The newest Remote Code Execution (RCE) resources are on the Remote Code Execution (RCE) page. For a reading order instead of a date order, see the Remote Code Execution (RCE) learning path.
| Date Added | Link | Excerpt |
|---|---|---|
| 2026-06-17 2026 | Googles Vertex AI SDK could allow RCE through bucket squatting news 2 min read | Writeup of RCE vulnerability in Google's Vertex AI SDK for Python, dubbed "Bucket Squatting" and "Pickle in the Middle." Attackers could hijack model uploads by pre-registering globally unique cloud storage bucket names derived from victim project IDs and regions. This allowed injecting malicious models serialized with pickle, leading to remote code execution when processed by Vertex AI's infrastructure. The flaw affected versions 1.139.0 and 1.140.0, with fixes deployed in 1.144.0 and 1.148.0. → csoonline.com |
| 2026-06-17 2026 | Rapid7 Analysis: CVE-2020-3992 ESXi OpenSLP remote code execution vulnerability news 2 min read | Analysis of CVE-2020-3992 details a critical use-after-free vulnerability in VMware ESXi's OpenSLP service, allowing remote code execution with a CVSSv3 score of 9.8. This actively exploited vulnerability, also seen in conjunction with CVE-2019-5544, poses a significant threat as ransomware groups target critical hypervisor infrastructure. Mitigation involves patching ESXi, disabling the SLP service, and restricting management network access. → rapid7.com |
| 2026-06-17 2026 | Rapid7 Analysis: CVE-2020-16952 Microsoft SharePoint Remote Code Execution Vulnerabilities news 2 min read | Analysis of CVE-2020-16952 details a Microsoft SharePoint remote code execution vulnerability. Exploitable by authenticated users, it allows arbitrary file disclosure, including the web.config file, enabling .NET deserialization attacks via ysoserial.net. A Metasploit module and Python proof-of-concept exist, demonstrating straightforward exploitation by leaking keys to forge malicious ViewState payloads. Rapid7 recommends immediate patching for SharePoint Foundation 2013, Enterprise Server 2016, and Server 2019. → rapid7.com |
| 2026-06-17 2026 | Rapid7 Analysis: CVE-2021-26084 Confluence Server OGNL injection news 14 min read | Analysis of CVE-2021-26084 details a critical OGNL injection vulnerability in Atlassian Confluence Server and Data Center. This flaw, carrying a CVSSv3 score of 9.8, allows unauthenticated remote code execution. Widespread exploitation began in September 2021, with attackers initially deploying coin miners and later ransomware. The vulnerability resides in the `createpage-entervariables` functionality, and proof-of-concept code is publicly available. → rapid7.com |
| 2026-06-17 2026 | Rapid7 Analysis: Pre-auth RCE in ForgeRock Access Manager (CVE-2021-35464) news 10 min read | Analysis of CVE-2021-35464 reveals a pre-authentication remote code execution vulnerability in ForgeRock Access Manager and OpenIdentity Platform's OpenAM. This Java deserialization flaw within the JATO framework is exploitable via a simple GET or POST request, yielding code execution on vulnerable systems running versions below 7.0 on Java 8. Rapid7 identified over 1,000 internet-facing systems potentially exposed, with proof-of-concept exploit code readily available. → rapid7.com |
| 2026-06-17 2026 | Rapid7 Analysis: CVE-2021-44228 (Log4Shell) news 20 min read | Analysis of CVE-2021-44228, the Log4Shell vulnerability in Apache Log4j, details its critical remote code execution capabilities triggered by specially crafted log messages. This write-up provides exploitation methods, including a proof-of-concept against Apache Struts 2, and outlines mitigation strategies like upgrading Log4j, setting system properties, or removing the `JndiLookup` class. It also recommends monitoring for indicators like "${jndi:" strings and mentions IDS coverage from EmergentThreat Labs. → rapid7.com |
