The newest Remote Code Execution (RCE) resources are on the Remote Code Execution (RCE) page. For a reading order instead of a date order, see the Remote Code Execution (RCE) learning path.
| Date Added | Link | Excerpt |
|---|---|---|
| 2026-05-05 2026 | Critical High-Severity Vulnerabilities Patched in Apache MINA HTTP Server news 1 min read | Library updates for Apache MINA and HTTP Server address critical and high-severity vulnerabilities. Apache MINA 2.2.7 and 2.1.12 fix CVE-2026-42778, an incomplete fix for insecure deserialization and RCE, and CVE-2026-42779, an incomplete fix for allowlist bypass and code execution. Apache HTTP Server 2.4.67 resolves CVE-2026-23918 (double-free, RCE), CVE-2026-28780 (heap buffer overflow, RCE), and other issues including CRLF sequence manipulation (CVE-2026-33523) and digest authentication bypass (CVE-2026-33006). → securityweek.com |
| 2026-05-05 2026 | MetInfo Weaver E-cology Vulnerabilities in Attackers Crosshairs news 1 min read | Writeup detailing exploitation of CVE-2026-29014 in MetInfo CMS and CVE-2026-22679 in Weaver E-cology. Both vulnerabilities allow unauthenticated remote code execution (RCE). MetInfo's flaw is a PHP code injection, while Weaver E-cology's stems from exposed debug functionality, enabling attackers to execute arbitrary commands via crafted POST requests and use the debug endpoint as a direct shell for discovery and payload delivery. → securityweek.com |
| 2026-05-05 2026 | Weaver E-cology RCE Flaw CVE-2026-22679 Actively Exploited via Debug API news 1 min read API Sec | Writeup of CVE-2026-22679, an unauthenticated remote code execution vulnerability in Weaver E-cology 10.0. Attackers exploit the debug API via the "/papi/esearch/data/devops/dubboApi/debug/method" endpoint by crafting POST requests to execute arbitrary commands. This flaw has been actively exploited since at least March 17, 2026, with observed techniques including payload drops and discovery commands like `whoami` and `ipconfig`. A Python detection script is available to identify vulnerable instances. → thehackernews.com |
| 2026-05-04 2026 | Weaver E-cology critical bug exploited in attacks since March news 2 min read | Library for Weaver E-cology office automation addressing CVE-2026-22679, a critical unauthenticated remote code execution flaw in versions prior to March 12. Exploited since March, the vulnerability stems from an exposed debug API endpoint allowing attackers to execute system commands via improperly validated user parameters. Attackers leveraged this for discovery commands like `whoami`, `ipconfig`, and `tasklist`, and attempted PowerShell-based payload downloads. The vendor's fix removes the debug endpoint entirely, making upgrades essential. → bleepingcomputer.com |
| 2026-05-04 2026 | Weekly Recap: AI-Powered Phishing Android Spying Tool Linux Exploit GitHub RCE & More news 19 min read AI Mobile | Library of tools and techniques for application security professionals, detailing active exploitation of a cPanel flaw (CVE-2026-41940) enabling authentication bypass and website wipes, alongside a Linux kernel vulnerability (CVE-2026-31431) for trivial privilege escalation. The recap also covers cybercrime groups using vishing for SaaS environment infiltration, TeamPCP's supply chain attacks across npm, PyPI, and Packagist, a Python backdoor (DEEP#DOOR) for comprehensive data theft, a critical GitHub vulnerability (CVE-2026-3854) allowing remote code execution, and VECT 2.0 ransomware's destructive file wiping. → thehackernews.com |
| 2026-05-02 2026 | 88% of self-hosted GitHub servers exposed to RCE researchers warn (CVE-2026-3854) news 2 min read | Writeup detailing CVE-2026-3854, a critical remote code execution vulnerability found in self-hosted GitHub Enterprise Server instances by Wiz researchers. Exploitable via a single git push command by authenticated users, this flaw allows arbitrary command execution on backend servers, potentially granting access to all hosted repositories and internal secrets. GitHub has released patches for supported GitHub Enterprise Server versions and advises reviewing audit logs for signs of exploitation. → helpnetsecurity.com |
| 2026-05-02 2026 | Script Injection and Data Theft: Python Data Analysis Tool Compromised news 2 min read Python | Writeup of MAL-2026-3083, detailing the compromise of the Python data monitoring tool elementary-data. An attacker exploited script injection in a GitHub Actions workflow to upload a malicious version to PyPI, stealing SSH keys, AWS credentials, API tokens, and cryptocurrency wallet files. The compromised package was active for nearly half a day before being removed. |
