The newest Remote Code Execution (RCE) resources are on the Remote Code Execution (RCE) page. For a reading order instead of a date order, see the Remote Code Execution (RCE) learning path.
| Date Added | Link | Excerpt |
|---|---|---|
| 2026-05-14 2026 | 18-year-old NGINX vulnerability allows DoS potential RCE news 4 min read | Library for detecting CVE-2026-42945, an 18-year-old heap buffer overflow in NGINX's ngx_http_rewrite_module, which can lead to denial of service and, under specific conditions like disabled ASLR, remote code execution. This flaw, affecting versions 0.6.27 through 1.30.0, arises from inconsistent state handling during URI processing when 'rewrite' and 'set' directives are used together. The library would likely target this vulnerability and potentially the three other memory corruption issues (CVE-2026-42946, CVE-2026-40701, CVE-2026-42934) discovered alongside it. → bleepingcomputer.com |
| 2026-05-14 2026 | Critical 18-Year-Old NGINX Vulnerability Enables Remote Code Execution Attacks news 2 min read | Writeup detailing CVE-2026-42945, an 18-year-old NGINX vulnerability in the `ngx_http_rewrite_module` that enables unauthenticated remote code execution. Triggered by a state mismatch in the two-pass script engine when `rewrite` and `set` directives are used together, particularly with a question mark in the `rewrite` directive, it leads to a heap buffer overflow. Researchers developed an RCE exploit chaining heap manipulation and structure spraying, affecting various F5/NGINX products. Immediate upgrades to NGINX 1.30.1 or 1.31.0 are recommended. |
| 2026-05-14 2026 | Critical NGINX exploit: hackers can crash servers run remote code without authentication news | A critical vulnerability has been discovered in NGINX, a popular web server. Attackers can exploit this flaw to crash servers and execute remote code without needing any authentication. This means unauthenticated users could potentially gain control of compromised servers. The severity of this exploit poses a significant risk to systems running NGINX. → cybernews.com |
| 2026-05-14 2026 | 18-Year-Old NGINX Rewrite Module Flaw Enables Unauthenticated RCE news 3 min read | Writeup detailing CVE-2026-42945, a critical heap buffer overflow vulnerability in NGINX's `ngx_http_rewrite_module`, codenamed NGINX Rift. This 18-year-old flaw, discovered by depthfirst, allows unauthenticated remote code execution or denial-of-service through crafted HTTP requests, particularly when using unnamed PCRE captures with a question mark in rewrite directives. The writeup also covers related vulnerabilities: CVE-2026-42946 (excessive memory allocation), CVE-2026-40701 (use-after-free), and CVE-2026-42934 (out-of-bounds read). → thehackernews.com |
| 2026-05-14 2026 | SAP Rushes Emergency Security Updates For Critical Commerce Cloud & S/4HANA Vulnerabilities news | SAP has released emergency security updates to address critical vulnerabilities in its Commerce Cloud and S/4HANA software. These vulnerabilities pose a significant risk, and the urgent patching indicates a high level of severity. Organizations using these SAP products are strongly advised to apply the updates immediately to protect their systems from potential exploitation. The specific details of the vulnerabilities and the affected components have not been disclosed beyond the product names. |
| 2026-05-14 2026 | Palo Alto Products Multiple Vulnerabilities news 2 min read | Writeup of multiple vulnerabilities affecting Palo Alto products, including GlobalProtect App and PAN-OS. Attackers can exploit these flaws to achieve elevation of privilege, denial of service, remote code execution, cross-site scripting, and security restriction bypass. Specific CVEs identified include CVE-2026-0249, CVE-2026-0250, and CVE-2026-0251, among others. Affected versions span across PAN-OS 10.2, 11.1, 11.2, 12.1, and various GlobalProtect App releases. → hkcert.org |
