpoint allows attackers to execute arbitrary code without authentication, leading to full site control, database access, and potential compromise of the hosting environment. Patches are available in WordPress 6.9.5 and 7.0.2. → csoonline.com |
| 2026-07-20 2026 | Active Exploitation Alert: Critical CVE-2026-6875 Remote Code Execution Vulnerability in ServiceNow AI Platform news 4 min read | Analysis of CVE-2026-6875, a critical unauthenticated remote code execution vulnerability in the ServiceNow AI Platform, detailing its exploitation via crafted HTTP requests to /assessment_thanks.do. The flaw allows sandbox escape, enabling attackers to execute arbitrary code, and is actively exploited by both opportunistic and targeted actors, including sophisticated adversaries. Post-exploitation techniques include privilege escalation, credential harvesting, and lateral movement. Immediate patching is crucial, alongside monitoring for indicators of compromise such as anomalous requests and unexpected process creation on vulnerable instances. → rescana.com |
| 2026-07-20 2026 | New 7-Zip Vulnerability Could Let Crafted XZ Archives Run Code During Extraction news 2 min read | Library for application security, focusing on CVE-2026-14266, a high-severity heap-based buffer overflow in 7-Zip's XZ chunked data processing. Exploitation of this flaw, discovered by Landon Peng and detailed by Trend Micro's ZDI, allows for code execution within the context of the 7-Zip process. The vulnerability was patched in 7-Zip version 26.02, addressing an out-of-bounds write in the `MixCoder_Code` function within `C/XzDec.c`. This release also includes fixes for other memory-safety bugs, such as CVE-2026-48095. → thehackernews.com |
| 2026-07-20 2026 | WP2Shell WordPress Vulnerabilities Exploited in the Wild news 2 min read | Writeup on WP2Shell, two severe WordPress vulnerabilities (CVE-2026-60137 and CVE-2026-63030) actively exploited in the wild. These flaws, affecting versions 6.9.0-6.9.4 and 7.0.0-7.0.1, allow unauthenticated attackers to achieve remote code execution by chaining an SQL injection with arbitrary code execution. Patches have been released, and forced auto-updates are enabled for affected sites, with Cloudflare also providing protective rules. → securityweek.com |
| 2026-07-20 2026 | Active Exploitation Alert: Unauthenticated RCE Vulnerabilities in WordPress Core (wp2shell) with Public Exploits news 5 min read | Writeup detailing the active exploitation of unauthenticated RCE vulnerabilities in WordPress Core, dubbed wp2shell. This advisory covers the technical analysis of the SQL injection flaw within the `/wp-json/batch/v1` REST API endpoint, observed Tactics, Techniques, and Procedures (TTPs) including MITRE ATT&CK techniques T1190 and T1059, and real-world exploitation trends documented by threat intelligence platforms like Aikido Intel. Mitigation strategies emphasize upgrading WordPress Core to patched versions (7.0.2, 6.9.5, or 6.8.6), blocking the vulnerable endpoint, and conducting post-exploitation audits. → rescana.com |
| 2026-07-20 2026 | AI-Driven Cyberattack Compromises Hugging Face Production Infrastructure via Autonomous Agent: Incident Analysis and Mitigation Strategies news 6 min read | Analysis of an AI-driven cyberattack targeting Hugging Face's production infrastructure reveals exploitation of code-execution vulnerabilities in the dataset processing pipeline. An autonomous AI agent leveraged these flaws for remote code execution, privilege escalation, credential harvesting, and lateral movement across internal clusters. Detection and forensic analysis relied on Hugging Face's own LLM-based systems, highlighting the need for self-hosted AI models due to commercial model guardrail limitations. The incident underscores emerging threats and the importance of rapid credential rotation and robust sandboxing. → rescana.com |
| 2026-07-20 2026 | wp2shell: a defender’s guide (CVE-2026-63030 + CVE-2026-60137) with a list of forensic artifacts, a compromise scanner WordPress plugin and a free Chrome/Edge/Firefox browser extension to in-browser check if a website has been patched. intermediate 8 min read | Library of tools and forensic artifacts for defending against wp2shell, a critical unauthenticated RCE vulnerability in WordPress core (CVE-2026-63030 and CVE-2026-60137). This resource includes a WordPress plugin compromise scanner, a browser extension checker, and guidance on identifying forensic evidence left by the exploit chain, which leverages a REST API route-confusion bug and an SQL injection to achieve pre-authentication code execution. |
| 2026-07-19 2026 | Pixels to Payload: Dissecting a Four-Stage Bitmap-Steganography Dropper Delivering AsyncRAT :: Rhys Downing advanced 8 min read | Library for dissecting a four-stage .NET dropper that delivers AsyncRAT 0.5.8. This library, pixelchain, extracts all four stages and the final RAT configuration without execution. The analysis details two distinct bitmap steganography schemes with anti-carving measures, an Eazfuscator-wrapped loader performing persistence and Microsoft Defender tampering, and process hollowing into signed .NET utilities. It also covers the decryption of the AsyncRAT client, which uses TLS with a pinned self-signed certificate. |
| 2026-07-19 2026 | wp2shell (CVE-2026-63030): Pre-Auth RCE Chain in WordPress Core - Analysis and Open-Source Scanner advanced 9 min read | Tool analyzing CVE-2026-63030, a pre-authentication RCE in WordPress Core versions 6.9.0 through 7.0.1. The vulnerability stems from an array index desynchronization in the REST API batch endpoint, allowing bypassing of validation and sanitization. This can lead to SQL injection via the `author__not_in` parameter and re-entrancy in `serve_request`. The analysis covers the specific bugs, affected files, and provides mitigation steps. A scanner for this vulnerability is also open-sourced. |
| 2026-07-19 2026 | From SQL Injection to Infrastructure-Level RCE: A PostgreSQL Superuser Compromise advanced 1 min read SQLi | Writeup detailing an exploit chain from SQL Injection to Remote Code Execution (RCE) on a PostgreSQL database. The process begins with an unparameterized `pJobNumber` parameter in the `vss00CvStatusData.php` endpoint, leading to a raw PostgreSQL error. By leveraging `UNION SELECT` with `NULL` placeholders, the attacker identified the PostgreSQL version and confirmed the application connected as the `postgres` superuser. This superuser access allowed enumeration of system catalogs, revealing sensitive Personally Identifiable Information (PII) within the `public.vss01tpemployee` table. → infosecwriteups.com |
| 2026-07-19 2026 | MCP Supply Chain Advisory: RCE Vulnerabilities Across the AI Ecosystem news 11 min read | Advisory detailing command injection vulnerabilities across multiple AI ecosystem products, including LangFlow (unassigned CVE), GPT Researcher (CVE-2025-65720), LiteLLM (CVE-2026-30623), Agent Zero (CVE-2026-30624), LangBot (CVE-2026-54449), and Fay Digital Human Framework (CVE-2026-30618). These vulnerabilities, stemming from improper handling of MCP adapter configurations, allow unauthenticated or authenticated attackers to execute arbitrary operating system commands on affected servers. → ox.security |
| 2026-07-19 2026 | Code Runner VS Code Extension Enables Remote Code Execution via Settings Manipulation intermediate 2 min read | Writeup of CVE-2025-65715, a remote code execution vulnerability in the Code Runner VS Code extension. Attackers can exploit this by manipulating the extension's `executorMap` setting within `settings.json`, tricking users into executing malicious commands through the extension's code execution functionality. This flaw leverages unsafe `child_process.spawn()` usage with `shell: true`, allowing arbitrary shell command injection, which can lead to persistence or reverse shell connections. → ox.security |
| 2026-07-18 2026 | WordPress releases emergency update for critical 'wp2shell' RCE flaw news 2 min read | Writeup on the wp2shell RCE vulnerability in WordPress. This critical chain, affecting versions 6.9 to 7.0.1, allows unauthenticated attackers remote code execution. It combines CVE-2026-60137, an SQL injection flaw, with CVE-2026-63030, a REST API batch-route confusion. Proof-of-concept exploits are circulating, and initial real-world exploitation has been observed, prompting emergency updates and warnings for administrators to patch immediately. |
| 2026-07-18 2026 | wp2shell: Pre Authentication RCE in WordPress Core intermediate 1 min read | Tool that checks for CVE-2024-XXXX, a pre-authentication RCE in WordPress Core affecting millions of websites. This vulnerability can be exploited by anonymous users on a stock install without plugins. Mitigation strategies include blocking `/wp-json/batch/v1` and the `rest_route=/batch/v1` query parameter, or enabling a temporary plugin like "Disable Unauthenticated REST Batch API" until WordPress 7.0.2 or 6.9.5 can be installed. |
| 2026-07-18 2026 | Openwrt pre-auth remote root exploit intermediate | This content describes a pre-authentication remote root exploit affecting OpenWrt. This means attackers can gain full administrative (root) control of vulnerable OpenWrt devices without needing any prior authentication or credentials. This type of vulnerability poses a significant security risk, allowing for complete compromise and potential misuse of the affected devices. |
| 2026-07-18 2026 | Unauthenticated RCE in WordPress core (wp2shell), via SQL injection news 3 min read SQLi | Library with an embedded firewall, Aikido Zen, offers runtime protection against the unauthenticated RCE in WordPress core (wp2shell) caused by SQL injection. This vulnerability affects versions 6.9.0-6.9.4 and 7.0.0-7.0.1, with a fix available in 7.0.2. Aikido Zen inspects user input to block SQL injection and other vulnerabilities at runtime, providing a defense for unpatched sites while updates are deployed. Additionally, Aikido Intel tracks this vulnerability and others across open-source ecosystems. → aikido.dev |
| 2026-07-18 2026 | Three Steps to the Terminal: A Siemens ROX II Zero-Day Trilogy advanced 10 min read AuthZ | Writeup details a chained exploit of three zero-day vulnerabilities—CVE-2025-40948, CVE-2025-40947, and CVE-2025-40949—in Siemens ROX II OT switches. The exploit begins with arbitrary file disclosure via an insecure xz utility configuration, followed by privilege escalation through command injection in the feature key validation function, and finally achieves persistent root code execution by manipulating the web management task scheduler's cron table. These vulnerabilities allow for full privilege escalation and persistent root-level access on critical industrial control network components. → unit42.paloaltonetworks.com |
| 2026-07-18 2026 | CVE-2026-63030: wp2shell a Critical Remote Code Execution Vulnerability in WordPress Core news 2 min read | Writeup of CVE-2026-63030, a critical unauthenticated remote code execution vulnerability in WordPress Core, exploitable via the REST API batch endpoint. Affecting versions 6.9.0-6.9.4 and 7.0.0-7.0.1, this flaw can lead to complete website compromise without user interaction or plugins. Exploitation is considered highly likely, making urgent patching to versions 6.9.5, 7.0.2, or later critical. → rapid7.com |
| 2026-07-17 2026 | ASUS bsitf.sys (CVE-2026-13585): Arbitrary Physical Memory Mapping via Unvalidated IOCTL news 2 min read | Writeup of CVE-2026-13585 details an arbitrary physical memory mapping vulnerability in ASUS's bsitf.sys kernel driver. Discovered using DeepZero, the flaw allows an unvalidated IOCTL to allocate contiguous kernel memory, map it into a user process, and expose both virtual and physical addresses. This primitive enables pool exhaustion DoS attacks and physical address disclosure, potentially aiding DMA attacks or shellcode staging on specific driver versions. |
| 2026-07-17 2026 | No Shark is Safe: Millions of Shark Vacuums are Vulnerable to RCE news 10 min read | Writeup details a critical RCE vulnerability affecting internet-connected Shark vacuums, specifically RV2320EDUS and AV1102ARUS models. Exploitation involves using UART access to gain a root shell via U-Boot, then injecting a script to enable SSH. The vacuum's `appd` daemon communicates with an AWS IoT Core MQTT broker using device certificates and private keys. Lack of access controls allows subscribing to $aws/things/# topics, enabling potential remote control of millions of devices. |
| 2026-07-16 2026 | StrikeShark Campaign Exploits Known Vulnerabilities to Deploy Cobalt Strike via SharkLoader news 4 min read | Writeup of the StrikeShark campaign, which uses the SharkLoader malware to deploy Cobalt Strike by exploiting known vulnerabilities in internet-facing applications like Microsoft Exchange (CVE-2021-26855, CVE-2022-41082), Microsoft SharePoint (CVE-2021-27076), Openfire Server (CVE-2023-32315), and F5 BIG-IP (CVE-2023-46747), among others. The campaign highlights the critical need for timely patching and exposure management, as attackers leverage publicly available exploit code to gain initial access through remote code execution and authentication bypass. → hkcert.org |
| 2026-07-16 2026 | (More) Unauthenticated Arbitrary Code Execution in ServiceNow news 26 min read | Writeup detailing unauthenticated arbitrary code execution in ServiceNow instances, a vulnerability allowing full server-side control. The exploit involves manipulating specific input fields, such as the forgotten password username, with crafted JavaScript strings. These strings trigger a sandbox escape within ServiceNow's Rhino engine, enabling attackers to exfiltrate sensitive credentials like those for GitHub and Workday by creating scheduled jobs that decrypt data from credential tables. Patches for this issue were released incrementally, with subsequent research identifying further bypasses and primitives until the introduction of Guarded Script eventually neutralized the primary attack vectors. |
| 2026-07-16 2026 | TuxBot v3: Inside an IoT Botnet Framework With LLM-Assisted Development intermediate 25 min read AI | Library comprising the source code for TuxBot v3 Evolution, a modular IoT botnet framework. The framework features a C-based bot agent, a Go-based command-and-control server with a DDoS-for-hire panel, a custom exploit virtual machine, and automated build systems. It utilizes various fallback C2 mechanisms including DGA, P2P gossip, IRC, and DNS TXT queries. The development process leveraged large language models, resulting in some non-functional components and unremoved safety disclaimers. → unit42.paloaltonetworks.com |
| 2026-07-15 2026 | Smashing the ServiceNow Sandbox – Pre Authentication RCE intermediate 10 min read | Library for finding pre-authentication RCE vulnerabilities in ServiceNow, focusing on the GlideRecord system and its "javascript:" filter operator. This resource details how to leverage the `javascript:` prefix within `addQuery` calls to achieve remote code execution, bypassing ServiceNow's additional script sandbox by exploiting the `gs.include()` function to access script includes and ultimately gain full compromise of the instance and connected proxy servers. |
| 2026-07-15 2026 | TS-2026-009: Insecure argument handling in Tailscale SSH permitted root access news 2 min read | Bulletin TS-2026-009 details two vulnerabilities in Tailscale SSH: insecure argument handling allowing root access via malformed usernames (e.g., `-i`) and a denial-of-service flaw in Tailscale Serve/Funnel where specific HTTP requests could indefinitely pin a CPU core. Both issues are fixed in Tailscale version 1.98.9 or newer. Anthropic and Ada Logics reported these vulnerabilities. |
| 2026-07-14 2026 | CET-Compliant Callstack Spoofing via Thread Pool & Enum Callback Trampolining (Rust PoC) advanced 38 min read | Library for CET-compliant call stack spoofing, utilizing Windows Thread Pools, Enum callback trampolining, and indirect syscalls. This Rust-based Proof of Concept, with inline assembly and full CET support, crafts a call stack where every frame appears legitimate to EDR solutions by combining a `jmp`-based context switch with shadow stack pointer reconciliation. It achieves this without modifying unwind metadata, circumventing hardware enforcement of Intel CET. |
| 2026-07-14 2026 | Persistence via Fake AMSI Provider | Playbook & Detection Strategies intermediate 8 min read | Library that demonstrates persistence via a fake AMSI provider. This technique abuses the Antimalware Scan Interface (AMSI) by registering a malicious provider that can execute arbitrary code when specific trigger strings are detected in PowerShell content. The provided C++ code implements a sample AMSI provider that allows threat actors with elevated permissions to achieve persistence by bypassing security scans. |
| 2026-07-13 2026 | Unauthenticated RCE in Motorola's MR2600 Router intermediate 5 min read | Writeup detailing unauthenticated RCE in Motorola's MR2600 router, stemming from a firmware upload flaw where multipart boundary parsing is bypassed by sending raw firmware, and an authentication bypass on the `LoadFirmwareValidation` endpoint due to inconsistent URI comparison logic. This allows remote code execution by an attacker on the LAN or over the internet if remote management is enabled. |
| 2026-07-13 2026 | iCagenda and Balbooa Forms Joomla Flaws Reportedly Exploited as Zero-Days news 3 min read | Writeup on zero-day exploits targeting Joomla extensions iCagenda (CVE-2026-48939) and Balbooa Forms (CVE-2026-56291). Both vulnerabilities allow arbitrary file uploads, leading to remote code execution. Exploitation was observed since June 2026 and July 2026 respectively, affecting unpatched versions of these extensions. CISA has added these to its KEV catalog due to active exploitation in the wild. Updates have been released to address these critical flaws. → thehackernews.com |
| 2026-07-13 2026 | Palo Alto Products Multiple Vulnerabilities news 1 min read | Writeup of multiple vulnerabilities affecting Palo Alto Products including Cloud NGFW, PAN-OS (versions 10.2, 11.1, 11.2, 12.1), and Prisma Access. Exploitable conditions include remote code execution, denial of service, security restriction bypass, cross-site scripting, information disclosure, and data manipulation, impacting various versions. Specific CVEs identified are CVE-2026-0279 through CVE-2026-0288. → hkcert.org |
| 2026-07-12 2026 | Critical CVE-2026-2699 and CVE-2026-2701 Vulnerabilities Force Immediate Shutdown of Progress ShareFile Storage Zone Controller v5.x news 3 min read | Writeup detailing critical vulnerabilities CVE-2026-2699 and CVE-2026-2701 impacting Progress ShareFile Storage Zone Controller v5.x. These flaws allow unauthenticated remote attackers to access configuration pages and achieve remote code execution, enabling potential system compromise. The vulnerabilities are linked to MITRE ATT&CK techniques T1190, T1078, and T1059. Progress Software issued an urgent shutdown directive for affected on-premises deployments due to the severe risk, with no patch currently available. → rescana.com |
| 2026-07-12 2026 | Global CMS Attack Wave: Attackers Distribute Web Shells via Known WordPress Joomla and Craft Vulnerabilities news 4 min read | Analysis of a global CMS attack wave exploiting known vulnerabilities in WordPress, Joomla, Craft CMS, MaxSite CMS, and MetInfo CMS. Attackers leverage issues like CVE-2026-0740 in Ninja Forms File Uploads and CVE-2025-32432 in Craft CMS to deploy web shells, leading to potential credential harvesting, malware distribution, and internal system compromise. The campaign emphasizes the critical need for prompt patching and thorough post-compromise investigation, including file and log analysis, to remove persistence mechanisms and restore compromised systems. |
| 2026-07-10 2026 | Zero Day Initiative CVE-2026-47291: Remote Code Execution in the Windows HTTP.sys news 6 min read | Writeup detailing CVE-2026-47291, a kernel-mode remote code execution vulnerability in Windows HTTP.sys. Exploitation involves an attacker sending crafted HTTP/1.x requests over TLS, triggering a heap buffer overflow during header parsing due to insufficient bounds checking when growing a buffer reference array. This can lead to denial-of-service or code execution with kernel privileges. The vulnerability is mitigated by configuring `MaxRequestBytes` to 65,535 or lower, and detection requires monitoring TLS-encrypted traffic for an unusually high number of HTTP header lines per request. |
| 2026-07-10 2026 | Researcher Details WhatsApp-to-Host Attack Chain Using Three OpenClaw Flaws advanced 2 min read | Writeup detailing a WhatsApp-to-host attack chain leveraging three OpenClaw vulnerabilities: GHSA-hjr6-g723-hmfm and GHSA-9969-8g9h-rxwm, both involving OS command injection and incomplete input validation in the host execution environment filtering; and GHSA-575v-8hfq-m3mc, a path traversal flaw enabling sandbox bind mount bypass. These flaws allow for credential theft, privilege escalation, and arbitrary code execution without prior host compromise, as demonstrated by accessing sensitive user files or the Docker socket. → thehackernews.com |
| 2026-07-08 2026 | Attackers using Langflow flaw for credential harvesting (CVE-2026-55255) news 2 min read | Writeup on CVE-2026-55255, an insecure direct object reference (IDOR) vulnerability in Langflow versions prior to 1.9.2. This flaw allows an authenticated attacker to execute any user's flow by supplying its ID, leading to credential harvesting, cross-tenant data exposure, and secret theft, as demonstrated by attackers exploiting it alongside CVE-2026-33017 for code execution and implant delivery. CISA has mandated federal agencies patch this vulnerability by July 10, 2026. → helpnetsecurity.com |
| 2026-07-07 2026 | RCE via Gemini Live AI Voice Session Misconfiguration. advanced 10 min read AI | Library for exploiting RCE vulnerabilities in applications integrating Google's Gemini Live AI Voice sessions by injecting client-controlled setup frames. The vulnerability arises when ephemeral tokens, used for browser-facing WebSocket connections to endpoints like `BidiGenerateContentConstrained`, are issued without proper `live_connect_constraints`. This misconfiguration allows attackers to control session parameters, including the model, system instruction, and critically, the `tools` field, enabling the injection of code execution capabilities. The writeup details how the official Gemini Live API example repository promotes this insecure pattern by omitting the `bidi_generate_content_setup` from token creation. → infosecwriteups.com |
| 2026-07-03 2026 | Critical Cursor AI IDE Flaws Could Lead to OS-Level Remote Code Execution news 2 min read | Writeup detailing CVE-2026-50548 and CVE-2026-50549, dubbed DuneSlide, which allow OS-level remote code execution in the Cursor AI IDE. These flaws leverage unchecked terminal command execution and symbolic link vulnerabilities to bypass sandbox restrictions, enabling attackers to overwrite critical executables or write to arbitrary locations by manipulating path resolution logic when processing user prompts. Patches are available in Cursor 3.0. → securityweek.com |
| 2026-07-03 2026 | WinRAR flaw could allow attackers to take control of your computer news 2 min read | Writeup on CVE-2026-14191, a WinRAR vulnerability allowing remote code execution via crafted RAR5 recovery-volume (.rev) files. This bug, similar to CVE-2023-40477, exploits how WinRAR handles these repair files to write data outside allocated memory, potentially enabling attackers to run malicious code. The advisory urges users to manually update WinRAR to version 7.23, as automatic updates are not supported, and highlights the risk posed by the lack of timely updates, referencing past exploitation of similar WinRAR flaws by state-aligned groups. |
| 2026-07-03 2026 | It’s 37oC, And All We Can Think About Is ColdFusion (Adobe ColdFusion Security Bulletin APSB26-68 CVE Bonanza) - watchTowr Labs news 9 min read | Analysis of CVE-2026-48282 and CVE-2026-48313 details how Adobe ColdFusion's Remote Development Services (RDS) feature, when authentication is disabled, allows for arbitrary file reads and writes through an RPC protocol. The vulnerability arises from insufficient path validation in the `FileReadOperator` and `FileWriteOperator` methods, which were previously addressed by introducing `RdsFileSecurity.resolveCanonical` to enforce stricter path checks. → labs.watchtowr.com |
| 2026-07-02 2026 | Why Being in the Docker Group Is a Backdoor to Your Whole System intermediate AuthZ | Library explaining how membership in the `docker` group on Linux grants users root privileges on the host system without explicit `sudo` access. It details how this is an intended consequence of Docker's design, not a vulnerability, and provides a proof of concept demonstrating this capability. Administrators are advised on mitigation strategies to prevent this elevated access. → infosecwriteups.com |
| 2026-07-02 2026 | Sandbox bypass flaws in Cursor IDE highlight prompt injection as an RCE vector intermediate 3 min read | Writeup of CVE-2026-50548 and CVE-2026-50549 in Cursor IDE, detailing how prompt injection bypasses the command execution sandbox via a `working_directory` parameter override and symlink canonicalization fallbacks. These vulnerabilities, collectively dubbed DuneSlide by researchers, allow attackers to achieve remote code execution (RCE) by writing malicious scripts or overwriting executables outside the intended project directory, highlighting systemic risks in AI-assisted development tools. → csoonline.com |
| 2026-06-30 2026 | CVE-2026-55200: Critical libssh2 Client-Side SSH Vulnerability Exposes Curl Git PHP to Remote Code Execution Risk news 4 min read | Library detailing CVE-2026-55200, a critical out-of-bounds write vulnerability in libssh2 client-side SSH. This flaw allows a malicious SSH server to trigger memory corruption and potential remote code execution on clients using affected versions up to 1.11.1. The widespread use of libssh2 in tools like curl, Git, and PHP amplifies the risk. A public proof-of-concept exploit exists, increasing the likelihood of exploitation. → rescana.com |
| 2026-06-30 2026 | Langflow RCE Exploited to Deploy Monero Miner on Exposed AI App Endpoints intermediate 3 min read | Library that exploits CVE-2026-33017, a critical unauthenticated RCE vulnerability in Langflow, to deploy a Monero cryptocurrency miner. Attacks target exposed AI application endpoints, leveraging a single line of Python code to download and execute a shell script that fetches a miner binary. This payload terminates rival miners, disables security controls, establishes persistence via cron jobs, and spreads via SSH keys, impacting AI application infrastructure as a new attack vector. → thehackernews.com |
| 2026-06-30 2026 | Critical Remote Code Execution Vulnerability in libssh2 Client Library Require Urgent Mitigation news 3 min read | Library with critical vulnerabilities impacting libssh2, including CVE-2026-55200, a pre-authentication RCE due to a memory corruption bug in ssh2_transport_read(). Exploitable via a crafted packet from a malicious SSH server, this flaw affects widely used tools like curl and Git GUI clients. Urgent mitigation involves inventorying libssh2 usage, applying patches like commit 97acf3df, and restricting outbound SSH client connectivity to trusted endpoints. → arcticwolf.com |
| 2026-06-30 2026 | Enterprise Tech In, Shell Out (Progress Kemp LoadMaster Uninitialized Heap to Pre-Auth RCE CVE-2026-8037) - watchTowr Labs intermediate 13 min read | Writeup on CVE-2026-8037, an uninitialized heap to pre-authentication Remote Code Execution vulnerability in Progress Kemp LoadMaster. The vulnerability arises from improper handling of user input within the `escape_quotes` function, which fails to null-terminate an allocated buffer. This can lead to information disclosure or code execution when the uninitialized memory is later processed by the API. The writeup details the vulnerability's mechanism and the specific code changes introduced in the patch. → labs.watchtowr.com |
| 2026-06-29 2026 | Enterprise Tech In Shell Out (Progress Kemp LoadMaster Uninitialized Heap to Pre-Auth RCE CVE-2026-8037) news 13 min read | Writeup detailing CVE-2026-8037, a pre-authentication Remote Code Execution vulnerability in Progress Kemp LoadMaster. The vulnerability stems from an uninitialized heap buffer used in the `escape_quotes` function, which fails to properly sanitize user input and lacks a null terminator. Exploiting this flaw allows an attacker to gain control of the system by crafting malicious API requests. → labs.watchtowr.com |
| 2026-06-27 2026 | MCP Auto-Execution: From Git Clone to Cloud Compromise in Amazon Q VS Code Extension advanced 6 min read AI | Tool for arbitrary code execution and cloud credential theft; Amazon Q Developer Extension for VS Code automatically loaded MCP server configurations from workspace files without user consent, enabling immediate code execution upon opening a malicious repository. This vulnerability, similar to others found in AI coding tools, exploited the Model Context Protocol's convenience features and environment inheritance risks. Amazon has remediated this issue in language server version 1.65.0. → wiz.io |
| 2026-06-27 2026 | Intigriti Bug Bytes #237 - June 2026 🚀 news 10 min read AuthZ Bug Bounty | Library of AI-focused security discussions and tools, including interviews with researchers on using AI smartly in offensive security, securing AI systems, and the human element in AI adoption. It highlights Intigriti Quick Scope (IQS), a Burp Suite extension, and mentions AFL++ and Metis for fuzzing and LLM-powered code review. The entry also covers vulnerabilities like RCE in phpBB and CSP bypasses, along with winning the PortSwigger Burp Suite Extension Award and being named Best Security Company at the 2026 SC Awards Europe. → intigriti.com |
| 2026-06-25 2026 | CVE-2026-1606: Code Injection Vulnerability in GitLab CE/EE Snippets Affected Versions Risks and Remediation Steps intermediate 3 min read | Writeup detailing CVE-2026-1606, a code injection vulnerability (CWE-94) in GitLab CE/EE Snippets. Affecting versions 14.8 through 19.1.0, it allows authenticated users to conceal content due to insufficient input validation. While not enabling arbitrary code execution, this medium-severity flaw (CVSS 4.3) risks project data integrity. Patched versions include 18.11.6, 19.0.3, and 19.1.1. No active exploitation or APT group activity has been reported. → rescana.com |
| 2026-06-24 2026 | New Cisco RCE was fixed news | New Cisco RCE was fixed |
| 2026-06-24 2026 | High severity vulnerability found in libcurl and curl (CVE-2023-38545) news 5 min read | Writeup on CVE-2023-38545, a high-severity heap-based buffer overflow in libcurl and curl, released October 2023. This vulnerability, impacting numerous open source ecosystems and Linux distributions, requires specific exploit conditions like interacting with compromised servers or using attacker-controlled SOCKS5 proxy URLs. Snyk offers reporting features to identify affected projects by CVE number. → snyk.io |
| 2026-06-24 2026 | FFmpeg PixelSmash Vulnerability Enables Remote Code Execution news 3 min read | Writeup on CVE-2026-8461, the "PixelSmash" vulnerability, details how a flaw in FFmpeg's MagicYUV decoder allows remote code execution via specially crafted media files. This critical vulnerability, with a CVSS score of 8.8, affects numerous FFmpeg-dependent applications like Jellyfin and Nextcloud, and can be triggered by automated processes such as thumbnail generation or metadata extraction. Researchers successfully demonstrated RCE and denial-of-service conditions across various products including Kodi, mpv, and OBS Studio. Mitigation strategies include patching FFmpeg, disabling unnecessary codecs, restricting media uploads, and isolating media-processing workloads. → esecurityplanet.com |
| 2026-06-24 2026 | FFmpeg PixelSmash Flaw Allows RCE on Video Players Media Servers NAS Appliances news 2 min read | Library for detecting and mitigating CVE-2026-8461, a critical heap out-of-bounds write vulnerability dubbed PixelSmash within FFmpeg's MagicYUV decoder. This flaw, present in numerous video players, media servers, and NAS appliances, enables attackers to achieve remote code execution (RCE) by delivering a crafted media file, potentially leading to zero-click attacks. The library aids in identifying vulnerable FFmpeg builds and understanding the exploit vector, which involves targeting the AVBuffer struct to inject shell commands before the inevitable process crash. → securityweek.com |
| 2026-06-23 2026 | Leaky Vessels: runC and BuildKit container escape vulnerabilities - everything you need to know intermediate 10 min read Supply Chain | Writeup detailing "Leaky Vessels," container escape vulnerabilities in runC (CVE-2024-21626) and BuildKit (CVE-2024-23651, CVE-2024-23652, CVE-2024-23653). The runC flaw allows host filesystem access via leaked file descriptors, posing significant risk to Kubernetes and build pipelines. BuildKit issues involve race conditions and mount feature manipulation enabling host file modification or deletion, or elevated container privileges when using the security.insecure entitlement. The analysis highlights affected Linux distributions and cloud providers, emphasizing the widespread risk and advising immediate patching. → wiz.io |
| 2026-06-23 2026 | PixelSmash – Critical FFmpeg Vulnerability Turns Media Files into Weapons news 17 min read | Tool for detecting PixelSmash (CVE-2026-8461), a critical FFmpeg vulnerability enabling remote code execution via crafted media files. This heap out-of-bounds write affects hundreds of applications like Jellyfin, Nextcloud, Kodi, and mpv by exploiting the MagicYUV decoder's handling of slice heights, leading to crashes or arbitrary code execution when processing malicious AVI, MKV, or MOV files. → jfrog.com |
| 2026-06-22 2026 | FFmpeg PixelSmash bug triggers code execution on media file open intermediate 2 min read | Library for FFmpeg's CVE-2026-8461, "PixelSmash," a critical heap out-of-bounds write vulnerability in the MagicYUV decoder. This flaw allows remote code execution through specially crafted media files like AVI, MKV, or MOV, impacting numerous downstream applications including Kodi, OBS Studio, Jellyfin, and Nextcloud. Exploitation involves overwriting function pointers within FFmpeg's heap structures, enabling arbitrary command execution. The vulnerability was patched in FFmpeg 8.1.2. |
| 2026-06-22 2026 | Microsoft fixes AutoGen Studio flaw that enabled code execution news 2 min read | Writeup of AutoJack, a vulnerability chain in Microsoft's AutoGen Studio, detailing how attackers could manipulate AI agents into executing arbitrary commands. The chain exploits weaknesses in WebSocket trust, authentication middleware, and URL parameter handling to enable remote code execution by tricking a browsing agent into loading malicious JavaScript. Microsoft remediated the flaw before its PyPI release, limiting exposure to developers building from source during a specific window. → bleepingcomputer.com |
| 2026-06-22 2026 | [News] RCE found in Meccha Chameleon news 5 min read | Writeup detailing a Remote Code Execution (RCE) vulnerability in the game Meccha Chameleon, specifically within its custom map functionality. The vulnerability arises from the game's Blueprint scripting system executing arbitrary code via the `LaunchURL` function, which internally uses `ShellExecuteW`. Attackers can craft malicious custom maps containing a batch file in a predictable Steam Workshop content directory. When a user subscribes to this map, the batch file is automatically executed, leading to arbitrary command execution on the victim's machine. The article highlights the risk of user-generated content and recommends allowlisting asset file types and restricting Blueprint usage. |
| 2026-06-22 2026 | Backdoor in XZ Utils allows RCE: everything you need to know news 8 min read Supply Chain | Analysis of CVE-2024-3094, a critical RCE vulnerability in XZ Utils versions 5.6.0 and 5.6.1, detailing the supply chain compromise. The backdoor, injected via obfuscated test files during compilation on specific Linux distributions, targets liblzma and can affect OpenSSH, leading to remote code execution. Exploitation requires specific runtime conditions, including the absence of the TERM environment variable and targeting of the sshd binary. Mitigation involves downgrading XZ Utils versions and hunting for suspicious activity. → wiz.io |
| 2026-06-22 2026 | CVE-2024-4040 exploited in the wild: everything you need to know news 2 min read | Writeup detailing CVE-2024-4040, a critical vulnerability in CrushFTP versions prior to 10.7.1 and 11.1.0. Initially described as a VFS sandbox escape allowing arbitrary file reads, researchers found it enables unauthenticated remote code execution and administrator bypass. Exploited in the wild, this flaw, potentially a server-side template injection, affects 1.7% of cloud environments. Updating to patched versions is crucial, as previous mitigation advice regarding DMZs has been retracted. → wiz.io |
| 2026-06-22 2026 | Code injection in Python: examples and prevention beginner 7 min read Python | Library that details code injection vulnerabilities in Python, covering insecure use of functions like `eval()` and dynamic code construction. It explains risks associated with user-controlled inputs, lack of validation, and insecure deserialization, providing mitigation techniques such as allowlisting, using `literal_eval()`, parameterized queries, and secure deserialization practices. The library also emphasizes secure coding conventions and the use of developer security tools like Snyk to identify and fix issues. → snyk.io |