| 2026-05-01 2026 | "Copy Fail": Linux root in all major distributions with 732 bytes of Python news 2 min read Python | Writeup of CVE-2026-31431, the "Copy Fail" vulnerability, details a logic error in the Linux kernel allowing local users 4-byte writes to the page cache. A 732-byte Python exploit leverages this to gain root privileges on major distributions like Ubuntu, Amazon Linux, RHEL, and SUSE. The vulnerability, discovered with AI assistance and affecting systems since 2017, involves manipulating setuid binaries and can break container boundaries. Fixes are available, with temporary workarounds including blocking AF_ALG socket creation or blacklisting the algif_aead module. |
| 2026-04-30 2026 | Google's fix for critical Gemini CLI bug might break your CI/CD pipelines news 3 min read Supply Chain | Library for securing AI development layers, addressing vulnerabilities in agentic AI and supply chain risks. It discusses techniques for building secure development environments, managing trust in AI agent skills, and mitigating risks associated with AI models like Claude and Gemini. The library also touches upon hardware supply chain turbulence and identity resilience strategies in the context of AI. → theregister.com |
| 2026-04-30 2026 | New Linux 'Copy Fail' Vulnerability Enables Root Access on Major Distributions news 2 min read Python | Writeup on CVE-2026-31431, "Copy Fail," detailing how an unprivileged local user can achieve root access on Linux distributions since 2017. The vulnerability stems from a logic flaw in the `algif_aead` module of the kernel's cryptographic subsystem, allowing controlled writes to the page cache of any readable file. Exploitation involves a Python script to corrupt the page cache of a setuid binary like `/usr/bin/su`, granting root privileges. This primitive shares similarities with Dirty Pipe (CVE-2022-0847) and offers portable, stealthy, and cross-container exploitation. → thehackernews.com |
| 2026-04-30 2026 | OpenWrt 23.05 Authenticated Remote Code Execution (RCE) Vulnerability: Risk Analysis Impact and Mitigation (CVE-2025-62526) news 5 min read | Analysis of CVE-2025-62526, an authenticated RCE vulnerability in OpenWrt 23.05, details how attackers can compromise devices by exploiting flaws in inter-process communication and sandboxing mechanisms, particularly on Lantiq, Intel, and MaxLinear SoCs. Mitigation involves upgrading to OpenWrt 24.10.4, securing credentials, restricting management interface access, and monitoring for unauthorized changes, with historical exploitation of similar flaws by groups like APT41 and Lazarus serving as a precedent. → rescana.com |
| 2026-04-30 2026 | Critical Authenticated Remote Code Execution Vulnerability in JuzaWeb CMS 3.4.2 (CVE-2025-5425) Exploit in the Wild and Mitigation Guidance news 5 min read | Writeup detailing CVE-2025-5425, a critical authenticated RCE vulnerability in JuzaWeb CMS 3.4.2. This flaw, stemming from broken access control (CWE-266), allows low-privilege users to access the Theme Editor, inject PHP code, and achieve full server compromise. Exploits are publicly available, and exploitation in the wild has been observed. Mitigation involves restricting access to the Theme Editor endpoint and auditing user roles. The vulnerability maps to MITRE ATT&CK techniques T1190 and T1059. → rescana.com |
| 2026-04-30 2026 | GitHub rushed to fix a critical vulnerability in less than six hours news 2 min read | Writeup of a critical remote code execution vulnerability in GitHub's internal git infrastructure, discovered using AI models by Wiz Research. GitHub's security team validated the bug bounty report, reproduced the vulnerability, and deployed a fix to GitHub.com and GitHub Enterprise Server in under six hours. The vulnerability, described as "remarkably easy to exploit" despite its complexity, highlights the emerging role of AI in identifying flaws in closed-source binaries. |