| 2026-06-17 2026 | Rapid7 Analysis: CVE-2022-26134 news 7 min read | Analysis of CVE-2022-26134 details a critical unauthenticated RCE vulnerability in Atlassian Confluence Server and Data Center. This OGNL injection flaw, exploitable via HTTP requests, allows attackers to execute arbitrary code on the server. Rapid7's writeup provides technical details on exploitation, including crafted curl commands that insert payloads into URIs and retrieve command output via HTTP headers, and notes that this vulnerability is similar to CVE-2021-26084. → rapid7.com |
| 2026-06-17 2026 | Rapid7 Analysis: CVE-2022-3786 news 5 min read | Analysis of CVE-2022-3786 details an arbitrary-length overflow vulnerability in OpenSSL's Punycode library within libcrypto.so. This flaw, occurring during Punycode domain name parsing via the `ossl_a2ulabel` function, allows for infinite period characters to be appended to a buffer, potentially leading to denial of service or, in rare circumstances, exploitable memory corruption. While exploitation is unlikely due to specific memory layout requirements, affected versions include OpenSSL 3.0.0 through 3.0.6. Updating to OpenSSL 3.0.7 is recommended. → rapid7.com |
| 2026-06-17 2026 | Rapid7 Analysis: CVE-2023-42793 news 9 min read | Analysis of CVE-2023-42793 reveals a critical authentication bypass in JetBrains TeamCity, affecting versions prior to 2023.05.4. This vulnerability, stemming from an improper handling of the wildcard path `/**/RPC2` within the `RequestInterceptors` class, allows unauthenticated attackers to achieve remote code execution. By exploiting this flaw, attackers can gain access to sensitive data like source code and build artifacts, potentially enabling supply chain attacks. The analysis details patch diffing using BeyondCompare and decompilation with cfr to identify the root cause in `RequestInterceptors.java` and the target endpoint within the `rest-api.jar`. → rapid7.com |
| 2026-06-17 2026 | Rapid7 Analysis: CVE-2023-46747 news 4 min read | Analysis of CVE-2023-46747 details an unauthenticated remote code execution vulnerability in F5 BIG-IP's Traffic Management User Interface (TMUI). This flaw, stemming from mishandled AJP requests between Apache and the AJP server, allows attackers to smuggle AJP requests. By crafting specific requests, an attacker can create a new administrator user, change its password, and then exploit the system to leak hashes or execute OS commands via the `mgmt/tm/util/bash` resource, achieving full device compromise. → rapid7.com |
| 2026-06-17 2026 | Critical LiteLLM Vulnerability Chain Enables Remote Code Execution and Full AI Gateway Server Takeover (CVE-2026-42271 CVE-2026-47101 CVE-2026-47102 CVE-2026-40217) news 5 min read | Writeup detailing a critical vulnerability chain in LiteLLM, impacting versions prior to v1.83.14-stable. The chain, comprising CVE-2026-47101 (Authorization Bypass), CVE-2026-47102 (Privilege Escalation), and CVE-2026-40217/CVE-2026-42271 (Remote Code Execution), allows low-privilege users to achieve full administrative control and execute arbitrary code on AI gateway servers. Exploitation in the wild has been observed for CVE-2026-42271, and supply chain attacks via backdoored PyPI releases have also occurred, highlighting the severe risks and need for immediate upgrades. → rescana.com |
| 2026-06-17 2026 | Wiz Research Identifies Exploitation in the Wild of Aviatrix Controller RCE (CVE-2024-50603) news 4 min read AuthZ | Writeup of CVE-2024-50603, an unauthenticated RCE in Aviatrix Controller, detailing its command injection flaw and exploitation in the wild for cryptojacking and Sliver backdoor deployment. The vulnerability, stemming from improper input neutralization in API endpoints like `list_flightpath_destination_instances`, allows arbitrary command execution. Wiz Research observed exploitation leading to privilege escalation in AWS control plane environments, with affected versions requiring urgent patching to 7.1.4191 or 7.2.4996. → wiz.io |
| 2026-06-17 2026 | How Wiz found a Critical NVIDIA AI vulnerability: Deep Dive into a container escape (CVE-2024-0132) intermediate 11 min read | Writeup detailing CVE-2024-0132, a critical container escape vulnerability in NVIDIA Container Toolkit and GPU Operator. This vulnerability allows attackers who control a container image to gain full access to the host system by mounting the host's root filesystem and exploiting access to container runtime sockets. The article discusses exploitation methods against Docker and gVisor, mentions a bypass vulnerability (CVE-2025-23359), and recommends updating to NVIDIA Container Toolkit version 1.17.4 for mitigation. → wiz.io |