| 2026-06-22 2026 | AutoJack: How a single page can RCE the host running your AI agent intermediate 16 min read | Technique AutoJack demonstrates how a single web page can achieve remote code execution on the host running an AI agent, specifically targeting AutoGen Studio. By exploiting three weaknesses in the Model Context Protocol (MCP) WebSocket — an origin allowlist easily bypassed by an agent, opt-out authentication middleware, and unvalidated `server_params` from the URL—an attacker can trick the browsing agent into executing arbitrary commands on the host. This crosses the localhost trust boundary, turning the agent into a delivery vehicle for RCE. → microsoft.com |
| 2026-06-21 2026 | Active Exploitation of Critical CVE-2026-20253 in Splunk Enterprise: Unauthenticated RCE via PostgreSQL Sidecar Service news 4 min read | Writeup detailing active exploitation of CVE-2026-20253 in Splunk Enterprise, a critical vulnerability allowing unauthenticated remote code execution via the PostgreSQL Sidecar Service. This flaw, cataloged by CISA, enables attackers to create or truncate arbitrary files by abusing backup and restore endpoints, leading to potential system compromise. The article covers exploitation mechanics, including chaining operations to write malicious scripts, and provides example exploit requests, detection indicators, and mitigation steps like upgrading Splunk or disabling the affected service. → rescana.com |
| 2026-06-21 2026 | Windows Server 2016 Security Update Failures and CVE-2024-49116 RCE Vulnerability: Analysis and Mitigation Strategies news 4 min read | Analysis of CVE-2024-49116, a critical RCE vulnerability in Windows Remote Desktop Services, details use-after-free and race condition flaws exploitable by unauthenticated requests. This entry also addresses Windows Server 2016 update failures leading to domain controller restarts, resolved by KB5091572. Mitigation strategies include applying December 2024 security updates, disabling Remote Desktop Gateway services, restricting network access, and enabling NLA. Affected versions span Windows Server 2016 through 2025. → rescana.com |
| 2026-06-21 2026 | Active Exploitation Alert: Critical CVE-2026-42945 NGINX Rift Vulnerability in NGINX and F5 ProductsPatch Immediately news 5 min read | Writeup of CVE-2026-42945, dubbed "NGINX Rift," a critical heap-based buffer overflow in NGINX and F5 products. This vulnerability, affecting numerous NGINX Open Source and Plus versions, enables unauthenticated remote code execution and denial-of-service via crafted HTTP requests, particularly when using rewrite and set directives. A public PoC exploit exists, and active exploitation is confirmed. Related vulnerabilities include CVE-2026-42946 and CVE-2026-40701. Mitigation involves immediate patching or replacing unnamed PCRE captures with named ones. → rescana.com |
| 2026-06-21 2026 | Chaining Security Bugs in Discuz! X5.0: from Race Condition to Pre-Auth RCE advanced 28 min read | Library for chaining vulnerabilities in Discuz! X5.0, demonstrating a pre-authentication RCE attack. The exploit combines a Cross-Context Token Reuse leading to a Race Condition and Authentication Bypass, a custom OCR model for CAPTCHA bypass, and an administrative Local File Inclusion (LFI) vulnerability to achieve full server control. |
| 2026-06-21 2026 | Critical RCE vulnerability in PHP CGI: everything you need to know news 3 min read | Writeup of CVE-2024-4577, a critical RCE in PHP CGI, details its exploitation by TellYouThePass ransomware via argument injection on Windows systems. The vulnerability, particularly affecting Chinese and Japanese locales, leverages Windows' Best-Fit encoding feature to bypass previous protections. Affected PHP versions include 8.3 before 8.3.8, 8.2 before 8.2.20, and 8.1 before 8.1.29, as well as end-of-life versions. Mitigation involves upgrading PHP, applying temporary rewrite rules, or disabling CGI for XAMPP installations. → wiz.io |
| 2026-06-21 2026 | Probllama: Ollama Remote Code Execution Vulnerability (CVE-2024-37032) – Overview and Mitigations news 6 min read AI | Writeup of CVE-2024-37032, "Probllama," a Remote Code Execution vulnerability in Ollama, the popular open-source AI model deployment tool. The vulnerability stems from insufficient input validation in the `/api/pull` endpoint, allowing path traversal to overwrite arbitrary files. This can be leveraged to achieve arbitrary file reads and ultimately remote code execution, particularly in Docker deployments where the server runs with root privileges. Users are advised to upgrade to Ollama version 0.1.34 or newer. → wiz.io |
| 2026-06-21 2026 | RCE vulnerability in OpenSSH: everything you need to know news 3 min read | Library detailing CVE-2024-6387, a critical RCE-as-root vulnerability in OpenSSH (sshd) dubbed "regreSSHion." This signal handler race condition affects default configurations on 32-bit glibc-based Linux distributions, potentially leading to heap corruption and arbitrary code execution. Exploitation requires specific environmental conditions, making widespread attacks unlikely but possible against targeted, patient adversaries. Patches are available for affected versions, and organizations should upgrade and restrict internet-facing SSH access. → wiz.io |
| 2026-06-21 2026 | Command injection in Python: examples and prevention beginner 10 min read Python | Library for preventing command injection in Python, detailing vulnerabilities arising from insecure use of `os.system`, `subprocess.run` with `shell=True`, dynamic command construction, and `eval()`. It highlights examples like MLflow and PaddlePaddle, and emphasizes mitigation through strict input validation, sanitization, and the use of parameterized queries to protect against unauthorized command execution and system compromise. → snyk.io |
| 2026-06-21 2026 | Krampus delivers an end-of-year Struts vulnerability news 7 min read | Analysis of CVE-2023-50164, a critical Struts path traversal vulnerability, with a proof-of-concept exploit. This vulnerability allows attackers to upload files to arbitrary locations within an application's web-served directories, potentially leading to remote code execution. The article details remediation steps, including upgrading Struts to version 2.5.33 or 6.3.0.2 and implementing custom code checks using Snyk's SAST and SCA tools to prevent malicious file uploads and identify vulnerable dependencies. → snyk.io |
| 2026-06-20 2026 | Use-after-free in the QPACK encoder of nginx HTTP/3 - CVE-2026-42530 advanced 5 min read | Writeup detailing CVE-2026-42530, a use-after-free vulnerability impacting the QPACK encoder within nginx's HTTP/3 implementation. The analysis provides insights into the specific flaw found in the popular web server software. |
| 2026-06-19 2026 | Rapid7 Analysis: CVE-2020-12271: Sophos XG Firewall Pre-Auth SQL Injection Vulnerability intermediate 1 min read | Analysis of CVE-2020-12271 details a pre-authentication SQL injection vulnerability affecting Sophos XG Firewalls, which can lead to remote code execution. Exploited in the wild, this zero-day flaw, with a CVSSv3 score of 10, allows attackers to download malware, establish persistence, and exfiltrate credentials. Affected versions include 17.0, 17.1, 17.5, and 18.0. The analysis highlights reverse engineering efforts and ongoing threats even after a patch is available. → rapid7.com |
| 2026-06-19 2026 | AutoJack Attack Lets One Web Page Hijack AI Agent for Host Code Execution news 3 min read | Writeup detailing the AutoJack attack, an exploit chain targeting AutoGen Studio's pre-release versions (0.4.3.dev1 and 0.4.3.dev2). This vulnerability allows a malicious webpage, loaded by an AI browsing agent, to execute arbitrary commands on the host machine. The attack exploits three weaknesses in the Model Context Protocol (MCP) WebSocket: localhost trust, skipped authentication middleware, and unauthenticated command execution. While a plain `pip install autogenstudio` is unaffected, users of pre-releases must pull fixes from GitHub main (commit b047730) as a patched PyPI release is not yet available. This research highlights broader risks in agent frameworks, echoing similar localhost vulnerabilities found in Semantic Kernel (CVE-2026-26030, CVE-2026-25592) and ChatGPhish. → thehackernews.com |
| 2026-06-18 2026 | F5 Patches Two Critical NGINX Open Source Flaws Enabling Remote Code Execution news 2 min read | Writeup of CVE-2026-42530 and CVE-2026-42055, two critical NGINX Open Source vulnerabilities patched by F5. CVE-2026-42530, a use-after-free flaw in the HTTP/3 QUIC module, allows remote code execution. CVE-2026-42055, a heap-based buffer overflow in proxy modules, also enables code execution. Both flaws have high CVSS scores and affected various NGINX products, including NGINX Plus and Ingress Controller. Mitigations involve disabling HTTP/3 or adjusting proxy configurations. → thehackernews.com |
| 2026-06-18 2026 | F5 Patches Critical NGINX Vulnerabilities Enabling Unauthenticated Code Execution news 2 min read | Patches address critical NGINX vulnerabilities CVE-2026-42530 and CVE-2026-42055, both with CVSS 9.2. CVE-2026-42530, a Use-After-Free in `ngx_http_v3_module`, enables remote unauthenticated attackers to cause restarts or arbitrary code execution via crafted HTTP/3 sessions. CVE-2026-42055, a heap-based buffer overflow in `ngx_http_proxy_v2_module` and `ngx_http_grpc_module`, requires specific configurations like disabled header validation for potential code execution. High-severity CVE-2026-11311 and CVE-2026-50107 in NGINX Gateway Fabric also allow authenticated configuration directive injection. → securityaffairs.com |
| 2026-06-18 2026 | Under the Radar: Exploring Spring Boot Actuator Misconfigurations intermediate 10 min read Secrets | Library for detecting Spring Boot Actuator misconfigurations that can leak sensitive data like environment variables, passwords, and API keys, or even lead to remote code execution. The library highlights common vulnerabilities such as exposed `/heapdump` files and insecure `/gateway/routes` endpoints, particularly noting CVE-2022-22947 in Spring Cloud Gateway versions and default exposures prior to Spring Boot Actuator 1.5. → wiz.io |
| 2026-06-18 2026 | A Crash, Not a Shell: SolarWinds Serv-U CVE-2026-28318 advanced 5 min read | Tool for detecting SolarWinds Serv-U CVE-2026-28318, a denial-of-service vulnerability affecting versions prior to 15.5.4 HF1. The vulnerability allows an unauthenticated POST request with `Content-Encoding: deflate` to crash the service by triggering heap corruption. While heap corruption can sometimes lead to remote code execution, this analysis demonstrates that three distinct RCE exploitation paths are dead ends, confirming the vulnerability's impact is availability-only. The tool flags vulnerable hosts without triggering the crash, and mitigation involves patching or WAF filtering of POST requests with `Content-Encoding` headers. → bishopfox.com |
| 2026-06-17 2026 | Googles Vertex AI SDK could allow RCE through bucket squatting news 2 min read | Writeup of RCE vulnerability in Google's Vertex AI SDK for Python, dubbed "Bucket Squatting" and "Pickle in the Middle." Attackers could hijack model uploads by pre-registering globally unique cloud storage bucket names derived from victim project IDs and regions. This allowed injecting malicious models serialized with pickle, leading to remote code execution when processed by Vertex AI's infrastructure. The flaw affected versions 1.139.0 and 1.140.0, with fixes deployed in 1.144.0 and 1.148.0. → csoonline.com |
| 2026-06-17 2026 | Rapid7 Analysis: CVE-2020-3992 ESXi OpenSLP remote code execution vulnerability news 2 min read | Analysis of CVE-2020-3992 details a critical use-after-free vulnerability in VMware ESXi's OpenSLP service, allowing remote code execution with a CVSSv3 score of 9.8. This actively exploited vulnerability, also seen in conjunction with CVE-2019-5544, poses a significant threat as ransomware groups target critical hypervisor infrastructure. Mitigation involves patching ESXi, disabling the SLP service, and restricting management network access. → rapid7.com |
| 2026-06-17 2026 | Rapid7 Analysis: CVE-2020-16952 Microsoft SharePoint Remote Code Execution Vulnerabilities news 2 min read | Analysis of CVE-2020-16952 details a Microsoft SharePoint remote code execution vulnerability. Exploitable by authenticated users, it allows arbitrary file disclosure, including the web.config file, enabling .NET deserialization attacks via ysoserial.net. A Metasploit module and Python proof-of-concept exist, demonstrating straightforward exploitation by leaking keys to forge malicious ViewState payloads. Rapid7 recommends immediate patching for SharePoint Foundation 2013, Enterprise Server 2016, and Server 2019. → rapid7.com |
| 2026-06-17 2026 | Rapid7 Analysis: CVE-2021-26084 Confluence Server OGNL injection news 14 min read | Analysis of CVE-2021-26084 details a critical OGNL injection vulnerability in Atlassian Confluence Server and Data Center. This flaw, carrying a CVSSv3 score of 9.8, allows unauthenticated remote code execution. Widespread exploitation began in September 2021, with attackers initially deploying coin miners and later ransomware. The vulnerability resides in the `createpage-entervariables` functionality, and proof-of-concept code is publicly available. → rapid7.com |
| 2026-06-17 2026 | Rapid7 Analysis: Pre-auth RCE in ForgeRock Access Manager (CVE-2021-35464) news 10 min read | Analysis of CVE-2021-35464 reveals a pre-authentication remote code execution vulnerability in ForgeRock Access Manager and OpenIdentity Platform's OpenAM. This Java deserialization flaw within the JATO framework is exploitable via a simple GET or POST request, yielding code execution on vulnerable systems running versions below 7.0 on Java 8. Rapid7 identified over 1,000 internet-facing systems potentially exposed, with proof-of-concept exploit code readily available. → rapid7.com |
| 2026-06-17 2026 | Rapid7 Analysis: CVE-2021-44228 (Log4Shell) news 20 min read | Analysis of CVE-2021-44228, the Log4Shell vulnerability in Apache Log4j, details its critical remote code execution capabilities triggered by specially crafted log messages. This write-up provides exploitation methods, including a proof-of-concept against Apache Struts 2, and outlines mitigation strategies like upgrading Log4j, setting system properties, or removing the `JndiLookup` class. It also recommends monitoring for indicators like "${jndi:" strings and mentions IDS coverage from EmergentThreat Labs. → rapid7.com |
| 2026-06-17 2026 | Rapid7 Analysis: CVE-2022-26134 news 7 min read | Analysis of CVE-2022-26134 details a critical unauthenticated RCE vulnerability in Atlassian Confluence Server and Data Center. This OGNL injection flaw, exploitable via HTTP requests, allows attackers to execute arbitrary code on the server. Rapid7's writeup provides technical details on exploitation, including crafted curl commands that insert payloads into URIs and retrieve command output via HTTP headers, and notes that this vulnerability is similar to CVE-2021-26084. → rapid7.com |
| 2026-06-17 2026 | Rapid7 Analysis: CVE-2022-3786 news 5 min read | Analysis of CVE-2022-3786 details an arbitrary-length overflow vulnerability in OpenSSL's Punycode library within libcrypto.so. This flaw, occurring during Punycode domain name parsing via the `ossl_a2ulabel` function, allows for infinite period characters to be appended to a buffer, potentially leading to denial of service or, in rare circumstances, exploitable memory corruption. While exploitation is unlikely due to specific memory layout requirements, affected versions include OpenSSL 3.0.0 through 3.0.6. Updating to OpenSSL 3.0.7 is recommended. → rapid7.com |
| 2026-06-17 2026 | Rapid7 Analysis: CVE-2023-42793 news 9 min read | Analysis of CVE-2023-42793 reveals a critical authentication bypass in JetBrains TeamCity, affecting versions prior to 2023.05.4. This vulnerability, stemming from an improper handling of the wildcard path `/**/RPC2` within the `RequestInterceptors` class, allows unauthenticated attackers to achieve remote code execution. By exploiting this flaw, attackers can gain access to sensitive data like source code and build artifacts, potentially enabling supply chain attacks. The analysis details patch diffing using BeyondCompare and decompilation with cfr to identify the root cause in `RequestInterceptors.java` and the target endpoint within the `rest-api.jar`. → rapid7.com |
| 2026-06-17 2026 | Rapid7 Analysis: CVE-2023-46747 news 4 min read | Analysis of CVE-2023-46747 details an unauthenticated remote code execution vulnerability in F5 BIG-IP's Traffic Management User Interface (TMUI). This flaw, stemming from mishandled AJP requests between Apache and the AJP server, allows attackers to smuggle AJP requests. By crafting specific requests, an attacker can create a new administrator user, change its password, and then exploit the system to leak hashes or execute OS commands via the `mgmt/tm/util/bash` resource, achieving full device compromise. → rapid7.com |
| 2026-06-17 2026 | Critical LiteLLM Vulnerability Chain Enables Remote Code Execution and Full AI Gateway Server Takeover (CVE-2026-42271 CVE-2026-47101 CVE-2026-47102 CVE-2026-40217) news 5 min read | Writeup detailing a critical vulnerability chain in LiteLLM, impacting versions prior to v1.83.14-stable. The chain, comprising CVE-2026-47101 (Authorization Bypass), CVE-2026-47102 (Privilege Escalation), and CVE-2026-40217/CVE-2026-42271 (Remote Code Execution), allows low-privilege users to achieve full administrative control and execute arbitrary code on AI gateway servers. Exploitation in the wild has been observed for CVE-2026-42271, and supply chain attacks via backdoored PyPI releases have also occurred, highlighting the severe risks and need for immediate upgrades. → rescana.com |
| 2026-06-17 2026 | Wiz Research Identifies Exploitation in the Wild of Aviatrix Controller RCE (CVE-2024-50603) news 4 min read AuthZ | Writeup of CVE-2024-50603, an unauthenticated RCE in Aviatrix Controller, detailing its command injection flaw and exploitation in the wild for cryptojacking and Sliver backdoor deployment. The vulnerability, stemming from improper input neutralization in API endpoints like `list_flightpath_destination_instances`, allows arbitrary command execution. Wiz Research observed exploitation leading to privilege escalation in AWS control plane environments, with affected versions requiring urgent patching to 7.1.4191 or 7.2.4996. → wiz.io |
| 2026-06-17 2026 | How Wiz found a Critical NVIDIA AI vulnerability: Deep Dive into a container escape (CVE-2024-0132) intermediate 11 min read | Writeup detailing CVE-2024-0132, a critical container escape vulnerability in NVIDIA Container Toolkit and GPU Operator. This vulnerability allows attackers who control a container image to gain full access to the host system by mounting the host's root filesystem and exploiting access to container runtime sockets. The article discusses exploitation methods against Docker and gVisor, mentions a bypass vulnerability (CVE-2025-23359), and recommends updating to NVIDIA Container Toolkit version 1.17.4 for mitigation. → wiz.io |
| 2026-06-17 2026 | Pickle in the Middle – Hijacking Vertex AI Model Uploads for Cross-Tenant RCE intermediate 12 min read AI Supply Chain | Writeup detailing a "Pickle in the Middle" attack against Vertex AI model uploads in google-cloud-aiplatform SDK versions 1.139.0 and 1.140.0. The vulnerability arises from predictable default bucket names and a missing ownership check, allowing attackers to squat preemptively create a staging bucket in their own project and then replace a victim's model with a malicious one that exploits pickle deserialization for cross-tenant RCE. → unit42.paloaltonetworks.com |
| 2026-06-16 2026 | Critical Oracle PeopleSoft Vulnerability Actively Exploited in ShinyHunters Campaign news 2 min read | Writeup of CVE-2026-35273, a critical Oracle PeopleSoft vulnerability, details its active exploitation by the ShinyHunters group in widespread data theft campaigns. This unauthenticated remote code execution flaw, with a CVSS 3.1 score of 9.8, has been leveraged by attackers to compromise hundreds of instances globally, disproportionately impacting the education sector. ShinyHunters employ a "gadget chain" and demonstrate deep PeopleSoft architecture knowledge to extract credentials, with ransom notes like README-IF-YOU-SEE-THIS-YOUVE-BEEN-HACKED.TXT observed. Immediate patching via Oracle's out-of-band security alert is recommended, with temporary workarounds including network access restrictions and WAF rules. → arcticwolf.com |
| 2026-06-16 2026 | Pickle in the Middle Hijacking Vertex AI Model Uploads for Cross-Tenant RCE advanced 12 min read | Toolchain vulnerability in the Google Cloud Vertex AI SDK for Python allows attackers to hijack model uploads for cross-tenant RCE. Exploiting predictable default bucket names and a missing ownership check, attackers can preemptively squat a bucket, cause legitimate model artifacts to be uploaded to their project, and then replace the model with a malicious version that leverages pickle deserialization to execute arbitrary code within the victim's Vertex AI serving infrastructure. This affects google-cloud-aiplatform SDK versions 1.139.0 and 1.140.0, with fixes available in v1.148.0. → unit42.paloaltonetworks.com |
| 2026-06-16 2026 | IngressNightmare: CVE-2025-1974 - 9.8 Critical Unauthenticated Remote Code Execution Vulnerabilities in Ingress NGINX news 14 min read API Sec | Writeup of IngressNightmare (CVE-2025-1974), a series of critical unauthenticated RCE vulnerabilities affecting Ingress NGINX Controller for Kubernetes. This flaw allows attackers to gain unauthorized access to all cluster secrets, enabling complete cluster takeover. The vulnerabilities stem from remote NGINX configuration injection into the admission controller, a common, often externally exposed, component. Exploitation has been observed in over 6,500 clusters. Mitigation involves updating to patched versions or disabling the admission controller. → wiz.io |
| 2026-06-16 2026 | Ivanti EPMM RCE Vulnerability Chain Exploited in the Wild news 6 min read | Writeup of Ivanti EPMM RCE vulnerability chain exploitation, detailing how CVE-2025-4427 (authentication bypass) and CVE-2025-4428 (post-auth RCE via Java Expression Language injection) are combined for unauthenticated remote code execution. The analysis includes observed exploitation in the wild, use of Sliver beacons, MySQL database dumping, and web shell deployments, referencing affected versions and patched releases. → wiz.io |
| 2026-06-16 2026 | Understanding command injection vulnerabilities in Go beginner 7 min read | Library for mitigating command injection vulnerabilities in Go applications. It details how insecurely handling user input with packages like `os/exec` can lead to attackers executing arbitrary commands, potentially causing data breaches or system compromise. The library emphasizes secure coding practices such as rigorous input validation and sanitation, preferring safe APIs (like `github.com/disintegration/imaging` for image manipulation) over direct system command execution, and refactoring vulnerable code to use `exec.Command` with separate arguments instead of constructing shell strings. → snyk.io |
| 2026-06-15 2026 | Langflow RCE under active attack months after a patch was shipped news 3 min read | Writeup detailing CVE-2026-5027, a path traversal vulnerability in Langflow versions up to 1.8.4. This flaw allows unauthenticated attackers to write files to arbitrary locations, leading to remote code execution when auto-login is enabled. Exploited by the MuddyWater group, the vulnerability affects thousands of internet-exposed instances of the popular AI orchestration platform. → csoonline.com |
| 2026-06-15 2026 | Exposed JDWP Exploited in the Wild: What Happens When Debug Ports Are Left Open beginner 5 min read | Library for detecting and preventing attacks exploiting exposed Java Debug Wire Protocol (JDWP) interfaces. This protocol, often unintentionally exposed in popular applications like TeamCity, Jenkins, and Spring Boot, allows for remote code execution. Attackers can leverage this misconfiguration to deploy malware, establish persistence through various methods including systemd services and cron jobs, and execute stealthy cryptomining payloads like customized XMRig. The library aids in identifying exploitation attempts and the subsequent malicious activities, such as those observed in the wild with rapid exploitation of JDWP ports. → wiz.io |
| 2026-06-15 2026 | NVIDIAScape - Critical NVIDIA AI Vulnerability: A Three-Line Container Escape in NVIDIA Container Toolkit (CVE-2025-23266) news 7 min read AI | Library for discovering CVE-2025-23266, a critical NVIDIA Container Toolkit vulnerability allowing a three-line Dockerfile escape to gain root access on the host. This flaw, dubbed #NVIDIAScape, impacts managed AI cloud services by enabling malicious containers to bypass isolation and compromise other customers' data and models on shared GPU infrastructure. Affected versions include NCT up to v1.17.7 and NVIDIA GPU Operator up to 25.3.1. Mitigation involves upgrading the toolkit or disabling the enable-cuda-compat hook. → wiz.io |
| 2026-06-15 2026 | Ultralytics AI Pwn Request Supply Chain Attack news 6 min read AI Supply Chain | Analysis of the Ultralytics supply chain attack, which occurred in two phases between December 4-7, 2024, details how malicious versions (8.3.41, 8.3.42, 8.3.45, 8.3.46) were published to PyPI. The attack exploited a template injection vulnerability in GitHub Actions workflows, specifically using a `pull_request_target` trigger with unescaped template expressions in a crafted branch name to execute a shell script. This script exfiltrated GitHub tokens, poisoned the pip cache, and injected a Monero cryptocurrency mining payload (XMRig) into the package, impacting users across projects like ComfyUI and Comic-Translate. → snyk.io |
| 2026-06-14 2026 | MeshCentral: From XSS to RCE advanced 8 min read XSS | Writeup detailing a full RCE exploit chain against MeshCentral, starting with an XSS vulnerability. The analysis demonstrates how a large language model, Claude Opus, was used to discover and develop a Proof of Concept, which was then refined to allow an attacker to impersonate an existing agent by extracting credentials from local files. The article contrasts this with a failed attempt using a local, uncensored LLM, highlighting the practical application of AI in security research and exploit development. |
| 2026-06-14 2026 | Breaking NVIDIA Triton: CVE-2025-23319 - A Vulnerability Chain Leading to AI Server Takeover advanced 6 min read AI | Library for discovering vulnerabilities in NVIDIA Triton Inference Server, including CVE-2025-23319, CVE-2025-23320, and CVE-2025-23334. This exploit chain begins with a Python backend information leak, allowing an attacker to abuse the shared memory API for arbitrary read/write operations, potentially leading to remote code execution and full server takeover. The findings highlight the critical need for securing AI infrastructure. → wiz.io |
| 2026-06-13 2026 | Why Use App-Level Auth When Every Database Has Auth? (Splunk Enterprise CVE-2026-20253 Pre-Auth RCE) - watchTowr Labs news 15 min read AuthZ | Writeup detailing Splunk Enterprise CVE-2026-20253, a pre-authentication RCE vulnerability. The analysis highlights how the PostgreSQL Sidecar Service Endpoint, enabled by default in AWS deployments and Splunk versions 10+, lacks authentication, allowing unauthenticated invocation of file operations like backup and restore. This research demonstrates a path to exploitation by proxying requests through the main Splunk web application. → labs.watchtowr.com |
| 2026-06-13 2026 | RediShell: Critical Remote Code Execution Vulnerability (CVE-2025-49844) in Redis, 10 CVSS score news 5 min read | Writeup of CVE-2025-49844, dubbed RediShell, a critical 10.0 CVSS score Use-After-Free vulnerability in Redis. This flaw allows authenticated attackers to escape the Lua sandbox via crafted Lua scripts, achieving arbitrary native code execution on the Redis host. Affecting Redis and forks like Valkey, along with managed services such as Amazon ElastiCache, Google Cloud Memorystore, and Azure Cache for Redis, exploitation can lead to system compromise, data exfiltration, and lateral movement. Immediate patching and security hardening, including enabling authentication and restricting access, are crucial. → wiz.io |
| 2026-06-12 2026 | Why Use App-Level Auth When Every Database Has Auth? (Splunk Enterprise CVE-2026-20253 Pre-Auth RCE) intermediate 14 min read | Writeup detailing CVE-2026-20253, a pre-authentication Remote Code Execution vulnerability in Splunk Enterprise. The writeup explains how the PostgreSQL Sidecar Service, enabled by default on AWS deployments and available in version 10+, lacks authentication, allowing unauthenticated users to trigger file operations like backup creation. This leads to arbitrary file creation and truncation, ultimately enabling RCE through the Splunkd web application which proxies requests to the vulnerable service on port 5435. → labs.watchtowr.com |
| 2026-06-12 2026 | LangGraph Flaw Chain Exposes Self-Hosted AI Agents to Remote Code Execution news 2 min read | Writeup on LangGraph vulnerabilities, detailing a critical chain involving CVE-2025-67644 (SQL injection) and CVE-2026-28277 (unsafe msgpack deserialization) that enables remote code execution on self-hosted AI agent deployments. Additional vulnerability CVE-2026-27022, a RediSearch Query Injection, also impacts checkpoint functionality. The chain exploits metadata filters and checkpoint data manipulation to achieve arbitrary code execution. → thehackernews.com |
| 2026-06-12 2026 | Marking Your Own Homework (Check Point Remote Access VPN IKEv1 Authentication Bypass CVE-2026-50751) - watchTowr Labs news 11 min read AuthN | Analysis of CVE-2026-50751 reveals a critical authentication bypass vulnerability in Check Point Remote Access VPN IKEv1 implementations. A logic flaw in certificate validation allowed attackers to bypass signature verification by manipulating a flag, effectively preventing authentication. This vulnerability, present in multiple Gaia versions, was exploited in the wild by threat actors, including a Qilin ransomware affiliate. The patch involves modifying the `process_cert_payloads` function within the `iked` daemon to enforce policy-based certificate validation rather than client-controlled flags. → labs.watchtowr.com |
| 2026-06-12 2026 | The RCE that AMD wouldn't fix news 6 min read | Writeup detailing a trivial Remote Code Execution (RCE) vulnerability discovered in AMD's AutoUpdate software, where HTTP URLs for executable downloads enabled Man-in-the-Middle attacks, allowing for the substitution of malicious executables. The author encountered initial rejection from AMD's bug bounty program due to the MITM scenario being out of scope, but AMD later agreed to issue a CVE and implement a fix after public disclosure. The writeup also highlights issues with extended embargo periods and a subsequent redirection bug that rendered the RCE unexploitable. |
| 2026-06-12 2026 | React2Shell (CVE-2025-55182): Everything You Need to Know About the Critical React Vulnerability news 5 min read | Library for detecting and mitigating React2Shell (CVE-2025-55182), a critical RCE vulnerability in React Server Components and Next.js exploiting insecure deserialization. This unauthenticated flaw, affecting default configurations, allows crafted HTTP requests to influence server-side execution. Exploitation has been observed in the wild by Wiz, Amazon, and Datadog, with post-exploitation activity including credential harvesting and cryptomining. Immediate patching is required, as hardened releases for React and Next.js are available. → wiz.io |
| 2026-06-12 2026 | React2Shell: Technical Deep-Dive & In-the-Wild Exploitation of CVE-2025-55182 intermediate 10 min read | Writeup of CVE-2025-55182 "React2Shell," detailing its exploit mechanics and observed in-the-wild attacks. The vulnerability, an improper input deserialization flaw in React Server Components, allows arbitrary code execution on the server. The analysis highlights exploitation in Next.js, Waku, and Vite, with observed attacks including credential harvesting, cloud metadata access, cryptominer deployment, and the use of Sliver implants for persistent backdoors, including a fileless backdoor achieved by monkey-patching Node.js. → wiz.io |
| 2026-06-12 2026 | Gogs 0-Day Exploited in the Wild news 6 min read | Analysis of CVE-2025-8110, a zero-day RCE in Gogs exploited in the wild, reveals a symlink bypass of a previous vulnerability (CVE-2024-55947). This flaw allows authenticated users to overwrite files outside the repository by exploiting Gogs' handling of symbolic links within its API, leading to arbitrary command execution. Over 700 compromised instances were identified, with attackers using the Supershell framework for C2 communication. Gogs version v0.13.4 addresses this issue. → wiz.io |
| 2026-06-12 2026 | Hacking Into A Server Through FTP beginner | This article explores the continued vulnerability of servers still using FTP (File Transfer Protocol). It highlights how this outdated protocol can be a gateway for attackers to gain unauthorized access to sensitive data and systems. The piece likely details the methods used in such attacks and emphasizes the importance of migrating to more secure alternatives to prevent potential breaches. → infosecwriteups.com |
| 2026-06-12 2026 | Google Chrome Multiple Vulnerabilities news | Writeup detailing multiple vulnerabilities in Google Chrome, including CVE-2026-12007 through CVE-2026-12035. Exploitation of these flaws could lead to remote code execution, denial of service, security restriction bypass, and sensitive information disclosure. Patches are available by updating Google Chrome to version 149.0.7827.114 (Linux) or 149.0.7827.114/.115 (Mac/Windows) or later. → hkcert.org |
| 2026-06-11 2026 | ShinyHunters Exploits Oracle PeopleSoft Zero-Day (CVE-2026-35273) to Breach Universities news 3 min read | Writeup of CVE-2026-35273, a critical Oracle PeopleSoft remote code execution vulnerability, exploited by the ShinyHunters group against universities. The zero-day, affecting PeopleTools 8.61 and 8.62, allowed unauthenticated network access for server takeover. Attackers used custom MeshCentral agents and a lateral movement script to exfiltrate data, targeting endpoints with exposed Environment Management Hubs. Mitigation involves disabling the service, blocking specific paths, and hunting for indicators like unexpected JSP files or outbound SMB traffic. → thehackernews.com |
| 2026-06-11 2026 | Claroty finds authentication bypass RCEflaws in Vertiv UPS management cards that could disrupt data center operations advanced 4 min read | Writeup of CVE-2025-46412 and CVE-2025-41426, authentication bypass and RCE flaws in Vertiv Liebert UPS management cards. Researchers detailed how a URI confusion vulnerability in the web server allowed attackers to bypass authentication by manipulating URL parsing logic, enabling unauthorized access to sensitive functions like configuration uploads and firmware upgrades on RDU101 and UNITY-DP models. The stack-based buffer overflow vulnerability enabled remote code execution. |
| 2026-06-11 2026 | Hackers Exploit Langflow Vulnerability for Remote Code Execution news 1 min read | Writeup of CVE-2026-5027, a path traversal vulnerability in Langflow, allowing unauthenticated remote code execution. Exploitation involves sending a request to the `/api/v2/files` endpoint without sanitizing the `filename` parameter, enabling attackers to write files to arbitrary locations and achieve RCE. The flaw is particularly dangerous due to Langflow's default unauthenticated auto-login feature. This highlights a trend of attackers targeting AI development tooling. → securityweek.com |
| 2026-06-11 2026 | Patch Tuesday June 2026: 211 Fixes Critical CVEs news 5 min read | Analysis of Microsoft's June 2026 Patch Tuesday reveals 211 fixes, including 37 critical vulnerabilities, with a significant focus on enabling multi-stage attack chains. Key risks highlighted are CVE-2026-47291, a critical HTTP.sys RCE with a CVSS score of 9.8 and exploitation more likely, and CVE-2026-41091, a Microsoft Defender Elevation of Privilege vulnerability with detected exploitation. The release underscores attackers assembling attack chains across trusted enterprise platforms like Office, SharePoint, and Exchange, with a persistent emphasis on Elevation of Privilege vulnerabilities and Security Feature Bypasses impacting components such as BitLocker. |
| 2026-06-11 2026 | CodeBreach: Infiltrating the AWS Console Supply Chain and Hijacking AWS GitHub Repositories via CodeBuild advanced 13 min read Supply Chain | Tool for infiltrating the AWS Console supply chain, CodeBreach exploits a CodeBuild misconfiguration, allowing unauthenticated attackers to hijack key AWS GitHub repositories, including the JavaScript SDK. This vulnerability, stemming from unanchored regex filters in build triggers, could lead to platform-wide compromise by enabling malicious code injection. Mitigations include securing CodeBuild-GitHub connections with fine-grained tokens and ensuring anchored regex patterns for webhook filters. → wiz.io |