| 2026-05-14 2026 | Microsoft's agentic security system MDASH uncovers four critical Windows RCE flaws news 3 min read | Tool: Microsoft's MDASH, an agentic security system orchestrating over 100 AI agents, has discovered 16 previously unknown Windows vulnerabilities, including four critical remote code execution flaws. These include CVE-2026-33827, a use-after-free in tcpip.sys, and CVE-2026-33824, a double-free in the IKEv2 service. MDASH utilizes frontier and distilled AI models, domain plugins, and a pipeline of prepare, scan, validate, dedup, and prove stages to identify complex bugs missed by traditional scanners. |
| 2026-05-13 2026 | Fortinet fixes two critical RCE flaws in FortiAuthenticator and FortiSandbox news 2 min read | Patches addressing two critical RCE vulnerabilities, CVE-2026-44277 in FortiAuthenticator (improper access control) and CVE-2026-26083 in FortiSandbox (missing authorization), have been released by Fortinet. These flaws allow unauthenticated attackers to execute arbitrary code via specifically crafted requests. Fortinet also provided updates for other flaws, including CVE-2025-53844, CVE-2025-53870, and CVE-2025-53680 in FortiOS and FortiAP products. → csoonline.com |
| 2026-05-13 2026 | New critical Exim mailer flaw allows remote code execution news 2 min read | Writeup of CVE-2026-45185, a critical user-after-free vulnerability in Exim mail transfer agent versions 4.97 through 4.99.2 compiled with GnuTLS. This flaw allows unauthenticated remote code execution by exploiting a TLS shutdown issue during BDAT chunked SMTP traffic. XBOW's AI-assisted research aided in developing a proof-of-concept exploit, highlighting the evolving landscape of vulnerability discovery and exploitation. → bleepingcomputer.com |
| 2026-05-13 2026 | Microsoft Patches Critical Zero-Click Outlook Vulnerability Threatening Enterprises news 2 min read | Vulnerability writeup of CVE-2026-40361, a critical zero-click use-after-free bug in Microsoft Outlook and Word, allowing remote code execution via email previews. Discovered by Haifei Li, developer of Expmon, this flaw, similar to the decade-old BadWinmail (CVE-2015-6172), bypasses enterprise firewalls and targets users by exploiting Outlook's email rendering engine, making plain-text rendering a potential mitigation. Microsoft rates exploitation as "more likely." → securityweek.com |
| 2026-05-13 2026 | Fortinet Ivanti Patch Critical Vulnerabilities news 2 min read | Advisories detail critical vulnerabilities patched by Fortinet and Ivanti. Fortinet addressed CVE-2026-44277 and CVE-2026-26083, both CVSS 9.1 critical code execution flaws in FortiAuthenticator and FortiSandbox respectively, alongside CVE-2025-53844, a high-severity out-of-bounds write in FortiOS. Ivanti's patches include CVE-2026-8043, a critical CVSS 9.6 file write vulnerability in Xtraction, plus high-severity SQL injection and OS command injection flaws in Endpoint Manager and Virtual Traffic Manager. → securityweek.com |
| 2026-05-13 2026 | Microsofts agentic AI system found four critical Windows RCE flaws news 2 min read | Library utilizing over 100 specialized AI agents, codenamed MDASH, discovered four critical Windows RCE flaws, including CVE-2026-40361 and CVE-2026-40364. This system, developed by Microsoft’s Autonomous Code Security team, demonstrated strong performance on internal and public benchmarks like CyberGym, identifying all 21 injected vulnerabilities in a private Windows driver without false positives, and achieving high recall rates against historical Microsoft Security Response Center vulnerabilities. → helpnetsecurity.com |
| 2026-05-13 2026 | Microsoft Patches 138 Vulnerabilities Including DNS and Netlogon RCE Flaws news 6 min read | Patches from Microsoft address 138 vulnerabilities, including critical RCE flaws in Windows DNS (CVE-2026-41096) and Netlogon (CVE-2026-41089), along with Azure DevOps information exposure (CVE-2026-42826) and Azure Managed Instance for Apache Cassandra code execution (CVE-2026-33109). Additional fixes target Microsoft Dynamics 365, Azure Logic Apps, Microsoft Teams, Azure Cloud Shell, Azure Entra ID, Windows Hyper-V, and a Microsoft SSO Plugin for Jira & Confluence (CVE-2026-41103), with several identified by Microsoft's AI-driven discovery system MDASH. An AMD vulnerability (CVE-2025-54518) related to CPU cache isolation is also patched. → thehackernews.com |