| 2026-06-17 2026 | Pickle in the Middle – Hijacking Vertex AI Model Uploads for Cross-Tenant RCE intermediate 12 min read AI Supply Chain | Writeup detailing a "Pickle in the Middle" attack against Vertex AI model uploads in google-cloud-aiplatform SDK versions 1.139.0 and 1.140.0. The vulnerability arises from predictable default bucket names and a missing ownership check, allowing attackers to squat preemptively create a staging bucket in their own project and then replace a victim's model with a malicious one that exploits pickle deserialization for cross-tenant RCE. → unit42.paloaltonetworks.com |
| 2026-06-16 2026 | Critical Oracle PeopleSoft Vulnerability Actively Exploited in ShinyHunters Campaign news 2 min read | Writeup of CVE-2026-35273, a critical Oracle PeopleSoft vulnerability, details its active exploitation by the ShinyHunters group in widespread data theft campaigns. This unauthenticated remote code execution flaw, with a CVSS 3.1 score of 9.8, has been leveraged by attackers to compromise hundreds of instances globally, disproportionately impacting the education sector. ShinyHunters employ a "gadget chain" and demonstrate deep PeopleSoft architecture knowledge to extract credentials, with ransom notes like README-IF-YOU-SEE-THIS-YOUVE-BEEN-HACKED.TXT observed. Immediate patching via Oracle's out-of-band security alert is recommended, with temporary workarounds including network access restrictions and WAF rules. → arcticwolf.com |
| 2026-06-16 2026 | Pickle in the Middle Hijacking Vertex AI Model Uploads for Cross-Tenant RCE advanced 12 min read | Toolchain vulnerability in the Google Cloud Vertex AI SDK for Python allows attackers to hijack model uploads for cross-tenant RCE. Exploiting predictable default bucket names and a missing ownership check, attackers can preemptively squat a bucket, cause legitimate model artifacts to be uploaded to their project, and then replace the model with a malicious version that leverages pickle deserialization to execute arbitrary code within the victim's Vertex AI serving infrastructure. This affects google-cloud-aiplatform SDK versions 1.139.0 and 1.140.0, with fixes available in v1.148.0. → unit42.paloaltonetworks.com |
| 2026-06-16 2026 | IngressNightmare: CVE-2025-1974 - 9.8 Critical Unauthenticated Remote Code Execution Vulnerabilities in Ingress NGINX news 14 min read API Sec | Writeup of IngressNightmare (CVE-2025-1974), a series of critical unauthenticated RCE vulnerabilities affecting Ingress NGINX Controller for Kubernetes. This flaw allows attackers to gain unauthorized access to all cluster secrets, enabling complete cluster takeover. The vulnerabilities stem from remote NGINX configuration injection into the admission controller, a common, often externally exposed, component. Exploitation has been observed in over 6,500 clusters. Mitigation involves updating to patched versions or disabling the admission controller. → wiz.io |
| 2026-06-16 2026 | Ivanti EPMM RCE Vulnerability Chain Exploited in the Wild news 6 min read | Writeup of Ivanti EPMM RCE vulnerability chain exploitation, detailing how CVE-2025-4427 (authentication bypass) and CVE-2025-4428 (post-auth RCE via Java Expression Language injection) are combined for unauthenticated remote code execution. The analysis includes observed exploitation in the wild, use of Sliver beacons, MySQL database dumping, and web shell deployments, referencing affected versions and patched releases. → wiz.io |