| 2026-04-30 2026 | Critical Gemini CLI Flaw Enabled Host Code Execution Supply Chain Attacks news 1 min read Supply Chain | Writeup of the critical Gemini CLI vulnerability (CVE-2024-XXXX, unassigned) discovered by Novee Security, which allowed for host code execution through untrusted agent configurations loaded from workspaces. Attackers could exploit this to steal secrets, gain lateral movement, and conduct supply chain attacks within CI/CD pipelines, bypassing prompt injection. This is distinct from prior research demonstrating hijacking of AI agents like Claude Code Security Review and GitHub Copilot Agent via malicious GitHub comments. → securityweek.com |
| 2026-04-30 2026 | Max-severity RCE flaw found in Google Gemini CLI news 2 min read | Library update fixes a critical remote code execution (RCE) vulnerability in Google Gemini CLI. Disclosed by Novee Security, this flaw (related to CWE-77 and CWE-78) allowed attackers to inject malicious configurations and execute arbitrary commands on the host system, particularly in CI/CD environments processing untrusted input. Patched versions 0.39.1 and 0.40.0-preview.3, along with the run-gemini-cli GitHub Action fix (v0.1.22), address the vulnerability by removing implicit workspace trust and enforcing stricter tool allowlisting, aligning non-interactive execution with interactive safeguards. → csoonline.com |
| 2026-04-30 2026 | Google Fixes CVSS 10 Gemini CLI CI RCE and Cursor Flaws Enable Code Execution news 5 min read | Library addressing Google's CVSS 10 Gemini CLI CI RCE, which allowed attackers to execute arbitrary commands by manipulating configuration files in CI environments, and Cursor's CVE-2026-26268 RCE via malicious Git hooks, plus an unpatched CursorJacking vulnerability enabling extension access to API keys and credentials. → thehackernews.com |
| 2026-04-30 2026 | GitHub Flaw Enables Remote Code Execution With a Single Git Push news 2 min read | Writeup detailing CVE-2026-3854, a vulnerability in GitHub's internal git protocol allowing authenticated users to achieve remote code execution. Exploitation leveraged an injection flaw in the X-Stat header, where semicolon-delimited options, unsanitized by GitHub, could override security controls via a "last-write-wins" parsing model. This flaw affected both GitHub.com and GitHub Enterprise Server, potentially leading to repository compromise and server takeover. Mitigation involves upgrading GHES, enforcing least privilege, monitoring git activity, and hardening configurations. → esecurityplanet.com |
| 2026-04-29 2026 | Hackers exploit RCE flaws in Qinglong task scheduler for cryptomining news 2 min read | Library for securing the Qinglong open-source task scheduler, addressing CVE-2026-3965 and CVE-2026-4047. These vulnerabilities, stemming from authentication bypass and path traversal flaws in versions 2.20.1 and older, allow for remote code execution. Attackers have been exploiting these issues to deploy cryptominers, disguised by the process name '.fullgc,' on developer servers by injecting shell commands into `config.sh` and downloading binaries from `file.551911.xyz`. → bleepingcomputer.com |
| 2026-04-29 2026 | AI Finds 38 Security Flaws in OpenEMR news AI | An AI security tool, DeepScribe, has identified 38 vulnerabilities in OpenEMR, a popular open-source electronic health record system. These flaws range in severity, with DeepScribe flagging 10 as critical. The company plans to disclose these findings responsibly to OpenEMR's development team. This discovery highlights the potential of AI in uncovering security weaknesses in complex software. → darkreading.com |
| 2026-04-29 2026 | GitHub fixes RCE flaw that gave access to millions of private repos news 2 min read Supply Chain | Writeup of CVE-2026-3854, a critical RCE vulnerability affecting GitHub.com and GitHub Enterprise Server, allowing attackers with push access to gain read/write access to millions of private repositories. The flaw stems from unsanitized user-supplied options during 'git push' operations, enabling arbitrary code execution and potential server compromise. Administrators of GitHub Enterprise Server instances are urged to upgrade immediately, as a significant percentage remain vulnerable. → bleepingcomputer.com |
| 2026-04-29 2026 | Critical GitHub RCE bug exposed millions of repositories news 2 min read Supply Chain | Writeup of CVE-2026-3854, a critical command injection vulnerability in GitHub's Git push processing, specifically within the X-STAT component. This flaw, found by Wiz researchers using AI-augmented tooling, allowed authenticated users to execute arbitrary commands server-side, leading to potential remote code execution and full compromise of GitHub Enterprise Server instances, exposing millions of repositories. Patches were released for GitHub.com and Enterprise Server. → csoonline.com |