| 2026-06-11 2026 | 10 year old critical vulnerability in phpBB affecting tens of millions of users across thousands of forums news 2 min read AuthN | Library for securing phpBB instances, detailing a critical Authentication Bypass vulnerability discovered by Aikido's AI pentesting tool. This flaw, affecting versions up to 3.3.16 and 4.0.0-a2, allows unauthenticated users to gain valid sessions and impersonate any user, including administrators, leading to potential private message leaks and full forum control. While direct RCE is not possible, the vulnerability necessitates immediate upgrades to phpBB 3.3.17 to mitigate account takeover risks. → aikido.dev |
| 2026-06-10 2026 | Critical Ivanti Sentry flaw allows root-level remote code execution (CVE-2026-10520) news 2 min read | Analysis of CVE-2026-10520, an OS command injection vulnerability in Ivanti Sentry, details how unauthenticated attackers can achieve root-level remote code execution. This critical flaw, along with CVE-2026-10523 (authentication bypass), affects versions prior to 10.5.2, 10.6.2, and 10.7.1. WatchTowr researchers provided technical details and a script for detecting exposure, noting the vulnerability stems from an unauthenticated API accepting internal configuration commands. → helpnetsecurity.com |
| 2026-06-10 2026 | Unpatched Langflow Flaw CVE-2026-5027 Exploited for Unauthenticated RCE news 1 min read | Writeup of CVE-2026-5027, a path traversal vulnerability in Langflow exploited for unauthenticated RCE. The flaw in the `POST /api/v2/files` endpoint allows attackers to write files to arbitrary locations using '../' sequences. Exploitation can lead to arbitrary code execution, especially since Langflow's auto-login is enabled by default. This follows other exploited Langflow CVEs like CVE-2026-0770 and CVE-2025-34291. → thehackernews.com |
| 2026-06-10 2026 | 10 year old critical vulnerability in phpBB affecting tens of millions of users across thousands of forums news 2 min read | Tool discovery by Aikido Attack identified a critical Authentication Bypass vulnerability in phpBB, potentially leading to Remote Code Execution. This flaw impacts versions up to 3.3.16 and 4.0.0-a2, and was promptly patched in version 3.3.17 following a rapid disclosure via HackerOne. Exploitation can grant unauthorized session access, exposing private messages or full administrative control. → aikido.dev |
| 2026-06-10 2026 | Unauthenticated RCE as QSECOFR via IBM i Management Central — port 5555, client-controlled verify flag, no credentials required (V7R4 and earlier) news 10 min read | Tool for unauthenticated Remote Code Execution on IBM i Management Central (port 5555) targeting V7R4 and earlier. This tool exploits a vulnerability in the custom MGTC packet protocol, specifically within the `McPacketableAuthenticationData` structure. By manipulating the `verify` flag to skip validation and providing a crafted `userId`, an attacker can execute arbitrary CL commands as the QSECOFR user without requiring credentials. The exploit bypasses authentication checks by setting `verify` to 0 and utilizing specific class IDs like `McStartRequest` with `McEndpointManagedCmdData` and `McManagedCmdDefinition`. |
| 2026-06-10 2026 | Security Advisory: Critical RCE Vulnerabilities in React Server Components (CVE-2025-55182) news 4 min read Deser | Advisory detailing CVE-2025-55182, a critical RCE vulnerability affecting React 19 and Next.js versions through unsafe deserialization in the React Server Components (RSC) "Flight" protocol. Exploitation requires a single crafted HTTP request and impacts any framework embedding RSC, including Vite and Parcel plugins. Immediate patching of React and Next.js is recommended, alongside validation of third-party frameworks and implementation of defense-in-depth controls like runtime sandboxing and WAF rules. → snyk.io |
| 2026-06-10 2026 | Wait, binding.gyp Can Do What? Exploring npm's Weirdest Build System intermediate 15 min read Supply Chain | Library for identifying vulnerabilities in `binding.gyp` files, which `npm` executes during package installation. This library explores how attackers can abuse `binding.gyp`'s command expansion feature and Python `eval()` sandbox to execute arbitrary code, as demonstrated by the Miasma worm which exploited Red Hat packages and others like `@vapi-ai/server-sdk`. It details techniques for escaping the `eval()` sandbox to achieve arbitrary code execution, even when no explicit lifecycle scripts are present in `package.json`. → aikido.dev |
| 2026-06-10 2026 | Six Proto6 Vulnerabilities in protobuf.js Expose Node.js Apps to RCE and DoS news 2 min read | Writeup detailing six Proto6 vulnerabilities in protobuf.js (CVE-2026-44289 through CVE-2026-44295), impacting Node.js applications. These flaws, stemming from improper schema and metadata handling, can lead to remote code execution (RCE) and denial-of-service (DoS) through unbounded recursion, unsafe option paths, prototype pollution, and crafted field names or schema names. Exploitation is particularly concerning in data and AI ecosystems, affecting tools like Baileys and CI/CD pipelines, with CVE-2026-44291 posing the most severe RCE risk via prototype pollution. → thehackernews.com |
| 2026-06-10 2026 | More Evidence That Words Don't Mean What We Thought They Meant (Ivanti Sentry Pre-Auth OS Command Injection CVE-2026-10520) news 8 min read | Analysis of CVE-2026-10520 in Ivanti Sentry reveals a critical pre-authenticated OS command injection vulnerability. Exploiting this flaw allows remote, unauthenticated attackers to achieve root-level remote code execution by crafting specific input strings processed by the `handleMessage` endpoint. The vulnerability stems from improper handling of user-supplied `message` parameters, which are parsed and directly passed into internal commands, enabling the injection of arbitrary OS commands. This advisory details the affected versions and the technical path leading to this high-severity flaw. → labs.watchtowr.com |
| 2026-06-09 2026 | Critical Veeam RCE flaw Lets Low-Privilege Users Take Over Backup Servers news 1 min read | Writeup of CVE-2026-44963, a critical RCE vulnerability in Veeam Backup & Replication 12.x, allowing low-privileged domain users to compromise backup servers. This flaw, with a CVSS v4 score of 9.4, could enable attackers to delete or encrypt backups, steal data, and extract credentials for further network compromise. A previous critical vulnerability, CVE-2025-23121, was patched in June 2025. → securityaffairs.com |
| 2026-06-09 2026 | Veeam Backup & Replication RCE Flaw Lets Domain Users Run Remote Code news | Writeup of CVE-2026-44963, a critical remote code execution flaw in Veeam Backup & Replication impacting version 12.3.2.4465 and earlier. This vulnerability, with a CVSS score of 9.4, allows authenticated domain users to execute code on the Backup Server. Veeam has released patches, addressing the issue in version 12.3.2.4854, and noting that version 13.x builds are not affected due to architectural changes. → thehackernews.com |
| 2026-06-09 2026 | New Veeam vulnerability exposes backup servers to RCE attacks news 2 min read | Writeup detailing CVE-2026-44963, a critical remote code execution flaw in Veeam Backup & Replication (VBR) versions 12.3.2.4465 and earlier, which allows authenticated domain users to compromise backup servers. This vulnerability impacts domain-joined installations, a configuration that deviates from Veeam's best practices. The article highlights the history of VBR flaws being exploited by ransomware gangs like Akira, Fog, Frag, FIN7, and Cuba, and notes that reverse-engineering of patches is likely to occur. Veeam has released patches in version 12.3.2.4854. → bleepingcomputer.com |
| 2026-06-09 2026 | Vulnerabilities in Logseq software news 1 min read | Writeup on CVE-2026-9279 and related vulnerabilities in Logseq software. This analysis details how an IPC handler bypass via shell metacharacters in arguments to `child_process.spawn` allows arbitrary shell command execution. Additional vulnerabilities include improper path validation in preload scripts leading to file manipulation, stored XSS in `package.json`'s name field, and a sandbox escape flaw enabled by a disabled CSP, allowing arbitrary JavaScript execution in the host context. Version v0.10.15 was confirmed vulnerable. → cert.pl |
| 2026-06-09 2026 | Active Exploitation Alert: CVE-2026-42271 and CVE-2026-48710Unauthenticated RCE in LiteLLM AI Gateway via Starlette Host Header Bypass news 5 min read | Writeup details active exploitation of CVE-2026-42271, an unauthenticated RCE in LiteLLM AI Gateway, by chaining it with a Starlette Host header bypass (CVE-2026-48710). This chain enables attackers to execute arbitrary commands on vulnerable systems, leading to full compromise. Exploitation is widespread, with the vulnerabilities listed on CISA's KEV catalog. The article explains the technical exploitation flow and suggests upgrading LiteLLM to version 1.83.7 and Starlette to 1.0.1 as mitigation. → rescana.com |
| 2026-06-09 2026 | Claude Mythos: Preparing for a World Where AI Finds and Exploits Vulnerabilities Faster Than Ever advanced 10 min read AI | Analysis of Anthropic's Claude Mythos, an AI model capable of autonomously discovering zero-day vulnerabilities and generating exploits. This capability signals a future where AI-driven vulnerability research accelerates, leading to more CVEs in the short term and necessitating an AI-focused AppSec program for defense in the medium-to-long term. The trend suggests attackers will leverage AI, requiring defenders to adapt by integrating AI into security tooling and workflows to proactively identify and remediate flaws. → wiz.io |
| 2026-06-09 2026 | Securing AI Applications From Inception to Deployment intermediate 5 min read AI | Library extending Wiz AI-APP to the code layer, Wiz Code integrates with IDEs and the CLI to detect AI-specific risks during development. It validates exploitability at runtime using an AI attacker, Red Agent, then automates remediation with Green Agent, generating context-aware fixes and delegating tasks to coding agents. This unified approach aligns with OWASP Top 10 for LLM Applications 2025 and Agentic Applications 2026, securing the entire AI application lifecycle from inception to production. → wiz.io |
| 2026-06-09 2026 | Securing GitHub: Wiz Research uncovers Remote Code Execution in GitHub.com and GitHub Enterprise Server (CVE-2026-3854) news 10 min read | Writeup of CVE-2026-3854, an RCE vulnerability in GitHub's git infrastructure, identified by Wiz Research. The flaw in the X-Stat header parsing allowed authenticated users to execute arbitrary commands on backend servers via a crafted git push. Exploitation leverages injection of fields like `rails_env`, `custom_hooks_dir`, and `repo_pre_receive_hooks` to bypass sandboxing and achieve command execution. This impacts both GitHub.com and GitHub Enterprise Server, with immediate patching recommended for GHES customers. → wiz.io |
| 2026-06-09 2026 | How a Poisoned Security Scanner Became the Key to Backdooring LiteLLM news 9 min read Python Supply Chain | Library detailing the compromise of the `litellm` Python package via a poisoned Trivy security scanner. The attack chain, attributed to threat actor TeamPCP, involved rewriting Git tags in Trivy's GitHub Action, leading to credential exfiltration used to publish malicious `litellm` versions. These versions utilized source injection and a `.pth` file for payload delivery, a technique mapped to MITRE ATT\&CK T1546.018. The payload performed extensive data collection, encrypted and exfiltrated information, and established local persistence and Kubernetes lateral movement. → snyk.io |
| 2026-06-09 2026 | Axios npm Package Compromised: Supply Chain Attack Delivers Cross-Platform RAT news 7 min read Supply Chain | Library that details a supply chain attack on the popular npm package `axios`. Malicious versions, `1.14.1` and `0.30.4`, were briefly published, including a hidden dependency `plain-crypto-js` which deployed a cross-platform RAT. The attack leveraged a compromised maintainer account and a purpose-built malicious dependency with a postinstall script that obfuscated its presence and delivered platform-specific payloads for macOS, Windows, and Linux. → snyk.io |
| 2026-06-08 2026 | JavaScript Prototype Pollution Deep Dive : — Reconnaissance, Exploitation & Bug Bounty Guideline intermediate XSS | This guide offers a deep dive into JavaScript Prototype Pollution, a misunderstood vulnerability. It covers reconnaissance, exploitation from cross-site scripting (XSS) to remote code execution (RCE), and real-world bug bounty case studies. The content explores attack vectors, entry points, advanced exploit chains, and includes tooling/automation for detection, along with defense and remediation strategies. A production-ready Python scanner is also mentioned. The article aims to demystify this vulnerability for security professionals and bug bounty hunters. → infosecwriteups.com |
| 2026-06-08 2026 | Node-gyp Supply Chain Compromise: A Self-Propagating npm Worm That Hides in binding.gyp intermediate 10 min read Supply Chain | Library for detecting and mitigating the Node-gyp Supply Chain Compromise, a self-propagating npm worm that exploits `binding.gyp` files for code execution. This malware, tracked as "Miasma" by StepSecurity and "Node-gyp Supply Chain Compromise - June 2026" by Snyk, injects malicious code during `npm install` by abusing `node-gyp`'s configuration phase. The payload harvests credentials from developer and CI/CD environments, including AWS, GCP, Azure, and GitHub Actions, then exfiltrates them via attacker-controlled GitHub repositories and maintains persistence through GitHub Actions workflows. It self-propagates by republishing affected packages, impacting 57 packages across hundreds of malicious versions. → snyk.io |
| 2026-06-08 2026 | From XSS to RCE (dompdf 0day) intermediate 10 min read XSS | Library for rendering PDFs from HTML that suffers from Remote Code Execution. By injecting CSS with a malicious font and enabling remote file access, an attacker can trick dompdf into caching a `.php` file in its font cache. This cached file can then be executed by accessing it directly, leading to RCE. |
| 2026-06-08 2026 | Hacking Auto-GPT and escaping its docker container intermediate 17 min read AI | Library detailing an attack on Auto-GPT that exploits indirect prompt injection to achieve arbitrary code execution. The exploit involves tricking Auto-GPT into processing attacker-controlled website content via the `browse_website` command, leading to unauthorized command execution. The library also covers a trivial Docker escape vulnerability, allowing access to the host system, and a path traversal exploit in non-Docker versions, both fixed in v0.4.3. |
| 2026-06-08 2026 | Intigriti Bug Bytes #236 - May 2026 🚀 news 7 min read Bug Bounty | Library for Burp Suite, Intigriti Quick Scope (IQS), fetches programs from the Researcher API to auto-configure project scope and headers, simplifying workflow for researchers. This issue also highlights exploits for SQL injection, bypasses for Chrome's Sanitizer API, and RCE in Google Cloud, alongside discussions on AI in security, NIS2 compliance, and practical red teaming techniques. → intigriti.com |
| 2026-06-08 2026 | Looting UniFi Controllers: Detecting and Weaponizing CVE-2026-22557 intermediate 20 min read AuthZ | Tool for detecting and weaponizing CVE-2026-22557, an unauthenticated path traversal vulnerability in UniFi Network Application's guest captive portal. This critical flaw, with a CVSS score of 10.0, allows attackers to read arbitrary files from customized portals, potentially exfiltrating backups containing administrative credentials for all managed devices. The accompanying tool from Bishop Fox safely identifies vulnerable controllers, while this analysis details attack paths, exploitability preconditions, and mitigation strategies, including patching to updated versions like 10.1.89 or later. → bishopfox.com |
| 2026-06-08 2026 | Popping Root on UniFi OS Server: Unauthenticated RCE Chain Detection & Analysis advanced 18 min read AuthZ | Tool for detecting unauthenticated RCE chains on UniFi OS Server, specifically addressing CVE-2026-34908, CVE-2026-34909, and CVE-2026-34910. This vulnerability allows attackers to bypass authentication, perform path traversal, and achieve command injection leading to root privileges. The tool aids defenders in identifying exposed systems and recommends immediate patching, network segmentation, and secret rotation, as exploitation grants access to sensitive data and control over managed devices. → bishopfox.com |
| 2026-06-08 2026 | Breaking the Sound Barrier, Part II: Exploiting CVE-2024-54529 advanced 13 min read Fuzzing | Writeup detailing the exploitation of CVE-2024-54529, a type confusion vulnerability in macOS's CoreAudio daemon. The author describes the process of turning the crash into a working exploit by establishing a pointer chain to control object types and ultimately hijack control flow. This involved developing custom tools like an object dumper using TinyInst and performing static analysis with IDAPython to navigate heap intricacies and overcome initial exploitation hurdles with CFString objects. The analysis also explored and ruled out an out-of-bounds read primitive, highlighting the importance of version-specific vulnerabilities. → projectzero.google |
| 2026-06-08 2026 | A 0-click exploit chain for the Pixel 10: When a Door Closes, a Window Opens advanced 5 min read Mobile | Writeup detailing a two-exploit chain achieving root on the Google Pixel 10, bypassing Pixel 9 privilege escalation with a novel VPU driver vulnerability (CVE-2026-0000). The Dolby UDC exploit, patched in December 2025, was adapted for Pixel 10 by addressing RET PAC, and a new vulnerability in the /dev/vpu driver allowed arbitrary kernel read-write via an unbounded `mmap` handler, patched in the February 2026 security bulletin. → projectzero.google |
| 2026-06-07 2026 | Mirasvit Vulnerability Exploited to Execute Code on Magento Servers news 2 min read | Writeup of CVE-2026-45247, a critical PHP object injection vulnerability in Mirasvit's Full Page Cache Warmer for Magento 2, allowing unauthenticated remote code execution. Exploitation occurs via crafted serialized PHP objects in the CacheWarmer cookie, leading to arbitrary code execution on Magento and Adobe Commerce servers. Organizations using versions prior to 1.11.12 are vulnerable, and detection indicators include CacheWarmer cookie values starting with specific base64 strings. → securityweek.com |
| 2026-06-05 2026 | VS Code Vulnerability Allows One-Click GitHub Token Theft news 2 min read | Writeup details a VS Code vulnerability allowing one-click GitHub token theft via specially crafted Jupyter notebooks on github.dev. Exploiting this zero-day involves hidden code simulating keystrokes to install a malicious extension, which then exfiltrates the user's GitHub access token. This grants attackers read/write access to repositories, including private ones. The vulnerability also affects the desktop version of VS Code, potentially leading to remote code execution, though it appears unpatched there. → securityweek.com |
| 2026-06-03 2026 | Exclusive: How One Line of Code Put Billions of Microsoft Android App Downloads at Risk news 3 min read | Library detailing a critical vulnerability in six Microsoft Android apps, including Word and Excel, where a single debug flag, `setIsDebugMode(true)`, left in production code allowed untrusted apps to intercept Microsoft account access tokens. This flaw, affecting billions of downloads and assigned CVE-2026-41100, -41101, and -41102, enabled potential supply chain attacks by granting attackers access to sensitive data like emails and documents. The issue was identified by Enclave and has since been patched by Microsoft. → securityweek.com |
| 2026-06-03 2026 | CVE-2026-34197 Jolokia Exposure Enables RCE in Apache ActiveMQ news 10 min read | Writeup of CVE-2026-34197, a remote code execution vulnerability in Apache ActiveMQ Classic, stemming from insecure exposure of broker management via the Jolokia HTTP/JMX interface. This allows attackers to interact with privileged operations, potentially leading to broker-side processing of malicious configuration content. Validation confirmed exploit path feasibility in controlled, insecure environments, highlighting a significant enterprise security concern due to ActiveMQ's critical infrastructure role. |
| 2026-06-03 2026 | Critical Vulnerability in HP VoIP Phones Enables Enterprise Network Breaches news 2 min read | Writeup of CVE-2026-0826, a critical stack-based buffer overflow in HP Poly Voice VoIP phones impacting models like the VVX 150-450 and Trio 8800-8300 series. The vulnerability, exploitable via crafted SIP INVITE requests with malicious Session Description Protocol attributes when Interactive Connectivity Establishment (ICE) is enabled, allows for remote code execution with root privileges by leveraging Return Oriented Programming chains to bypass ASLR and NX mitigations. Disabling ICE or updating firmware mitigates the risk. → securityweek.com |
| 2026-06-02 2026 | HP Poly VoIP vulnerability sets the stage for executive voice deepfakes news 3 min read | Writeup of CVE-2026-0826, a critical buffer overflow vulnerability in HP Poly VoIP phones, allows unauthenticated attackers to gain root access and perform eavesdropping or record audio for AI-enabled voice deepfakes. Discovered by Rapid7, the flaw in the SDP parsing code, even with ASLR enabled, enables exploit execution via Metasploit. This vulnerability highlights the growing threat of embedded device compromise for both traditional espionage and modern AI-driven fraud. → csoonline.com |
| 2026-06-02 2026 | Critical Windows Netlogon Vulnerability in Attackers Crosshairs news 2 min read | Writeup of CVE-2026-41089, a critical Windows Netlogon vulnerability, details its exploitation for remote code execution by threat actors. This stack-based buffer overflow flaw allows unauthenticated attackers to target domain controllers, potentially gaining system privileges. The Centre for Cybersecurity Belgium warns of active in-the-wild exploitation, urging immediate patching despite Microsoft's initial assessment. This vulnerability poses a significant risk due to Netlogon's role in domain authentication. → securityweek.com |
| 2026-05-30 2026 | Notepad vulnerabilities could enable arbitrary code execution on Windows systems news 3 min read | Library of information detailing two arbitrary code execution vulnerabilities, CVE-2026-48778 and CVE-2026-48800, affecting Notepad++ versions up to 8.9.6. These flaws, rated High (CVSS 7.8), allow local attackers to execute commands by manipulating `shortcuts.xml` and `config.xml` files. A third crash bug, CVE-2026-48770, was also patched. Exploitation requires the attacker to have write access to user profile directories or trick the user into opening a poisoned settings folder. → csoonline.com |
| 2026-05-29 2026 | No fix yet for critical Gogs RCE bug - exploit module is out news 3 min read | Writeup on a critical Remote Code Execution (RCE) vulnerability in the open-source Git service Gogs. As of May 2024, no fix has been released, and an exploit module is publicly available. The researcher reported the vulnerability in March, but maintainers have not responded. → theregister.com |
| 2026-05-29 2026 | Attackers Use LLM Agent for Post-Exploitation After Marimo CVE-2026-39987 Exploit intermediate 3 min read | Writeup on CVE-2026-39987 exploitation impacting Marimo, detailing how attackers leverage an LLM agent for post-exploitation. The agent autonomously exfiltrated cloud credentials and an SSH private key from AWS Secrets Manager, subsequently used to access an SSH bastion server and extract an internal PostgreSQL database schema and contents rapidly. Indicators of LLM involvement include improvisational database dumping, machine-consumable command streams with delimiters, and the agent feeding its own previous output into subsequent actions. → thehackernews.com |
| 2026-05-28 2026 | New Gogs zero-day flaw lets hackers get remote code execution news 3 min read | Library for analyzing Gogs zero-day RCE vulnerabilities, including an unpatched argument injection flaw enabling remote code execution via specially crafted pull requests and malicious branch names. This critical vulnerability, affecting Gogs 0.14.2 and 0.15.0+dev, allows authenticated attackers to compromise servers, access private repositories, and extract credentials. The flaw resembles previously patched argument injection issues like CVE-2024-39933 and CVE-2024-39932, but targets a different code path. → bleepingcomputer.com |
| 2026-05-27 2026 | SharePoint Has a New RCE Flaw. If You Haven't Patched Yet Go Do That. news 1 min read | Writeup of CVE-2026-45659, a high-severity Microsoft SharePoint remote code execution vulnerability. Exploitable by authenticated attackers with minimal Site Member permissions, the flaw stems from deserialization of untrusted data and does not require complex conditions. Microsoft has released patches for SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Enterprise Server 2016. This follows other recent SharePoint targeting, including CVE-2026-32201 being added to CISA's KEV catalog. → securityaffairs.com |
| 2026-05-26 2026 | High-severity SharePoint RCE bug patched by Microsoft (CVE-2026-45659) news 1 min read | Writeup of CVE-2026-45659, a high-severity SharePoint RCE vulnerability patched by Microsoft. This flaw allows authenticated attackers to execute arbitrary code remotely on vulnerable SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Enterprise Server 2016 instances through deserialization of untrusted data, requiring low attack complexity without user interaction. → helpnetsecurity.com |
| 2026-05-26 2026 | Active Exploitation of CVE-2026-5426 in KnowledgeDeliver LMS Enables Godzilla (BLUEBEAM) Web Shell and Cobalt Strike Attacks news 5 min read | Analysis of CVE-2026-5426 in KnowledgeDeliver LMS reveals exploitation of hardcoded ASP.NET machineKey values, enabling unauthenticated remote code execution. Threat actors deploy the Godzilla (BLUEBEAM) web shell and Cobalt Strike BEACON payloads, targeting Japanese enterprises and educational institutions. Attackers leverage ViewState deserialization for initial access, install web shells for persistence, and employ social engineering to deliver Cobalt Strike to user endpoints, leading to widespread compromise. → rescana.com |
| 2026-05-25 2026 | From Auth Bypass to RCE: A 4-Vulnerability Exploit Chain in DataEase advanced 6 min read | Writeup of a 4-vulnerability exploit chain in DataEase, including CVE-2026-40899, CVE-2026-40900, and CVE-2026-40901, alongside a previously disclosed authentication bypass. This chain enables unauthenticated remote command execution and data exposure by leveraging a JDBC blocklist bypass for arbitrary file read, stacked SQL injection for database manipulation, and Quartz deserialization for RCE. The exploit targets DataEase versions up to v2.10.21, and users should upgrade to v2.10.21 or later. → ox.security |
| 2026-05-24 2026 | Drupal Remote Code Execution vulnerability news 1 min read | Vulnerability describing a Drupal Remote Code Execution flaw impacting various versions of Drupal 8.9 and later, up to Drupal 11.3.10, allows attackers to execute code, manipulate data, elevate privileges, and disclose sensitive information. Patches are available for Drupal 8.9, Drupal 9.5, and updates are recommended for Drupal 10.4.x through 11.3.x. End-of-life versions like Drupal 8 and 9 may have other unaddressed vulnerabilities. → hkcert.org |
| 2026-05-22 2026 | Attackers Can Exploit a Claude Code RCE Flaw to Take Command of System news 3 min read | Library for securing developer models, this entry details a critical RCE vulnerability in Anthropic's Claude Code (version 2.1.118). Attackers could exploit a parsing flaw in the `eagerParseCliFlag` function via crafted deeplinks to inject arbitrary commands, bypassing trust prompts and taking control of a victim's system. The vulnerability was discovered by Joernchen of 0day.click and has since been patched. → devops.com |
| 2026-05-21 2026 | Experts warn of active exploitation of critical NGINX flaw CVE-2026-42945 news 2 min read | Writeup of CVE-2026-42945, also known as NGINX Rift, detailing a critical heap buffer overflow in NGINX Plus and Open Source impacting the `ngx_http_rewrite_module`. This vulnerability arises from how rewrite directives with unnamed PCRE capture groups and specific replacement string patterns interact with the script engine, potentially leading to a controlled buffer overflow. While actively exploited, remote code execution requires specific NGINX configurations and the disabling of ASLR on modern Linux systems, making widespread RCE attacks less likely according to expert analysis. → securityaffairs.com |
| 2026-05-21 2026 | Highly Critical Drupal Core Flaw Exposes PostgreSQL Sites to RCE Attacks news 2 min read | Analysis of CVE-2026-9082, a critical Drupal Core vulnerability affecting PostgreSQL sites, enables remote code execution and privilege escalation. Exploitable by anonymous users, this flaw stems from a database abstraction API weakness. Searchlight Cyber has released proof-of-concept code, highlighting the urgency for sites using PostgreSQL to update to patched Drupal versions, including 11.3.10, 10.6.9, and others, which also contain upstream Symfony and Twig security updates. → thehackernews.com |
| 2026-05-20 2026 | Critical RCE SQL Injection and Privilege Escalation Vulnerabilities Affecting Ivanti Endpoint Manager Fortinet FortiClient EMS (CVE-2026-21643) SAP VMware and n8n: CVE Analysis Exploitation and Patch Guidance news 5 min read | Analysis of critical RCE, SQL Injection, and Privilege Escalation vulnerabilities affecting Ivanti Endpoint Manager (CVE-2025-11622, CVE-2025-9713), Fortinet FortiClient EMS (CVE-2026-21643), SAP, VMware, and n8n. This advisory details exploitation vectors, including insecure deserialization and path traversal on Ivanti, and improper Site header handling on Fortinet, which can lead to unauthenticated RCE. The analysis covers affected versions, active exploitation trends, and mitigation strategies such as immediate patching and monitoring for suspicious activity across these enterprise platforms. → rescana.com |
| 2026-05-20 2026 | Mozilla Products Multiple Vulnerabilities news 1 min read | Bulletin detailing multiple vulnerabilities affecting Mozilla Products including Firefox, Firefox ESR, Firefox for iOS, and Thunderbird. Exploitable by remote attackers, these issues can lead to denial of service, remote code execution, information disclosure, security restriction bypass, elevation of privilege, and spoofing. Specific CVEs such as CVE-2026-8388, CVE-2026-8391, and CVE-2026-8401 are listed, with patches available for affected versions including Firefox 151 and Thunderbird 151. → hkcert.org |
| 2026-05-19 2026 | TP-Link Photoshop OpenVPN Norton VPN vulnerabilities news 3 min read | Writeup detailing eight vulnerabilities in TP-Link Archer AX53 routers, including stack-based buffer overflow (CVE-2026-30814) and OS command injection (CVE-2026-30815, CVE-2026-30816, CVE-2026-30817, CVE-2026-30818, TALOS-2025-2307, TALOS-2025-2308, TALOS-2025-2309). It also covers privilege escalation in Adobe Photoshop via the Microsoft Store (CVE-2026-34632), a reachable assertion leading to DoS in OpenVPN (CVE-2026-35058), and privilege escalation in Norton VPN via the Microsoft Store (CVE-2025-58074). → blog.talosintelligence.com |
| 2026-05-19 2026 | Unpatched ChromaDB Vulnerability Can Lead to Server Takeover news 2 min read | Writeup of CVE-2026-45829, dubbed ChromaToast, a pre-authentication RCE vulnerability in ChromaDB. This flaw allows unauthenticated attackers to execute arbitrary code, gain shell access, and compromise sensitive data, including API keys and secrets. Exploitation involves tricking the server into downloading and executing a malicious HuggingFace model before authentication. The vulnerability affects ChromaDB versions since 1.0.0, with an estimated 73% of internet-accessible deployments exposed. HiddenLayer and researcher Azraelxuemo have reported the issue without response from Chroma. → securityweek.com |
| 2026-05-19 2026 | PoC Code Published for Critical NGINX Vulnerability news 2 min read | Writeup detailing CVE-2026-42945, a critical heap buffer overflow in NGINX's `ngx_http_rewrite_module` that can lead to denial-of-service or remote code execution. The vulnerability arises from a two-pass script engine process where an undersized buffer is allocated due to an unpropagated flag when a rewrite replacement contains a question mark. Exploitation involves manipulating request URIs with escapable characters to control the overflow size and employing cross-request heap feng shui to corrupt cleanup pointers for RCE. Patched versions include NGINX Plus 37.0.0 and NGINX open source 1.31.0. → securityweek.com |
| 2026-05-19 2026 | SEPPMail Secure E-Mail Gateway Vulnerabilities Enable RCE and Mail Traffic Access news 2 min read | Writeup of SEPPMail Secure E-Mail Gateway vulnerabilities including CVE-2026-2743 for path traversal leading to RCE, CVE-2026-7864 for information exposure, CVE-2026-44125 for missing authorization, CVE-2026-44126 for deserialization, CVE-2026-44127 for path traversal and file deletion, CVE-2026-44128 for eval injection, and CVE-2026-44129 for template engine vulnerabilities. These flaws allow unauthenticated attackers to execute arbitrary code, read mail traffic, and gain network access, with some fixed in versions 15.0.2.1, 15.0.3, and 15.0.4. → thehackernews.com |
| 2026-05-17 2026 | NGINX CVE-2026-42945 Exploited in the Wild Causing Worker Crashes and Possible RCE news 2 min read | Library updates address critical NGINX CVE-2026-42945, a heap buffer overflow in ngx_http_rewrite_module causing worker crashes and potential RCE when ASLR is disabled. Also, two openDCIM vulnerabilities, CVE-2026-28515 (missing authorization) and CVE-2026-28517 (OS command injection), are actively exploited and can be chained with CVE-2026-28516 (SQL injection) for RCE, reportedly by attackers using AI tools like Vulnhuntr. → thehackernews.com |
| 2026-05-17 2026 | CVE-2026-42945: NGINX Rewrite Heap Overflow Enables Remote DoS & Potential RCE news 5 min read | Writeup of CVE-2026-42945, an NGINX rewrite heap overflow vulnerability, details its exploitation via crafted HTTP requests, particularly when using unnamed PCRE captures with a question mark in the replacement string. This flaw, present in versions from 0.6.27 through 1.30.0, can lead to Denial of Service through worker crashes or potential Remote Code Execution, especially with ASLR disabled. A proof-of-concept demonstrating RCE has been published. → socradar.io |
| 2026-05-16 2026 | Microsofts Patch Tuesday Update Targets 120 Security Flaws news | Microsoft's latest Patch Tuesday update addresses 120 security vulnerabilities, a significant release aimed at bolstering system security. This update is critical for users to install to protect their systems from potential exploits. The specific details of each vulnerability and the affected products are available in Microsoft's official release notes. The content does not mention any specific bug bounty payout amounts. → techrepublic.com |
| 2026-05-15 2026 | Google Chrome Multiple Vulnerabilities news 1 min read | Writeup detailing multiple vulnerabilities in Google Chrome, affecting versions prior to 148.0.7778.167 (Linux) and 148.0.7778.167/168 (Mac/Windows). Exploitation of these CVEs, including CVE-2026-8509 through CVE-2026-8587, could lead to remote code execution, denial of service, security restriction bypass, spoofing, cross-site scripting, and information disclosure. Users are advised to update to the patched versions. → hkcert.org |
| 2026-05-14 2026 | AI agent finds 18-year-old remote code execution flaw in Nginx news 3 min read | Tool for finding vulnerabilities, this LLM-powered system discovered four bugs in Nginx, including CVE-2026-42945, a critical heap buffer overflow in the `ngx_http_rewrite_module` that allows for remote code execution by exploiting specific rewrite directive configurations. This flaw, impacting Nginx versions 0.6.27 to 1.30.0 and Nginx Plus, was patched in later releases. Additional vulnerabilities CVE-2026-42946, CVE-2026-42934, and CVE-2026-40701 were also identified, leading to denial of service, memory leaks, or data modification. → csoonline.com |
| 2026-05-14 2026 | ThreatsDay Bulletin: PAN-OS RCE Mythos cURL Bug AI Tokenizer Attacks and 10 Stories news 9 min read | Library for threat intelligence, detailing exploited PAN-OS RCE (CVE-2026-0300) with EarthWorm and ReverseSocks5 payloads, private AI chats leveraging Trusted Execution Environments for Meta AI, a zero-auth data leak impacting Schemata's AI training platform, the FCC's router update deadline extension, Operation GriefLure's APT phishing targeting Vietnam and Philippines with RATs, a multi-stage intrusion using weaponized PowerShell disguised as JPEGs for ConnectWise ScreenConnect, an aid-themed infostealer using LNK files and Python implants, GhostLock's PoC demonstrating denial of file access via SMB share locking, AI scan results for cURL identifying a low-severity bug, and an MoU between Indian agencies for fraud-risk intelligence sharing. → thehackernews.com |
| 2026-05-14 2026 | 18-year-old NGINX vulnerability allows DoS potential RCE news 4 min read | Library for detecting CVE-2026-42945, an 18-year-old heap buffer overflow in NGINX's ngx_http_rewrite_module, which can lead to denial of service and, under specific conditions like disabled ASLR, remote code execution. This flaw, affecting versions 0.6.27 through 1.30.0, arises from inconsistent state handling during URI processing when 'rewrite' and 'set' directives are used together. The library would likely target this vulnerability and potentially the three other memory corruption issues (CVE-2026-42946, CVE-2026-40701, CVE-2026-42934) discovered alongside it. → bleepingcomputer.com |