| 2026-06-16 2026 | Understanding command injection vulnerabilities in Go beginner 7 min read | Library for mitigating command injection vulnerabilities in Go applications. It details how insecurely handling user input with packages like `os/exec` can lead to attackers executing arbitrary commands, potentially causing data breaches or system compromise. The library emphasizes secure coding practices such as rigorous input validation and sanitation, preferring safe APIs (like `github.com/disintegration/imaging` for image manipulation) over direct system command execution, and refactoring vulnerable code to use `exec.Command` with separate arguments instead of constructing shell strings. → snyk.io |
| 2026-06-15 2026 | Langflow RCE under active attack months after a patch was shipped news 3 min read | Writeup detailing CVE-2026-5027, a path traversal vulnerability in Langflow versions up to 1.8.4. This flaw allows unauthenticated attackers to write files to arbitrary locations, leading to remote code execution when auto-login is enabled. Exploited by the MuddyWater group, the vulnerability affects thousands of internet-exposed instances of the popular AI orchestration platform. → csoonline.com |
| 2026-06-15 2026 | Exposed JDWP Exploited in the Wild: What Happens When Debug Ports Are Left Open beginner 5 min read | Library for detecting and preventing attacks exploiting exposed Java Debug Wire Protocol (JDWP) interfaces. This protocol, often unintentionally exposed in popular applications like TeamCity, Jenkins, and Spring Boot, allows for remote code execution. Attackers can leverage this misconfiguration to deploy malware, establish persistence through various methods including systemd services and cron jobs, and execute stealthy cryptomining payloads like customized XMRig. The library aids in identifying exploitation attempts and the subsequent malicious activities, such as those observed in the wild with rapid exploitation of JDWP ports. → wiz.io |
| 2026-06-15 2026 | NVIDIAScape - Critical NVIDIA AI Vulnerability: A Three-Line Container Escape in NVIDIA Container Toolkit (CVE-2025-23266) news 7 min read AI | Library for discovering CVE-2025-23266, a critical NVIDIA Container Toolkit vulnerability allowing a three-line Dockerfile escape to gain root access on the host. This flaw, dubbed #NVIDIAScape, impacts managed AI cloud services by enabling malicious containers to bypass isolation and compromise other customers' data and models on shared GPU infrastructure. Affected versions include NCT up to v1.17.7 and NVIDIA GPU Operator up to 25.3.1. Mitigation involves upgrading the toolkit or disabling the enable-cuda-compat hook. → wiz.io |
| 2026-06-15 2026 | Ultralytics AI Pwn Request Supply Chain Attack news 6 min read AI Supply Chain | Analysis of the Ultralytics supply chain attack, which occurred in two phases between December 4-7, 2024, details how malicious versions (8.3.41, 8.3.42, 8.3.45, 8.3.46) were published to PyPI. The attack exploited a template injection vulnerability in GitHub Actions workflows, specifically using a `pull_request_target` trigger with unescaped template expressions in a crafted branch name to execute a shell script. This script exfiltrated GitHub tokens, poisoned the pip cache, and injected a Monero cryptocurrency mining payload (XMRig) into the package, impacting users across projects like ComfyUI and Comic-Translate. → snyk.io |
| 2026-06-14 2026 | MeshCentral: From XSS to RCE advanced 8 min read XSS | Writeup detailing a full RCE exploit chain against MeshCentral, starting with an XSS vulnerability. The analysis demonstrates how a large language model, Claude Opus, was used to discover and develop a Proof of Concept, which was then refined to allow an attacker to impersonate an existing agent by extracting credentials from local files. The article contrasts this with a failed attempt using a local, uncensored LLM, highlighting the practical application of AI in security research and exploit development. |
| 2026-06-14 2026 | Breaking NVIDIA Triton: CVE-2025-23319 - A Vulnerability Chain Leading to AI Server Takeover advanced 6 min read AI | Library for discovering vulnerabilities in NVIDIA Triton Inference Server, including CVE-2025-23319, CVE-2025-23320, and CVE-2025-23334. This exploit chain begins with a Python backend information leak, allowing an attacker to abuse the shared memory API for arbitrary read/write operations, potentially leading to remote code execution and full server takeover. The findings highlight the critical need for securing AI infrastructure. → wiz.io |