| 2026-05-13 2026 | Defense at AI speed: Microsofts new multi-model agentic security system tops leading industry benchmark beginner 15 min read | Library for agentic AI-driven vulnerability discovery, codename MDASH, utilizes over 100 specialized agents and an ensemble of models to find and prove exploitable bugs. This system orchestrated across frontier and distilled models achieved top scores on industry benchmarks, including identifying 16 new vulnerabilities in Windows networking and authentication, four of which were Critical remote code execution flaws in components like the TCP/IP stack and IKEv2 service. MDASH's end-to-end pipeline includes stages for preparation, scanning, validation, deduplication, and proof, demonstrating a move towards production-grade, enterprise-scale AI vulnerability defense. → microsoft.com |
| 2026-05-13 2026 | May Patch Tuesday roundup: Critical holes in Windows Netlogon DNS and SAP S/4HANA news 5 min read | Report detailing Microsoft's May Patch Tuesday, highlighting critical vulnerabilities in Windows Netlogon (CVE-2026-41089) and Windows Server DNS Client (CVE-2026-41096), both with CVSS 9.8 scores. It also addresses a severe remote code execution flaw in Microsoft Dynamics 365 On Premises (CVE-2026-42898), a privilege escalation in the Microsoft SSO plugin for Jira/Confluence (CVE-2026-41103), and an SQL injection in SAP S/4HANA Enterprise Search (CVE-2026-34260). → csoonline.com |
| 2026-05-12 2026 | Microsoft Patch Tuesday for May 2026 Snort rules and prominent vulnerabilities news 4 min read | Library of Snort rules addresses Microsoft's May 2026 Patch Tuesday vulnerabilities, including 31 critical issues like RCE flaws in Azure, Windows services, Microsoft Office, and SharePoint. Specific CVEs highlighted include CVE-2026-32161 (Windows Native WiFi Miniport Driver), CVE-2026-33109 and CVE-2026-33844 (Azure Managed Instance for Apache Cassandra), CVE-2026-35421 (Windows GDI), CVE-2026-40358, CVE-2026-40361, CVE-2026-40363, CVE-2026-40364, CVE-2026-40366, and CVE-2026-4067 (Microsoft Office/Word), CVE-2026-40365 (Microsoft SharePoint), CVE-2026-40403 (Windows Win32K – GRFX), CVE-2026-41089 (Windows Netlogon), CVE-2026-41096 (Windows DNS Client), CVE-2026-42831 (Office for Android), and CVE-2026-42898 (Microsoft Dynamics 365). → blog.talosintelligence.com |
| 2026-05-12 2026 | Fortinet warns of critical RCE flaws in FortiSandbox and FortiAuthenticator news 1 min read | Writeup detailing critical RCE vulnerabilities in Fortinet products. CVE-2026-44277, an Improper Access Control flaw in FortiAuthenticator, and CVE-2026-26083, a missing authorization weakness in FortiSandbox, allow unauthenticated attackers to execute unauthorized code via crafted requests. These flaws, while not reported as exploited in the wild, follow a pattern of actively exploited Fortinet vulnerabilities, including previous issues in FortiClient EMS. → bleepingcomputer.com |
| 2026-05-12 2026 | New Exim BDAT Vulnerability Exposes GnuTLS Builds to Potential Code Execution news 2 min read | Library addressing CVE-2026-45185, a critical use-after-free vulnerability in Exim's BDAT message body parsing when using GnuTLS. This flaw allows attackers to trigger heap corruption and potential code execution by sending specific TLS close_notify alerts followed by cleartext data during BDAT transfers. The issue impacts Exim versions 4.97 through 4.99.2, with a fix available in version 4.99.3. → thehackernews.com |
| 2026-05-11 2026 | Mozilla Products Multiple Vulnerabilities news | Analysis of multiple vulnerabilities in Mozilla Products, including Firefox and Thunderbird, leading to potential denial of service and remote code execution. Affects versions prior to Firefox 150.0.2, Firefox ESR 115.35.2, Firefox ESR 140.10.2, Thunderbird 140.10.2, and Thunderbird 150.0.2. Patches are available from the vendor. → hkcert.org |
| 2026-05-10 2026 | New cPanel vulnerabilities could allow file access and remote code execution news 2 min read | Writeup of cPanel vulnerabilities CVE-2026-29201, CVE-2026-29202, and CVE-2026-29203, which permit arbitrary file reads, Perl code execution via the create_user API, and potential denial-of-service or privilege escalation through chmod. These flaws affect multiple cPanel & WHM releases and have been patched. This disclosure follows the weaponization of a separate cPanel authentication bypass vulnerability, CVE-2026-41940, as a zero-day for botnet deployment. Tools are available from watchTowr and cPanel to detect vulnerable hosts. → securityaffairs.com |