| 2026-05-14 2026 | Critical 18-Year-Old NGINX Vulnerability Enables Remote Code Execution Attacks news 2 min read | Writeup detailing CVE-2026-42945, an 18-year-old NGINX vulnerability in the `ngx_http_rewrite_module` that enables unauthenticated remote code execution. Triggered by a state mismatch in the two-pass script engine when `rewrite` and `set` directives are used together, particularly with a question mark in the `rewrite` directive, it leads to a heap buffer overflow. Researchers developed an RCE exploit chaining heap manipulation and structure spraying, affecting various F5/NGINX products. Immediate upgrades to NGINX 1.30.1 or 1.31.0 are recommended. |
| 2026-05-14 2026 | Critical NGINX exploit: hackers can crash servers run remote code without authentication news | A critical vulnerability has been discovered in NGINX, a popular web server. Attackers can exploit this flaw to crash servers and execute remote code without needing any authentication. This means unauthenticated users could potentially gain control of compromised servers. The severity of this exploit poses a significant risk to systems running NGINX. → cybernews.com |
| 2026-05-14 2026 | 18-Year-Old NGINX Rewrite Module Flaw Enables Unauthenticated RCE news 3 min read | Writeup detailing CVE-2026-42945, a critical heap buffer overflow vulnerability in NGINX's `ngx_http_rewrite_module`, codenamed NGINX Rift. This 18-year-old flaw, discovered by depthfirst, allows unauthenticated remote code execution or denial-of-service through crafted HTTP requests, particularly when using unnamed PCRE captures with a question mark in rewrite directives. The writeup also covers related vulnerabilities: CVE-2026-42946 (excessive memory allocation), CVE-2026-40701 (use-after-free), and CVE-2026-42934 (out-of-bounds read). → thehackernews.com |
| 2026-05-14 2026 | SAP Rushes Emergency Security Updates For Critical Commerce Cloud & S/4HANA Vulnerabilities news | SAP has released emergency security updates to address critical vulnerabilities in its Commerce Cloud and S/4HANA software. These vulnerabilities pose a significant risk, and the urgent patching indicates a high level of severity. Organizations using these SAP products are strongly advised to apply the updates immediately to protect their systems from potential exploitation. The specific details of the vulnerabilities and the affected components have not been disclosed beyond the product names. |
| 2026-05-14 2026 | Palo Alto Products Multiple Vulnerabilities news 2 min read | Writeup of multiple vulnerabilities affecting Palo Alto products, including GlobalProtect App and PAN-OS. Attackers can exploit these flaws to achieve elevation of privilege, denial of service, remote code execution, cross-site scripting, and security restriction bypass. Specific CVEs identified include CVE-2026-0249, CVE-2026-0250, and CVE-2026-0251, among others. Affected versions span across PAN-OS 10.2, 11.1, 11.2, 12.1, and various GlobalProtect App releases. → hkcert.org |
| 2026-05-14 2026 | Microsoft's agentic security system MDASH uncovers four critical Windows RCE flaws news 3 min read | Tool: Microsoft's MDASH, an agentic security system orchestrating over 100 AI agents, has discovered 16 previously unknown Windows vulnerabilities, including four critical remote code execution flaws. These include CVE-2026-33827, a use-after-free in tcpip.sys, and CVE-2026-33824, a double-free in the IKEv2 service. MDASH utilizes frontier and distilled AI models, domain plugins, and a pipeline of prepare, scan, validate, dedup, and prove stages to identify complex bugs missed by traditional scanners. |
| 2026-05-13 2026 | Fortinet fixes two critical RCE flaws in FortiAuthenticator and FortiSandbox news 2 min read | Patches addressing two critical RCE vulnerabilities, CVE-2026-44277 in FortiAuthenticator (improper access control) and CVE-2026-26083 in FortiSandbox (missing authorization), have been released by Fortinet. These flaws allow unauthenticated attackers to execute arbitrary code via specifically crafted requests. Fortinet also provided updates for other flaws, including CVE-2025-53844, CVE-2025-53870, and CVE-2025-53680 in FortiOS and FortiAP products. → csoonline.com |
| 2026-05-13 2026 | New critical Exim mailer flaw allows remote code execution news 2 min read | Writeup of CVE-2026-45185, a critical user-after-free vulnerability in Exim mail transfer agent versions 4.97 through 4.99.2 compiled with GnuTLS. This flaw allows unauthenticated remote code execution by exploiting a TLS shutdown issue during BDAT chunked SMTP traffic. XBOW's AI-assisted research aided in developing a proof-of-concept exploit, highlighting the evolving landscape of vulnerability discovery and exploitation. → bleepingcomputer.com |
| 2026-05-13 2026 | Microsoft Patches Critical Zero-Click Outlook Vulnerability Threatening Enterprises news 2 min read | Vulnerability writeup of CVE-2026-40361, a critical zero-click use-after-free bug in Microsoft Outlook and Word, allowing remote code execution via email previews. Discovered by Haifei Li, developer of Expmon, this flaw, similar to the decade-old BadWinmail (CVE-2015-6172), bypasses enterprise firewalls and targets users by exploiting Outlook's email rendering engine, making plain-text rendering a potential mitigation. Microsoft rates exploitation as "more likely." → securityweek.com |
| 2026-05-13 2026 | Fortinet Ivanti Patch Critical Vulnerabilities news 2 min read | Advisories detail critical vulnerabilities patched by Fortinet and Ivanti. Fortinet addressed CVE-2026-44277 and CVE-2026-26083, both CVSS 9.1 critical code execution flaws in FortiAuthenticator and FortiSandbox respectively, alongside CVE-2025-53844, a high-severity out-of-bounds write in FortiOS. Ivanti's patches include CVE-2026-8043, a critical CVSS 9.6 file write vulnerability in Xtraction, plus high-severity SQL injection and OS command injection flaws in Endpoint Manager and Virtual Traffic Manager. → securityweek.com |
| 2026-05-13 2026 | Microsofts agentic AI system found four critical Windows RCE flaws news 2 min read | Library utilizing over 100 specialized AI agents, codenamed MDASH, discovered four critical Windows RCE flaws, including CVE-2026-40361 and CVE-2026-40364. This system, developed by Microsoft’s Autonomous Code Security team, demonstrated strong performance on internal and public benchmarks like CyberGym, identifying all 21 injected vulnerabilities in a private Windows driver without false positives, and achieving high recall rates against historical Microsoft Security Response Center vulnerabilities. → helpnetsecurity.com |
| 2026-05-13 2026 | Microsoft Patches 138 Vulnerabilities Including DNS and Netlogon RCE Flaws news 6 min read | Patches from Microsoft address 138 vulnerabilities, including critical RCE flaws in Windows DNS (CVE-2026-41096) and Netlogon (CVE-2026-41089), along with Azure DevOps information exposure (CVE-2026-42826) and Azure Managed Instance for Apache Cassandra code execution (CVE-2026-33109). Additional fixes target Microsoft Dynamics 365, Azure Logic Apps, Microsoft Teams, Azure Cloud Shell, Azure Entra ID, Windows Hyper-V, and a Microsoft SSO Plugin for Jira & Confluence (CVE-2026-41103), with several identified by Microsoft's AI-driven discovery system MDASH. An AMD vulnerability (CVE-2025-54518) related to CPU cache isolation is also patched. → thehackernews.com |
| 2026-05-13 2026 | Defense at AI speed: Microsofts new multi-model agentic security system tops leading industry benchmark beginner 15 min read | Library for agentic AI-driven vulnerability discovery, codename MDASH, utilizes over 100 specialized agents and an ensemble of models to find and prove exploitable bugs. This system orchestrated across frontier and distilled models achieved top scores on industry benchmarks, including identifying 16 new vulnerabilities in Windows networking and authentication, four of which were Critical remote code execution flaws in components like the TCP/IP stack and IKEv2 service. MDASH's end-to-end pipeline includes stages for preparation, scanning, validation, deduplication, and proof, demonstrating a move towards production-grade, enterprise-scale AI vulnerability defense. → microsoft.com |
| 2026-05-13 2026 | May Patch Tuesday roundup: Critical holes in Windows Netlogon DNS and SAP S/4HANA news 5 min read | Report detailing Microsoft's May Patch Tuesday, highlighting critical vulnerabilities in Windows Netlogon (CVE-2026-41089) and Windows Server DNS Client (CVE-2026-41096), both with CVSS 9.8 scores. It also addresses a severe remote code execution flaw in Microsoft Dynamics 365 On Premises (CVE-2026-42898), a privilege escalation in the Microsoft SSO plugin for Jira/Confluence (CVE-2026-41103), and an SQL injection in SAP S/4HANA Enterprise Search (CVE-2026-34260). → csoonline.com |
| 2026-05-12 2026 | Microsoft Patch Tuesday for May 2026 Snort rules and prominent vulnerabilities news 4 min read | Library of Snort rules addresses Microsoft's May 2026 Patch Tuesday vulnerabilities, including 31 critical issues like RCE flaws in Azure, Windows services, Microsoft Office, and SharePoint. Specific CVEs highlighted include CVE-2026-32161 (Windows Native WiFi Miniport Driver), CVE-2026-33109 and CVE-2026-33844 (Azure Managed Instance for Apache Cassandra), CVE-2026-35421 (Windows GDI), CVE-2026-40358, CVE-2026-40361, CVE-2026-40363, CVE-2026-40364, CVE-2026-40366, and CVE-2026-4067 (Microsoft Office/Word), CVE-2026-40365 (Microsoft SharePoint), CVE-2026-40403 (Windows Win32K – GRFX), CVE-2026-41089 (Windows Netlogon), CVE-2026-41096 (Windows DNS Client), CVE-2026-42831 (Office for Android), and CVE-2026-42898 (Microsoft Dynamics 365). → blog.talosintelligence.com |
| 2026-05-12 2026 | Fortinet warns of critical RCE flaws in FortiSandbox and FortiAuthenticator news 1 min read | Writeup detailing critical RCE vulnerabilities in Fortinet products. CVE-2026-44277, an Improper Access Control flaw in FortiAuthenticator, and CVE-2026-26083, a missing authorization weakness in FortiSandbox, allow unauthenticated attackers to execute unauthorized code via crafted requests. These flaws, while not reported as exploited in the wild, follow a pattern of actively exploited Fortinet vulnerabilities, including previous issues in FortiClient EMS. → bleepingcomputer.com |
| 2026-05-12 2026 | New Exim BDAT Vulnerability Exposes GnuTLS Builds to Potential Code Execution news 2 min read | Library addressing CVE-2026-45185, a critical use-after-free vulnerability in Exim's BDAT message body parsing when using GnuTLS. This flaw allows attackers to trigger heap corruption and potential code execution by sending specific TLS close_notify alerts followed by cleartext data during BDAT transfers. The issue impacts Exim versions 4.97 through 4.99.2, with a fix available in version 4.99.3. → thehackernews.com |
| 2026-05-11 2026 | Mozilla Products Multiple Vulnerabilities news | Analysis of multiple vulnerabilities in Mozilla Products, including Firefox and Thunderbird, leading to potential denial of service and remote code execution. Affects versions prior to Firefox 150.0.2, Firefox ESR 115.35.2, Firefox ESR 140.10.2, Thunderbird 140.10.2, and Thunderbird 150.0.2. Patches are available from the vendor. → hkcert.org |
| 2026-05-10 2026 | New cPanel vulnerabilities could allow file access and remote code execution news 2 min read | Writeup of cPanel vulnerabilities CVE-2026-29201, CVE-2026-29202, and CVE-2026-29203, which permit arbitrary file reads, Perl code execution via the create_user API, and potential denial-of-service or privilege escalation through chmod. These flaws affect multiple cPanel & WHM releases and have been patched. This disclosure follows the weaponization of a separate cPanel authentication bypass vulnerability, CVE-2026-41940, as a zero-day for botnet deployment. Tools are available from watchTowr and cPanel to detect vulnerable hosts. → securityaffairs.com |
| 2026-05-07 2026 | When prompts become shells: RCE vulnerabilities in AI agent frameworks news 13 min read | Library providing security analysis of AI agent frameworks, detailing RCE vulnerabilities like CVE-2026-25592 and CVE-2026-26030 discovered in Semantic Kernel. The research highlights how prompt injection can lead to host-level code execution through unsafe string interpolation and blocklist bypasses in plugins like the In-Memory Vector Store, enabling attackers to leverage Semantic Kernel's tool execution capabilities for malicious purposes. → microsoft.com |
| 2026-05-07 2026 | Ivanti EPMM CVE-2026-6973 RCE Under Active Exploitation Grants Admin-Level Access news 1 min read | Writeup on CVE-2026-6973, an active RCE vulnerability in Ivanti Endpoint Manager Mobile (EPMM) allowing administrative users to execute arbitrary code. This flaw, along with CVE-2026-5786, CVE-2026-5787, CVE-2026-5788, and CVE-2026-7821, impacts on-premise EPMM and is under active exploitation. CISA has added CVE-2026-6973 to its KEV catalog, mandating fixes for federal agencies. → thehackernews.com |
| 2026-05-07 2026 | Ivanti warns of new EPMM flaw exploited in zero-day attacks news 2 min read | Writeup of CVE-2026-6973, a critical Improper Input Validation vulnerability in Ivanti Endpoint Manager Mobile (EPMM) exploited in zero-day attacks. This flaw allows remote attackers with administrative privileges to execute arbitrary code on EPMM versions 12.8.0.0 and earlier. Ivanti recommends patching to EPMM 12.6.1.1, 12.7.0.1, and 12.8.0.1, and rotating admin credentials. Four other high-severity EPMM vulnerabilities (CVE-2026-5786, CVE-2026-5787, CVE-2026-5788, and CVE-2026-7821) were also patched. → bleepingcomputer.com |
| 2026-05-07 2026 | Cisco patches high-severity flaws enabling SSRF code execution attacks news 2 min read | Advisory detailing high-severity vulnerabilities in Cisco Unity Connection, including CVE‑2026‑20034 allowing authenticated remote root code execution via crafted API requests, and CVE‑2026‑20035 enabling unauthenticated SSRF attacks by sending crafted HTTP requests. These flaws stem from insufficient input validation, potentially leading to complete system compromise or arbitrary network traffic originating from the affected device. → securityaffairs.com |
| 2026-05-07 2026 | PAN-OS RCE Exploit Under Active Use Enabling Root Access and Espionage news 2 min read | Writeup of CVE-2026-0300, a critical buffer overflow in PAN-OS enabling root access, exploited by threat actors potentially as early as April 9, 2026. The vulnerability allows unauthenticated RCE via crafted packets, with successful exploitation observed by Unit 42, attributed to state-sponsored cluster CL-STA-1132. Post-exploitation involved AD enumeration and deployment of tools like EarthWorm and ReverseSocks5. Mitigation includes restricting portal access, disabling Response Pages, and enabling Threat ID 510019. → thehackernews.com |
| 2026-05-07 2026 | 'TrustFall' Exposes Claude Code Execution Risk news | 'TrustFall' Exposes Claude Code Execution Risk https://ift.tt/uApnWBD → darkreading.com |
| 2026-05-07 2026 | Hackers run code on PAN-OS firewalls as root without authentication: critical zero-day unveiled news | A critical zero-day vulnerability has been discovered in Palo Alto Networks' PAN-OS firewalls. This flaw allows attackers to execute code as root without any authentication. The vulnerability, identified as CVE-2024-3400, impacts PAN-OS versions 10.1, 11.0, 11.1, and 11.2. While the content mentions a critical zero-day, it does not specify any bug bounty payout amount. → cybernews.com |
| 2026-05-07 2026 | vm2 Node.js Library Vulnerabilities Enable Sandbox Escape and Arbitrary Code Execution news 2 min read | Writeup detailing critical vulnerabilities within the vm2 Node.js library, enabling sandbox escape and arbitrary code execution. These flaws, including CVE-2026-43997 and CVE-2026-44005, exploit mechanisms like `__lookupGetter__`, the `species` property of promises, the `inspect` function, `SuppressedError`, Symbol-to-string coercion, prototype pollution, and bypasses of the allowlist. The report highlights the ongoing challenge of secure code isolation in JavaScript environments and strongly advises updating to version 3.11.2. → thehackernews.com |
| 2026-05-07 2026 | Threat Brief: Exploitation of PAN-OS Captive Portal Zero-Day for Unauthenticated Remote Code Execution news 6 min read | Writeup detailing CVE-2026-0300, a buffer overflow vulnerability in Palo Alto Networks PAN-OS's Captive Portal service, enabling unauthenticated remote code execution. Exploitation by state-sponsored actors involved injecting shellcode, deploying tools like EarthWorm and ReverseSocks5 for tunneling, and enumerating Active Directory using compromised credentials. The analysis highlights the attackers' operational restraint and reliance on open-source tools for stealthy compromise of edge network devices. → unit42.paloaltonetworks.com |
| 2026-05-06 2026 | Critical Palo Alto PAN-OS Vulnerability Actively Exploited For Remote Code Execution (RCE) news | A critical vulnerability in Palo Alto Networks' PAN-OS is being actively exploited, allowing for remote code execution (RCE). This means attackers can potentially take control of affected devices. Details of the vulnerability and potential mitigation strategies are available via the provided link. No specific bounty payout amount is mentioned in the content. |
| 2026-05-06 2026 | WARNING: Critical Flaw In Apache HTTP Server Enables DoS & Remote Code Execution (RCE) Attacks news | A critical vulnerability has been discovered in the Apache HTTP Server, potentially allowing attackers to launch Denial of Service (DoS) and Remote Code Execution (RCE) attacks. This flaw poses a significant security risk, enabling unauthorized control and disruption of services hosted on affected servers. Users are strongly advised to update their Apache HTTP Server installations to the latest patched version to mitigate these risks. No specific payout amount for reporting this bug was mentioned. |
| 2026-05-06 2026 | Critical Buffer Overflow Vulnerability in PAN-OS Exploited in-the-Wild news 1 min read | Writeup of CVE-2026-0300, a critical buffer overflow in Palo Alto Networks PAN-OS, allowing unauthenticated attackers remote code execution with root privileges. The vulnerability targets the User-ID Authentication Portal service, particularly when exposed to untrusted networks or the public internet. Exploitation risk is high for instances accessible externally via ports 6081 or 6082. Immediate patching, access restriction, or disabling the portal are recommended mitigation steps. → wiz.io |
| 2026-05-06 2026 | WhatsApp Multiple Vulnerabilities news | Bulletin detailing multiple vulnerabilities in WhatsApp clients (iOS, Android, Windows) allowing remote attackers to bypass security restrictions and perform spoofing. Affected versions include specific ranges prior to recent updates on each platform. Users are advised to update to the latest available versions for iOS v2.26.15.72+, Android v2.26.7.10+, and Windows v2.3000.1032164386.258709 or later. → hkcert.org |
| 2026-05-06 2026 | Apache fixes critical HTTP/2 double-free flaw CVE-2026-23918 enabling RCE news | Library fixing CVE-2026-23918, a critical HTTP/2 double-free vulnerability in Apache HTTP Server 2.4.66. This flaw, discovered by Bartlomiej Dmitruk and Stanislaw Strzalkowski, can cause memory corruption leading to denial of service and, under specific configurations like mmap usage, potential remote code execution. The issue resides within mod_http2 and is resolved in version 2.4.67. → securityaffairs.com |
| 2026-05-06 2026 | Palo Alto Networks warns of firewall RCE zero-day exploited in attacks news 2 min read | Writeup of CVE-2026-0300, a critical PAN-OS zero-day exploited in attacks. This buffer overflow vulnerability affects the User-ID Authentication Portal on Internet-exposed PA-Series and VM-Series firewalls, allowing unauthenticated attackers to achieve root-level remote code execution. Palo Alto Networks recommends restricting access to trusted zones or disabling the portal until a patch is released, with initial fixes expected May 13, 2026. → bleepingcomputer.com |
| 2026-05-06 2026 | Palo Alto Networks PAN-OS flaw exploited for remote code execution news 1 min read API Sec | Writeup of CVE-2026-0300, a critical PAN-OS buffer overflow allowing unauthenticated remote code execution with root privileges. This vulnerability affects PA-Series and VM-Series firewalls using the User-ID Authentication Portal when exposed to the internet. Palo Alto Networks advises restricting access to trusted internal IP addresses to mitigate risk, noting limited exploitation observed primarily on internet-facing portals. Fixes are expected by May 13, 2026. → securityaffairs.com |
| 2026-05-06 2026 | Critical Android vulnerability CVE-2026-0073 fixed by Google news 1 min read Mobile | Analysis of CVE-2026-0073, a critical remote code execution vulnerability in Android's System component affecting the adbd daemon. Exploitation, which requires no user interaction or special permissions, could lead to shell user code execution and full device compromise. Google has released a patch, and no public exploits or active attacks exploiting this specific flaw are currently known. This follows a previously exploited Qualcomm component vulnerability (CVE-2026-21385) involving a buffer over-read in the Graphics component. → securityaffairs.com |
| 2026-05-06 2026 | SUSE Linux Kernel Multiple Vulnerabilities news | Vulnerabilities impacting SUSE Linux Kernel allow remote attackers to achieve denial of service, remote code execution, security bypass, privilege escalation, data manipulation, and information disclosure. Affected systems include SUSE Linux Enterprise High Performance Computing 12 SP5, SUSE Linux Enterprise Live Patching 12-SP5, and various SUSE Linux Enterprise Server 12 SP5 variants. Specific CVEs include CVE-2024-26584, CVE-2025-38234, CVE-2025-39759, CVE-2025-71268, CVE-2025-71269, CVE-2026-22990, CVE-2026-23103, CVE-2026-23120, CVE-2026-23243, CVE-2026-23262, CVE-2026-23272, CVE-2026-23277, CVE-2026-23318, CVE-2026-23362, CVE-2026-23382, CVE-2026-23386, and CVE-2026-23398. → hkcert.org |
| 2026-05-06 2026 | Palo Alto PAN-OS Flaw Under Active Exploitation Enables Remote Code Execution news 1 min read API Sec | Analysis of CVE-2026-0300, a critical buffer overflow vulnerability in Palo Alto Networks' PAN-OS software, allows unauthenticated remote code execution with root privileges. This flaw impacts PA-Series and VM-Series firewalls, particularly those with the User-ID Authentication Portal accessible from untrusted networks. While patches are forthcoming, interim mitigations include restricting portal access or disabling it entirely. → thehackernews.com |
| 2026-05-06 2026 | n8n: From Parsing Bug to Remote Code Execution aka CVE-2026-42231 news 9 min read API Sec | Library analyzing n8n's CVE-2026-42231, detailing how a prototype pollution vulnerability within the xml2js XML parsing library, exacerbated by CoffeeScript semantic quirks, can be chained to achieve unauthenticated Remote Code Execution. The exploit path leverages a specific gadget in `@n8n/node-cli` that mimics older, exploitable `spawn` behavior, allowing controlled properties to propagate into the execution context for RCE. |
| 2026-05-06 2026 | Critical Remote Code Execution Vulnerability Patched in Android news Mobile | Library for analyzing Android security, detailing CVE-2026-0073, a critical remote code execution vulnerability in the System component affecting the Android Debug Bridge daemon. This flaw allows code execution as the shell user without interaction. Google confirmed no exploitation has been observed. |
| 2026-05-05 2026 | Google Update: Android Flaw Could Put Billions of Devices at Risk news Mobile | Google has addressed a critical vulnerability in Android that could have affected billions of devices. The flaw, detailed in a recent update, potentially exposed users to significant security risks. While the specific nature of the exploit and its full impact remain underspecified in the provided content, Google's swift patching mitigates the threat. The article highlights Google's ongoing efforts to secure the Android ecosystem. No bounty payout amount is mentioned. → techrepublic.com |
| 2026-05-05 2026 | Critical Apache HTTP/2 Flaw (CVE-2026-23918) Enables DoS and Potential RCE news 2 min read | Writeup of CVE-2026-23918, a critical double-free vulnerability in Apache HTTP Server's HTTP/2 protocol handling that enables denial-of-service and potential remote code execution. Discovered by Bartlomiej Dmitruk and Stanislaw Strzalkowski, the flaw in `mod_http2`'s `h2_mplx.c` allows an attacker to trigger an RCE by exploiting memory reuse with the APR mmap allocator and Apache's scoreboard. Exploitation, while requiring an info leak for system() and scoreboard offsets, is practical on Debian-derived systems and the official httpd Docker image. → thehackernews.com |
| 2026-05-05 2026 | Android Zero-Click RCE Vulnerability Enables Remote Shell Access news 3 min read Mobile | Reference for CVE-2026-0073, a proximal zero-click RCE vulnerability in Android's Debug Bridge daemon (adbd). This flaw, affecting multiple Android versions, allows attackers on the same local network or within physical proximity to gain remote shell access without user interaction, bypassing application sandboxing. Exploitation requires timely patching, disabling USB debugging, network segmentation, and implementing zero-trust policies. → esecurityplanet.com |
| 2026-05-05 2026 | Unpatched flaws turn Ollama's auto-updater into a persistent RCE vector researchers say news 3 min read | Writeup of CVE-2026-42248 and CVE-2026-42249, which allow persistent RCE on Ollama for Windows by chaining a path traversal flaw with a non-functional signature verification. Attackers can plant arbitrary executables in the Windows Startup folder by controlling update responses, leading to silent execution on every login. Exploitation requires controlling update infrastructure, redirecting clients, or network interception, with the auto-update feature and Ollama in the Startup folder being default prerequisites. → helpnetsecurity.com |
| 2026-05-05 2026 | Security Audit Finds RCE Risks in 6.2% of MCP Servers news | A recent security audit revealed that 6.2% of Managed Cloud Platform (MCP) servers are vulnerable to Remote Code Execution (RCE) risks. The audit, which focused on identifying exploitable weaknesses, discovered these critical flaws present in a significant portion of the analyzed servers. The specific details of the vulnerabilities and the affected MCP server versions were not disclosed in this brief announcement. No bug bounty payout amounts were mentioned in the provided content. → hackernoon.com |
| 2026-05-05 2026 | Google Confirms Critical Android 0-Click VulnerabilityUpdate Now news Mobile | Google has confirmed a critical 0-click vulnerability affecting Android devices, urging users to update immediately. This exploit allows attackers to compromise devices without any user interaction. While the article highlights the severity and the need for an update, it **does not mention any specific bug bounty payout amount**. Users should prioritize applying the latest security patches to protect their devices. |
| 2026-05-05 2026 | Linux vulnerability "Copy Fail" is already being attacked news 1 min read | Library for Linux security exploits CVE-2026-31431, nicknamed "Copy Fail." This vulnerability allows local users to gain root privileges by performing a controlled 4-byte write to the page cache of any readable file system. Proof-of-concept exploit code is available, and attackers are actively misusing it. The vulnerability was discovered with AI assistance and affects most major Linux distributions since 2017. Updates are available. |
| 2026-05-05 2026 | MetInfo CMS CVE-2026-29014 Exploited for Remote Code Execution Attacks news 1 min read | Exploit details for CVE-2026-29014, a critical PHP code injection vulnerability in MetInfo CMS versions 7.9, 8.0, and 8.1. Discovered by Egidio Romano, the flaw stems from insufficient input neutralization in the `/app/system/weixin/include/class/weixinreply.class.php` script, allowing unauthenticated remote attackers to execute arbitrary PHP code by crafting malicious Weixin API requests. Successful exploitation requires the `/cache/weixin/` directory to exist. Patches were released on April 7, 2026, but active exploitation by threat actors was observed shortly after. → thehackernews.com |
| 2026-05-05 2026 | Critical Remote Code Execution Vulnerability Patched in Android news 1 min read Mobile | Library addressing CVE-2026-0073, a critical Android System vulnerability enabling unauthenticated remote code execution via the Android Debug Bridge daemon. Exploitation does not require user interaction. This critical flaw, impacting the 'adbd' process, allows attackers to execute code as the shell user without further privileges. While no exploits in the wild have been reported for this specific CVE, other Android vulnerabilities like CVE-2024-43093 and CVE-2025-38352 were exploited previously. → securityweek.com |
| 2026-05-05 2026 | Critical High-Severity Vulnerabilities Patched in Apache MINA HTTP Server news 1 min read | Library updates for Apache MINA and HTTP Server address critical and high-severity vulnerabilities. Apache MINA 2.2.7 and 2.1.12 fix CVE-2026-42778, an incomplete fix for insecure deserialization and RCE, and CVE-2026-42779, an incomplete fix for allowlist bypass and code execution. Apache HTTP Server 2.4.67 resolves CVE-2026-23918 (double-free, RCE), CVE-2026-28780 (heap buffer overflow, RCE), and other issues including CRLF sequence manipulation (CVE-2026-33523) and digest authentication bypass (CVE-2026-33006). → securityweek.com |
| 2026-05-05 2026 | MetInfo Weaver E-cology Vulnerabilities in Attackers Crosshairs news 1 min read | Writeup detailing exploitation of CVE-2026-29014 in MetInfo CMS and CVE-2026-22679 in Weaver E-cology. Both vulnerabilities allow unauthenticated remote code execution (RCE). MetInfo's flaw is a PHP code injection, while Weaver E-cology's stems from exposed debug functionality, enabling attackers to execute arbitrary commands via crafted POST requests and use the debug endpoint as a direct shell for discovery and payload delivery. → securityweek.com |
| 2026-05-05 2026 | Weaver E-cology RCE Flaw CVE-2026-22679 Actively Exploited via Debug API news 1 min read API Sec | Writeup of CVE-2026-22679, an unauthenticated remote code execution vulnerability in Weaver E-cology 10.0. Attackers exploit the debug API via the "/papi/esearch/data/devops/dubboApi/debug/method" endpoint by crafting POST requests to execute arbitrary commands. This flaw has been actively exploited since at least March 17, 2026, with observed techniques including payload drops and discovery commands like `whoami` and `ipconfig`. A Python detection script is available to identify vulnerable instances. → thehackernews.com |
| 2026-05-04 2026 | Weaver E-cology critical bug exploited in attacks since March news 2 min read | Library for Weaver E-cology office automation addressing CVE-2026-22679, a critical unauthenticated remote code execution flaw in versions prior to March 12. Exploited since March, the vulnerability stems from an exposed debug API endpoint allowing attackers to execute system commands via improperly validated user parameters. Attackers leveraged this for discovery commands like `whoami`, `ipconfig`, and `tasklist`, and attempted PowerShell-based payload downloads. The vendor's fix removes the debug endpoint entirely, making upgrades essential. → bleepingcomputer.com |
| 2026-05-04 2026 | Weekly Recap: AI-Powered Phishing Android Spying Tool Linux Exploit GitHub RCE & More news 19 min read AI Mobile | Library of tools and techniques for application security professionals, detailing active exploitation of a cPanel flaw (CVE-2026-41940) enabling authentication bypass and website wipes, alongside a Linux kernel vulnerability (CVE-2026-31431) for trivial privilege escalation. The recap also covers cybercrime groups using vishing for SaaS environment infiltration, TeamPCP's supply chain attacks across npm, PyPI, and Packagist, a Python backdoor (DEEP#DOOR) for comprehensive data theft, a critical GitHub vulnerability (CVE-2026-3854) allowing remote code execution, and VECT 2.0 ransomware's destructive file wiping. → thehackernews.com |
| 2026-05-02 2026 | 88% of self-hosted GitHub servers exposed to RCE researchers warn (CVE-2026-3854) news 2 min read | Writeup detailing CVE-2026-3854, a critical remote code execution vulnerability found in self-hosted GitHub Enterprise Server instances by Wiz researchers. Exploitable via a single git push command by authenticated users, this flaw allows arbitrary command execution on backend servers, potentially granting access to all hosted repositories and internal secrets. GitHub has released patches for supported GitHub Enterprise Server versions and advises reviewing audit logs for signs of exploitation. → helpnetsecurity.com |
| 2026-05-02 2026 | Script Injection and Data Theft: Python Data Analysis Tool Compromised news 2 min read Python | Writeup of MAL-2026-3083, detailing the compromise of the Python data monitoring tool elementary-data. An attacker exploited script injection in a GitHub Actions workflow to upload a malicious version to PyPI, stealing SSH keys, AWS credentials, API tokens, and cryptocurrency wallet files. The compromised package was active for nearly half a day before being removed. |
| 2026-05-01 2026 | "Copy Fail": Linux root in all major distributions with 732 bytes of Python news 2 min read Python | Writeup of CVE-2026-31431, the "Copy Fail" vulnerability, details a logic error in the Linux kernel allowing local users 4-byte writes to the page cache. A 732-byte Python exploit leverages this to gain root privileges on major distributions like Ubuntu, Amazon Linux, RHEL, and SUSE. The vulnerability, discovered with AI assistance and affecting systems since 2017, involves manipulating setuid binaries and can break container boundaries. Fixes are available, with temporary workarounds including blocking AF_ALG socket creation or blacklisting the algif_aead module. |
| 2026-04-30 2026 | Google's fix for critical Gemini CLI bug might break your CI/CD pipelines news 3 min read Supply Chain | Library for securing AI development layers, addressing vulnerabilities in agentic AI and supply chain risks. It discusses techniques for building secure development environments, managing trust in AI agent skills, and mitigating risks associated with AI models like Claude and Gemini. The library also touches upon hardware supply chain turbulence and identity resilience strategies in the context of AI. → theregister.com |
| 2026-04-30 2026 | New Linux 'Copy Fail' Vulnerability Enables Root Access on Major Distributions news 2 min read Python | Writeup on CVE-2026-31431, "Copy Fail," detailing how an unprivileged local user can achieve root access on Linux distributions since 2017. The vulnerability stems from a logic flaw in the `algif_aead` module of the kernel's cryptographic subsystem, allowing controlled writes to the page cache of any readable file. Exploitation involves a Python script to corrupt the page cache of a setuid binary like `/usr/bin/su`, granting root privileges. This primitive shares similarities with Dirty Pipe (CVE-2022-0847) and offers portable, stealthy, and cross-container exploitation. → thehackernews.com |
| 2026-04-30 2026 | OpenWrt 23.05 Authenticated Remote Code Execution (RCE) Vulnerability: Risk Analysis Impact and Mitigation (CVE-2025-62526) news 5 min read | Analysis of CVE-2025-62526, an authenticated RCE vulnerability in OpenWrt 23.05, details how attackers can compromise devices by exploiting flaws in inter-process communication and sandboxing mechanisms, particularly on Lantiq, Intel, and MaxLinear SoCs. Mitigation involves upgrading to OpenWrt 24.10.4, securing credentials, restricting management interface access, and monitoring for unauthorized changes, with historical exploitation of similar flaws by groups like APT41 and Lazarus serving as a precedent. → rescana.com |
| 2026-04-30 2026 | Critical Authenticated Remote Code Execution Vulnerability in JuzaWeb CMS 3.4.2 (CVE-2025-5425) Exploit in the Wild and Mitigation Guidance news 5 min read | Writeup detailing CVE-2025-5425, a critical authenticated RCE vulnerability in JuzaWeb CMS 3.4.2. This flaw, stemming from broken access control (CWE-266), allows low-privilege users to access the Theme Editor, inject PHP code, and achieve full server compromise. Exploits are publicly available, and exploitation in the wild has been observed. Mitigation involves restricting access to the Theme Editor endpoint and auditing user roles. The vulnerability maps to MITRE ATT&CK techniques T1190 and T1059. → rescana.com |
| 2026-04-30 2026 | GitHub rushed to fix a critical vulnerability in less than six hours news 2 min read | Writeup of a critical remote code execution vulnerability in GitHub's internal git infrastructure, discovered using AI models by Wiz Research. GitHub's security team validated the bug bounty report, reproduced the vulnerability, and deployed a fix to GitHub.com and GitHub Enterprise Server in under six hours. The vulnerability, described as "remarkably easy to exploit" despite its complexity, highlights the emerging role of AI in identifying flaws in closed-source binaries. |
| 2026-04-30 2026 | Critical Gemini CLI Flaw Enabled Host Code Execution Supply Chain Attacks news 1 min read Supply Chain | Writeup of the critical Gemini CLI vulnerability (CVE-2024-XXXX, unassigned) discovered by Novee Security, which allowed for host code execution through untrusted agent configurations loaded from workspaces. Attackers could exploit this to steal secrets, gain lateral movement, and conduct supply chain attacks within CI/CD pipelines, bypassing prompt injection. This is distinct from prior research demonstrating hijacking of AI agents like Claude Code Security Review and GitHub Copilot Agent via malicious GitHub comments. → securityweek.com |