| 2026-06-13 2026 | Why Use App-Level Auth When Every Database Has Auth? (Splunk Enterprise CVE-2026-20253 Pre-Auth RCE) - watchTowr Labs news 15 min read AuthZ | Writeup detailing Splunk Enterprise CVE-2026-20253, a pre-authentication RCE vulnerability. The analysis highlights how the PostgreSQL Sidecar Service Endpoint, enabled by default in AWS deployments and Splunk versions 10+, lacks authentication, allowing unauthenticated invocation of file operations like backup and restore. This research demonstrates a path to exploitation by proxying requests through the main Splunk web application. → labs.watchtowr.com |
| 2026-06-13 2026 | RediShell: Critical Remote Code Execution Vulnerability (CVE-2025-49844) in Redis, 10 CVSS score news 5 min read | Writeup of CVE-2025-49844, dubbed RediShell, a critical 10.0 CVSS score Use-After-Free vulnerability in Redis. This flaw allows authenticated attackers to escape the Lua sandbox via crafted Lua scripts, achieving arbitrary native code execution on the Redis host. Affecting Redis and forks like Valkey, along with managed services such as Amazon ElastiCache, Google Cloud Memorystore, and Azure Cache for Redis, exploitation can lead to system compromise, data exfiltration, and lateral movement. Immediate patching and security hardening, including enabling authentication and restricting access, are crucial. → wiz.io |
| 2026-06-12 2026 | Why Use App-Level Auth When Every Database Has Auth? (Splunk Enterprise CVE-2026-20253 Pre-Auth RCE) intermediate 14 min read | Writeup detailing CVE-2026-20253, a pre-authentication Remote Code Execution vulnerability in Splunk Enterprise. The writeup explains how the PostgreSQL Sidecar Service, enabled by default on AWS deployments and available in version 10+, lacks authentication, allowing unauthenticated users to trigger file operations like backup creation. This leads to arbitrary file creation and truncation, ultimately enabling RCE through the Splunkd web application which proxies requests to the vulnerable service on port 5435. → labs.watchtowr.com |
| 2026-06-12 2026 | LangGraph Flaw Chain Exposes Self-Hosted AI Agents to Remote Code Execution news 2 min read | Writeup on LangGraph vulnerabilities, detailing a critical chain involving CVE-2025-67644 (SQL injection) and CVE-2026-28277 (unsafe msgpack deserialization) that enables remote code execution on self-hosted AI agent deployments. Additional vulnerability CVE-2026-27022, a RediSearch Query Injection, also impacts checkpoint functionality. The chain exploits metadata filters and checkpoint data manipulation to achieve arbitrary code execution. → thehackernews.com |
| 2026-06-12 2026 | Marking Your Own Homework (Check Point Remote Access VPN IKEv1 Authentication Bypass CVE-2026-50751) - watchTowr Labs news 11 min read AuthN | Analysis of CVE-2026-50751 reveals a critical authentication bypass vulnerability in Check Point Remote Access VPN IKEv1 implementations. A logic flaw in certificate validation allowed attackers to bypass signature verification by manipulating a flag, effectively preventing authentication. This vulnerability, present in multiple Gaia versions, was exploited in the wild by threat actors, including a Qilin ransomware affiliate. The patch involves modifying the `process_cert_payloads` function within the `iked` daemon to enforce policy-based certificate validation rather than client-controlled flags. → labs.watchtowr.com |
| 2026-06-12 2026 | The RCE that AMD wouldn't fix news 6 min read | Writeup detailing a trivial Remote Code Execution (RCE) vulnerability discovered in AMD's AutoUpdate software, where HTTP URLs for executable downloads enabled Man-in-the-Middle attacks, allowing for the substitution of malicious executables. The author encountered initial rejection from AMD's bug bounty program due to the MITM scenario being out of scope, but AMD later agreed to issue a CVE and implement a fix after public disclosure. The writeup also highlights issues with extended embargo periods and a subsequent redirection bug that rendered the RCE unexploitable. |