| 2026-05-07 2026 | When prompts become shells: RCE vulnerabilities in AI agent frameworks news 13 min read | Library providing security analysis of AI agent frameworks, detailing RCE vulnerabilities like CVE-2026-25592 and CVE-2026-26030 discovered in Semantic Kernel. The research highlights how prompt injection can lead to host-level code execution through unsafe string interpolation and blocklist bypasses in plugins like the In-Memory Vector Store, enabling attackers to leverage Semantic Kernel's tool execution capabilities for malicious purposes. → microsoft.com |
| 2026-05-07 2026 | Ivanti EPMM CVE-2026-6973 RCE Under Active Exploitation Grants Admin-Level Access news 1 min read | Writeup on CVE-2026-6973, an active RCE vulnerability in Ivanti Endpoint Manager Mobile (EPMM) allowing administrative users to execute arbitrary code. This flaw, along with CVE-2026-5786, CVE-2026-5787, CVE-2026-5788, and CVE-2026-7821, impacts on-premise EPMM and is under active exploitation. CISA has added CVE-2026-6973 to its KEV catalog, mandating fixes for federal agencies. → thehackernews.com |
| 2026-05-07 2026 | Ivanti warns of new EPMM flaw exploited in zero-day attacks news 2 min read | Writeup of CVE-2026-6973, a critical Improper Input Validation vulnerability in Ivanti Endpoint Manager Mobile (EPMM) exploited in zero-day attacks. This flaw allows remote attackers with administrative privileges to execute arbitrary code on EPMM versions 12.8.0.0 and earlier. Ivanti recommends patching to EPMM 12.6.1.1, 12.7.0.1, and 12.8.0.1, and rotating admin credentials. Four other high-severity EPMM vulnerabilities (CVE-2026-5786, CVE-2026-5787, CVE-2026-5788, and CVE-2026-7821) were also patched. → bleepingcomputer.com |
| 2026-05-07 2026 | Cisco patches high-severity flaws enabling SSRF code execution attacks news 2 min read | Advisory detailing high-severity vulnerabilities in Cisco Unity Connection, including CVE‑2026‑20034 allowing authenticated remote root code execution via crafted API requests, and CVE‑2026‑20035 enabling unauthenticated SSRF attacks by sending crafted HTTP requests. These flaws stem from insufficient input validation, potentially leading to complete system compromise or arbitrary network traffic originating from the affected device. → securityaffairs.com |
| 2026-05-07 2026 | PAN-OS RCE Exploit Under Active Use Enabling Root Access and Espionage news 2 min read | Writeup of CVE-2026-0300, a critical buffer overflow in PAN-OS enabling root access, exploited by threat actors potentially as early as April 9, 2026. The vulnerability allows unauthenticated RCE via crafted packets, with successful exploitation observed by Unit 42, attributed to state-sponsored cluster CL-STA-1132. Post-exploitation involved AD enumeration and deployment of tools like EarthWorm and ReverseSocks5. Mitigation includes restricting portal access, disabling Response Pages, and enabling Threat ID 510019. → thehackernews.com |
| 2026-05-07 2026 | 'TrustFall' Exposes Claude Code Execution Risk news | 'TrustFall' Exposes Claude Code Execution Risk https://ift.tt/uApnWBD → darkreading.com |
| 2026-05-07 2026 | Hackers run code on PAN-OS firewalls as root without authentication: critical zero-day unveiled news | A critical zero-day vulnerability has been discovered in Palo Alto Networks' PAN-OS firewalls. This flaw allows attackers to execute code as root without any authentication. The vulnerability, identified as CVE-2024-3400, impacts PAN-OS versions 10.1, 11.0, 11.1, and 11.2. → cybernews.com |
| 2026-05-07 2026 | vm2 Node.js Library Vulnerabilities Enable Sandbox Escape and Arbitrary Code Execution news 2 min read | Writeup detailing critical vulnerabilities within the vm2 Node.js library, enabling sandbox escape and arbitrary code execution. These flaws, including CVE-2026-43997 and CVE-2026-44005, exploit mechanisms like `__lookupGetter__`, the `species` property of promises, the `inspect` function, `SuppressedError`, Symbol-to-string coercion, prototype pollution, and bypasses of the allowlist. The report highlights the ongoing challenge of secure code isolation in JavaScript environments and strongly advises updating to version 3.11.2. → thehackernews.com |