| 2026-04-29 2026 | Critical GitHub Vulnerability Exposed Millions of Repositories news 2 min read Supply Chain | Writeup of CVE-2026-3854, a critical remote code execution flaw in GitHub's internal Git infrastructure. This injection vulnerability allowed authenticated users to execute arbitrary commands on backend servers via a simple `git push` command, potentially compromising millions of repositories on GitHub Enterprise Server and GitHub.com. Wiz researchers discovered the issue, which affected various GitHub Enterprise offerings, and a patch was subsequently released. → securityweek.com |
| 2026-04-29 2026 | Mozilla Firefox Multiple Vulnerabilities news | Library of advisories detailing multiple vulnerabilities in Mozilla Firefox. These issues, impacting versions prior to Firefox 150.0.1, Firefox ESR 115.35.1, and Firefox ESR 140.10.1, can lead to remote code execution, security restriction bypass, and information disclosure. Patches are available from the vendor. → hkcert.org |
| 2026-04-29 2026 | GitHub patches critical 'git push' remote code execution bug news 1 min read | Writeup on a critical vulnerability in GitHub's `git push` command, allowing authenticated users to achieve remote code execution on backend infrastructure. Discovered by Wiz researchers using IDA's MCP server, the flaw exploited GitHub's internal protocol by adding malicious options to the `git push` command. GitHub patched the issue on GitHub.com and released a fix for GitHub Enterprise Server. |
| 2026-04-28 2026 | Major Security Flaw In GitHub Enables Remote Code Execution Across Millions of Repositories news | A significant security vulnerability has been discovered in GitHub that could allow for remote code execution across millions of repositories. This flaw, if exploited, could have widespread implications for developers and organizations relying on GitHub for code hosting and collaboration. The exact impact and potential severity are still being assessed, but the discovery highlights the ongoing challenges in securing large-scale software development platforms. Further details on the vulnerability are expected to be released as the situation unfolds and mitigation efforts are implemented. |
| 2026-04-28 2026 | CVE-2026-3854 GitHub flaw enables remote code execution news 3 min read | Writeup of CVE-2026-3854, a critical command injection vulnerability in GitHub Enterprise allowing remote code execution. Exploitable via a crafted git push, attackers can inject malicious metadata, bypass sandbox protections, and run arbitrary commands. Wiz researchers reported the flaw, which GitHub fixed with patches for Enterprise Server versions. The vulnerability underscores risks in inter-service communication and sanitization of user-controlled data in complex systems. → securityaffairs.com |
| 2026-04-28 2026 | GitHub RCE Vulnerability: CVE-2026-3854 Breakdown news 10 min read | Tool for analyzing CVE-2026-3854, a critical RCE vulnerability in GitHub's internal git infrastructure. This flaw, exploitable via a single git push from an authenticated user, allowed arbitrary command execution on GitHub.com's backend servers, potentially exposing millions of repositories. On GitHub Enterprise Server, it granted full server compromise. The analysis details the X-Stat header injection flaw and the exploitation chain involving `rails_env`, `custom_hooks_dir`, and `repo_pre_receive_hooks` fields to bypass sandboxing and achieve remote code execution. → wiz.io |
| 2026-04-28 2026 | Researchers Discover Critical GitHub CVE-2026-3854 RCE Flaw Exploitable via Single Git Push news 3 min read Supply Chain | Writeup of CVE-2026-3854, a critical command injection vulnerability in GitHub.com and GitHub Enterprise Server. Exploitable via a single "git push" command, this flaw allows authenticated users with push access to achieve remote code execution by injecting malicious metadata into internal service headers. Researchers from Wiz demonstrated a technique chaining three injections to bypass sandboxing, redirect hooks, and execute arbitrary commands as the git user, potentially leading to cross-tenant repository exposure on GitHub.com. → thehackernews.com |