| 2026-06-12 2026 | React2Shell (CVE-2025-55182): Everything You Need to Know About the Critical React Vulnerability news 5 min read | Library for detecting and mitigating React2Shell (CVE-2025-55182), a critical RCE vulnerability in React Server Components and Next.js exploiting insecure deserialization. This unauthenticated flaw, affecting default configurations, allows crafted HTTP requests to influence server-side execution. Exploitation has been observed in the wild by Wiz, Amazon, and Datadog, with post-exploitation activity including credential harvesting and cryptomining. Immediate patching is required, as hardened releases for React and Next.js are available. → wiz.io |
| 2026-06-12 2026 | React2Shell: Technical Deep-Dive & In-the-Wild Exploitation of CVE-2025-55182 intermediate 10 min read | Writeup of CVE-2025-55182 "React2Shell," detailing its exploit mechanics and observed in-the-wild attacks. The vulnerability, an improper input deserialization flaw in React Server Components, allows arbitrary code execution on the server. The analysis highlights exploitation in Next.js, Waku, and Vite, with observed attacks including credential harvesting, cloud metadata access, cryptominer deployment, and the use of Sliver implants for persistent backdoors, including a fileless backdoor achieved by monkey-patching Node.js. → wiz.io |
| 2026-06-12 2026 | Gogs 0-Day Exploited in the Wild news 6 min read | Analysis of CVE-2025-8110, a zero-day RCE in Gogs exploited in the wild, reveals a symlink bypass of a previous vulnerability (CVE-2024-55947). This flaw allows authenticated users to overwrite files outside the repository by exploiting Gogs' handling of symbolic links within its API, leading to arbitrary command execution. Over 700 compromised instances were identified, with attackers using the Supershell framework for C2 communication. Gogs version v0.13.4 addresses this issue. → wiz.io |
| 2026-06-12 2026 | Hacking Into A Server Through FTP beginner | This article explores the continued vulnerability of servers still using FTP (File Transfer Protocol). It highlights how this outdated protocol can be a gateway for attackers to gain unauthorized access to sensitive data and systems. The piece likely details the methods used in such attacks and emphasizes the importance of migrating to more secure alternatives to prevent potential breaches. → infosecwriteups.com |
| 2026-06-12 2026 | Google Chrome Multiple Vulnerabilities news | Writeup detailing multiple vulnerabilities in Google Chrome, including CVE-2026-12007 through CVE-2026-12035. Exploitation of these flaws could lead to remote code execution, denial of service, security restriction bypass, and sensitive information disclosure. Patches are available by updating Google Chrome to version 149.0.7827.114 (Linux) or 149.0.7827.114/.115 (Mac/Windows) or later. → hkcert.org |
| 2026-06-11 2026 | ShinyHunters Exploits Oracle PeopleSoft Zero-Day (CVE-2026-35273) to Breach Universities news 3 min read | Writeup of CVE-2026-35273, a critical Oracle PeopleSoft remote code execution vulnerability, exploited by the ShinyHunters group against universities. The zero-day, affecting PeopleTools 8.61 and 8.62, allowed unauthenticated network access for server takeover. Attackers used custom MeshCentral agents and a lateral movement script to exfiltrate data, targeting endpoints with exposed Environment Management Hubs. Mitigation involves disabling the service, blocking specific paths, and hunting for indicators like unexpected JSP files or outbound SMB traffic. → thehackernews.com |
| 2026-06-11 2026 | Claroty finds authentication bypass RCEflaws in Vertiv UPS management cards that could disrupt data center operations advanced 4 min read | Writeup of CVE-2025-46412 and CVE-2025-41426, authentication bypass and RCE flaws in Vertiv Liebert UPS management cards. Researchers detailed how a URI confusion vulnerability in the web server allowed attackers to bypass authentication by manipulating URL parsing logic, enabling unauthorized access to sensitive functions like configuration uploads and firmware upgrades on RDU101 and UNITY-DP models. The stack-based buffer overflow vulnerability enabled remote code execution. |