| 2026-04-30 2026 | Max-severity RCE flaw found in Google Gemini CLI news 2 min read | Library update fixes a critical remote code execution (RCE) vulnerability in Google Gemini CLI. Disclosed by Novee Security, this flaw (related to CWE-77 and CWE-78) allowed attackers to inject malicious configurations and execute arbitrary commands on the host system, particularly in CI/CD environments processing untrusted input. Patched versions 0.39.1 and 0.40.0-preview.3, along with the run-gemini-cli GitHub Action fix (v0.1.22), address the vulnerability by removing implicit workspace trust and enforcing stricter tool allowlisting, aligning non-interactive execution with interactive safeguards. → csoonline.com |
| 2026-04-30 2026 | Google Fixes CVSS 10 Gemini CLI CI RCE and Cursor Flaws Enable Code Execution news 5 min read | Library addressing Google's CVSS 10 Gemini CLI CI RCE, which allowed attackers to execute arbitrary commands by manipulating configuration files in CI environments, and Cursor's CVE-2026-26268 RCE via malicious Git hooks, plus an unpatched CursorJacking vulnerability enabling extension access to API keys and credentials. → thehackernews.com |
| 2026-04-30 2026 | GitHub Flaw Enables Remote Code Execution With a Single Git Push news 2 min read | Writeup detailing CVE-2026-3854, a vulnerability in GitHub's internal git protocol allowing authenticated users to achieve remote code execution. Exploitation leveraged an injection flaw in the X-Stat header, where semicolon-delimited options, unsanitized by GitHub, could override security controls via a "last-write-wins" parsing model. This flaw affected both GitHub.com and GitHub Enterprise Server, potentially leading to repository compromise and server takeover. Mitigation involves upgrading GHES, enforcing least privilege, monitoring git activity, and hardening configurations. → esecurityplanet.com |
| 2026-04-29 2026 | Hackers exploit RCE flaws in Qinglong task scheduler for cryptomining news 2 min read | Library for securing the Qinglong open-source task scheduler, addressing CVE-2026-3965 and CVE-2026-4047. These vulnerabilities, stemming from authentication bypass and path traversal flaws in versions 2.20.1 and older, allow for remote code execution. Attackers have been exploiting these issues to deploy cryptominers, disguised by the process name '.fullgc,' on developer servers by injecting shell commands into `config.sh` and downloading binaries from `file.551911.xyz`. → bleepingcomputer.com |
| 2026-04-29 2026 | AI Finds 38 Security Flaws in OpenEMR news AI | An AI security tool, DeepScribe, has identified 38 vulnerabilities in OpenEMR, a popular open-source electronic health record system. These flaws range in severity, with DeepScribe flagging 10 as critical. The company plans to disclose these findings responsibly to OpenEMR's development team. This discovery highlights the potential of AI in uncovering security weaknesses in complex software. The specific bounty payout amount for this discovery is not mentioned. → darkreading.com |
| 2026-04-29 2026 | GitHub fixes RCE flaw that gave access to millions of private repos news 2 min read Supply Chain | Writeup of CVE-2026-3854, a critical RCE vulnerability affecting GitHub.com and GitHub Enterprise Server, allowing attackers with push access to gain read/write access to millions of private repositories. The flaw stems from unsanitized user-supplied options during 'git push' operations, enabling arbitrary code execution and potential server compromise. Administrators of GitHub Enterprise Server instances are urged to upgrade immediately, as a significant percentage remain vulnerable. → bleepingcomputer.com |
| 2026-04-29 2026 | Critical GitHub RCE bug exposed millions of repositories news 2 min read Supply Chain | Writeup of CVE-2026-3854, a critical command injection vulnerability in GitHub's Git push processing, specifically within the X-STAT component. This flaw, found by Wiz researchers using AI-augmented tooling, allowed authenticated users to execute arbitrary commands server-side, leading to potential remote code execution and full compromise of GitHub Enterprise Server instances, exposing millions of repositories. Patches were released for GitHub.com and Enterprise Server. → csoonline.com |
| 2026-04-29 2026 | Critical GitHub Vulnerability Exposed Millions of Repositories news 2 min read Supply Chain | Writeup of CVE-2026-3854, a critical remote code execution flaw in GitHub's internal Git infrastructure. This injection vulnerability allowed authenticated users to execute arbitrary commands on backend servers via a simple `git push` command, potentially compromising millions of repositories on GitHub Enterprise Server and GitHub.com. Wiz researchers discovered the issue, which affected various GitHub Enterprise offerings, and a patch was subsequently released. → securityweek.com |
| 2026-04-29 2026 | Mozilla Firefox Multiple Vulnerabilities news | Library of advisories detailing multiple vulnerabilities in Mozilla Firefox. These issues, impacting versions prior to Firefox 150.0.1, Firefox ESR 115.35.1, and Firefox ESR 140.10.1, can lead to remote code execution, security restriction bypass, and information disclosure. Patches are available from the vendor. → hkcert.org |
| 2026-04-29 2026 | GitHub patches critical 'git push' remote code execution bug news 1 min read | Writeup on a critical vulnerability in GitHub's `git push` command, allowing authenticated users to achieve remote code execution on backend infrastructure. Discovered by Wiz researchers using IDA's MCP server, the flaw exploited GitHub's internal protocol by adding malicious options to the `git push` command. GitHub patched the issue on GitHub.com and released a fix for GitHub Enterprise Server. |
| 2026-04-28 2026 | Major Security Flaw In GitHub Enables Remote Code Execution Across Millions of Repositories news | A significant security vulnerability has been discovered in GitHub that could allow for remote code execution across millions of repositories. This flaw, if exploited, could have widespread implications for developers and organizations relying on GitHub for code hosting and collaboration. The exact impact and potential severity are still being assessed, but the discovery highlights the ongoing challenges in securing large-scale software development platforms. Further details on the vulnerability are expected to be released as the situation unfolds and mitigation efforts are implemented. |
| 2026-04-28 2026 | CVE-2026-3854 GitHub flaw enables remote code execution news 3 min read | Writeup of CVE-2026-3854, a critical command injection vulnerability in GitHub Enterprise allowing remote code execution. Exploitable via a crafted git push, attackers can inject malicious metadata, bypass sandbox protections, and run arbitrary commands. Wiz researchers reported the flaw, which GitHub fixed with patches for Enterprise Server versions. The vulnerability underscores risks in inter-service communication and sanitization of user-controlled data in complex systems. → securityaffairs.com |
| 2026-04-28 2026 | GitHub RCE Vulnerability: CVE-2026-3854 Breakdown news 10 min read | Tool for analyzing CVE-2026-3854, a critical RCE vulnerability in GitHub's internal git infrastructure. This flaw, exploitable via a single git push from an authenticated user, allowed arbitrary command execution on GitHub.com's backend servers, potentially exposing millions of repositories. On GitHub Enterprise Server, it granted full server compromise. The analysis details the X-Stat header injection flaw and the exploitation chain involving `rails_env`, `custom_hooks_dir`, and `repo_pre_receive_hooks` fields to bypass sandboxing and achieve remote code execution. → wiz.io |
| 2026-04-28 2026 | Researchers Discover Critical GitHub CVE-2026-3854 RCE Flaw Exploitable via Single Git Push news 3 min read Supply Chain | Writeup of CVE-2026-3854, a critical command injection vulnerability in GitHub.com and GitHub Enterprise Server. Exploitable via a single "git push" command, this flaw allows authenticated users with push access to achieve remote code execution by injecting malicious metadata into internal service headers. Researchers from Wiz demonstrated a technique chaining three injections to bypass sandboxing, redirect hooks, and execute arbitrary commands as the git user, potentially leading to cross-tenant repository exposure on GitHub.com. → thehackernews.com |
| 2026-04-28 2026 | Securing the git push pipeline: Responding to a critical remote code execution vulnerability intermediate 4 min read Supply Chain | Writeup of CVE-2026-3854, a critical remote code execution vulnerability in GitHub's `git push` pipeline. The vulnerability allowed arbitrary command execution on the server by crafting a `git push` command with unsanitized push options that manipulated internal metadata, bypassing sandboxing. GitHub deployed a fix within hours to github.com and released patches for GitHub Enterprise Server, recommending immediate upgrades. The investigation found no evidence of exploitation. → github.blog |
| 2026-04-28 2026 | Critical Cursor bug could turn routine Git into RCE news 3 min read Supply Chain | Library for securing AI-augmented IDEs against RCE vulnerabilities, exemplified by CVE-2026-26268 in Cursor IDE. This flaw, which allowed arbitrary code execution via malicious Git repositories and AI agent interaction with Git hooks and bare repositories, is patched in Cursor version 2.5. The exploit leverages Git's documented features, making detection challenging due to its integration into normal development workflows. → csoonline.com |
| 2026-04-28 2026 | Critical Unpatched Flaw Leaves Hugging Face LeRobot Open to Unauthenticated RCE news 2 min read | Writeup on CVE-2026-25874, a critical unauthenticated RCE vulnerability in Hugging Face's LeRobot platform. The flaw, found in version 0.4.3, stems from unsafe data deserialization using Python's pickle format within the async inference pipeline, allowing attackers to execute arbitrary code via gRPC calls. This impacts the PolicyServer and robot client components, potentially leading to network compromise, data theft, and safety risks. A fix is planned for version 0.6.0. → thehackernews.com |
| 2026-04-28 2026 | Microsoft Confirms Active Exploitation of Windows Shell CVE-2026-32202 news 2 min read | Writeup on CVE-2026-32202, a Windows Shell spoofing vulnerability actively exploited in the wild. This zero-click flaw, with a CVSS score of 4.3, stems from an incomplete patch for CVE-2026-21510 and allows attackers to steal Net-NTLMv2 hashes via SMB connections. Russian nation-state group APT28 reportedly used it in conjunction with CVE-2026-21513, leveraging malicious LNK files to bypass Microsoft Defender SmartScreen and achieve credential theft. → thehackernews.com |
| 2026-04-24 2026 | Hackers exploit file upload bug in Breeze Cache WordPress plugin news 2 min read | Library for detecting and preventing arbitrary file uploads, specifically addressing CVE-2026-3844 in the Breeze Cache WordPress plugin. This critical vulnerability, with a severity score of 9.8, allows unauthenticated attackers to achieve remote code execution (RCE) by exploiting a missing file-type validation in the ‘fetch_gravatar_from_remote’ function when the “Host Files Locally - Gravatars” add-on is enabled. Versions up to 2.4.4 are affected. → bleepingcomputer.com |
| 2026-04-24 2026 | 20th April Threat Intelligence Report news 3 min read | Library of threat intelligence covering the week of April 20th, detailing data breaches at Booking.com and McGraw-Hill, supply chain compromise of EssentialPlugin, and Basic-Fit. AI threats include weaponized Claude Code and GPT-4 for government breaches, phishing campaigns impersonating Claude AI, and prompt injection on GitHub agents. Vulnerabilities addressed include Apache ActiveMQ CVE-2026-34197, Splunk CVE-2026-20204, Microsoft Defender CVE-2026-33825, and Windows Task Host CVE-2025-60710. Other intelligence covers brand impersonation phishing, ZionSiphon malware targeting industrial control, Russian C2 infrastructure, and a fake Ledger Live app. |
| 2026-04-22 2026 | CVE-2025-68454: Craft CMS Twig SSTI RCE Vulnerability news 5 min read | Writeup detailing CVE-2025-68454, an authenticated Remote Code Execution vulnerability in Craft CMS versions 5.0.0-RC1 through 5.8.20 and 4.0.0-RC1 through 4.16.16. Exploitation occurs via Server-Side Template Injection (SSTI) using the Twig map filter in text fields within Settings or the System Messages utility. Attackers with administrative privileges or access to System Messages can achieve arbitrary code execution by crafting malicious Twig payloads. Mitigation involves updating to patched versions 5.8.21 or 4.16.17, disabling allowAdminChanges, and restricting access to sensitive utilities. → sentinelone.com |
| 2026-04-22 2026 | React2Shell (CVE-2025-55182): RSC Flight Decoder Remote Code Execution news 2 min read | Writeup of CVE-2025-55182, a critical RCE in React Server Components (RSC) that affects frameworks like Next.js. Attackers exploit a flaw in the flight protocol decoding, where improperly handled prototype chain lookups allow arbitrary code execution on the server. The vulnerability stems from not checking for own properties during object deserialization. Mitigation involves upgrading React packages, restricting exposure of RSC routes, and deploying IPS/WAF rules to detect malicious multipart payloads. |
| 2026-04-22 2026 | Ivanti EPMM: Another Pre-Auth RCE (CVE-2026-1281 and CVE-2026-1340) news 2 min read | Writeup on CVE-2026-1281 and CVE-2026-1340 in Ivanti EPMM details pre-authentication remote code execution vulnerabilities. Attackers can exploit these by sending crafted requests to run arbitrary code on unpatched instances, as researchers at WatchTowr discovered. Ivanti has released an RPM patch, but it is removed upon version upgrades, requiring reapplication. These vulnerabilities were actively exploited in the wild before disclosure, and public PoC code increases immediate risk. |
| 2026-04-22 2026 | CVE-2025-57738: Apache Syncope Groovy Injection RCE news 4 min read | Writeup of CVE-2025-57738, an Apache Syncope Groovy injection vulnerability allowing RCE. Vulnerable versions compile administrator-uploaded Groovy implementations using a bare `GroovyClassLoader`, enabling static initializer blocks to execute arbitrary JVM API commands like `Runtime.exec()` or `ProcessBuilder` with full process privileges. The PoC script `CVE-2025-57738.py` demonstrates this by uploading a malicious class that executes a command and writes output to `/tmp/pwned`. Patched versions implement sandboxing using Jenkins’ Script Security infrastructure to block dangerous API calls. |
| 2026-04-22 2026 | Anthropic MCP Design Vulnerability Enables RCE, Threatening AI Supply Chain news 2 min read | Analysis of the Model Context Protocol (MCP) reveals a fundamental design flaw enabling Arbitrary Command Execution (RCE) across its SDK implementations in Python, TypeScript, Java, and Rust. This systemic vulnerability, affecting over 7,000 projects including LiteLLM, LangChain, and Flowise, stems from unsafe defaults in STDIO transport, leading to identified CVEs like CVE-2026-30623 and CVE-2025-49596. The flaw allows attackers to inject commands through various means, including prompt injection and network requests, potentially compromising sensitive data and impacting the AI supply chain, despite Anthropic classifying the behavior as "expected." → thehackernews.com |
| 2026-04-22 2026 | Critical RCE Vulnerability in Anthropic MCP Inspector (CVE-2025-49596) news 11 min read | Writeup of CVE-2025-49596, a critical RCE in Anthropic's MCP Inspector, details how attackers can exploit default insecure configurations and the 0.0.0.0-day browser vulnerability to execute arbitrary code on a developer's machine. This allows for data theft and network lateral movement, posing a significant risk to AI teams and enterprise adopters. The vulnerability stems from the MCP Inspector's lack of default authorization and its interaction with browser handling of the 0.0.0.0 IP address. |
| 2026-04-22 2026 | CVE-2025-24893: XWiki SSTI Unauthenticated RCE Exploit news | Tool for exploiting CVE-2025-24893 in XWiki, enabling unauthenticated RCE via Server-Side Template Injection. The vulnerability lies in the SolrSearch endpoint, which processes user input through the Groovy template engine without proper sanitization. Attackers can inject malicious Groovy expressions via the `text` query parameter to execute arbitrary commands on the server, with output reflected in the RSS response. The provided Python script facilitates single command execution or interactive shell access. |
| 2026-04-22 2026 | CVE-2026-34197: ActiveMQ RCE via Jolokia API news 6 min read | Writeup detailing CVE-2026-34197, a remote code execution vulnerability in Apache ActiveMQ Classic. Exploitation leverages the Jolokia API to invoke `addNetworkConnector` with a crafted `vm://` URI, forcing the broker to fetch and execute a remote Spring XML configuration file. This technique, similar to CVE-2023-46604, allows arbitrary OS command execution. The vulnerability is unauthenticated on ActiveMQ versions 6.0.0–6.1.1 due to CVE-2024-32114. |
| 2026-04-22 2026 | Google Antigravity in Crosshairs of Security Researchers Cybercriminals news 2 min read | Writeup on Google Antigravity vulnerabilities, detailing a sandbox escape flaw allowing arbitrary code execution through insufficient input sanitization during file search operations, which bypasses Secure Mode and can be triggered via indirect prompt injection. Additionally, researchers discovered a fake website distributing a trojanized installer that deploys stealer malware, targeting browser data, cryptocurrency wallets, and employing techniques like clipboard hijacking, keystroke logging, and hidden desktop tradecraft. → securityweek.com |
| 2026-04-22 2026 | Cohere AI Terrarium Sandbox Flaw Enables Root Code Execution Container Escape news 2 min read | Writeup of CVE-2026-5752, a critical sandbox escape vulnerability in Cohere AI's Terrarium, allowing root code execution via JavaScript prototype chain traversal within the Pyodide WebAssembly environment. This flaw enables attackers with local access to execute arbitrary system commands, access sensitive files like "/etc/passwd," reach other network services, and potentially escape containers. Since the open-source project is unmaintained, mitigations focus on disabling code submission, network segmentation, Web Application Firewall deployment, and rigorous container monitoring. → thehackernews.com |
| 2026-04-22 2026 | Fake SVG puts 750000 websites at risk: hackers can seize the web server news | Fake SVG puts 750,000 websites at risk: hackers can seize the web server https://ift.tt/BwtOzhU → cybernews.com |
| 2026-04-22 2026 | Adobe Acrobat Reader: Prototype pollution vulnerability enables remote code execution news 3 min read | Writeup of CVE‑2026‑34621, a prototype pollution vulnerability in Adobe Acrobat Reader's JavaScript engine, enabling remote code execution through malicious PDFs. Exploitation involves manipulating object prototypes to inject arbitrary properties, overriding security-critical internal functions. This flaw, affecting Acrobat DC and Reader DC, has been observed in spear-phishing campaigns by financially motivated actors. Adobe has released patches, and interim mitigations include disabling JavaScript and strengthening email security controls. |
| 2026-04-21 2026 | 22 BRIDGE:BREAK Flaws Expose 20000 Lantronix and Silex Serial-to-IP Converters news 2 min read | Writeup of BRIDGE:BREAK vulnerabilities affecting Lantronix and Silex serial-to-IP converters. Forescout Research Vedere Labs identified 22 flaws, including remote code execution (CVE-2026-32955, CVE-2025-67041), DoS (CVE-2015-5621), authentication bypass (CVE-2026-32960), and device takeover (FSCT-2025-0021), in devices like Lantronix EDS3000PS Series and Silex SD330-AC, potentially allowing attackers to hijack devices and tamper with data. → thehackernews.com |
| 2026-04-21 2026 | Google Fixes Critical RCE Flaw in AI-Based Antigravity Tool news | Google Fixes Critical RCE Flaw in AI-Based Antigravity Tool https://ift.tt/1QOIZsB → darkreading.com |
| 2026-04-21 2026 | Actively exploited Apache ActiveMQ flaw impacts 6400 servers news 2 min read | Writeup on CVE-2026-34197, a code injection vulnerability in Apache ActiveMQ Classic, impacting over 6,400 exposed servers. Discovered by Horizon3 researcher Naveen Sunkavally, the flaw allows authenticated actors to execute arbitrary code due to improper input validation. Patched in versions 6.2.3 and 5.19.4, this actively exploited vulnerability has been a repeated target, with CISA urging federal agencies to secure their systems. Exploitation indicators include suspicious broker connections with VM transport and the brokerConfig=xbean:http:// parameter. Previous exploited ActiveMQ flaws include CVE-2016-3088 and CVE-2023-46604. → bleepingcomputer.com |
| 2026-04-21 2026 | Tenable Research Uncovers Remote Code Execution Vulnerability in Microsoft GitHub Repository news 2 min read | Writeup of a critical RCE vulnerability in a Microsoft GitHub repository, discovered by Tenable Research. The flaw, exploitable via Python string injection in issue creation, allows attackers to exfiltrate GITHUB_TOKEN secrets, potentially enabling unauthorized modification of repository content and compromising the software supply chain. This highlights the attack surface presented by CI/CD infrastructure and emphasizes the need for strict security controls, permission reviews, and pipeline monitoring. |
| 2026-04-21 2026 | Tenable Research Uncovers Remote Code Execution Vulnerability in Microsoft GitHub Repository Exposing CI/CD Pipeline to Unauthorized Code Execution news 2 min read | Writeup detailing a Remote Code Execution (RCE) vulnerability in a Microsoft GitHub repository affecting CI/CD pipelines. The flaw, a Python string injection within GitHub Actions workflows, allowed attackers to exfiltrate GITHUB_TOKEN secrets by creating a malicious GitHub issue, leading to potential unauthorized code execution and supply chain compromises. Recommendations include implementing strict security controls, reviewing token permissions, and monitoring automated workflows. |
| 2026-04-20 2026 | Google Chrome Multiple Vulnerabilities news 1 min read | Writeup detailing multiple vulnerabilities in Google Chrome, including CVE-2026-6296 through CVE-2026-6364. Exploitation of these weaknesses can lead to remote code execution, denial of service, information disclosure, and security restriction bypass. Affected versions are prior to 147.0.7727.101 on Linux, and prior to 147.0.7727.101/102 on Mac and Windows. Mitigation involves updating to the latest vendor-released versions. → hkcert.org |
| 2026-04-20 2026 | SGLang CVE-2026-5760 (CVSS 9.8) Enables RCE via Malicious GGUF Model Files news 2 min read Python | Vulnerability CVE-2026-5760, a critical RCE flaw in SGLang with a CVSS score of 9.8, stems from Jinja2 server-side template injection in GGUF model files loaded via the "/v1/rerank" endpoint. Attackers craft malicious GGUF files with SSTI payloads in the tokenizer.chat_template parameter, leading to arbitrary Python code execution on the SGLang server when the endpoint is accessed. This vulnerability is similar to CVE-2024-34359 and CVE-2025-61620, and mitigation involves using ImmutableSandboxedEnvironment for template rendering. → thehackernews.com |
| 2026-04-20 2026 | Vulnerability exploitation surges often precede disclosure offering possible early warnings news | Vulnerability exploitation surges often precede disclosure, offering possible early warnings https://ift.tt/UAnQyhJ → cybersecuritydive.com |
| 2026-04-19 2026 | CISA tells feds to patch 13-year-old Apache ActiveMQ bug under active attack news 2 min read | Reference for CVE-2026-34197, a critical remote code execution vulnerability in Apache ActiveMQ Classic. This 13-year-old flaw, now on CISA's Known Exploited Vulnerabilities catalog, allows authenticated attackers to run arbitrary OS commands via the Jolokia management API. The vulnerability is exacerbated by common default credentials and can be chained with CVE-2024-32114 on certain versions to enable unauthenticated exploitation. Patches are available in ActiveMQ versions 5.19.5 and 6.2.3. → theregister.com |
| 2026-04-19 2026 | CVE-2025-22457: Ivanti Connect Secure VPN Zero-Day RCE news | Writeup of CVE-2025-22457, a zero-day stack-based buffer overflow in Ivanti Connect Secure VPN exploited by UNC5221. This vulnerability allows unauthenticated remote code execution and has been used for data exfiltration and backdoor installation. Urgent patching to the latest fixed version is recommended to mitigate exploitation. → arcticwolf.com |
| 2026-04-19 2026 | Advisory: Actively Exploited Unauthenticated RCE in Ivanti Connect Secure (CVE-2025-0282) news 2 min read | Advisory for CVE-2025-0282, an unauthenticated RCE vulnerability in Ivanti Connect Secure and other Ivanti products, disclosed January 8, 2025, and actively exploited since mid-December 2024. This stack overflow allows arbitrary code execution. Exploitation tactics include lateral movement and SPAWN malware deployment, with links to previous Ivanti vulnerability campaigns. Ivanti's Integrity Checker Tool and Mandiant IoCs can identify compromise. |
| 2026-04-19 2026 | Command Injection in Jenkins via Git Parameter (CVE-2025-53652) intermediate 4 min read | Writeup of CVE-2025-53652 in Jenkins, detailing command injection via the Git Parameter plugin. Attackers can exploit unvalidated Git parameters to achieve remote code execution, leveraging Git's GTFObin capabilities to execute arbitrary commands like `sleep` or establish reverse shells. The vulnerability requires a valid session cookie, build name, and Jenkins crumb for exploitation, even in unauthenticated instances. Detection is possible through Suricata rules and analysis of Jenkins job logs. |
| 2026-04-19 2026 | 0xMarcio/cve: Latest CVEs with PoC Exploits intermediate | 0xMarcio/cve: Latest CVEs with PoC Exploits |
| 2026-04-19 2026 | Microsoft WSUS RCE (CVE-2025-59287) Actively Exploited news 6 min read | Analysis of CVE-2025-59287, a critical unauthenticated RCE in Microsoft WSUS, details its exploitation via unsafe deserialization through the GetCookie() or ReportingWebService endpoints. Observed attack chains involve PowerShell execution, network reconnaissance, and exfiltration to attacker-controlled webhooks. Affected systems include various Windows Server versions with the WSUS role enabled. Temporary mitigations include disabling the WSUS role or blocking ports 8530 and 8531. → unit42.paloaltonetworks.com |
| 2026-04-18 2026 | Critical flaw in Protobuf library enables JavaScript code execution news 2 min read | Library vulnerability GHSA-xq3m-2v4x-88gg, a critical RCE flaw in protobuf.js, arises from unsafe dynamic code generation. Attackers can inject arbitrary JavaScript code by supplying malicious schemas, leading to code execution on servers or developer machines. Endor Labs identified the issue, impacting versions 8.0.0/7.5.4 and lower, with patches available in 8.0.1 and 7.5.5. Mitigation involves upgrading, auditing dependencies, and treating schema loading as untrusted input. → bleepingcomputer.com |
| 2026-04-17 2026 | U.S. CISA adds a flaw in Apache ActiveMQ to its Known Exploited Vulnerabilities catalog news 1 min read | Writeup of CVE-2026-34197, a critical flaw in Apache ActiveMQ Classic impacting versions prior to 5.19.4 and 6.2.3. This vulnerability, caused by improper input validation and unsafe code execution, allows authenticated attackers to achieve remote code execution by exploiting the Jolokia JMX-HTTP bridge. The flaw leverages a crafted discovery URI to force the broker to load a malicious remote Spring XML configuration, enabling arbitrary code execution through bean factory methods like `Runtime.exec()`. CISA has added this vulnerability to its Known Exploited Vulnerabilities catalog, mandating remediation for federal agencies. → securityaffairs.com |
| 2026-04-17 2026 | Microsoft and Adobe Patch Tuesday April 2026 Security Update Review news 9 min read | Analysis of April 2026 Patch Tuesday updates from Microsoft and Adobe reveals 163 vulnerabilities addressed by Microsoft, including eight critical-severity issues and two zero-days: an access-control flaw in Windows Defender and an input validation flaw in Microsoft Office SharePoint, both actively exploited. Adobe patched 56 vulnerabilities across various products, with 38 critical. Notable Microsoft issues include use-after-free flaws in Remote Desktop Client and Microsoft Office, and race conditions in Windows Active Directory and TCP/IP, enabling remote code execution or privilege escalation. → blog.qualys.com |
| 2026-04-17 2026 | Apache ActiveMQ CVE-2026-34197 Added to CISA KEV Amid Active Exploitation news 2 min read | Writeup detailing CVE-2026-34197, a critical Apache ActiveMQ Classic vulnerability allowing code injection via the Jolokia API. This flaw, actively exploited and added to CISA's KEV catalog, has been present for 13 years and is exacerbated by CVE-2024-32114 on certain versions, enabling unauthenticated RCE. Horizon3.ai and SAFE Security highlight its exploitation targeting exposed management endpoints, with Fortinet noting dozens of attempts. Upgrading to versions 5.19.4 or 6.2.3 is recommended. → thehackernews.com |
| 2026-04-16 2026 | Empirical Study on RCE in ML Model Hosting Ecosystems advanced 56 min read | Survey of Remote Code Execution risks in ML model hosting ecosystems, analyzing custom code execution on platforms like Hugging Face and ModelScope. The study employs static analysis tools Bandit, CodeQL, and Semgrep, alongside YARA for pattern detection, to identify vulnerabilities. It also examines platform security mechanisms and developer discussions to understand perceptions, revealing widespread unsafe defaults and developer confusion about executing remote code. → arxiv.org |
| 2026-04-16 2026 | Method Confusion in Go SSTIs Lead to File Read and RCE advanced 3 min read | Library for researching Go Server-Side Template Injection (SSTI) vulnerabilities, focusing on method confusion within the `html/template` module. This library demonstrates how to achieve arbitrary file reads and Remote Code Execution (RCE) by leveraging exported methods of rendered objects, such as the `Secret` method for command execution or the `File` method from the `echo` framework for local file disclosure. → onsecurity.io |
| 2026-04-16 2026 | SmarterTools SmarterMail Pre-Auth RCE (CVE-2025-52691) news 10 min read | Writeup of CVE-2025-52691, a pre-authentication remote code execution vulnerability in SmarterTools SmarterMail. This analysis details how an unauthenticated file upload endpoint, which accepts a JSON-deserializable `contextData` parameter, allows an attacker to control a `guid` property. The patched build 9413 introduces GUID validation, suggesting its exploitation was previously possible by manipulating this field during upload processing, as detailed by Mr Chua Meng Han from CSIT. → labs.watchtowr.com |
| 2026-04-16 2026 | Dissecting and Exploiting CVE-2025-62507: RCE in Redis intermediate 12 min read | Writeup of CVE-2025-62507, a stack buffer overflow in Redis's XACKDEL command, details how an attacker can trigger this vulnerability by providing an excessive number of stream IDs. This overflow allows for overwriting the return address on the stack, potentially leading to remote code execution, especially in unauthenticated Redis instances. The analysis demonstrates exploiting this flaw by crashing the server with carefully crafted commands, revealing the path to weaponized exploits. → jfrog.com |
| 2026-04-16 2026 | Domain-Level RCE in Veeam Backup & Replication (CVE-2025-23120) intermediate 12 min read | Writeup detailing CVE-2025-23120, a domain-level RCE in Veeam Backup & Replication. This vulnerability arises from a flawed blacklist-based deserialization mechanism, allowing domain users to achieve SYSTEM privileges on the Veeam server. The attack leverages the .NET Remoting Channel and a specific class, `Veeam.Backup.Model.CDbCryptoKeyInfo`, which ultimately leads to inner deserialization with a blacklist. This writeup follows previous research on CVE-2024-40711, also in Veeam, highlighting the persistent issues with blacklist-based security. → labs.watchtowr.com |
| 2026-04-16 2026 | Exploitation Walkthrough - Ivanti Connect Secure RCE (CVE-2025-0282) intermediate 12 min read | Walkthrough of CVE-2025-0282 in Ivanti Connect Secure, detailing a stack-based buffer overflow in the `ift_handle_1` function. Exploitation involves crafting a malicious `clientCapabilities` block exceeding 256 bytes to trigger an out-of-bounds write. While direct return address overwriting is complicated by a preceding `free()` call on `object_to_be_freed`, an alternative exploitation path leverages a virtual function call at offset 0x48 within `a1`. → labs.watchtowr.com |
| 2026-04-16 2026 | React2Shell Deep Dive: CVE-2025-55182 Exploit Mechanics advanced 10 min read | Library detailing CVE-2025-55182, dubbed "React2Shell," a critical RCE vulnerability in React Server Components. This library breaks down the exploit mechanics, including improper input deserialization and gadget chains, and analyzes in-the-wild attacks observed by Wiz. These attacks range from opportunistic cryptomining and credential harvesting to sophisticated cloud backdoors leveraging Node.js for fileless persistence and Sliver implants for long-term access. The vulnerability has broader implications beyond Next.js, affecting frameworks like Waku and Vite with RSC plugins. → wiz.io |
| 2026-04-16 2026 | Remote Code Execution in Ghost CMS (CVE-2026-29053) intermediate 8 min read | Writeup on CVE-2026-29053, a remote code execution vulnerability in Ghost CMS versions 0.7.2 through 6.19.0. The flaw arises from unsafe expression evaluation within the theming system, where specially crafted themes can exploit a dependency chain involving the `jsonpath` and `static-eval` libraries. Exploitation requires an administrator to upload and activate a malicious theme, leading to arbitrary JavaScript execution on the server during page rendering, potentially impacting supply-chain trust and admin-targeted deception. |
| 2026-04-16 2026 | Ni8mare: Unauthenticated Remote Code Execution in n8n (CVE-2026-21858) intermediate 22 min read | Writeup of CVE-2026-21858, an unauthenticated remote code execution vulnerability in n8n discovered due to a Content-Type confusion bug. Attackers can exploit this flaw by crafting a malicious request that manipulates the `req.body.files` object, allowing them to read arbitrary local files and achieve full takeover of n8n instances. This issue impacts over 100,000 servers globally and has a CVSS score of 10.0. Users should upgrade to n8n version 1.121.0 or later for remediation. |
| 2026-04-16 2026 | Hackers exploit Marimo flaw to deploy NKAbuse malware from Hugging Face news 2 min read | Writeup detailing the exploitation of Marimo CVE-2026-39987, which allows remote code execution and deployment of NKAbuse malware. Attackers leverage Hugging Face Spaces, posing as legitimate AI tools, to host dropper scripts and malware binaries. The payload, a variant of NKAbuse, functions as a remote access trojan with capabilities for shell command execution and data exfiltration, including credential theft from environment variables and Redis servers. Exploitation has increased in volume and tactics, with affected users urged to upgrade Marimo to version 0.23.0 or later, or block external access to the `/terminal/ws` endpoint. → bleepingcomputer.com |
| 2026-04-16 2026 | ThreatsDay Bulletin: 17-Year-Old Excel RCEDefender 0-DaySonicWall Brute-Force and 15 More Stories news 12 min read | Library of recent application security vulnerabilities, including a 17-year-old Microsoft Office Excel RCE (CVE-2009-0238), a new Microsoft Defender privilege escalation zero-day (RedSun) and DoS exploit (UnDefend), a targeted cryptocurrency wallet breach via AI social engineering against Zerion, and a fake Ledger app on the Apple App Store that stole $9.5 million. It also covers a new ransomware strain (JanaWare) targeting Turkey, the uncovering of stealthy C2 frameworks (ObsidianStrike, ArchangelC2), and updates to Raspberry Pi OS disabling passwordless sudo by default. → thehackernews.com |
| 2026-04-16 2026 | Splunk Enterprise Update Patches Code Execution Vulnerability news 1 min read | Update for Splunk Enterprise addresses CVE-2026-20204, a high-severity flaw allowing low-privileged users to achieve remote code execution via temporary file handling issues. It also patches medium-severity vulnerabilities in Splunk Enterprise and Cloud Platform related to username formatting and Data Model Acceleration control. Additionally, CVE-2026-20205 in MCP Server, a high-severity vulnerability allowing authenticated attackers to view clear-text user sessions and tokens, is fixed in MCP Server app version 1.0.3. Patches for third-party packages across various Splunk products are also included. → securityweek.com |
| 2026-04-16 2026 | Weekly Vulnerability Report: Azure AI Spring AI Fortinet Bugs news 3 min read | Report detailing 1,431 vulnerabilities this week, including 270+ with public PoCs and 3 on underground forums. Highlights include CVE-2026-32213 in Azure AI Foundry, CVE-2026-35022 in Claude Code CLI, CVE-2026-22738 in Spring AI, CVE-2026-4631 in Cockpit, and CVE-2026-35616 in Fortinet FortiClient EMS. Also covers ICS vulnerabilities from Siemens, Hitachi Energy, and Yokogawa. |