| 2026-05-07 2026 | Threat Brief: Exploitation of PAN-OS Captive Portal Zero-Day for Unauthenticated Remote Code Execution news 6 min read | Writeup detailing CVE-2026-0300, a buffer overflow vulnerability in Palo Alto Networks PAN-OS's Captive Portal service, enabling unauthenticated remote code execution. Exploitation by state-sponsored actors involved injecting shellcode, deploying tools like EarthWorm and ReverseSocks5 for tunneling, and enumerating Active Directory using compromised credentials. The analysis highlights the attackers' operational restraint and reliance on open-source tools for stealthy compromise of edge network devices. → unit42.paloaltonetworks.com |
| 2026-05-06 2026 | Critical Palo Alto PAN-OS Vulnerability Actively Exploited For Remote Code Execution (RCE) news | A critical vulnerability in Palo Alto Networks' PAN-OS is being actively exploited, allowing for remote code execution (RCE). This means attackers can potentially take control of affected devices. Details of the vulnerability and potential mitigation strategies are available via the provided link. |
| 2026-05-06 2026 | WARNING: Critical Flaw In Apache HTTP Server Enables DoS & Remote Code Execution (RCE) Attacks news | A critical vulnerability has been discovered in the Apache HTTP Server, potentially allowing attackers to launch Denial of Service (DoS) and Remote Code Execution (RCE) attacks. This flaw poses a significant security risk, enabling unauthorized control and disruption of services hosted on affected servers. Users are strongly advised to update their Apache HTTP Server installations to the latest patched version to mitigate these risks. |
| 2026-05-06 2026 | Critical Buffer Overflow Vulnerability in PAN-OS Exploited in-the-Wild news 1 min read | Writeup of CVE-2026-0300, a critical buffer overflow in Palo Alto Networks PAN-OS, allowing unauthenticated attackers remote code execution with root privileges. The vulnerability targets the User-ID Authentication Portal service, particularly when exposed to untrusted networks or the public internet. Exploitation risk is high for instances accessible externally via ports 6081 or 6082. Immediate patching, access restriction, or disabling the portal are recommended mitigation steps. → wiz.io |
| 2026-05-06 2026 | WhatsApp Multiple Vulnerabilities news | Bulletin detailing multiple vulnerabilities in WhatsApp clients (iOS, Android, Windows) allowing remote attackers to bypass security restrictions and perform spoofing. Affected versions include specific ranges prior to recent updates on each platform. Users are advised to update to the latest available versions for iOS v2.26.15.72+, Android v2.26.7.10+, and Windows v2.3000.1032164386.258709 or later. → hkcert.org |
| 2026-05-06 2026 | Apache fixes critical HTTP/2 double-free flaw CVE-2026-23918 enabling RCE news | Library fixing CVE-2026-23918, a critical HTTP/2 double-free vulnerability in Apache HTTP Server 2.4.66. This flaw, discovered by Bartlomiej Dmitruk and Stanislaw Strzalkowski, can cause memory corruption leading to denial of service and, under specific configurations like mmap usage, potential remote code execution. The issue resides within mod_http2 and is resolved in version 2.4.67. → securityaffairs.com |
| 2026-05-06 2026 | Palo Alto Networks warns of firewall RCE zero-day exploited in attacks news 2 min read | Writeup of CVE-2026-0300, a critical PAN-OS zero-day exploited in attacks. This buffer overflow vulnerability affects the User-ID Authentication Portal on Internet-exposed PA-Series and VM-Series firewalls, allowing unauthenticated attackers to achieve root-level remote code execution. Palo Alto Networks recommends restricting access to trusted zones or disabling the portal until a patch is released, with initial fixes expected May 13, 2026. → bleepingcomputer.com |