| 2026-06-11 2026 | Hackers Exploit Langflow Vulnerability for Remote Code Execution news 1 min read | Writeup of CVE-2026-5027, a path traversal vulnerability in Langflow, allowing unauthenticated remote code execution. Exploitation involves sending a request to the `/api/v2/files` endpoint without sanitizing the `filename` parameter, enabling attackers to write files to arbitrary locations and achieve RCE. The flaw is particularly dangerous due to Langflow's default unauthenticated auto-login feature. This highlights a trend of attackers targeting AI development tooling. → securityweek.com |
| 2026-06-11 2026 | Patch Tuesday June 2026: 211 Fixes Critical CVEs news 5 min read | Analysis of Microsoft's June 2026 Patch Tuesday reveals 211 fixes, including 37 critical vulnerabilities, with a significant focus on enabling multi-stage attack chains. Key risks highlighted are CVE-2026-47291, a critical HTTP.sys RCE with a CVSS score of 9.8 and exploitation more likely, and CVE-2026-41091, a Microsoft Defender Elevation of Privilege vulnerability with detected exploitation. The release underscores attackers assembling attack chains across trusted enterprise platforms like Office, SharePoint, and Exchange, with a persistent emphasis on Elevation of Privilege vulnerabilities and Security Feature Bypasses impacting components such as BitLocker. |
| 2026-06-11 2026 | CodeBreach: Infiltrating the AWS Console Supply Chain and Hijacking AWS GitHub Repositories via CodeBuild advanced 13 min read Supply Chain | Tool for infiltrating the AWS Console supply chain, CodeBreach exploits a CodeBuild misconfiguration, allowing unauthenticated attackers to hijack key AWS GitHub repositories, including the JavaScript SDK. This vulnerability, stemming from unanchored regex filters in build triggers, could lead to platform-wide compromise by enabling malicious code injection. Mitigations include securing CodeBuild-GitHub connections with fine-grained tokens and ensuring anchored regex patterns for webhook filters. → wiz.io |
| 2026-06-11 2026 | 10 year old critical vulnerability in phpBB affecting tens of millions of users across thousands of forums news 2 min read AuthN | Library for securing phpBB instances, detailing a critical Authentication Bypass vulnerability discovered by Aikido's AI pentesting tool. This flaw, affecting versions up to 3.3.16 and 4.0.0-a2, allows unauthenticated users to gain valid sessions and impersonate any user, including administrators, leading to potential private message leaks and full forum control. While direct RCE is not possible, the vulnerability necessitates immediate upgrades to phpBB 3.3.17 to mitigate account takeover risks. → aikido.dev |
| 2026-06-10 2026 | Critical Ivanti Sentry flaw allows root-level remote code execution (CVE-2026-10520) news 2 min read | Analysis of CVE-2026-10520, an OS command injection vulnerability in Ivanti Sentry, details how unauthenticated attackers can achieve root-level remote code execution. This critical flaw, along with CVE-2026-10523 (authentication bypass), affects versions prior to 10.5.2, 10.6.2, and 10.7.1. WatchTowr researchers provided technical details and a script for detecting exposure, noting the vulnerability stems from an unauthenticated API accepting internal configuration commands. → helpnetsecurity.com |
| 2026-06-10 2026 | Unpatched Langflow Flaw CVE-2026-5027 Exploited for Unauthenticated RCE news 1 min read | Writeup of CVE-2026-5027, a path traversal vulnerability in Langflow exploited for unauthenticated RCE. The flaw in the `POST /api/v2/files` endpoint allows attackers to write files to arbitrary locations using '../' sequences. Exploitation can lead to arbitrary code execution, especially since Langflow's auto-login is enabled by default. This follows other exploited Langflow CVEs like CVE-2026-0770 and CVE-2025-34291. → thehackernews.com |