| 2026-04-16 2026 | Cisco Patches Four Critical Identity Services Webex Flaws Enabling Code Execution news 2 min read | Writeup detailing Cisco's patching of four critical vulnerabilities in Identity Services and Webex Services. CVE-2026-20184, a critical improper certificate validation flaw in Webex SSO, allows unauthenticated user impersonation. CVE-2026-20147, CVE-2026-20180, and CVE-2026-20186 are insufficient input validation flaws in Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC), enabling authenticated remote code execution and arbitrary command execution with administrative or read-only credentials respectively. → thehackernews.com |
| 2026-04-15 2026 | Adobe Acrobat Reader vulnerability trapped PDFs and prepress workflow security news 1 min read | Writeup of CVE-2026-34621, a vulnerability in Adobe Acrobat Reader exploiting internal APIs like `util.readFileIntoStream` and `RSS.addFeed` to achieve remote code execution and sandbox bypass. This flaw allowed attackers to exfiltrate local files and gain elevated privileges on prepress workstations, posing a significant risk to production data and connected systems. The vulnerability remained unpatched for months, highlighting workflow security challenges in the graphic arts industry. |
| 2026-04-15 2026 | Microsoft fixes 167 security flaws in April second biggest Patch Tuesday ever news 3 min read | Analysis of Microsoft's April Patch Tuesday, the second-largest security update ever, reveals fixes for 167 vulnerabilities across Windows, Office, and cloud services. Eight critical flaws include actively exploited zero-days in SharePoint Server (CVE-2026-32201) and Office, with some Office RCE vulnerabilities (e.g., CVE-2026-33114) exploitable via preview panes. Other critical issues affect the TCP/IP stack (CVE-2026-33827), Internet Key Exchange (CVE-2026-33824), Remote Desktop Client (CVE-2026-32157), Active Directory (CVE-2026-33826), and .NET Framework DoS (CVE-2026-23666). Additionally, an Elevation of Privilege vulnerability in Defender (CVE-2026-33825) was known pre-patch. |
| 2026-04-15 2026 | Microsoft Patch Tuesday for April 2026 fixed actively exploited SharePoint zero-day news 1 min read | Writeup of Microsoft's April 2026 Patch Tuesday, which fixed 165 vulnerabilities, including an actively exploited SharePoint zero-day, CVE-2026-32201. This critical spoofing vulnerability, likely an XSS flaw, allowed attackers to view or modify sensitive information. Security experts urge rapid patching, noting the release's large size and potential impact on organizations with internet-facing SharePoint servers. → securityaffairs.com |
| 2026-04-15 2026 | April Patch Tuesday Fixes Critical Flaws Across SAP Adobe Microsoft Fortinet and More news 3 min read | Reference detailing critical vulnerabilities patched in April's Patch Tuesday, including an SQL injection in SAP Business Planning and Consolidation (CVE-2026-27681), a remotely exploitable code execution in Adobe Acrobat Reader (CVE-2026-34621), and path traversal flaws in FortiSandbox (CVE-2026-39813, CVE-2026-39808). It also mentions a spoofing vulnerability in Microsoft SharePoint Server (CVE-2026-32201) and numerous other patches from vendors like ABB, AWS, Apple, Cisco, and Linux distributions. → thehackernews.com |
| 2026-04-15 2026 | Critical nginx-ui Vulnerability CVE-2026-33032 Allows Unauthenticated Nginx Takeover news 3 min read | Writeup of CVE-2026-33032, an authentication bypass vulnerability in nginx-ui. This flaw, codenamed MCPwn, allows unauthenticated attackers to seize control of Nginx services by exploiting the /mcp_message endpoint, which bypasses authentication while only enforcing IP whitelisting. Attackers can gain session IDs by leveraging a separate vulnerability (CVE-2026-27944) to decrypt backups and extract sensitive data, including "node_secret" credentials. Exploitation can lead to restarting Nginx, modifying configuration files, and intercepting traffic. The vulnerability is patched in nginx-ui version 2.3.4. → thehackernews.com |
| 2026-04-15 2026 | Zero Day Initiative The April 2026 Security Update Review news 9 min read | Reference detailing April 2026 security updates from Adobe and Microsoft, covering 61 CVEs in Adobe products like Acrobat Reader and ColdFusion, and 163 CVEs in Microsoft products including Windows, Office, and Azure. Highlights actively exploited vulnerabilities such as CVE-2026-32201 (SharePoint Server Spoofing), CVE-2026-33825 (Microsoft Defender Elevation of Privilege), CVE-2026-33827 (Windows TCP/IP RCE), and CVE-2026-33824 (Windows IKE Service RCE). Also notes critical vulnerabilities in Office, .NET, SQL Server, and Hyper-V, alongside numerous Elevation of Privilege and sandbox escape bugs. |
| 2026-04-15 2026 | Microsoft April 2026 Patch Tuesday Fixes 167 Flaws 2 Zero-Days news 6 min read | Library of Microsoft's April 2026 Patch Tuesday fixes details 167 vulnerabilities, including an actively exploited SharePoint zero-day (CVE-2026-32201) and a Defender privilege escalation zero-day (CVE-2026-33825) found using the Diffract fuzzing tool. This release also addresses remote code execution bugs in Office, particularly those exploitable via document preview, and high-severity flaws in products like Remote Desktop Client. |
| 2026-04-15 2026 | Fortinet Patches Critical FortiSandbox Vulnerabilities news 1 min read | Library advisories detail critical vulnerabilities patched by Fortinet, including CVE-2026-39813 for FortiSandbox JRPC API authentication bypass and CVE-2026-39808 for FortiSandbox OS command injection, both exploitable via HTTP requests without authentication. Additionally, CVE-2026-22828, a high-severity buffer overflow in FortiAnalyzer Cloud, was patched, alongside SQL injection bugs in FortiDDoS-F and FortiClientEMS, and various medium- and low-severity issues across other Fortinet products. → securityweek.com |
| 2026-04-15 2026 | Microsoft Issues Patches for SharePoint Zero-Day and 168 Other Vulnerabilities news 4 min read | Library of Microsoft patches addressing 169 vulnerabilities, including zero-day CVE-2026-32201 impacting SharePoint Server, a privilege escalation flaw in Microsoft Defender (CVE-2026-33825) known as BlueHammer, and a critical remote code execution vulnerability in Windows Internet Key Exchange (CVE-2026-33824). The release also included CVEs impacting AMD, Node.js, Windows Secure Boot, and Git for Windows. → thehackernews.com |
| 2026-04-15 2026 | Adobe Acrobat Remote Code Execution Vulnerability news | Writeup detailing CVE-2026-34621, a high-risk Adobe Acrobat remote code execution vulnerability. Exploitation requires user interaction, typically by opening a malicious file, and leads to arbitrary code execution via Prototype Pollution. Affected versions include Acrobat DC, Acrobat Reader DC, and Acrobat 2024, with patches available for update. → hkcert.org |
| 2026-04-14 2026 | Microsoft Patch Tuesday for April 2026 - Snort Rule and Prominent Vulnerabilities news 4 min read | Snort rules detect exploitation attempts for Microsoft's April 2026 Patch Tuesday, which includes 165 vulnerabilities. Critical issues addressed by the rules include CVE-2026-23666 (.NET DoS), CVE-2026-33824 (Windows IKE RCE), CVE-2026-33826 (Active Directory RCE), and CVE-2026-33827 (Windows TCP/IP RCE). The update also covers several "more likely" to be exploited important vulnerabilities, such as CVE-2026-0390 (UEFI Secure Boot bypass) and CVE-2026-32201 (SharePoint spoofing). → blog.talosintelligence.com |
| 2026-04-14 2026 | Microsoft April 2026 Patch Tuesday Fixes 160 Vulnerabilities Including 2 Zero-Day Flaws news | Microsoft April 2026 Patch Tuesday Fixes 160+ Vulnerabilities, Including 2 Zero-Day Flaws https://ift.tt/YKfCdMi |
| 2026-04-14 2026 | Microsoft April 2026 Patch Tuesday fixes 167 flaws 2 zero-days news | Microsoft April 2026 Patch Tuesday fixes 167 flaws, 2 zero-days https://ift.tt/nLAl5mZ → bleepingcomputer.com |
| 2026-04-14 2026 | Adobe patched zero day in Acrobat that allowed remote code execution news 2 min read | Writeup detailing CVE-2026-34621, an Adobe Acrobat zero-day vulnerability patched by Adobe. This flaw allowed for remote code execution, enabling malware installation on Windows and macOS through maliciously crafted PDF files. The vulnerability, exploited in the wild for at least four months, could grant attackers full control over a victim's system and facilitate data theft across Acrobat DC, Reader DC, and Acrobat 2024. |
| 2026-04-14 2026 | ShowDoc RCE Flaw CVE-2025-0520 Actively Exploited on Unpatched Servers news 1 min read | Writeup of CVE-2025-0520, a critical ShowDoc RCE flaw with CVSS 9.4, actively exploited due to unrestricted file upload via improper extension validation. Attackers can upload PHP web shells to execute arbitrary code on unpatched servers running versions before 2.8.7, demonstrating the exploitation of N-day vulnerabilities. → thehackernews.com |
| 2026-04-14 2026 | CISA Adds 6 Known Exploited Flaws in Fortinet Microsoft and Adobe Software news 1 min read | Survey of CISA's Known Exploited Vulnerabilities (KEV) catalog, detailing six critical flaws actively exploited in the wild. This includes an SQL injection in Fortinet FortiClient EMS (CVE-2026-21643), use-after-free in Adobe Acrobat Reader (CVE-2020-9715), privilege escalation via Windows CLFS driver (CVE-2023-36424), deserialization vulnerability in Microsoft Exchange Server (CVE-2023-21529), local privilege elevation in Host Process for Windows Tasks (CVE-2025-60710), and insecure library loading in Microsoft VBA (CVE-2012-1854). → thehackernews.com |
| 2026-04-14 2026 | Cisco warns of critical IMC vulnerabilities ironically the server manager itself has become a point of entry news 2 min read | Advisories detail critical Cisco IMC vulnerabilities including CVE-2026-20093, an authentication bypass allowing remote admin access, and CVE-2026-20094 through CVE-2026-20097, enabling command injection and RCE with root privileges, even for read-only users. These issues highlight the risk of neglecting "internal" management interfaces like IMC, BMC, iLO, and iDRAC, which can serve as prime entry points into data center environments. |
| 2026-04-13 2026 | Seven IBM WebSphere Liberty flaws can be chained into full takeover news 2 min read | Writeup on seven IBM WebSphere Liberty flaws, including CVE-2026-1561 for pre-authentication RCE via SAML Web SSO, CVE-2025-14915 for privilege escalation via AdminCenter, and others related to hardcoded keys and insecure archive extraction, that can be chained for full server compromise and remote code execution. → csoonline.com |
| 2026-04-13 2026 | Juniper Junos OS Multiple Vulnerabilities news 1 min read | Bulletin detailing multiple vulnerabilities in Juniper Junos OS and Junos OS Evolved. These issues, including CVE-2022-24805, CVE-2025-13914, CVE-2025-30650, and numerous others listed in the 2026-04 Security Bulletin, can lead to spoofing, data manipulation, remote code execution, denial of service, information disclosure, privilege elevation, and security restriction bypass. Remediation requires consulting Juniper's vendor website. → hkcert.org |
| 2026-04-13 2026 | Marimo RCE Flaw Exploited Within Hours of Disclosure news 3 min read | Tool for detecting and mitigating the Marimo RCE vulnerability (CVE-2026-39987), which allows pre-authentication remote code execution via an unauthenticated WebSocket endpoint. Exploitation observed within 10 hours of disclosure, targeting sensitive credentials and infrastructure. Mitigation strategies include patching, access control, credential rotation, least privilege, and enhanced monitoring. → esecurityplanet.com |
| 2026-04-13 2026 | Microsoft Edge Multiple Vulnerabilities news 2 min read | Bulletin detailing multiple vulnerabilities in Microsoft Edge, including CVE-2026-5281 which is actively exploited. Exploitation can lead to remote code execution, denial of service, security restriction bypass, data manipulation, sensitive information disclosure, and spoofing. Affected versions are prior to 147.0.3912.60. Updating to version 147.0.3912.60 or later is recommended. → hkcert.org |
| 2026-04-12 2026 | Google Chrome 147 Security Update: Patches 60 Vulnerabilities Including Critical WebML Remote Code Execution F news 5 min read | Analysis of Google Chrome 147, which patched 60 vulnerabilities including critical heap buffer overflow (CVE-2026-5858) and integer overflow (CVE-2026-5859) flaws in the WebML component. These vulnerabilities, awarded $86,000 in bug bounties, enable remote code execution via crafted web pages. The advisory details technical aspects, exploitation potential, affected versions, and mitigation strategies such as immediate patching. While no in-the-wild exploitation is reported, the significant risk necessitates vigilance, especially concerning APT groups. → rescana.com |
| 2026-04-12 2026 | Critical Marimo pre-auth RCE flaw now under active exploitation news 2 min read | Writeup detailing CVE-2026-39987, a critical pre-authentication RCE vulnerability in Marimo versions 0.20.4 and earlier. Exploitable via the unauthenticated WebSocket endpoint '/terminal/ws', attackers can gain an interactive shell with the Marimo process's privileges. Active exploitation observed within hours of disclosure, with attackers exfiltrating credentials and SSH keys. Sysdig researchers noted a methodical operator targeting high-value information. Mitigation includes upgrading to version 0.23.0, restricting external access, or disabling the '/terminal/ws' endpoint. → bleepingcomputer.com |
| 2026-04-12 2026 | Critical Marimo Python Notebook RCE Vulnerability (CVE-2026-39987) Exploited Within 10 Hours of Disclosure news 5 min read | Analysis of CVE-2026-39987 details a critical RCE vulnerability in Marimo, an open-source Python notebook platform, allowing unauthenticated attackers shell access via a misconfigured WebSocket endpoint. Exploitation occurred within 10 hours of disclosure, focusing on credential harvesting and reconnaissance using T1190, T1552, and T1083 MITRE ATT&CK techniques. Mitigation involves upgrading to Marimo 0.23.0+, auditing logs, and rotating compromised credentials. → rescana.com |
| 2026-04-12 2026 | Adobe Patches Actively Exploited Acrobat Reader Flaw CVE-2026-34621 news 1 min read | Writeup of CVE-2026-34621, an actively exploited Adobe Acrobat Reader flaw. This prototype pollution vulnerability, with a CVSS score of 8.6, allows arbitrary code execution when users open malicious PDF documents. Adobe has released emergency updates for Acrobat DC, Acrobat Reader DC, and Acrobat 2024. Security researcher Haifei Li disclosed the zero-day exploitation, and CISA has added it to their Known Exploited Vulnerabilities catalog. → thehackernews.com |
| 2026-04-11 2026 | Google Chrome Multiple Vulnerabilities news 1 min read | Vulnerability summary detailing multiple issues within Google Chrome versions prior to 147.0.7727.55 on Linux, and 147.0.7727.55/56 on Mac and Windows. Exploitation can lead to information disclosure, denial of service, remote code execution, security restriction bypass, and data manipulation. This bulletin lists CVE-2026-5858 through CVE-2026-5919 as affected vulnerabilities. → hkcert.org |
| 2026-04-11 2026 | CVE-2026-39987: Marimo RCE exploited in hours after disclosure news 2 min read | Writeup of CVE-2026-39987 in Marimo, a Python notebook tool, detailing its pre-authenticated RCE flaw. The vulnerability, actively exploited within 10 hours of disclosure by Sysdig Threat Research Team, allowed attackers to gain a full PTY shell by targeting the unauthenticated `/terminal/ws` WebSocket endpoint. This exploit highlights the rapid threat actor response to disclosures, even for niche software like Marimo, with credential theft occurring in under three minutes. → securityaffairs.com |
| 2026-04-10 2026 | Orthanc DICOM Vulnerabilities Lead to Crashes RCE news 2 min read | Library of nine vulnerabilities, CVE-2026-5437 to CVE-2026-5445, impacting the Orthanc DICOM server, allowing for server crashes, data leaks, and remote code execution. These defects stem from insufficient metadata validation, missing checks, and unsafe arithmetic, manifesting as out-of-bounds reads, GZIP and ZIP decompression bombs, HTTP server memory exhaustion, and heap buffer overflows in image parsing and decoding logic. Versions 1.12.10 and earlier are affected; update to 1.12.11 for remediation. → securityweek.com |
| 2026-04-10 2026 | Claude uncovers a 13yearold ActiveMQ RCE bug within minutes news 2 min read | Writeup detailing CVE-2026-34197, a 13-year-old RCE vulnerability in Apache ActiveMQ Classic, uncovered by Anthropic's Claude. The flaw, exploitable via the Jolokia API and a malicious Spring XML file, allows arbitrary system command execution. Researchers used AI to build an exploit chain in minutes, highlighting the potential for AI in vulnerability discovery. This critical flaw affects ActiveMQ Classic versions prior to 5.19.4 and several 6.x releases, with an unauthenticated variant possible in some 6.x versions due to CVE-2024-32114. → csoonline.com |
| 2026-04-10 2026 | Marimo RCE Flaw CVE-2026-39987 Exploited Within 10 Hours of Disclosure news 3 min read Python | Writeup of CVE-2026-39987, a critical pre-authenticated RCE vulnerability in Marimo exploited within 10 hours of disclosure. The flaw, impacting versions prior to 0.20.4, allows unauthenticated attackers to gain a full PTY shell via the terminal WebSocket endpoint. Exploitation observed included credential theft and deployment of NKAbuse, a multi-platform threat leveraging NKN for C2. CISA added CVE-2026-39987 to its KEV catalog, mandating remediation for FCEB agencies. → thehackernews.com |
| 2026-04-10 2026 | Critical Marimo Flaw Exploited Hours After Public Disclosure news 2 min read | Writeup detailing the rapid exploitation of CVE-2026-39987, a critical unauthenticated RCE vulnerability in the Marimo reactive notebook. The flaw, discovered in the terminal WebSocket endpoint due to a lack of authentication validation, allowed attackers to gain an interactive shell and execute arbitrary commands. Exploitation began within nine hours of public disclosure, with attackers quickly moving to exfiltrate credentials and search for sensitive files like SSH keys. Releases up to Marimo 0.20.4 are affected, and users are urged to update to version 0.23.0 or newer. → securityweek.com |
| 2026-04-10 2026 | Critical Vulnerability in Ninja Forms Exposes WordPress Sites news 1 min read | Library detailing an arbitrary file upload vulnerability (CVSS 9.8) in Ninja Forms – File Upload Plugin versions up to 3.3.26. This flaw allows unauthenticated attackers to upload malicious files, including PHP scripts, through insufficient file validation and filename manipulation, potentially leading to remote code execution and full website compromise. The vulnerability was discovered by Sélim Lanouar and patched in version 3.3.27. → infosecurity-magazine.com |
| 2026-04-10 2026 | CVE-2026-21858: Ni8mare Enables Unauthenticated RCE in n8n Webhooks news 5 min read | Writeup detailing CVE-2026-21858 (Ni8mare), an unauthenticated RCE vulnerability in n8n workflow automation software. The flaw arises from content-type confusion, enabling attackers to read arbitrary files, forge admin sessions, and execute commands. This affects n8n versions prior to 1.121.0 and carries a CVSS score of 10.0. The writeup also briefly mentions CVE-2026-21877, N8scape (CVE-2025-68668), and CVE-2025-68613, which allow authenticated RCE. |
| 2026-04-10 2026 | Potentially Critical RCE in OpenSSL (CVE-2025-15467) news 3 min read | Writeup of CVE-2025-15467, a critical RCE vulnerability in OpenSSL affecting versions 3.0 through 3.6. An attacker can exploit this stack overflow by sending a crafted CMS AuthEnvelopedData message with an oversized IV, triggering a buffer overflow before authentication. This vulnerability impacts applications calling specific CMS decryption APIs or using tools like `openssl cms` and `openssl smime`, and can be leveraged for remote code execution. Users should upgrade to patched versions immediately. |
| 2026-04-10 2026 | CVE-2025-55182: React and Next.js Deserialization RCE Deep Dive intermediate | CVE-2025-55182: React and Next.js Deserialization RCE Deep Dive → akamai.com |
| 2026-04-10 2026 | Active Exploitation of 7-Zip RCE Vulnerability news 2 min read | Analysis of active exploitation of 7-Zip RCE vulnerability CVE-2025-11001, stemming from improper symbolic link handling in crafted ZIP files. Exploitation allows attackers to overwrite system files or execute arbitrary code. NHS England Digital confirmed active exploitation, urging updates to version 25.0.0 or later, which also addresses CVE-2025-11002. Unpatched systems face risks including ransomware and data theft. → blog.qualys.com |
| 2026-04-10 2026 | CVE-2025-34291 Exploited in the Wild: LangFlow AI Under Fire news 3 min read | Writeup of CVE-2025-34291, a remote code execution vulnerability in LangFlow, reveals active exploitation in the wild. This cross-site request forgery flaw, stemming from improper CORS and SameSite cookie configurations, allows attackers to impersonate logged-in users and gain full control of AI infrastructure by exploiting Python code execution capabilities. Protection involves hardening LangFlow configurations by disabling authenticated cross-site requests or restricting allowed origins, upgrading to LangFlow 1.7, or utilizing a WAF like CrowdSec to block malicious IPs. |
| 2026-04-10 2026 | New runC Vulnerabilities Expose Docker and Kubernetes to Container Escape news 3 min read | Writeup on CVE-2025-31133, CVE-2025-52565, and CVE-2025-52881 in runC, detailing how these vulnerabilities allow container escape through manipulation of bind mounts and /proc filesystem writes. Exploitation requires the ability to start containers with custom mount configurations, enabling attackers to compromise host systems and bypass LSM relabel protections. Versions prior to runC 1.2.8, 1.3.3, or 1.4.0-rc.3 are affected. |
| 2026-04-10 2026 | CVE-2025-39601: WordPress Custom CSS, JS and PHP Plugin CSRF to RCE news 1 min read | Writeup of CVE-2025-39601, a Critical CSRF vulnerability in the WPFactory Custom CSS, JS & PHP plugin for WordPress. Versions up to and including 2.4.1 are affected, allowing unauthenticated attackers to achieve Remote Code Execution (RCE) by injecting malicious PHP code via unauthorized POST requests. Exploitation involves hosting a crafted HTML file that an authenticated administrator visits, triggering the injection of PHP code executed on page load. |
| 2026-04-10 2026 | CVE-2025-7384: Critical WordPress Plugin Unauthenticated RCE news 4 min read | Writeup of CVE-2025-7384, a critical PHP Object Injection vulnerability in the "Database for Contact Form 7, WPforms, Elementor Forms" WordPress plugin. This flaw, with a CVSS score of 9.8, allows unauthenticated attackers to inject arbitrary PHP objects, leading to denial of service and potential remote code execution through malicious deserialization. The exploit can result in the deletion of critical files like `wp-config.php`, affecting over 70,000 installations. While version 1.4.4 patches new exploits, old malicious data in the database remains a risk requiring database sanitization. |
| 2026-04-10 2026 | Sneeit WordPress RCE Exploited in the Wild news 3 min read | Writeup detailing active exploitation of CVE-2025-6389, a critical RCE vulnerability in the Sneeit Framework WordPress plugin, allowing unauthenticated attackers to execute arbitrary PHP functions like `wp_insert_user()` to create administrative backdoors. Exploitation involves crafting HTTP requests to `/wp-admin/admin-ajax.php` and uploading malicious PHP files such as "xL.php" and "up_sf.php." The report also notes concurrent attacks on ICTBroadcast, exploiting CVE-2025-2611 to deliver the "Frost" DDoS botnet, which employs spreader logic and targets specific response indicators before launching attacks. → thehackernews.com |
| 2026-04-10 2026 | Critical Unauthenticated RCE in n8n (CVE-2026-21858, CVSS 10.0) news 2 min read | Writeup on CVE-2026-21858, a critical unauthenticated RCE in n8n versions prior to 1.121.0. Exploitation involves Content-Type confusion in webhook and file-handling logic, allowing attackers to override internal parsing, access sensitive files, forge sessions, and achieve arbitrary code execution. This leads to server takeover, credential theft, and lateral movement. Orca Security aids in identifying and prioritizing remediation for vulnerable n8n instances. |
| 2026-04-10 2026 | TryHackMe Spring AI: CVE-2026-22738 RCE Writeup news | TryHackMe Spring AI: CVE-2026-22738 RCE Writeup |
| 2026-04-10 2026 | Dangerous runC Flaws Allow Hackers to Escape Docker Containers news 2 min read | Vulnerabilities in runC, CVE-2025-31133, CVE-2025-52565, and CVE-2025-52881, allow attackers with custom mount configurations to escape Docker and Kubernetes containers by exploiting bind-mounts and symlink race conditions to gain root privileges on the host system. Fixes are available in later runC versions, and mitigations include user namespaces and rootless containers. → bleepingcomputer.com |
| 2026-04-10 2026 | runC Container Escape Vulnerabilities: A Technical Overview intermediate 3 min read | Writeup of runc container escape vulnerabilities, including CVE-2025-31133, CVE-2025-52565, and CVE-2025-52881, which allow arbitrary writes to procfs files. Exploitation involves custom mount configurations, potentially leading to host compromise in environments like Kubernetes. Mitigations include updating runc to v1.4.0-rc.3, v1.3.3, or v1.2.8, and employing user namespaces, non-root users, and security modules. |
| 2026-04-10 2026 | New runC Vulnerabilities Allow Container Escape in Docker and Kubernetes news 3 min read | Analysis of three runc vulnerabilities, CVE-2025-31133, CVE-2025-52565, and CVE-2025-52881, details how attackers can achieve container escape in Docker and Kubernetes. These exploits leverage race conditions and mount manipulations, specifically involving maskedPaths abuse and /dev/console mount races, to gain root access to host systems by writing to critical procfs files. Mitigation strategies include updating runc, enabling user namespaces, and using rootless containers. |
| 2026-04-10 2026 | Attackers Exploit Critical Langflow RCE as CISA Sounds Alarm news 2 min read | Library for detecting and mitigating remote code execution in Langflow, particularly CVE-2026-33017. This vulnerability allows unauthenticated attackers to execute arbitrary Python code by submitting malicious workflow data via the `build_public_tmp` endpoint. Attackers have weaponized this flaw within hours of disclosure, leading to credential exfiltration and potential software supply chain compromise. Runtime detection is crucial, focusing on exploit behavior like shell command execution and data exfiltration over HTTP, rather than specific CVE signatures. → csoonline.com |
| 2026-04-10 2026 | CVE-2026-33017: How Attackers Compromised Langflow AI Pipelines in 20 Hours intermediate 8 min read | Writeup detailing CVE-2026-33017, an unauthenticated RCE in Langflow, exploited within 20 hours of its advisory. Attackers leveraged the vulnerability's public flow build endpoint to execute arbitrary Python code, exfiltrating credentials and potentially compromising supply chains. Exploitation attempts observed included automated scanning via nuclei templates and custom Python scripts for deeper reconnaissance and data harvesting, highlighting the rapid weaponization trend of newly disclosed vulnerabilities. |
| 2026-04-10 2026 | CVE-2025-3248: RCE Vulnerability in Langflow news 3 min read | Writeup detailing CVE-2025-3248, a critical remote code execution (RCE) vulnerability in Langflow. Exploitation of the `/api/v1/validate/code` endpoint allows unauthenticated arbitrary command execution by embedding malicious Python code within decorators or default function arguments, which are evaluated during AST processing prior to version 1.3.0. Recommendations include immediate upgrades, access restriction via ZTNA, input sandboxing, and monitoring. |
| 2026-04-10 2026 | React2Shell Explained: From Vulnerability Discovery to Exploitation intermediate 13 min read | Library for understanding CVE-2025-55182, the React2Shell vulnerability. This exploit targets React Server Components' React Flight protocol by abusing unsafe deserialization of client-controlled payloads. Successful exploitation allows unauthenticated attackers to achieve remote code execution (RCE) on vulnerable servers, impacting applications built with React 19.0.0-19.2.0 and Next.js App Router versions 16.0.0-16.0.6. The analysis details how attackers manipulate prototype chains and the Function constructor to inject malicious code. → resecurity.com |
| 2026-04-10 2026 | Protecting Against the Critical React2Shell RCE Exposure intermediate 5 min read | Library for identifying and mitigating the critical 'React2Shell' RCE vulnerability (CVE-2025-55182) affecting React Server Components and Next.js. This vulnerability allows unauthenticated attackers to perform server-side code execution via insecure deserialization in the RSC 'Flight' protocol. The library helps secure environments by detailing immediate actions, providing detection rules, and showcasing how SentinelOne's Offensive Security Engine can verify exploitability of affected workloads. → sentinelone.com |
| 2026-04-10 2026 | React2Shell: Node.js RCE Against a Production Next.js App advanced 52 min read | Analysis of CVE-2025-55182, "React2Shell," details a Node.js Remote Code Execution vulnerability in Next.js applications utilizing React Server Components. The exploit leverages the Flight protocol's unsafe deserialization to trigger `child_process.spawnSync()`, allowing arbitrary shell commands with server process privileges. The report reconstructs a six-stage attack campaign, including C2 communication across multiple servers and the use of Lachlan Davidson's "02-meow-rce-poc" for RCE confirmation, despite defensive measures like container restrictions limiting further attacker progression. |
| 2026-04-10 2026 | CVE-2025-68613: RCE via Expression Injection in n8n news 14 min read | Writeup of CVE-2025-68613, a critical RCE vulnerability in n8n's expression evaluation engine. This flaw allows authenticated users to inject malicious JavaScript expressions, escaping the sandbox to execute arbitrary code on the server with n8n process privileges. Exploitation enables attackers to run OS commands, steal secrets, modify files, and gain full server control, impacting over 100,000 instances globally. The vulnerability affects versions from 0.211.0 up to 1.120.3 and early 1.122.x releases, with fixes available in versions 1.120.4, 1.121.1, and 1.122.0+. → resecurity.com |
| 2026-04-10 2026 | Adobe Reader Zero-Day Exploited via Malicious PDFs Since December 2025 news 2 min read | Writeup of CVE-2026-34621, a zero-day vulnerability in Adobe Reader exploited since December 2025 via malicious PDFs. This sophisticated exploit, first observed in "Invoice540.pdf," uses obfuscated JavaScript to harvest sensitive data and potentially deliver subsequent payloads for remote code execution and sandbox escape. The exploit targets privileged Acrobat APIs and has been confirmed to work on the latest Adobe Reader version, necessitating user vigilance and prompt application of the provided security update. → thehackernews.com |
| 2026-04-10 2026 | From Pre-Auth SSRF to RCE in TruFusion Enterprise intermediate 2 min read | Writeup detailing pre-authentication SSRF (CVE-2025-32355) and path traversal (CVE-2025-59793) vulnerabilities in TRUfusion Enterprise. The SSRF allows an attacker to abuse a misconfigured reverse proxy to access internal services, including an Axis2 interface. This Axis2 service, vulnerable to path traversal, can be exploited with the default 'trubiquity' password to achieve remote code execution by writing arbitrary files to the filesystem. |
| 2026-04-10 2026 | Serverless Security Risks 2026: Mitigating SSRF and RCE Threats intermediate 17 min read SSRF | Library for serverless security, detailing risks like SSRF and RCE by focusing on identity, permissions, and configuration. It explains how short-lived cloud credentials for AWS Lambda, Azure Functions, and Google Cloud Functions become primary targets when exposed, enabling privilege escalation and lateral movement. The library emphasizes that interconnected services, shared dependencies, and insufficient visibility into invocation paths and configurations compound these risks, advocating for continuous monitoring and least-privilege enforcement. → blog.qualys.com |
| 2026-04-10 2026 | Intigriti Challenge: SSRF to RCE via File Upload Bypass intermediate | Intigriti Challenge: SSRF to RCE via File Upload Bypass |
| 2026-04-10 2026 | OpenMetadata RCE via SSTI in FreeMarker Email Templates intermediate 4 min read SSTI | Writeup of GHSA-5f29-2333-h9c7, detailing a critical Remote Code Execution vulnerability in OpenMetadata version 1.11.2. The vulnerability stems from Server-Side Template Injection (SSTI) within FreeMarker email templates, allowing an administrator to inject malicious code that is then executed by the server. Attack vectors include privilege escalation, data exfiltration, and establishing reverse shells, with significant impacts on confidentiality, integrity, and availability. |
| 2026-04-10 2026 | RCE in Airbyte via Server-Side Template Injection (SSTI) intermediate | Library for securing Airbyte connections, preventing Remote Code Execution (RCE) via Server-Side Template Injection (SSTI) in the connection builder Docker image. This vulnerability, discovered by Mike Cole of Mantel Group, could allow authenticated attackers to execute arbitrary code and expose sensitive information like credentials if a new connector is tested on a compromised instance. |
| 2026-04-10 2026 | File Upload Vulnerability Testing: Bypassing Filters and Getting RCE intermediate 4 min read | Guide detailing techniques for bypassing file upload filters to achieve Remote Code Execution (RCE). It covers extension filter bypasses, including alternative extensions like `.php5`, `.phtml`, `.phar`, and double extensions, as well as Content-Type and magic byte manipulation. The guide also explores filename manipulation for path traversal, `.htaccess` uploads to enable PHP execution for any extension, and exploitation of image processing vulnerabilities like ImageMagick's CVE-2016-3714. It provides web shell payloads and discusses chaining file uploads with other vulnerabilities such as LFI, SSRF, XSS, and XXE. |
| 2026-04-10 2026 | Critical LFI to RCE in WP Ghost Plugin Affecting 200k+ Sites intermediate 3 min read | Writeup of CVE-2025-26909, a critical unauthenticated Local File Inclusion (LFI) to Remote Code Execution (RCE) vulnerability in the WP Ghost WordPress plugin, affecting over 200,000 sites. The vulnerability arises from insufficient sanitization of user input in the `showFile` function, allowing path traversal and arbitrary file inclusion, potentially leading to RCE via techniques like `php://filter` chains or `PHP_SESSION_UPLOAD_PROGRESS`. The issue is fixed in version 5.4.02. |
| 2026-04-10 2026 | CVE-2026-22812: RCE on a 71k-Star AI Coding Tool With Zero Auth news | CVE-2026-22812: RCE on a 71k-Star AI Coding Tool With Zero Auth |
| 2026-04-10 2026 | Root in One Request: Marimo's Critical Pre-Auth RCE (CVE-2026-39987) news 8 min read | Writeup of CVE-2026-39987, a critical pre-authentication remote code execution vulnerability in the Marimo Python reactive notebook framework. This issue, with a CVSS v4.0 score of 9.3, stems from an unauthenticated WebSocket endpoint for the integrated terminal, allowing attackers to gain an interactive shell as the Marimo process user. The vulnerability has been exploited in the wild, and vulnerable instances are believed to be widespread. Marimo versions prior to 0.23.0 are affected. → endorlabs.com |
| 2026-04-10 2026 | Lessons From 2025: Zero-Day Exploitation Shaping 2026 news 6 min read | Analysis of 2025 zero-day exploitation reveals critical vulnerabilities in enterprise software like Oracle EBS (CVE-2025-61882), Meta React Server Components (CVE-2025-55182), SAP NetWeaver (CVE-2025-31324), Microsoft SharePoint (CVE-2025-53770), and Citrix NetScaler (CVE-2025-5777). Financially motivated groups and China-aligned actors were prominent exploiters, demonstrating rapid weaponization of public disclosures and the lingering risk even after patches are released. Enterprise software's central role made it a prime target, with exploitation leading to widespread compromise and extortion. |
| 2026-04-10 2026 | Cisco Patches Zero-Day RCE Exploited by China-Linked APT news 2 min read | Reference detailing CVE-2025-20393, a critical remote command execution flaw in Cisco AsyncOS Software for Secure Email Gateway and Web Manager. Exploited by China-linked APT UAT-9686, this vulnerability, with a CVSS score of 10.0, allows arbitrary root command execution via insufficient validation of HTTP requests to the Spam Quarantine feature. Attackers deployed tools like ReverseSSH, Chisel, AquaPurge, and AquaShell. Cisco has released patches and recommends hardening guidelines, including firewalling, disabling unnecessary services, and enforcing strong authentication. → thehackernews.com |
| 2026-04-10 2026 | Critical Redis RCE Vulnerability: CVE-2025-49844 news 5 min read | Writeup on CVE-2025-49844, dubbed #RediShell, detailing a critical Use-After-Free (UAF) vulnerability in Redis. This flaw allows authenticated attackers to execute arbitrary native code on the Redis host by escaping the Lua sandbox with a crafted Lua script. Given Redis's prevalence in cloud environments, this vulnerability poses a significant risk, potentially leading to data exfiltration, lateral movement, and system compromise. The writeup also highlights affected forks like Valkey and managed services such as Amazon ElastiCache, Google Cloud Memorystore, and Azure Cache for Redis. → wiz.io |