| 2026-05-06 2026 | Palo Alto Networks PAN-OS flaw exploited for remote code execution news 1 min read API Sec | Writeup of CVE-2026-0300, a critical PAN-OS buffer overflow allowing unauthenticated remote code execution with root privileges. This vulnerability affects PA-Series and VM-Series firewalls using the User-ID Authentication Portal when exposed to the internet. Palo Alto Networks advises restricting access to trusted internal IP addresses to mitigate risk, noting limited exploitation observed primarily on internet-facing portals. Fixes are expected by May 13, 2026. → securityaffairs.com |
| 2026-05-06 2026 | Critical Android vulnerability CVE-2026-0073 fixed by Google news 1 min read Mobile | Analysis of CVE-2026-0073, a critical remote code execution vulnerability in Android's System component affecting the adbd daemon. Exploitation, which requires no user interaction or special permissions, could lead to shell user code execution and full device compromise. Google has released a patch, and no public exploits or active attacks exploiting this specific flaw are currently known. This follows a previously exploited Qualcomm component vulnerability (CVE-2026-21385) involving a buffer over-read in the Graphics component. → securityaffairs.com |
| 2026-05-06 2026 | SUSE Linux Kernel Multiple Vulnerabilities news | Vulnerabilities impacting SUSE Linux Kernel allow remote attackers to achieve denial of service, remote code execution, security bypass, privilege escalation, data manipulation, and information disclosure. Affected systems include SUSE Linux Enterprise High Performance Computing 12 SP5, SUSE Linux Enterprise Live Patching 12-SP5, and various SUSE Linux Enterprise Server 12 SP5 variants. Specific CVEs include CVE-2024-26584, CVE-2025-38234, CVE-2025-39759, CVE-2025-71268, CVE-2025-71269, CVE-2026-22990, CVE-2026-23103, CVE-2026-23120, CVE-2026-23243, CVE-2026-23262, CVE-2026-23272, CVE-2026-23277, CVE-2026-23318, CVE-2026-23362, CVE-2026-23382, CVE-2026-23386, and CVE-2026-23398. → hkcert.org |
| 2026-05-06 2026 | Palo Alto PAN-OS Flaw Under Active Exploitation Enables Remote Code Execution news 1 min read API Sec | Analysis of CVE-2026-0300, a critical buffer overflow vulnerability in Palo Alto Networks' PAN-OS software, allows unauthenticated remote code execution with root privileges. This flaw impacts PA-Series and VM-Series firewalls, particularly those with the User-ID Authentication Portal accessible from untrusted networks. While patches are forthcoming, interim mitigations include restricting portal access or disabling it entirely. → thehackernews.com |
| 2026-05-06 2026 | n8n: From Parsing Bug to Remote Code Execution aka CVE-2026-42231 news 9 min read API Sec | Library analyzing n8n's CVE-2026-42231, detailing how a prototype pollution vulnerability within the xml2js XML parsing library, exacerbated by CoffeeScript semantic quirks, can be chained to achieve unauthenticated Remote Code Execution. The exploit path leverages a specific gadget in `@n8n/node-cli` that mimics older, exploitable `spawn` behavior, allowing controlled properties to propagate into the execution context for RCE. |
| 2026-05-06 2026 | Critical Remote Code Execution Vulnerability Patched in Android news Mobile | Library for analyzing Android security, detailing CVE-2026-0073, a critical remote code execution vulnerability in the System component affecting the Android Debug Bridge daemon. This flaw allows code execution as the shell user without interaction. Google confirmed no exploitation has been observed. |
| 2026-05-05 2026 | Google Update: Android Flaw Could Put Billions of Devices at Risk news Mobile | Google has addressed a critical vulnerability in Android that could have affected billions of devices. The flaw, detailed in a recent update, potentially exposed users to significant security risks. Google's swift patching mitigates the threat. The article highlights Google's ongoing efforts to secure the Android ecosystem. → techrepublic.com |
| 2026-05-05 2026 | Critical Apache HTTP/2 Flaw (CVE-2026-23918) Enables DoS and Potential RCE news 2 min read | Writeup of CVE-2026-23918, a critical double-free vulnerability in Apache HTTP Server's HTTP/2 protocol handling that enables denial-of-service and potential remote code execution. Discovered by Bartlomiej Dmitruk and Stanislaw Strzalkowski, the flaw in `mod_http2`'s `h2_mplx.c` allows an attacker to trigger an RCE by exploiting memory reuse with the APR mmap allocator and Apache's scoreboard. Exploitation, while requiring an info leak for system() and scoreboard offsets, is practical on Debian-derived systems and the official httpd Docker image. → thehackernews.com |