| 2026-06-10 2026 | 10 year old critical vulnerability in phpBB affecting tens of millions of users across thousands of forums news 2 min read | Tool discovery by Aikido Attack identified a critical Authentication Bypass vulnerability in phpBB, potentially leading to Remote Code Execution. This flaw impacts versions up to 3.3.16 and 4.0.0-a2, and was promptly patched in version 3.3.17 following a rapid disclosure via HackerOne. Exploitation can grant unauthorized session access, exposing private messages or full administrative control. → aikido.dev |
| 2026-06-10 2026 | Unauthenticated RCE as QSECOFR via IBM i Management Central — port 5555, client-controlled verify flag, no credentials required (V7R4 and earlier) news 10 min read | Tool for unauthenticated Remote Code Execution on IBM i Management Central (port 5555) targeting V7R4 and earlier. This tool exploits a vulnerability in the custom MGTC packet protocol, specifically within the `McPacketableAuthenticationData` structure. By manipulating the `verify` flag to skip validation and providing a crafted `userId`, an attacker can execute arbitrary CL commands as the QSECOFR user without requiring credentials. The exploit bypasses authentication checks by setting `verify` to 0 and utilizing specific class IDs like `McStartRequest` with `McEndpointManagedCmdData` and `McManagedCmdDefinition`. |
| 2026-06-10 2026 | Security Advisory: Critical RCE Vulnerabilities in React Server Components (CVE-2025-55182) news 4 min read Deser | Advisory detailing CVE-2025-55182, a critical RCE vulnerability affecting React 19 and Next.js versions through unsafe deserialization in the React Server Components (RSC) "Flight" protocol. Exploitation requires a single crafted HTTP request and impacts any framework embedding RSC, including Vite and Parcel plugins. Immediate patching of React and Next.js is recommended, alongside validation of third-party frameworks and implementation of defense-in-depth controls like runtime sandboxing and WAF rules. → snyk.io |
| 2026-06-10 2026 | Wait, binding.gyp Can Do What? Exploring npm's Weirdest Build System intermediate 15 min read Supply Chain | Library for identifying vulnerabilities in `binding.gyp` files, which `npm` executes during package installation. This library explores how attackers can abuse `binding.gyp`'s command expansion feature and Python `eval()` sandbox to execute arbitrary code, as demonstrated by the Miasma worm which exploited Red Hat packages and others like `@vapi-ai/server-sdk`. It details techniques for escaping the `eval()` sandbox to achieve arbitrary code execution, even when no explicit lifecycle scripts are present in `package.json`. → aikido.dev |
| 2026-06-10 2026 | Six Proto6 Vulnerabilities in protobuf.js Expose Node.js Apps to RCE and DoS news 2 min read | Writeup detailing six Proto6 vulnerabilities in protobuf.js (CVE-2026-44289 through CVE-2026-44295), impacting Node.js applications. These flaws, stemming from improper schema and metadata handling, can lead to remote code execution (RCE) and denial-of-service (DoS) through unbounded recursion, unsafe option paths, prototype pollution, and crafted field names or schema names. Exploitation is particularly concerning in data and AI ecosystems, affecting tools like Baileys and CI/CD pipelines, with CVE-2026-44291 posing the most severe RCE risk via prototype pollution. → thehackernews.com |
| 2026-06-10 2026 | More Evidence That Words Don't Mean What We Thought They Meant (Ivanti Sentry Pre-Auth OS Command Injection CVE-2026-10520) news 8 min read | Analysis of CVE-2026-10520 in Ivanti Sentry reveals a critical pre-authenticated OS command injection vulnerability. Exploiting this flaw allows remote, unauthenticated attackers to achieve root-level remote code execution by crafting specific input strings processed by the `handleMessage` endpoint. The vulnerability stems from improper handling of user-supplied `message` parameters, which are parsed and directly passed into internal commands, enabling the injection of arbitrary OS commands. This advisory details the affected versions and the technical path leading to this high-severity flaw. → labs.watchtowr.com |