| 2026-04-28 2026 | Securing the git push pipeline: Responding to a critical remote code execution vulnerability intermediate 4 min read Supply Chain | Writeup of CVE-2026-3854, a critical remote code execution vulnerability in GitHub's `git push` pipeline. The vulnerability allowed arbitrary command execution on the server by crafting a `git push` command with unsanitized push options that manipulated internal metadata, bypassing sandboxing. GitHub deployed a fix within hours to github.com and released patches for GitHub Enterprise Server, recommending immediate upgrades. The investigation found no evidence of exploitation. → github.blog |
| 2026-04-28 2026 | Critical Cursor bug could turn routine Git into RCE news 3 min read Supply Chain | Library for securing AI-augmented IDEs against RCE vulnerabilities, exemplified by CVE-2026-26268 in Cursor IDE. This flaw, which allowed arbitrary code execution via malicious Git repositories and AI agent interaction with Git hooks and bare repositories, is patched in Cursor version 2.5. The exploit leverages Git's documented features, making detection challenging due to its integration into normal development workflows. → csoonline.com |
| 2026-04-28 2026 | Critical Unpatched Flaw Leaves Hugging Face LeRobot Open to Unauthenticated RCE news 2 min read | Writeup on CVE-2026-25874, a critical unauthenticated RCE vulnerability in Hugging Face's LeRobot platform. The flaw, found in version 0.4.3, stems from unsafe data deserialization using Python's pickle format within the async inference pipeline, allowing attackers to execute arbitrary code via gRPC calls. This impacts the PolicyServer and robot client components, potentially leading to network compromise, data theft, and safety risks. A fix is planned for version 0.6.0. → thehackernews.com |
| 2026-04-28 2026 | Microsoft Confirms Active Exploitation of Windows Shell CVE-2026-32202 news 2 min read | Writeup on CVE-2026-32202, a Windows Shell spoofing vulnerability actively exploited in the wild. This zero-click flaw, with a CVSS score of 4.3, stems from an incomplete patch for CVE-2026-21510 and allows attackers to steal Net-NTLMv2 hashes via SMB connections. Russian nation-state group APT28 reportedly used it in conjunction with CVE-2026-21513, leveraging malicious LNK files to bypass Microsoft Defender SmartScreen and achieve credential theft. → thehackernews.com |
| 2026-04-24 2026 | Hackers exploit file upload bug in Breeze Cache WordPress plugin news 2 min read | Library for detecting and preventing arbitrary file uploads, specifically addressing CVE-2026-3844 in the Breeze Cache WordPress plugin. This critical vulnerability, with a severity score of 9.8, allows unauthenticated attackers to achieve remote code execution (RCE) by exploiting a missing file-type validation in the ‘fetch_gravatar_from_remote’ function when the “Host Files Locally - Gravatars” add-on is enabled. Versions up to 2.4.4 are affected. → bleepingcomputer.com |
| 2026-04-24 2026 | 20th April Threat Intelligence Report news 3 min read | Library of threat intelligence covering the week of April 20th, detailing data breaches at Booking.com and McGraw-Hill, supply chain compromise of EssentialPlugin, and Basic-Fit. AI threats include weaponized Claude Code and GPT-4 for government breaches, phishing campaigns impersonating Claude AI, and prompt injection on GitHub agents. Vulnerabilities addressed include Apache ActiveMQ CVE-2026-34197, Splunk CVE-2026-20204, Microsoft Defender CVE-2026-33825, and Windows Task Host CVE-2025-60710. Other intelligence covers brand impersonation phishing, ZionSiphon malware targeting industrial control, Russian C2 infrastructure, and a fake Ledger Live app. |
| 2026-04-22 2026 | CVE-2025-68454: Craft CMS Twig SSTI RCE Vulnerability news 5 min read | Writeup detailing CVE-2025-68454, an authenticated Remote Code Execution vulnerability in Craft CMS versions 5.0.0-RC1 through 5.8.20 and 4.0.0-RC1 through 4.16.16. Exploitation occurs via Server-Side Template Injection (SSTI) using the Twig map filter in text fields within Settings or the System Messages utility. Attackers with administrative privileges or access to System Messages can achieve arbitrary code execution by crafting malicious Twig payloads. Mitigation involves updating to patched versions 5.8.21 or 4.16.17, disabling allowAdminChanges, and restricting access to sensitive utilities. → sentinelone.com |