| 2026-05-05 2026 | Android Zero-Click RCE Vulnerability Enables Remote Shell Access news 3 min read Mobile | Reference for CVE-2026-0073, a proximal zero-click RCE vulnerability in Android's Debug Bridge daemon (adbd). This flaw, affecting multiple Android versions, allows attackers on the same local network or within physical proximity to gain remote shell access without user interaction, bypassing application sandboxing. Exploitation requires timely patching, disabling USB debugging, network segmentation, and implementing zero-trust policies. → esecurityplanet.com |
| 2026-05-05 2026 | Unpatched flaws turn Ollama's auto-updater into a persistent RCE vector researchers say news 3 min read | Writeup of CVE-2026-42248 and CVE-2026-42249, which allow persistent RCE on Ollama for Windows by chaining a path traversal flaw with a non-functional signature verification. Attackers can plant arbitrary executables in the Windows Startup folder by controlling update responses, leading to silent execution on every login. Exploitation requires controlling update infrastructure, redirecting clients, or network interception, with the auto-update feature and Ollama in the Startup folder being default prerequisites. → helpnetsecurity.com |
| 2026-05-05 2026 | Security Audit Finds RCE Risks in 6.2% of MCP Servers news | A recent security audit revealed that 6.2% of Managed Cloud Platform (MCP) servers are vulnerable to Remote Code Execution (RCE) risks. The audit, which focused on identifying exploitable weaknesses, discovered these critical flaws present in a significant portion of the analyzed servers. The specific details of the vulnerabilities and the affected MCP server versions were not disclosed in this brief announcement. → hackernoon.com |
| 2026-05-05 2026 | Google Confirms Critical Android 0-Click VulnerabilityUpdate Now news Mobile | Google has confirmed a critical 0-click vulnerability affecting Android devices, urging users to update immediately. This exploit allows attackers to compromise devices without any user interaction. Users should prioritize applying the latest security patches to protect their devices. |
| 2026-05-05 2026 | Linux vulnerability "Copy Fail" is already being attacked news 1 min read | Library for Linux security exploits CVE-2026-31431, nicknamed "Copy Fail." This vulnerability allows local users to gain root privileges by performing a controlled 4-byte write to the page cache of any readable file system. Proof-of-concept exploit code is available, and attackers are actively misusing it. The vulnerability was discovered with AI assistance and affects most major Linux distributions since 2017. Updates are available. |
| 2026-05-05 2026 | MetInfo CMS CVE-2026-29014 Exploited for Remote Code Execution Attacks news 1 min read | Exploit details for CVE-2026-29014, a critical PHP code injection vulnerability in MetInfo CMS versions 7.9, 8.0, and 8.1. Discovered by Egidio Romano, the flaw stems from insufficient input neutralization in the `/app/system/weixin/include/class/weixinreply.class.php` script, allowing unauthenticated remote attackers to execute arbitrary PHP code by crafting malicious Weixin API requests. Successful exploitation requires the `/cache/weixin/` directory to exist. Patches were released on April 7, 2026, but active exploitation by threat actors was observed shortly after. → thehackernews.com |
| 2026-05-05 2026 | Critical Remote Code Execution Vulnerability Patched in Android news 1 min read Mobile | Library addressing CVE-2026-0073, a critical Android System vulnerability enabling unauthenticated remote code execution via the Android Debug Bridge daemon. Exploitation does not require user interaction. This critical flaw, impacting the 'adbd' process, allows attackers to execute code as the shell user without further privileges. While no exploits in the wild have been reported for this specific CVE, other Android vulnerabilities like CVE-2024-43093 and CVE-2025-38352 were exploited previously. → securityweek.com |