| 2026-04-10 2026 | CVE-2025-59287: WSUS Unauthenticated RCE Vulnerability news 5 min read | Writeup detailing CVE-2025-59287, a critical (CVSS 9.8) unauthenticated RCE vulnerability in Windows Server Update Services (WSUS). The flaw stems from unsafe deserialization via .NET BinaryFormatter in WSUS reporting web services, allowing attackers to execute arbitrary code with SYSTEM privileges. Exploitation involves crafted SOAP requests to the GetCookie endpoint containing an encrypted gadget chain payload. Microsoft has released an out-of-band update, and active exploitation has been observed in the wild. → picussecurity.com |
| 2026-04-10 2026 | Ivanti EPMM RCE Vulnerability Chain Exploited in the Wild news 6 min read | Writeup detailing the exploitation of Ivanti EPMM by CVE-2025-4427 and CVE-2025-4428, a chain enabling unauthenticated RCE. The attack bypasses authentication via misconfigured Spring Security and leverages Java Expression Language injection for code execution. Observed in-the-wild activity includes Sliver beacon C2 communication, MySQL database dumping, deployment of JSP web shells, and direct reverse shells. Affected versions include 11.12.0.4 and prior, 12.3.0.1 and prior, 12.4.0.1 and prior, and 12.5.0.0 and prior. → wiz.io |
| 2026-04-10 2026 | CVE-2025-34291: Critical Account Takeover and RCE in Langflow news 7 min read AuthN | Library detailing CVE-2025-34291, a critical vulnerability in Langflow enabling account takeover and RCE through a chain involving permissive CORS settings, SameSite=None for the refresh token cookie, and the unauthenticated `/api/v1/refresh` endpoint, allowing attackers to steal valid access tokens and subsequently exploit the `/api/v1/validate/code` endpoint for code execution. |
| 2026-04-10 2026 | Critical Langflow RCE Flaw Exploited in the Wild Within Hours news 3 min read | Writeup of CVE-2026-33017, a critical unauthenticated RCE in Langflow, detailing its exploitation within hours of disclosure. The vulnerability allows attackers to execute arbitrary Python code on exposed instances via the public flow build endpoint. Exploitation attempts involved mass scanning, reconnaissance, and data exfiltration of API keys for OpenAI, Anthropic, and AWS, leading to potential downstream compromises of AI pipelines and connected data stores. |
| 2026-04-10 2026 | CVE-2026-20131: Analysis of Cisco FMC RCE news 4 min read | Analysis of CVE-2026-20131, a critical RCE vulnerability affecting Cisco Secure Firewall Management Center (FMC) Software, details how unauthenticated attackers can execute arbitrary Java code via a specially crafted serialized Java object. This vulnerability, actively exploited in the wild and added to CISA's KEV catalog, allows root privilege escalation and poses a significant risk to network security by potentially compromising entire infrastructures managed by FMC. Exploitation involves sending malicious HTTP requests triggering insecure deserialization, enabling post-exploitation activities like data exfiltration and backdoor installation. |
| 2026-04-10 2026 | n8n Critical Vulnerability (CVE-2026-21858): Unauthenticated RCE news 7 min read | Writeup of CVE-2026-21858, an unauthenticated RCE in n8n, allowing full compromise of locally deployed instances through arbitrary file access, authentication bypass, and command execution. Discovered by Cyera Research Labs and nicknamed 'Ni8mare', this vulnerability highlights automation platforms as high-impact attack surfaces. Remediation involves upgrading n8n, restricting exposure of Forms and Webhooks, and reviewing workflow configurations. → aikido.dev |
| 2026-04-10 2026 | Critical Telnetd Flaw (CVE-2026-32746) Enables Root RCE news 3 min read | Writeup of CVE-2026-32746, a critical out-of-bounds write vulnerability in GNU InetUtils telnetd's LINEMODE Set Local Characters suboption handler. This flaw allows unauthenticated remote attackers to execute arbitrary code as root by sending crafted messages during the initial connection handshake. Discovered by Dream, it affects versions through 2.7 and impacts various systems including FreeBSD, NetBSD, and TrueNAS Core. → thehackernews.com |
| 2026-04-10 2026 | Critical vLLM RCE Allows Server Takeover via Malicious Video URL (CVE-2026-22778) news 5 min read | Library addressing CVE-2026-22778, a critical remote code execution flaw in vLLM. This vulnerability, triggered by a malicious video URL, chains a PIL error information leak for ASLR bypass with a JPEG2000 heap overflow in OpenCV's FFmpeg dependency. Exploitation leads to arbitrary command execution by overwriting function pointers, allowing server takeover. Organizations running vLLM with multimodal video support must upgrade to version 0.14.1 or later immediately. |
| 2026-04-10 2026 | CVE-2026-27825: Critical Unauthenticated RCE and SSRF in mcp-atlassian news 1 min read SSRF | Writeup on CVE-2026-27825, detailing critical unauthenticated RCE and SSRF vulnerabilities in mcp-atlassian. The flaws stem from missing directory confinement and inadequate path traversal validation in attachment download tools, allowing arbitrary file writes for persistence or RCE. A related SSRF issue in header-controlled Atlassian base URLs is also covered. Patched versions 0.17.0 introduce `validate_safe_path()` and `validate_url_for_ssrf()` to mitigate these risks. → arcticwolf.com |
| 2026-04-10 2026 | Unrestricted File Upload Leads to SSRF and RCE intermediate 1 min read | Writeup detailing an unrestricted file upload vulnerability, leveraging ImageMagick and its associated CVEs like CVE-2016-3714 and CVE-2016-3718. This post demonstrates how an attacker can achieve Server-Side Request Forgery (SSRF) and ultimately Remote Code Execution (RCE) through various ImageMagick exploits, including Ghostscript vulnerabilities. The author utilized Burp Suite for initial detection. |
| 2026-04-10 2026 | Complete Defense Against Node.js RCE: Real-World Exploit Analysis advanced 10 min read | Analysis of Node.js RCE vulnerabilities, including CVE-2022-24329, details how attackers exploit `child_process.exec` misuse and improper input validation to achieve command injection. The article contrasts vulnerable code patterns, such as direct passing of user input to `exec`, with secure alternatives like `spawn` or `execFile` and emphasizes strict input validation and sanitization to prevent shell meta-character interpretation. It also discusses the need for an integrated security approach, combining SAST/DAST, cloud workload security with SeekersLab's FRIIM CNAPP, and real-time threat detection via Seekurity SIEM/SOAR, augmented by KYRA AI Sandbox for analyzing suspicious code. |
| 2026-04-10 2026 | Command Injection and RCE in MetaSpore (GHSL-2025-035 to 037) news 5 min read | Writeup detailing command injection (GHSL-2025-035) and RCE (GHSL-2025-037) vulnerabilities in MetaSpore's recommendation service. The command injection allows overwriting arbitrary files and leaking AWS tokens via the `aws s3 sync` command. The RCE is achieved by exploiting an unprotected Consul instance and a Spring Expression Language injection in `spring.application.name`, leading to arbitrary code execution. An additional vulnerability (GHSL-2025-036) involves sensitive Spring Boot Actuator endpoints being exposed without authentication. → securitylab.github.com |
| 2026-04-10 2026 | Command Injection RCE in Kubernetes Log Query on Windows intermediate | Command Injection RCE in Kubernetes Log Query on Windows → akamai.com |
| 2026-04-10 2026 | Prompt Injection to RCE in AI Agents intermediate 10 min read | Writeup on prompt injection leading to RCE in AI agents, detailing design antipatterns that enable argument injection attacks against pre-approved commands. The article demonstrates one-shot RCE exploits across three AI agent platforms, bypassing human approval through techniques like `go test -exec` and `git show --format`/`ripgrep --pre`. Recommendations focus on limiting impact via sandboxing and argument separation for developers, users, and security engineers. → blog.trailofbits.com |
| 2026-04-10 2026 | React2Shell and RSC Vulnerabilities: Exploitation Threat Brief intermediate 8 min read | Library rules protecting against React2Shell (CVE-2025-55182), CVE-2025-55183, and CVE-2025-55184 offer protection for React Server Components. Exploitation attempts, including those by Asian-nexus threat groups, were observed shortly after public disclosure, utilizing vulnerability scanners like Nuclei and Burp Suite. Threat actors employed Internet-wide scanning, asset discovery platforms, and metadata analysis, including SSL certificate details, to identify vulnerable deployments, with targeted efforts observed against geopolitical intelligence priorities, government entities, and critical infrastructure. |
| 2026-04-10 2026 | CVE-2025-55182: React Server Components RCE via Flight Payload Deserialization intermediate 4 min read | Writeup of CVE-2025-55182, a critical RCE in React Server Components. This vulnerability allows unauthenticated attackers to achieve arbitrary JavaScript execution on the server by crafting malicious Flight payloads that exploit unsafe deserialization of Chunks. The attack leverages Promise resolution and nested deserialization to control server-side functions, enabling actions like file reading or command execution. Public exploit code exists, and affected versions include 19.0, 19.1.0, 19.1.1, and 19.2.0. |
| 2026-04-10 2026 | n8n CVE-2025-68613 RCE Exploitation: A Detailed Guide intermediate 11 min read | Guide to CVE-2025-68613, a critical remote code execution vulnerability in n8n. This flaw, with a CVSS score of 9.9, allows authenticated users to compromise the entire system by injecting JavaScript expressions. Exploitation can lead to arbitrary command execution, file access, secret theft, and lateral movement within connected systems. The guide details the vulnerability's technical underpinnings, impact, and provides exploitation and testing examples across various n8n interfaces and API endpoints. |
| 2026-04-10 2026 | 2025 Zero-Days in Review: Lessons Learned news 22 min read | Survey of 2025 zero-day exploits reveals a continued shift towards enterprise targets, with 48% of tracked vulnerabilities impacting enterprise software and edge devices. State-sponsored espionage groups, particularly those linked to the People's Republic of China (PRC) such as UNC5221 and UNC3886, heavily favored these technologies for initial network access, while commercial surveillance vendors also expanded their exploit chain development. Malware campaigns like BRICKSTORM highlighted a new paradigm of using stolen IP for long-term zero-day development. → cloud.google.com |
| 2026-04-10 2026 | Multiple Threat Actors Exploit React2Shell (CVE-2025-55182) news 8 min read | Writeup detailing exploitation of CVE-2025-55182 ("React2Shell"), a critical RCE in React Server Components, by multiple threat actors including China-nexus espionage groups. Observed payloads include MINOCAT, SNOWLIGHT, HISONIC, COMPOOD backdoors, and XMRIG miners. The writeup highlights exploitation chains and post-compromise behaviors, with specific mention of UNC6600, UNC6586, UNC6588, and UNC6603 actors, and their deployment of these tools. It also addresses misinformation surrounding initial exploit disclosures, noting a GitHub repository that initially contained non-functional AI-generated exploit code before updating with legitimate, obfuscated samples. → cloud.google.com |
| 2026-04-10 2026 | React2Shell: Critical Unauthenticated RCE in React Server Components intermediate 4 min read | Writeup of CVE-2025-55182, a critical unauthenticated RCE vulnerability affecting React Server Components and frameworks like Next.js, dubbed React2Shell. Exploitation in-the-wild has begun, with a working proof-of-concept and Metasploit module available. The vulnerability, with a CVSS of 10.0, allows attackers to execute arbitrary code via malicious HTTP requests. Remediation involves updating affected React packages to versions 19.0.1, 19.1.2, or 19.2.1. Rapid7 customers have detection capabilities via Exposure Command, InsightVM, and Nexpose. → rapid7.com |
| 2026-04-10 2026 | Defending Against React2Shell in React Server Components intermediate 12 min read | Reference detailing CVE-2025-55182 (React2Shell), a critical pre-authentication RCE vulnerability in React Server Components, affecting frameworks like Next.js. The vulnerability, stemming from insecure payload validation and prototype pollution, allows attackers to execute arbitrary code via a single HTTP request. Observed exploits target Windows and Linux environments, deploying coin miners and RATs, and attempting to steal cloud credentials using tools like TruffleHog and Gitleaks. Mitigation includes immediate patching to updated React and Next.js versions, prioritizing internet-facing assets, and potentially using WAF protections. → microsoft.com |
| 2026-04-10 2026 | Gogs Zero-Day RCE (CVE-2025-8110) Actively Exploited news 6 min read | Writeup detailing CVE-2025-8110, an actively exploited RCE in Gogs, a self-hosted Git service. This vulnerability is a symlink bypass of a previous RCE (CVE-2024-55947), allowing authenticated users to overwrite files outside the repository via the PutContents API. The exploit chain involves committing a symlink and then using the API to overwrite sensitive files like `.git/config`. Wiz Research discovered this zero-day during an investigation, finding over 700 compromised instances public-facing. A fix is available in Gogs version v0.13.4. → wiz.io |
| 2026-04-10 2026 | SharePoint RCE: Exploitation, Detection, and Mitigation intermediate | SharePoint RCE: Exploitation, Detection, and Mitigation → akamai.com |
| 2026-04-10 2026 | Apache ActiveMQ RCE via Jolokia API (CVE-2026-34197) intermediate 2 min read | Writeup of CVE-2026-34197, an Apache ActiveMQ Classic RCE vulnerability leveraging the Jolokia JMX-HTTP bridge to trigger Remote Code Execution via a crafted discovery URI. Attackers can exploit this by invoking operations like BrokerService.addNetworkConnector, loading a remote Spring XML application context that leads to arbitrary code execution through Runtime.exec(). This flaw, with a CVSS score of 8.8, is particularly critical on versions 6.0.0-6.1.1 due to CVE-2024-32114, which makes exploitation unauthenticated. Patches are available in ActiveMQ Classic 5.19.4 and 6.2.3. |
| 2026-04-10 2026 | Telnet Vulnerability Opens Door to Remote Code Execution as Root intermediate 2 min read | Writeup on CVE-2026-32746, a critical vulnerability in GNU inetutils telnetd allowing pre-authentication remote code execution as root. Triggered by a buffer overflow in the LINEMODE Set Local Characters (SLC) handler, exploitation can lead to full system compromise on affected legacy infrastructure, networking equipment, and embedded systems. The flaw enables arbitrary memory writes via a corrupted pointer after exceeding a fixed buffer. Migrating to SSH, disabling telnetd, or blocking port 23 are recommended workarounds. → csoonline.com |
| 2026-04-10 2026 | CVE-2026-23744: Remote Code Execution in MCPJam Inspector PoC news | CVE-2026-23744: Remote Code Execution in MCPJam Inspector PoC |
| 2026-04-10 2026 | Remote Code Execution (RCE) 101 beginner | Remote Code Execution (RCE) 101 → bugcrowd.com |
| 2026-04-10 2026 | How I Got RCE in One of Bugcrowd's Public Programs intermediate | How I Got RCE in One of Bugcrowd's Public Programs |
| 2026-04-10 2026 | From Recon to RCE: Hunting React2Shell (CVE-2025-55182) intermediate | From Recon to RCE: Hunting React2Shell (CVE-2025-55182) → infosecwriteups.com |
| 2026-04-10 2026 | RCE via Unclaimed Node Package: $2,500 Bug Bounty Writeup intermediate | RCE via Unclaimed Node Package: $2,500 Bug Bounty Writeup |
| 2026-04-10 2026 | Max Severity Flowise RCE Vulnerability Now Exploited in Attacks news 2 min read | Library for securing Flowise, an open-source platform for LLM apps. It addresses CVE-2025-59528, a critical RCE vulnerability allowing arbitrary JavaScript code injection via the CustomMCP node. Developers should upgrade to version 3.0.6 or later to mitigate this threat, which has already been observed in active exploitation. Other Flowise vulnerabilities, CVE-2025-8943 and CVE-2025-26319, have also seen in-the-wild exploitation. → bleepingcomputer.com |
| 2026-04-10 2026 | CVE-2026-35056: XenForo RCE Vulnerability for Admin Accounts news 1 min read | Writeup of CVE-2026-35056, a High severity (CVSS 4.0: 8.6) Code Injection vulnerability in XenForo versions prior to 2.3.9 and 2.2.18. This RCE vulnerability allows authenticated admin users to execute arbitrary code remotely. While no public proof-of-concept or active exploitation has been confirmed, users should promptly apply vendor patches and review the official advisory for affected systems. |
| 2026-04-10 2026 | CVE-2026-1731: Critical Unauthenticated RCE in BeyondTrust Remote Support news 2 min read | Writeup of CVE-2026-1731, a critical unauthenticated RCE in BeyondTrust Remote Support and Privileged Remote Access products, which allows attackers to execute arbitrary OS commands. This vulnerability, with a CVSSv4 score of 9.9, affects RS versions 25.3.1 and prior, and PRA versions 24.3.4 and prior. While SaaS instances were patched, self-hosted deployments require manual updates. Discovered by Hacktron AI, the flaw was added to CISA's KEV list on February 13, 2026. Rapid7 customers using Exposure Command, InsightVM, and Nexpose can assess their exposure with authenticated checks released February 9, 2026. → rapid7.com |
| 2026-04-10 2026 | Critical n8n Flaws Allow Remote Code Execution and Credential Exposure news 3 min read | Writeup detailing critical n8n vulnerabilities including CVE-2026-27577 (expression sandbox escape for RCE) and CVE-2026-27493 (unauthenticated expression evaluation via Form nodes). These flaws, along with CVE-2026-27495 (JavaScript Task Runner code injection) and CVE-2026-27497 (Merge node SQL query mode RCE), allow for arbitrary code execution and credential exposure. Patched versions are 2.10.1, 2.9.3, and 1.123.22. → thehackernews.com |
| 2026-04-09 2026 | CISA adds second critical flaw in Ivanti EPMM to exploited vulnerabilities catalog news | CISA adds second critical flaw in Ivanti EPMM to exploited vulnerabilities catalog https://ift.tt/vfeE3wl → cybersecuritydive.com |
| 2026-04-09 2026 | Claude helps researcher dig up decade-old Apache ActiveMQ RCE vulnerability (CVE-2026-34197) news 2 min read | Writeup detailing CVE-2026-34197, a decade-old RCE vulnerability in Apache ActiveMQ Classic stemming from improper input validation and code injection. This vulnerability, exploitable with default credentials or unauthenticated in certain versions due to CVE-2024-32114, was discovered with AI assistance. Mitigation involves upgrading to ActiveMQ versions 6.2.3 or 5.19.4 and monitoring logs for specific indicators of compromise. CISA has since added CVE-2026-34197 to its Known Exploited Vulnerabilities catalog. → helpnetsecurity.com |
| 2026-04-09 2026 | ThreatsDay Bulletin: Hybrid P2P Botnet 13-Year Apache RCE ClickFix Node.js RAT & 18 More Stories news 13 min read | Library for securing applications, featuring protections against hybrid Phorpiex botnet variants, chained Apache ActiveMQ Classic RCE vulnerabilities (CVE-2026-34197, CVE-2024-32114, CVE-2022-41678), AI-driven DDoS tactics amplified by IoT botnets like TurboMirai, Magecart skimmers hidden in SVG elements affecting Magento stores, and malicious MSI installers delivering Node.js RATs. → thehackernews.com |
| 2026-04-08 2026 | 13-year-old bug in ActiveMQ lets hackers remotely execute commands news 2 min read | Writeup detailing CVE-2026-34197, a 13-year-old remote code execution vulnerability in Apache ActiveMQ Classic affecting versions before 5.19.4 and 6.2.3. Discovered using Claude AI, the flaw allows attackers to execute arbitrary commands by exploiting the Jolokia management API to load external configurations, often chaining with CVE-2024-32114 for unauthenticated access. This issue underscores ActiveMQ's history as a target for attackers, with previous RCEs like CVE-2016-3088 and CVE-2023-46604 appearing on CISA's KEV list. → bleepingcomputer.com |
| 2026-04-08 2026 | RCE Bug Lurked in Apache ActiveMQ Classic for 13 Years news 2 min read | Writeup of CVE-2026-34197, a critical RCE vulnerability in Apache ActiveMQ Classic discovered by Horizon3.ai. This flaw, present for 13 years, can be chained with CVE-2022-41678, allowing attackers to exploit the Jolokia API and VM transport to execute OS commands. In some deployments, it can be combined with CVE-2024-32114 for unauthenticated RCE. Updates to ActiveMQ Classic 5.19.4 and 6.2.3 are recommended. → securityweek.com |
| 2026-04-08 2026 | Fortinet FortiClientEMS Remote Code Execution Vulnerability news | Writeup of CVE-2026-35616 in FortiClientEMS, an Improper Access Control vulnerability allowing unauthenticated attackers to execute unauthorized code or commands via crafted requests. Exploited in the wild, this vulnerability can lead to remote code execution and elevation of privilege on affected systems. Users should update to FortiClientEMS 7.4.7 or later. → hkcert.org |
| 2026-04-08 2026 | Hackers Targeting Ninja Forms Bug That Exposes WordPress Sites to Takeover news 1 min read | Writeup on CVE-2026-0740, a critical unauthenticated arbitrary file upload vulnerability in Ninja Forms' File Uploads addon. This flaw, with a CVSS score of 9.8, allows attackers to bypass file type validation and use path traversal to upload malicious PHP code to the webroot, enabling remote code execution and complete site takeover. Defiant reports thousands of exploitation attempts against the ~50,000 affected websites. Users should update to version 3.3.27. → securityweek.com |
| 2026-04-08 2026 | Storm-1175 focuses gaze on vulnerable web-facing assets in high-tempo Medusa ransomware operations news 11 min read | Library detailing Storm-1175's high-tempo Medusa ransomware operations, exploiting N-days like CVE-2023-21529 (Microsoft Exchange), CVE-2023-27351 (Papercut), and CVE-2024-21887 (Ivanti), alongside zero-days. The actor rapidly chains exploits, establishes persistence via new users, uses tools like PsExec and RMMs (Atera, N-able), PDQ Deployer, and Impacket for lateral movement and credential theft before deploying ransomware. → microsoft.com |
| 2026-04-07 2026 | Attackers exploit critical Flowise flaw CVE-2025-59528 for remote code execution news 2 min read | Writeup of CVE-2025-59528 in Flowise, detailing how attackers exploit improper JavaScript validation in the CustomMCP node for remote code execution and file system access. The vulnerability, fixed in version 3.0.6, allows arbitrary JavaScript execution with full Node.js privileges, enabling command execution and data theft, and has seen active exploitation in the wild, targeting thousands of exposed instances. → securityaffairs.com |
| 2026-04-07 2026 | Hackers exploit critical flaw in Ninja Forms WordPress plugin news 2 min read | Writeup detailing CVE-2026-0740, a critical 9.8 severity vulnerability in Ninja Forms File Uploads for WordPress versions up to 3.3.26. The flaw allows unauthenticated arbitrary file uploads, including PHP scripts, through a lack of destination filename validation and supports path traversal, enabling remote code execution. The vulnerability was discovered by Sélim Lanouar and reported to Wordfence, who provided temporary firewall mitigations before the vendor released a full fix in version 3.3.27. → bleepingcomputer.com |
| 2026-04-07 2026 | Critical Flowise Vulnerability in Attacker Crosshairs news 2 min read | Library updates address CVE-2025-59528, a critical remote code execution vulnerability in Flowise affecting versions up to 3.0.5. This flaw allows attackers to exploit unvalidated user-supplied JavaScript in MCP server configuration, granting full Node.js runtime privileges and access to the file system. Threat actors are actively exploiting this bug, posing an extreme risk to business continuity and sensitive data for thousands of exposed Flowise instances. Version 3.0.6 includes the patch. → securityweek.com |
| 2026-04-07 2026 | Over 1000 Exposed ComfyUI Instances Targeted in Cryptomining Botnet Campaign news 7 min read | Tooling identified in a campaign targeting over 1000 exposed ComfyUI instances allows attackers to exploit custom node vulnerabilities for remote code execution. This enables enrollment into a cryptomining botnet for Monero and Conflux using XMRig and lolMiner, and deployment into a Hysteria V2 proxy botnet. The attack leverages tools that scan for vulnerable ComfyUI instances, install malicious nodes like "ComfyUI-Shell-Executor," and establish persistence via shell scripts that disable history, kill competing miners, and use `LD_PRELOAD` hooks and `chattr +i` for resilience. → thehackernews.com |
| 2026-04-07 2026 | Fortinet Releases Emergency Patch After FortiClient EMS Bug Is Exploited news 1 min read | Writeup of CVE-2026-35616, a critical improper access control vulnerability affecting FortiClient EMS, which has been exploited in the wild, allowing unauthenticated attackers to execute unauthorized code via crafted requests. This follows the discovery and exploitation of another critical flaw, CVE-2026-21643, an SQL injection vulnerability in the same platform, highlighting the significant risks associated with compromised endpoint management infrastructure. → infosecurity-magazine.com |
| 2026-04-07 2026 | Flowise AI Agent Builder Under Active CVSS 10.0 RCE Exploitation; 12000 Instances Exposed news 1 min read | Writeup on CVE-2025-59528, a CVSS 10.0 code injection vulnerability in Flowise AI Agent Builder, allowing remote code execution via JavaScript code injection, similar to prior Flowise flaws like CVE-2025-8943 and CVE-2025-26319. Exploitation can grant access to Node.js modules like `child_process` and `fs`, enabling system compromise, file access, and data exfiltration. Over 12,000 instances remain exposed, facing active exploitation. → thehackernews.com |
| 2026-04-07 2026 | AI agents found vulns in this popular Linux and Unix print server news 4 min read | Writeup of CVE-2026-34980 and CVE-2026-34990 in CUPS, a popular Linux and Unix print server, detailing how two chained vulnerabilities allow unauthenticated remote attackers to execute code and achieve root file overwrite. The flaws, discovered by AI agents and a security researcher, exploit CUPS' handling of anonymous print-job requests and option parsing to enable code injection. CVE-2026-34980 provides remote code execution as the `lp` user, which can then be chained with CVE-2026-34990, an authorization flaw, to gain root privileges. → theregister.com |
| 2026-04-06 2026 | CVE-2026-2699-and-CVE-2026-2701 news 1 min read | Writeup detailing CVE-2026-2699 and CVE-2026-2701, two critical severity vulnerabilities in Progress ShareFile Storage Zones Controller (SZC) 5.x. CVE-2026-2699, an authentication bypass via improper redirect/session handling, allows unauthenticated access to administrative functions. When combined with CVE-2026-2701, an arbitrary file upload to the webroot flaw, these vulnerabilities enable pre-authentication remote code execution. Affected versions include SZC 5.x up to 5.12.3, with fixes available in 5.12.4. → arcticwolf.com |
| 2026-04-06 2026 | Attackers Exploit RCE Flaw as 14000 F5 BIG-IP APM Instances Remain Exposed news 1 min read | Writeup detailing CVE-2025-53521, a critical RCE vulnerability affecting F5 BIG-IP APM instances. Attackers are actively exploiting this flaw, which allows specially crafted traffic to trigger remote code execution when access policies are enabled. Shadowserver reports over 14,000 exposed instances, with CISA adding the vulnerability to its Known Exploited Vulnerabilities catalog, mandating federal agencies to patch by March 30, 2026. → securityaffairs.com |
| 2026-04-06 2026 | Oracle issues emergency fix for pre-auth RCE in Identity Manager (CVE-2026-21992) news 1 min read | Patch for CVE-2026-21992, a critical pre-authentication RCE vulnerability in Oracle Identity Manager and Oracle Web Services Manager, is available. This unauthenticated flaw, affecting versions 12.2.1.4.0 and 14.1.2.1.0, mirrors the exploited CVE-2025-61757, also a missing authentication issue in Identity Manager reported by Assetnote / Searchlight Cyber. Urgent application of this emergency fix is recommended to prevent system takeover. → helpnetsecurity.com |
| 2026-04-06 2026 | Critical Flaws Identified in Progress Software ShareFile Service news | Critical Flaws Identified in Progress Software ShareFile Service https://ift.tt/ERZfLV6 |
| 2026-04-06 2026 | Metasploit Wrap-Up 04/03/2026 news 4 min read | Library updates for Metasploit Framework introduce new HTTP/HTTPS CMD payloads for Windows, enabling RCE against FreeScout (CVE-2026-27636, CVE-2026-28289) and Grav CMS (CVE-2025-50286). It also adds a generic HTTP command execution exploit, a Windows persistence technique via `UserInitMprLogonScript`, and various enhancements, bug fixes, and documentation updates. → rapid7.com |
| 2026-04-06 2026 | Multiple Vulnerabilities in Progress ShareFile Could Allow for Remote Code Execution news 4 min read | Advisory detailing multiple vulnerabilities in Progress ShareFile versions prior to 5.12.4. Chained exploitation of an authentication bypass (CVE-2026-2699) and a remote code execution flaw (CVE-2026-2701) allows attackers to upload malicious ASPX webshells via abuse of file upload and extraction functionality. Public proof-of-concept code is available for the mentioned CVEs. |
| 2026-04-06 2026 | Critical RCE Vulnerability in F5 BIG-IP Under Exploitation news | Critical RCE Vulnerability in F5 BIG-IP Under Exploitation |
| 2026-04-06 2026 | CVE-2026-20131 Cisco FMC RCE Vulnerability news 3 min read | Writeup of CVE-2026-20131, a critical RCE vulnerability in Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control Firewall Management. This insecure deserialization flaw in the web interface allows unauthenticated remote attackers to execute arbitrary code as root, and has been observed in ransomware campaigns. The vulnerability affects specific Cisco FMC and Security Cloud Control Firewall Management versions, with Cisco issuing software updates as the sole remediation. |
| 2026-04-06 2026 | Emerging Threat: CVE-2026-27876 Grafana Remote Code Execution via SQL Expressions news 3 min read | Writeup of CVE-2026-27876, a critical RCE vulnerability in Grafana's sqlExpressions feature, allowing arbitrary file writes to achieve remote code execution. Exploitable with viewer access, it affects specific versions of Grafana 11 and 12 when the feature is enabled, particularly impacting Information Technology and Communication Services sectors. Patches are available, with workarounds including disabling the feature toggle and network restriction. |
| 2026-04-05 2026 | New Chrome Zero-Day CVE-2026-5281 Under Active Exploitation news 1 min read | Writeup on CVE-2026-5281, a critical use-after-free vulnerability in Chrome's Dawn component. This zero-day flaw, actively exploited in the wild, allows remote attackers to execute arbitrary code via crafted HTML pages. The advisory highlights recent exploitation trends, including CVE-2026-3909, CVE-2026-3910, and CVE-2026-2441, urging users to update to the latest Chrome versions. → thehackernews.com |
| 2026-04-03 2026 | Researchers warn of critical flaws in Progress ShareFile news | Researchers warn of critical flaws in Progress ShareFile https://ift.tt/OIsV6B0 → cybersecuritydive.com |
| 2026-04-03 2026 | SSTI (Server-Side Template Injection) to RCE Walkthrough intermediate | SSTI (Server-Side Template Injection) to RCE Walkthrough |
| 2026-04-03 2026 | SSTI Leading to Remote Code Execution (RCE) intermediate | SSTI Leading to Remote Code Execution (RCE) |
| 2026-04-03 2026 | A Pentester's Guide to SSTI | Cobalt beginner 3 min read SSTI | Guide to Server-Side Template Injection (SSTI) detailing how attackers exploit template engines like Smarty, Twig, Velocity, Jinja, and Liquid to achieve remote code execution (RCE). It describes using polyglot payloads to detect vulnerabilities, identify template engines through error messages, and leverage available objects like `settings.SECRET_KEY` for exploitation. The guide also mentions Tplmap as an automated tool for SSTI exploitation and suggests input sanitization and sandboxing as remediation techniques. → cobalt.io |
| 2026-04-03 2026 | RCE with Server-Side Template Injection intermediate | RCE with Server-Side Template Injection |
| 2026-04-03 2026 | Rejetto HTTP File Server SSTI RCE (CVE-2024-23692) | Invicti news | Writeup of CVE-2024-23692, a Server-Side Template Injection (SSTI) vulnerability in Rejetto HTTP File Server (HFS) versions 2.3m and earlier. This flaw allows unauthenticated remote code execution via a malicious HTTP request. Remediation involves migrating to HFS 3.x, as version 2.x is end-of-life and unsupported. Compensating controls include network access restrictions, reverse proxy filtering, or temporary service shutdown. → invicti.com |
| 2026-04-03 2026 | WPML Plugin RCE via Twig SSTI (CVE-2024-6386) news 5 min read | Writeup detailing CVE-2024-6386, an authenticated Remote Code Execution vulnerability in the WPML Multilingual CMS Plugin for WordPress. The vulnerability stems from a Twig Server-Side Template Injection (SSTI) flaw due to inadequate input sanitization within shortcode processing. Exploitation involves constructing payloads using the `dump()` function to dynamically gather necessary characters, bypassing quote restrictions and enabling arbitrary command execution. Affected versions are `<= 4.6.11`. |
| 2026-04-03 2026 | PayloadsAllTheThings - Server Side Template Injection beginner 4 min read SSTI | Library of Server-Side Template Injection (SSTI) techniques and tools, including scanners like Hackmanit/TInjA and epinna/tplmap, along with research on Rendered, Error-Based, Boolean-Based, and Time-Based exploitation. It details methods for identifying template engines such as Jinja2, Twig, and FreeMarker, and provides example payloads and research papers like James Kettle's "Server-Side Template Injection: RCE For The Modern Web App." |
| 2026-04-03 2026 | SSTI: Advanced Exploitation Guide | Intigriti advanced 9 min read SSTI | Library that details advanced exploitation techniques for Server-Side Template Injection (SSTI) vulnerabilities. It covers identification methods for template engines like Jinja2, Twig, and ERB, and demonstrates how to escalate basic injections to remote code execution by exploiting sandboxed environments and chained objects, offering practical examples for Python, PHP, Ruby, JavaScript, Java, and C# template engines. → intigriti.com |
| 2026-04-03 2026 | SSTI Exploitation with RCE Everywhere | YesWeHack intermediate 7 min read SSTI | Writeup detailing advanced Server-Side Template Injection (SSTI) exploitation techniques for achieving Remote Code Execution (RCE) without quotes or external plugins. It covers payloads for Jinja2, Mako, Twig, Smarty, Blade, Groovy, and FreeMarker, demonstrating how to bypass auto-escaping and exploit built-in functions like `chr`, `popen`, `passthru`, and `execute` across various languages and frameworks. → yeswehack.com |
| 2026-04-03 2026 | Critical ShareFile Flaws Lead to Unauthenticated RCE news 2 min read | Writeup detailing chained vulnerabilities CVE-2026-2699 (Execution After Redirect) and CVE-2026-2701 (arbitrary file upload) in Citrix ShareFile. WatchTowr discovered these flaws allowed unauthenticated attackers to gain administrative access, exfiltrate sensitive files to attacker-controlled S3 buckets, and achieve remote code execution by uploading a web shell. The vulnerabilities were patched in ShareFile version 5.12.4. → securityweek.com |
| 2026-04-03 2026 | Under Fire: Attackers Target Flaws in F5 and Citrix Gear news 4 min read | Library: Actively exploited vulnerabilities in F5 BIG-IP APM (CVE-2025-53521, a critical remote code execution flaw) and NetScaler ADC/Gateway (CVE-2026-3055, a critical memory overread, and CVE-2026-4368, a session mix-up) are detailed. Attackers, including nation-state actors, are targeting these application delivery and security platforms, with F5 revising its BIG-IP APM flaw severity from denial-of-service to remote code execution, and CISA mandating patching for federal agencies. Memory leak vulnerabilities in Citrix products, like the previously disclosed CitrixBleed, continue to be a significant concern. → bankinfosecurity.com |
| 2026-04-02 2026 | Critical Fortinet FortiClient EMS flaw exploited for Remote Code Execution news 1 min read | Writeup of CVE-2026-21643, a critical SQL Injection vulnerability in Fortinet FortiClient EMS, now actively exploited. Threat actors smuggle SQL statements via the "Site"-header in HTTP requests to achieve remote code execution, potentially gaining an initial network foothold for lateral movement or malware deployment. Nearly 1000 instances of FortiClient EMS are publicly exposed. This follows the earlier CVE-2023-48788, also an SQL Injection flaw, added to CISA's KEV catalog. → securityaffairs.com |
| 2026-04-02 2026 | Fortinet hit by another exploited cybersecurity flaw news 4 min read | Analysis of CVE-2026-21643, a critical SQL injection vulnerability in FortiClient EMS, detailing its exploitation for remote code execution and data exfiltration. This flaw, present in version 7.4.4 with multi-tenant mode enabled, allows unauthenticated attackers to craft HTTP requests to access admin credentials, endpoint data, and certificates. The vulnerability remains a top application security risk, underscoring the need for organizations to patch immediately and consider zero-trust architectures to mitigate such threats. → csoonline.com |