| 2026-04-22 2026 | React2Shell (CVE-2025-55182): RSC Flight Decoder Remote Code Execution news 2 min read | Writeup of CVE-2025-55182, a critical RCE in React Server Components (RSC) that affects frameworks like Next.js. Attackers exploit a flaw in the flight protocol decoding, where improperly handled prototype chain lookups allow arbitrary code execution on the server. The vulnerability stems from not checking for own properties during object deserialization. Mitigation involves upgrading React packages, restricting exposure of RSC routes, and deploying IPS/WAF rules to detect malicious multipart payloads. |
| 2026-04-22 2026 | Ivanti EPMM: Another Pre-Auth RCE (CVE-2026-1281 and CVE-2026-1340) news 2 min read | Writeup on CVE-2026-1281 and CVE-2026-1340 in Ivanti EPMM details pre-authentication remote code execution vulnerabilities. Attackers can exploit these by sending crafted requests to run arbitrary code on unpatched instances, as researchers at WatchTowr discovered. Ivanti has released an RPM patch, but it is removed upon version upgrades, requiring reapplication. These vulnerabilities were actively exploited in the wild before disclosure, and public PoC code increases immediate risk. |
| 2026-04-22 2026 | CVE-2025-57738: Apache Syncope Groovy Injection RCE news 4 min read | Writeup of CVE-2025-57738, an Apache Syncope Groovy injection vulnerability allowing RCE. Vulnerable versions compile administrator-uploaded Groovy implementations using a bare `GroovyClassLoader`, enabling static initializer blocks to execute arbitrary JVM API commands like `Runtime.exec()` or `ProcessBuilder` with full process privileges. The PoC script `CVE-2025-57738.py` demonstrates this by uploading a malicious class that executes a command and writes output to `/tmp/pwned`. Patched versions implement sandboxing using Jenkins’ Script Security infrastructure to block dangerous API calls. |
| 2026-04-22 2026 | Anthropic MCP Design Vulnerability Enables RCE, Threatening AI Supply Chain news 2 min read | Analysis of the Model Context Protocol (MCP) reveals a fundamental design flaw enabling Arbitrary Command Execution (RCE) across its SDK implementations in Python, TypeScript, Java, and Rust. This systemic vulnerability, affecting over 7,000 projects including LiteLLM, LangChain, and Flowise, stems from unsafe defaults in STDIO transport, leading to identified CVEs like CVE-2026-30623 and CVE-2025-49596. The flaw allows attackers to inject commands through various means, including prompt injection and network requests, potentially compromising sensitive data and impacting the AI supply chain, despite Anthropic classifying the behavior as "expected." → thehackernews.com |
| 2026-04-22 2026 | Critical RCE Vulnerability in Anthropic MCP Inspector (CVE-2025-49596) news 11 min read | Writeup of CVE-2025-49596, a critical RCE in Anthropic's MCP Inspector, details how attackers can exploit default insecure configurations and the 0.0.0.0-day browser vulnerability to execute arbitrary code on a developer's machine. This allows for data theft and network lateral movement, posing a significant risk to AI teams and enterprise adopters. The vulnerability stems from the MCP Inspector's lack of default authorization and its interaction with browser handling of the 0.0.0.0 IP address. |
| 2026-04-22 2026 | CVE-2025-24893: XWiki SSTI Unauthenticated RCE Exploit news | Tool for exploiting CVE-2025-24893 in XWiki, enabling unauthenticated RCE via Server-Side Template Injection. The vulnerability lies in the SolrSearch endpoint, which processes user input through the Groovy template engine without proper sanitization. Attackers can inject malicious Groovy expressions via the `text` query parameter to execute arbitrary commands on the server, with output reflected in the RSS response. The provided Python script facilitates single command execution or interactive shell access. |
| 2026-04-22 2026 | CVE-2026-34197: ActiveMQ RCE via Jolokia API news 6 min read | Writeup detailing CVE-2026-34197, a remote code execution vulnerability in Apache ActiveMQ Classic. Exploitation leverages the Jolokia API to invoke `addNetworkConnector` with a crafted `vm://` URI, forcing the broker to fetch and execute a remote Spring XML configuration file. This technique, similar to CVE-2023-46604, allows arbitrary OS command execution. The vulnerability is unauthenticated on ActiveMQ versions 6.0.0–6.1.1 due to CVE-2024-32114. → horizon3.ai |
| 2026-04-22 2026 | Google Antigravity in Crosshairs of Security Researchers Cybercriminals news 2 min read | Writeup on Google Antigravity vulnerabilities, detailing a sandbox escape flaw allowing arbitrary code execution through insufficient input sanitization during file search operations, which bypasses Secure Mode and can be triggered via indirect prompt injection. Additionally, researchers discovered a fake website distributing a trojanized installer that deploys stealer malware, targeting browser data, cryptocurrency wallets, and employing techniques like clipboard hijacking, keystroke logging, and hidden desktop tradecraft. → securityweek.com |
| 2026-04-22 2026 | Cohere AI Terrarium Sandbox Flaw Enables Root Code Execution Container Escape news 2 min read | Writeup of CVE-2026-5752, a critical sandbox escape vulnerability in Cohere AI's Terrarium, allowing root code execution via JavaScript prototype chain traversal within the Pyodide WebAssembly environment. This flaw enables attackers with local access to execute arbitrary system commands, access sensitive files like "/etc/passwd," reach other network services, and potentially escape containers. Since the open-source project is unmaintained, mitigations focus on disabling code submission, network segmentation, Web Application Firewall deployment, and rigorous container monitoring. → thehackernews.com |
| 2026-04-22 2026 | Fake SVG puts 750000 websites at risk: hackers can seize the web server news | Fake SVG puts 750,000 websites at risk: hackers can seize the web server https://ift.tt/BwtOzhU → cybernews.com |
| 2026-04-22 2026 | Adobe Acrobat Reader: Prototype pollution vulnerability enables remote code execution news 3 min read | Writeup of CVE‑2026‑34621, a prototype pollution vulnerability in Adobe Acrobat Reader's JavaScript engine, enabling remote code execution through malicious PDFs. Exploitation involves manipulating object prototypes to inject arbitrary properties, overriding security-critical internal functions. This flaw, affecting Acrobat DC and Reader DC, has been observed in spear-phishing campaigns by financially motivated actors. Adobe has released patches, and interim mitigations include disabling JavaScript and strengthening email security controls. |
| 2026-04-21 2026 | 22 BRIDGE:BREAK Flaws Expose 20000 Lantronix and Silex Serial-to-IP Converters news 2 min read | Writeup of BRIDGE:BREAK vulnerabilities affecting Lantronix and Silex serial-to-IP converters. Forescout Research Vedere Labs identified 22 flaws, including remote code execution (CVE-2026-32955, CVE-2025-67041), DoS (CVE-2015-5621), authentication bypass (CVE-2026-32960), and device takeover (FSCT-2025-0021), in devices like Lantronix EDS3000PS Series and Silex SD330-AC, potentially allowing attackers to hijack devices and tamper with data. → thehackernews.com |
| 2026-04-21 2026 | Google Fixes Critical RCE Flaw in AI-Based Antigravity Tool news | Google Fixes Critical RCE Flaw in AI-Based Antigravity Tool https://ift.tt/1QOIZsB → darkreading.com |
| 2026-04-21 2026 | Actively exploited Apache ActiveMQ flaw impacts 6400 servers news 2 min read | Writeup on CVE-2026-34197, a code injection vulnerability in Apache ActiveMQ Classic, impacting over 6,400 exposed servers. Discovered by Horizon3 researcher Naveen Sunkavally, the flaw allows authenticated actors to execute arbitrary code due to improper input validation. Patched in versions 6.2.3 and 5.19.4, this actively exploited vulnerability has been a repeated target, with CISA urging federal agencies to secure their systems. Exploitation indicators include suspicious broker connections with VM transport and the brokerConfig=xbean:http:// parameter. Previous exploited ActiveMQ flaws include CVE-2016-3088 and CVE-2023-46604. → bleepingcomputer.com |
| 2026-04-21 2026 | Tenable Research Uncovers Remote Code Execution Vulnerability in Microsoft GitHub Repository news 2 min read | Writeup of a critical RCE vulnerability in a Microsoft GitHub repository, discovered by Tenable Research. The flaw, exploitable via Python string injection in issue creation, allows attackers to exfiltrate GITHUB_TOKEN secrets, potentially enabling unauthorized modification of repository content and compromising the software supply chain. This highlights the attack surface presented by CI/CD infrastructure and emphasizes the need for strict security controls, permission reviews, and pipeline monitoring. |