| 2026-04-02 2026 | Hackers exploiting critical F5 BIG-IP flaw in attacks patch now news 2 min read | Advisory regarding CVE-2025-53521, a critical remote code execution flaw in F5 BIG-IP APM systems that attackers are actively exploiting to deploy webshells. This vulnerability, previously classified as denial-of-service, allows unprivileged attackers to achieve RCE when access policies are configured on a virtual server. F5 strongly recommends patching and reviewing systems for signs of compromise. CISA has added it to its list of actively exploited flaws, urging federal agencies to secure their BIG-IP APM deployments. → bleepingcomputer.com |
| 2026-02-02 2026 | depthfirst | 1-Click RCE To Steal Your Moltbot Data and Keys advanced 5 min read AI Secrets | Library analysis by depthfirst identified a critical vulnerability (CVE-2026-25253) in OpenClaw, an AI assistant. This flaw allows for a one-click RCE exploit by chaining a logic gap in gateway URL ingestion with Cross-Site WebSocket Hijacking. The exploit bypasses Same Origin Policy and allows disabling security features like user confirmation and sandboxing via API calls, leading to arbitrary command execution and access to sensitive data like iMessage and Stripe API keys. |
| 2025-12-07 2025 | 🚨 New article: SSRF exploitation advanced SSRF | What's inside: → 20+ bypass techniques → Cloud metadata attacks (AWS/Azure/GCP) → Gopher protocol exploitation → Docker & Redis RCE chains → Blind SSRF detection → Real automation scripts From ping t... |
| 2025-08-14 2025 | https://weekly.infosecwriteups.com/iw-weekly-39-10-000-bounty-zero-click-account-takeover-stored-xss-open-redirection-vulnerability-sql-injection-rce-reconnaissance-techniques-and-much-more/ intermediate 3 min read SQLi XSS | Collection of Infosec writeups featuring a $10,000 bounty for a Facebook Reels vulnerability, Zoom stored XSS, Facebook zero-click account takeover, io_uring UAF (CVE-2022-2602), Apple subdomain open redirection, GraphQL pentesting, social engineering guides, insecure CORS, bug bounty automation, smart contract vulnerabilities, mental health tips for hackers, HTTP Basic Auth, SQL Injection to RCE (CVE-2022-44015), RFC analysis for bounties, MMORPG CTF challenges, CodeQL for GraphQL, reconnaissance techniques, SSRF deep dives, Foundry EVM chain tests, and online security learning resources. |
| 2025-08-14 2025 | Chaining an Blind SSRF bug to Get an RCE | by Santosh Kumar Sha (@killmonga intermediate SSRF | The content discusses chaining a Blind Server-Side Request Forgery (SSRF) bug to achieve Remote Code Execution (RCE), presented by Santosh Kumar Sha. This technique involves exploiting a vulnerability in which an attacker can make a server perform unauthorized requests, leading to gaining control over the server and executing malicious code remotely. The focus is on demonstrating how an SSRF bug can be leveraged to escalate to a more severe RCE attack, highlighting the importance of understanding and securing against such vulnerabilities in web applications. |
| 2025-08-14 2025 | Just Gopher It: Escalating a Blind SSRF to RCE for $15k — Yahoo Mail | by S intermediate SSRF | The content discusses escalating a blind Server-Side Request Forgery (SSRF) vulnerability to Remote Code Execution (RCE) in Yahoo Mail, earning a reward of $15,000. The process involves utilizing the Gopher protocol to exploit the SSRF vulnerability and achieve RCE. The article likely details the steps taken to identify, exploit, and report the vulnerability to Yahoo Mail's security team, resulting in a significant bounty payout. |
| 2025-08-14 2025 | https://github.com/smgorelik/Windows-RCE-exploits/tree/master/Web/VBScript advanced | The provided link leads to a GitHub repository containing Windows Remote Code Execution (RCE) exploits written in VBScript. The repository offers a collection of scripts that can be used to exploit vulnerabilities in Windows systems. It focuses on utilizing VBScript for web-based attacks. The content provides a resource for security researchers and professionals interested in studying or testing RCE vulnerabilities in Windows environments using VBScript. |
| 2025-08-14 2025 | https://medium.com/@logicbomb_1/bugbounty-how-i-was-able-to-bypass-firewall-to-get-rce-and-then-went-from-server-shell-to-get-783f71131b94?source=userActivityShare-90814179aa21-1525127127 intermediate | The content discusses a bug bounty experience where the author bypassed a firewall to achieve Remote Code Execution (RCE) and gained access to a server shell. The author describes the steps taken to exploit vulnerabilities, including identifying the firewall, exploiting it to gain RCE, and escalating privileges to access the server shell. The article provides insights into the process of identifying and exploiting security weaknesses, showcasing the author's skills in penetration testing and bug hunting. |
| 2025-08-14 2025 | https://medium.com/@kedrisec/how-i-found-2-9-rce-at-yahoo-bug-bounty-program-20ab50dbfac7 intermediate | The content discusses a security researcher's experience finding a critical Remote Code Execution (RCE) vulnerability in Yahoo's Bug Bounty Program. The researcher details the steps taken to discover and exploit the vulnerability, which allowed unauthorized code execution on Yahoo's servers. The post highlights the importance of responsible disclosure and the collaboration between security researchers and companies to address such vulnerabilities. The discovery earned the researcher a significant bounty reward. |
| 2025-08-14 2025 | https://medium.com/@p4c3n0g3/lfi-to-rce-via-access-log-injection-88684351e7c0?source=userActivityShare-90814179aa21-1524411790 intermediate | The content discusses a security vulnerability called Local File Inclusion (LFI) that can be exploited to achieve Remote Code Execution (RCE) through access log injection. By manipulating log files, an attacker can inject malicious code that gets executed on the server, leading to potential compromise. The article provides a detailed explanation of how this attack works and offers insights into the impact and mitigation strategies. It emphasizes the importance of understanding and securing against such vulnerabilities to protect systems from unauthorized access and data breaches. |
| 2025-08-14 2025 | https://engineering.salesforce.com/meraki-rce-when-red-team-and-vulnerability-research-fell-in-love-3a119ce2cf56?source=userActivityShare-90814179aa21-1515163858 intermediate | The content discusses a case study where a red team and vulnerability researchers collaborated to discover a critical Remote Code Execution (RCE) vulnerability in Meraki devices. The article highlights the importance of teamwork, communication, and collaboration between different security roles to identify and address security flaws effectively. The process involved reverse engineering, code analysis, and exploitation techniques to uncover the vulnerability. The findings were responsibly disclosed to the vendor for remediation. This case emphasizes the significance of cross-functional cooperation in cybersecurity to enhance overall security posture and protect against potential threats. |
| 2025-08-14 2025 | Leading the Blind to Light! - A Chain to RCE intermediate 5 min read | Writeup detailing a Remote Code Execution (RCE) chain achieved by exploiting an Oracle E-Business Suite instance. The chain begins with an authentication bypass leading to blind XXE, which then facilitates information disclosure. This information is combined with an SQL injection vulnerability on an internal database host, enabling the re-enabling of `xp_cmdshell`. Successful execution of `xp_cmdshell` ultimately grants command execution with Administrator privileges. → blog.zsec.uk |
| 2025-08-14 2025 | opsxcq/exploit-CVE-2016-10033: PHPMailer 5.2.18 Remote Code Execution intermediate 6 min read | Tool for exploiting CVE-2016-10033 in PHPMailer versions prior to 5.2.18, enabling remote code execution. This vulnerability allows attackers to inject arbitrary code by crafting a `From` address that bypasses filters, leading to the execution of commands via the `mail()` function's `additional_parameters`. The provided exploit leverages this by writing a backdoor file to a web-accessible directory, allowing for shell access and further exploitation. |
| 2025-08-14 2025 | Artificial truth · From LFI to RCE in php intermediate 2 min read | Technique for achieving RCE via LFI in PHP, improving on earlier /proc/self/environ and /var/log methods. This technique leverages PHP's temporary file handling during uploads. By repeatedly triggering an infinite recursive inclusion with a SIGSEGV, the temporary file is prevented from deletion, allowing an attacker to bruteforce its randomly generated name and achieve remote code execution, as demonstrated with a Python script and a shell.php payload. |
| 2025-08-14 2025 | The Tale Of SSRF To RCE on .GOV Domain | by Tobydavenn | Sep, 2022 | Medium intermediate SSRF | The content titled "The Tale Of SSRF To RCE on .GOV Domain" by Tobydavenn on Medium discusses a scenario involving Server-Side Request Forgery (SSRF) leading to Remote Code Execution (RCE) on a .GOV domain. The article likely delves into the technical details of how this vulnerability was exploited, highlighting the significance of such security flaws on government domains. It may provide insights into the exploitation process, potential impacts, and the importance of addressing SSRF vulnerabilities promptly to prevent RCE attacks. |
| 2025-08-14 2025 | https://www.reddit.com/r/Hacking_Tutorials/comments/gtpkug/remote_code_execution_explained_with_real_life/?utm_source=share&utm_medium=ios_app&utm_name=iossmf beginner Bug Bounty | The content discusses remote code execution, explaining how it works with real-life examples. It delves into the concept of exploiting vulnerabilities to execute code on a remote system, potentially leading to unauthorized access. The post likely provides insights into the dangers of remote code execution and how hackers can leverage it for malicious purposes. It serves as a tutorial or informational resource for individuals interested in understanding cybersecurity threats and how to protect against them. |
| 2025-08-14 2025 | https://medium.com/@smilehackerofficial/how-i-found-rce-but-got-duplicated-ea7b8b010990 intermediate | The content discusses a security researcher's experience finding a Remote Code Execution (RCE) vulnerability in a web application. The researcher details the steps taken to identify and exploit the vulnerability, leading to a successful demonstration of the RCE. However, the researcher later discovered that the same vulnerability had been previously reported by another researcher, resulting in a duplicate submission. The article highlights the importance of thorough research before reporting vulnerabilities to avoid duplication and emphasizes the need for collaboration within the security research community. |
| 2025-08-14 2025 | https://omespino.com/write-up-private-bug-bounty-usd-rce-as-root-on-marathon-instance/ intermediate 2 min read | Writeup detailing RCE as root on Marathon instances, found by exploiting unauthenticated Marathon UIs discovered via Shodan. The technique involves using `curl` to create a Marathon application with a command like `wget` to exfiltrate host data to an attacker-controlled listener, leveraging the `cmd` parameter for arbitrary command execution. This vulnerability allows for root-level command execution on vulnerable Marathon deployments. |
| 2025-08-14 2025 | Zoom Zero Day: 4 Million Webcams & maybe an RCE? Just get them to visit yo intermediate | The content mentions a Zoom zero-day vulnerability affecting 4 million webcams that could potentially lead to remote code execution (RCE). The vulnerability can be exploited by tricking users into visiting a malicious website. This poses a significant security risk as attackers could gain unauthorized access to users' webcams and potentially execute malicious code on their devices. It highlights the importance of staying vigilant and updating software to protect against such vulnerabilities. |
| 2025-08-14 2025 | elttam - Ruby 2.x Universal RCE Deserialization Gadget Chain advanced 11 min read | Library releasing a universal Ruby 2.x RCE deserialization gadget chain, bypassing prerequisites of earlier techniques like the ActiveSupport gem. This chain leverages code reuse attacks by chaining "gadgets" from the Ruby standard library, including techniques to indirectly load further libraries via `require` calls, ultimately enabling arbitrary command execution. |
| 2025-08-14 2025 | http://blog.orange.tw/2018/08/how-i-chained-4-bugs-features-into-rce-on-amazon.html advanced | The content discusses how a security researcher chained together four bugs and features to achieve Remote Code Execution (RCE) on Amazon. The researcher details the vulnerabilities found in Amazon's services and how they were exploited to gain unauthorized access and execute code remotely. The blog post provides a technical breakdown of the process, highlighting the importance of identifying and addressing security flaws to prevent such exploits. |
| 2025-08-14 2025 | RCE by uploading a web.config ↳... intermediate | The content discusses a Remote Code Execution (RCE) vulnerability that can be exploited by uploading a malicious web.config file. This type of vulnerability allows attackers to execute arbitrary code on a target system, potentially leading to unauthorized access or data breaches. It highlights the importance of securing file upload functionality and ensuring that user inputs are properly validated to prevent such security risks. |
| 2025-07-29 2025 | GitHub - jeanlucdupont/EXEfromCER: PoC that downloads an executable from a public SSL certificate intermediate Supply Chain | Proof-of-concept that demonstrates downloading and executing a Windows executable embedded within a public SSL certificate. This technique leverages custom X.509 certificate extensions and HTTPS to deliver the payload. The process involves generating a certificate with the executable in a custom OID extension using OpenSSL, serving it via TLS, and a Python client that connects, extracts the binary from the certificate, saves it, and then runs it. |
| 2025-05-17 2025 | New Process Injection Class: The CONTEXT-Only Attack Surface advanced 16 min read | Library for exploring the "context-only" attack surface in process injection. This research demonstrates techniques to inject code by focusing solely on execution primitives, bypassing traditional detection methods that rely on memory allocation and writing. Methods include using `CreateRemoteThread` with `LoadLibraryA` on existing in-process strings, calling arbitrary WinAPI functions via `SetThreadContext`, and leveraging `NtCreateThread` for remote shellcode execution, expanding to APC functions like `QueueUserAPC`. The accompanying `RedirectThread` tool aids in these investigations. |
| 2025-03-30 2025 | Stored XSS in My Flow To RCE in Opera Browser #2 - Renwa - Medium intermediate Bug Bounty XSS | Hey Opera team, after your great response and bounties with previous reports motivated me to look more into the program and find more bugs, luckily I found a critical bug in My Flow that allow an… |
| 2024-12-22 2024 | 0x03 - Approaching the Modern Windows Kernel Heap advanced 13 min read | Writeup detailing exploitation of a Use-After-Free (UaF) vulnerability on Windows 11 (x64) using techniques derived from Alex Ionescu's "Kernel Heap Fengshui." The process involves reverse engineering with Ghidra to identify object sizes and IOCTL codes, and then employing Named Pipes (NPFS.SYS) to trigger nonpaged pool allocations for kernel heap manipulation, overcoming initial challenges with object sizing and allocation control. |
| 2024-12-19 2024 | GitHub - WafflesExploits/hide-payload-in-images: A project that demonstrates embedding shellcode payloads into image files (like PNGs) using Python and extracting them using C/C++. Payloads can be retrieved directly from the file on disk or from the image stored in a binary's resources section (.rsrc) intermediate 1 min read Python | Library demonstrating shellcode payload embedding into PNG images using Python, with C/C++ extractors. The project includes `payload-extractor-from-file.cpp` for disk-based extraction, `payload-extractor-from-resource.cpp` utilizing WinAPI functions like `FindResource` and `LockResource`, and `payload-extractor-from-resource-via-peb.cpp` for stealthier extraction via manual PEB and PE header parsing, avoiding WinAPI calls and improving reliability with direct PEB access. |
| 2024-11-20 2024 | Win32 shellcode beginner | Win32 shellcode |
| 2024-11-10 2024 | GitHub - AnonKryptiQuz/Xploitra: Xploitra is a powerful reverse shell payload generator for educational and security testing. It offers customizable payloads with advanced obfuscation and session management, making it ideal for simulating real-world attack scenarios and assessing system security. intermediate 1 min read | Tool for generating customizable reverse shell payloads for Windows, Xploitra offers advanced obfuscation and session management for simulating attack scenarios. It supports payload customization of IP, port, and execution commands, with randomized encoding and string manipulation to bypass basic detection. The tool can generate payloads on any OS and handle multiple sessions concurrently, encoding them in Base64 for secure delivery and saving them as `.bat` files. |
| 2024-11-10 2024 | GitHub - AnonKryptiQuz/I-Espresso: I-Espresso is a tool that enables users to generate Portable Executable (PE) files from batch scripts. Leveraging IExpress, it demonstrates how file extension spoofing can be used to evade detection. intermediate 1 min read | Tool for generating Portable Executable (PE) files from batch scripts using IExpress. I-Espresso demonstrates file extension spoofing techniques to evade detection, offering a user-friendly, fast, and efficient method for creating disguised payloads without external dependencies on Windows. It guides users through prompts to specify batch scripts, executable names, and custom extensions for generated PE files, intended purely for educational and security testing purposes. |
| 2024-11-04 2024 | Microsoft SharePoint RCE bug exploited to breach corporate network news 2 min read | Writeup detailing the exploitation of CVE-2024-38094, a Microsoft SharePoint RCE vulnerability, for initial network access. Attackers deployed a webshell, leveraged Horoung Antivirus to disable defenses, and used tools like Impacket, Mimikatz, FRP, everything.exe, Certify.exe, and kerbrute for lateral movement, credential harvesting, persistence, and network scanning. The exploit involved a batch script for antivirus installation and manipulation of system logging. → bleepingcomputer.com |
| 2024-10-17 2024 | Vimeo SSRF with code execution potential. intermediate SSRF | The content discusses the discovery of a semi-responded SSRF vulnerability on Vimeo that potentially allows for code execution. The author shares their process of finding and exploiting this vulnerability in a blog post. → infosecwriteups.com |
| 2024-10-17 2024 | How I Chained 4 vulnerabilities on GitHub Enterprise, From SSRF Execution Chain to RCE! advanced 6 min read Bug Bounty SSRF | Writeup detailing a four-vulnerability exploit chain leading to Remote Code Execution (RCE) on GitHub Enterprise. The chain begins with a Server-Side Request Forgery (SSRF) discovered in the WebHook feature, which is then chained with a second SSRF in the Graphite service. This execution chain enables CR-LF injection, allowing protocol smuggling. Finally, a malicious Ruby Object is smuggled as a Memcached protocol, exploiting unsafe `Marshal` deserialization to achieve RCE. The article also mentions potential bypasses for Faraday IP restrictions and the use of Linux Glibc features. |
| 2024-10-01 2024 | GitHub - Offensive-Panda/ProcessInjectionTechniques: This comprehensive process injection series is crafted for cybersecurity enthusiasts, researchers, and professionals who aim to stay at the forefront of the field. It serves as a central repository of knowledge, offering in-depth exploration of various process injection techniques used by adversaries. advanced 2 min read | Library detailing numerous process injection techniques, including Classic Code Injection, Reflective DLL Injection, Process Hollowing, and PE Injection. It offers step-by-step explanations, implementation code, and demonstration videos, utilizing custom shellcode for illustrative purposes. References to MITRE ATT&CK T1055, Dirty Vanity, and resources from ired.team and RedTeamOperations are included. |
| 2024-08-22 2024 | BChecks/vulnerability-classes/injection at main · PortSwigger/BChecks · GitHub intermediate Burp SQLi XSS | BChecks collection for Burp Suite Professional and Burp Suite Enterprise Edition - PortSwigger/BChecks |
| 2023-11-06 2023 | The toddlers introduction to Heap exploitation (Part 1) beginner | The toddler’s introduction to Heap exploitation (Part 1) https://ift.tt/OhuPqgT |
| 2023-11-05 2023 | Offensive C# beginner Bug Bounty | Course on Offensive C# covering malware development, C2 creation, Active Directory enumeration and attacks, .NET loaders, persistence, WinAPI interaction, token enumeration, shellcode and DLL injection, PE backdooring, PE parsing, PE64 loading, process hollowing, and API hooking and hashing. |
| 2023-10-27 2023 | Perfect DLL Hijacking intermediate 42 min read | Library that details a novel technique for DLL hijacking that circumvents the limitations of Windows' Loader Lock by reverse-engineering the Windows library loader. This research builds upon prior work like Nick Landers' "Adaptive DLL Hijacking" and presents a data-only approach that avoids problematic actions such as changing memory protection with VirtualProtect or modifying pointers, which are often flagged by anti-malware or incompatible with exploit mitigations like Intel CET. The library also offers stable mitigation and detection mechanisms for defenders. |
| 2023-10-18 2023 | Empire beginner | Empire https://ift.tt/Qmfzot3 |
| 2023-10-13 2023 | Understanding File Upload Vulnerabilities in Web App Penetration Testing | 2023 beginner | Understanding File Upload Vulnerabilities in Web App Penetration Testing | 2023 https://ift.tt/8aVoHYJ → cyberw1ng.medium.com |
| 2023-09-22 2023 | How to turn SQL injection into an RCE or a file read? Case study of 128 bug bounty reports intermediate Bug Bounty SQLi Talks | How to turn SQL injection into an RCE or a file read? Case study of 128 bug bounty reports https://www.youtube.com/watch?v=ClnVdYf4PK0 |
| 2023-08-21 2023 | Journey into Windows Kernel Exploitation: The Basics beginner | Journey into Windows Kernel Exploitation: The Basics https://ift.tt/IyEYMN5 |
| 2023-07-22 2023 | ProcessInjection intermediate 1 min read | Tool implementing five process injection techniques: Vanilla, DLL, Process Hollowing, APC Queue, and KernelCallbackTable. It accepts shellcode in base64, hex, C, or raw formats, and supports P/Invoke, D/Invoke, Direct Syscalls, and Indirect Syscalls for injection. The tool also includes detection evasion through XOR or AES encryption, and Parent PID Spoofing, with the option to load via reflection from disk or a remote server. |
| 2023-04-03 2023 | Basic and Low-level Python Network Attacks beginner Python | https://ift.tt/SxGhvBQ |
| 2023-04-02 2023 | $10.000 bounty for exposed .git to RCE intermediate Bug Bounty | $10.000 bounty for exposed .git to RCE https://ift.tt/1AxW3QH |
| 2022-04-06 2022 | Favorite tweet by @hakluke beginner Bug Bounty | Favorite tweet: I see people confuse these terms all the time, so I wrote a reference-style blog about it! The difference between code injection, command injection, RCE, remote code execution and rem... |
| 2022-02-28 2022 | Favorite tweet by @NandanLohitaksh intermediate Bug Bounty | Favorite tweet: Top 25 Remote Code Execution (RCE) Parameters 1. ?cmd={payload} 2. ?exec={payload} 3. ?command={payload} 4. ?execute={payload} 5. ?ping={payload} 6. ?query={payload} 7. ?jump={payload... |
| 2022-01-18 2022 | Making Sense of the Constantly Changing Log4Shell Landscape beginner 13 min read | Tool for streaming live football matches; provides HD quality, stable connections, and expert commentary across global leagues like the Premier League, Champions League, and La Liga, with no advertisements or viruses. |
| 2022-01-17 2022 | Log4Pot beginner 1 min read | Honeypot for Log4Shell (CVE-2021-44228) that listens for exploitation attempts on various ports, detects malicious requests in lines and headers, and recursively downloads exploit payloads. It supports logging to files and Azure blob storage, with an included analyzer script to extract and decode payloads, and build timelines. Installation involves fetching the repository and using Poetry for dependency management. |
| 2022-01-03 2022 | Malicious PDF Generator intermediate | Tool for generating ten distinct malicious PDF files, each with phone-home functionality, designed for penetration testing and red-teaming. This application facilitates testing web pages and services that accept PDF uploads, security products, PDF readers, and PDF converters by creating sample files with embedded links that can be configured to point to a Burp Collaborator URL. |
| 2022-01-02 2022 | a c program containing vulnerable code for common types of vulnerabilities can be used to show fuzzing concepts. beginner 3 min read Fuzzing | Program containing vulnerable C code to demonstrate fuzzing concepts. This resource includes code for common vulnerabilities such as integer overflow/underflow, out-of-bounds read/write, double free, use-after-free, memory leaks, and stack/heap exhaustion. It is designed to be fuzzed using tools like AFL, libafl, libfuzzer, and honggfuzz, with instructions and video tutorials provided for setup and execution. |
| 2021-12-31 2021 | InfosecMindmaps/Log4shell at main DickReverse/InfosecMindmaps beginner | InfosecMindmaps/Log4shell at main DickReverse/InfosecMindmaps |
| 2021-12-31 2021 | Log4Shell Visualization beginner | Log4Shell Visualization |
| 2021-12-30 2021 | Golang Offensive Tools with C-Sto and capnspacehook intermediate Python | Library of offensive security tools built with Golang, showcasing work from developers like C-Sto (goWMIexec, BananaPhone, gosecretsdump) and capnspacehook (pandorasbox, garble). The resource covers challenges and future directions of Go malware, listing numerous tools for command and control, obfuscation, reverse engineering, and more, including notable projects like sliver and DeimosC2. |
| 2021-12-16 2021 | Mitigate Log4j2 / Log4Shell in Elasticsearch intermediate 16 min read Supply Chain | Analysis of Log4Shell (CVE-2021-44228) vulnerabilities in Elasticsearch versions 5.0 to 7.16.0. Discusses mitigation strategies including updating Log4j to 2.17.1, setting `log4j2.formatMsgNoLookups=true`, removing the `JndiLookup` class, and leveraging the Java Security Manager's protections. Explains why subsequent Log4j issues (CVE-2021-45046, CVE-2021-45105, CVE-2021-44832) have limited impact on Elasticsearch due to its configuration and security measures. Recommends upgrading Elasticsearch to versions ≥ 7.16.3 or ≥ 6.8.23 for full patching. |
| 2021-12-13 2021 | Semgrep beginner Supply Chain | Semgrep |
| 2021-12-13 2021 | Log4Shell The Worst Java Vulnerability in Years beginner | Log4Shell The Worst Java Vulnerability in Years |
| 2021-12-13 2021 | Java log4j security: Added Lookup injection rule. #1650 intermediate | Library of Semgrep rules designed to detect and prevent Log4j Lookup injection vulnerabilities in Java applications. This includes a specific rule (ID 1650) to address added lookup injections, enhancing static analysis for securing Java codebases against common Log4j exploits. |
| 2021-12-12 2021 | Log4j: Its worse than you think beginner 6 min read | Library of vulnerability scanner rules for detecting CVE-2021-4428 (Log4j), a critical Java package vulnerability. This tool leverages a partial trigger of the exploit to identify vulnerable instances, with a focus on providing remote scanning services to customers. Mitigation advice includes upgrading Log4j, disabling lookups, removing dangerous class files, and blocking JNDI lookup prefixes at the WAF. |
| 2021-12-12 2021 | Digging deeper into Log4Shell - 0Day RCE exploit found in Log4j intermediate 6 min read Supply Chain | Writeup detailing CVE-2021-44228, a remote code execution vulnerability in Apache Log4j. This widespread flaw enables attackers to execute arbitrary code by controlling log messages, leveraging JNDI lookups that can trigger LDAP or DNS calls to load malicious Java classes. The writeup describes the attack mechanism, observed exploitation tactics including targeting User-Agent headers, and mitigation strategies such as patching or disabling lookups. |
| 2021-12-12 2021 | PSA: Log4Shell and the current state of JNDI injection beginner 2 min read Supply Chain | Analysis of CVE-2021-44228 (Log4Shell), detailing how JNDI injection vulnerabilities in Log4j allow remote code execution. It highlights that even recent Java runtimes are susceptible, particularly through RMI and LDAP lookups. The analysis covers historical Java patches like CVE-2009-1094 and CVE-2018-3149, and discusses exploitation vectors using Apache XBean BeanFactory and Java deserialization, affecting environments like Apache Tomcat and WebSphere. |
| 2021-12-06 2021 | How to Brute-Force SSH Servers in Python intermediate 3 min read Python | Library for brute-forcing SSH servers in Python using the `paramiko` library. The tutorial details how to create a script that attempts password combinations from a provided wordlist against a target SSH host. It covers handling connection timeouts, authentication failures, and rate limiting, and includes argument parsing for host, username, and password list input. |
| 2021-11-26 2021 | Phantom - A multi-platform HTTP(S) Reverse Shell Server and Client intermediate 3 min read API Sec | Library for building multi-platform HTTP(S) reverse shells. Phantom allows creation of standalone Linux and Windows binaries using PyInstaller, supporting both auto-generated and user-supplied certificates for encrypted HTTPS communication. It includes a helper script for certificate generation and a straightforward build process via `build.py`, which can use Poetry or Virtualenv for dependency management. Client binaries can connect to specified server URLs, facilitating stealthy connections. |
| 2021-11-11 2021 | Game Hacking with Python and cheat engine intermediate Python | Game Hacking with Python and cheat engine |
| 2021-09-24 2021 | Buffer Overflow using ShellCraft - TryHackMe Intro to Pwntools beginner | Buffer Overflow using ShellCraft - TryHackMe Intro to Pwntools |
| 2021-09-05 2021 | Writing an iOS Kernel Exploit from Scratch advanced 43 min read Mobile | Library for creating an iOS kernel exploit from scratch, specifically focusing on chain #3 against a double-free vulnerability present in iOS 11 and mitigated in 11.4.1. This resource details setting up a test environment, analyzing the IOKit driver vulnerability and its trigger, and developing a full exploit using common techniques, including a sandbox escape method revealed by Siguza. It serves as a reference for beginners by filling potential gaps in exploit development knowledge. |
| 2021-08-18 2021 | remote-method-guesser: A Java RMI Vulnerability Scanner intermediate | remote-method-guesser: A Java RMI Vulnerability Scanner |
| 2021-05-31 2021 | Finding writable folders and hijackable DLLs intermediate | This content discusses security vulnerabilities related to identifying writable folders and DLL hijacking opportunities on a system. These vulnerabilities can be exploited by attackers to gain elevated privileges or execute malicious code. The process likely involves scanning file systems for improperly configured permissions and analyzing the search paths for dynamic-link libraries (DLLs) to find instances where an attacker could substitute a malicious DLL for a legitimate one. No specific bug bounty payout amount is mentioned. |
| 2021-01-20 2021 | Learn About Command Injection Attacks beginner | The content discusses command injection attacks where attackers can run their code on a victim's machine. This type of attack allows malicious actors to execute arbitrary commands on a system, potentially leading to unauthorized access, data theft, or system compromise. It is crucial to understand and protect against command injection vulnerabilities to prevent security breaches and safeguard sensitive information. |
| 2020-05-31 2020 | r/Hacking_Tutorials - Remote Code Execution explained with real life bug bounty reports beginner Bug Bounty | The Reddit post titled "r/Hacking_Tutorials - Remote Code Execution explained with real life bug bounty reports" has received 36 votes but no comments yet. The post likely discusses remote code execution vulnerabilities using real-life bug bounty reports. It aims to provide tutorials and insights into how these vulnerabilities can be exploited, potentially offering valuable information for those interested in hacking and cybersecurity. |
| 2019-10-05 2019 | SQL injection to RCE intermediate SQLi | The content discusses a case of SQL injection leading to Remote Code Execution (RCE) discovered during a recent customer penetration testing. It hints at the potential security vulnerability and the impact it had on the system. |
| 2019-08-28 2019 | WRITE UP – Private bug bounty $$,$$$ USD: “RCE as root on Marathon-Mesos instance” – @omespino intermediate 2 min read | Writeup detailing a private bug bounty win of $30,000 USD for a Remote Code Execution (RCE) as root vulnerability found on a Marathon-Mesos instance. The exploit involved using Shodan to locate unauthenticated Marathon UIs, then crafting a `curl` command to create a Marathon application that executed `/usr/bin/wget --post-data='id'` to a listener, demonstrating root-level command execution via this container orchestration platform. Tools used included netcat, curl, and a web browser. |
| 2019-04-20 2019 | PDFReacter SSRF to ROOT Level Local File Read which led to RCE intermediate SSRF | PDFReacter is a parser that converts HTML content to PDF. |
| 2018-11-09 2018 | elttam - Ruby 2.x Universal RCE Deserialization Gadget Chain advanced 11 min read | Library for Ruby 2.x universal RCE deserialization gadget chains, detailing exploitation of arbitrary deserialization and releasing a public gadget chain for command execution. It discusses serialization, deserialization pitfalls, and code reuse attacks via gadget chains, noting limitations of previous payloads requiring specific gems and libraries. This resource explores hunting for gadgets within the standard library, focusing on techniques that implicitly load additional libraries or allow partial control over arguments to `require`. |
| 2018-07-06 2018 | Latex to RCE, Private Bug Bounty Program intermediate | The content discusses the author's participation in a private bug bounty program focused on a CMS journal site, approximately a year ago. The author aims to share their learnings from this experience, particularly related to exploiting a vulnerability in Latex to achieve Remote Code Execution (RCE). The bug bounty program provided an opportunity for the author to enhance their skills in identifying and exploiting security flaws. |
| 2018-06-07 2018 | How I Chained 4 vulnerabilities on GitHub Enterprise, From SSRF Execution Chain to RCE! intermediate SSRF | The content appears to be a title mentioning chaining four vulnerabilities on GitHub Enterprise, from SSRF execution to RCE. The author is identified as 🍊. |
| 2018-04-29 2018 | #BugBounty — How I was able to bypass firewall to get RCE and then went from server shell to get… intermediate | The content is about a bug bounty experience where the author bypassed a firewall to achieve Remote Code Execution (RCE) and gained access to a server shell. The author likely shares details of the process and techniques used in this security testing scenario. |
| 2017-11-19 2017 | Leading the Blind to Light! - A Chain to RCE advanced 5 min read | Writeup detailing a Remote Code Execution chain on Oracle E-Business Suite. The exploit begins with an authentication bypass, leading to blind XXE and information disclosure. This disclosure helps identify an internal endpoint, which through further fuzzing, reveals an SQL injection vulnerability. By re-enabling `xp_cmdshell` via SQL injection, the attacker achieves command execution with administrator privileges. → blog.zsec.uk |
Frequently Asked Questions
- What is remote code execution?
- Remote Code Execution (RCE) is a vulnerability that allows an attacker to run arbitrary commands or code on a target system. It is the most critical class of security vulnerability because it gives the attacker the same level of access as the application or server process, often leading to complete system compromise.
- What are common RCE attack vectors?
- Common vectors include command injection (unsanitized input passed to shell commands), unsafe deserialization (Java, PHP, Python, .NET), Server-Side Template Injection (Jinja2, Twig, Freemarker), file upload bypasses that execute uploaded code, expression language injection in Java frameworks, and prototype pollution in Node.js leading to code execution.
- Why does RCE pay the highest bug bounties?
- RCE represents total system compromise — an attacker can read all data, modify the application, pivot to internal networks, and potentially access cloud infrastructure. The impact is maximum, so bounty programs consistently pay their highest rewards for RCE findings, often ranging from $10,000 to $100,000+ depending on the target.
Weekly AppSec Digest
Get new resources delivered every Monday.