The newest Remote Code Execution (RCE) resources are on the Remote Code Execution (RCE) page. For a reading order instead of a date order, see the Remote Code Execution (RCE) learning path.
| Date Added | Link | Excerpt |
|---|---|---|
| 2026-11-06 NEW 2026 | RELATE LMS RCE via insecure Celery pickle deserialization news 2 min read Deser Python | Advisory detailing RELATE LMS RCE via insecure Celery pickle deserialization. Exploitation occurs when Celery workers are configured to accept and deserialize untrusted pickle data, allowing an attacker to execute arbitrary commands. This vulnerability, combined with missing network isolation in code execution sandboxes, enables authenticated students to achieve full Remote Code Execution (RCE) on the host server by crafting a pickle payload and pushing it to the message broker. |
| 2026-11-06 NEW 2026 | DocsGPT unauthenticated RCE via FAISS pickle deserialization news 2 min read AI Deser Python | Advisory for GHSA-m448-vp23-j393 details an unauthenticated Remote Code Execution vulnerability in DocsGPT. Attackers can exploit this by uploading malicious FAISS index files (`index.pkl`) via the `/api/upload_index` endpoint. The application then uses `FAISS.load_local` with `allow_dangerous_deserialization=True`, enabling arbitrary command execution through `pickle` deserialization. This flaw bypasses authentication mechanisms like `AUTH_TYPE=simple_jwt` due to an application logic error in the `/api/upload_index` route. |
| 2026-11-06 NEW 2026 | numcodecs Pickle codec arbitrary code execution on decode news 2 min read Deser Python | Library advisory detailing arbitrary code execution via the `numcodecs.pickles.Pickle` codec. When decoding untrusted data, the `pickle.loads` function can be invoked, allowing an attacker to inject malicious code. This vulnerability is triggered when reading array chunks whose metadata specifies the "pickle" codec, enabling remote code execution without direct user interaction. |
| 2026-11-06 NEW 2026 | Xoscar unauthenticated cloudpickle RCE (CVE-2026-49950) news AI Deser Python | Writeup on CVE-2026-49950, an unauthenticated RCE vulnerability in Xorbits Xoscar up to v0.11.2. Attackers can exploit the `SocketChannel.recv()` method, which passes unvalidated data to `cloudpickle.loads()`. This allows for pickle reduce gadget execution before message type validation, enabling remote code execution as the server process, potentially with root privileges on GPU nodes. |
| 2026-11-06 NEW 2026 | Mautic SSTI in theme templates (GHSA-9fx4-7cmj-47vg) intermediate SSTI | Writeup of GHSA-9fx4-7cmj-47vg, a Server-Side Template Injection (SSTI) in Mautic theme templates. Unsandboxed Twig template rendering allows authenticated users with theme creation privileges to achieve Remote Code Execution by uploading malicious templates. Patched versions include 7.1.2, 6.0.9, 5.2.11, and 4.4.20 for ELTS. Restricting theme upload permissions is a mitigation. |
| 2026-11-06 NEW 2026 | Remote Code Execution via Polyglot Web Shell Upload intermediate Burp | This vulnerability allows for Remote Code Execution (RCE) by uploading a "polyglot" file. Instead of disguising a PHP file as an image, this method creates a file that is genuinely both a valid image and a functional PHP script. This bypasses typical upload filters that would otherwise prevent such malicious uploads, enabling attackers to execute arbitrary code on the server. |
| 2026-11-06 NEW 2026 | fsspec ReferenceFileSystem SSTI to RCE (CVE-2026-104851) intermediate 3 min read Python SSTI | Writeup of CVE-2026-104851 in fsspec, an RCE vulnerability exploitable via Jinja2 Server-Side Template Injection. Attackers controlling a malicious Kerchunk JSON document, served via a URL, can achieve arbitrary Python code execution before any data is read. This mirrors CVE-2024-34359 in llama-cpp-python and affects fsspec versions from 0.9.0 onward. The vulnerability lies in the unsandboxed rendering of Jinja2 templates within the ReferenceFileSystem implementation. |
| 2026-11-06 NEW 2026 | Trestle Jinja2 include SSTI incomplete fix (CVE-2026-57170) intermediate 4 min read Python SSTI | Library advisory for CVE-2026-57170 details an incomplete fix for Trestle's Jinja2 templating, allowing Server-Side Template Injection (SSTI) and leading to arbitrary code execution. The vulnerability stems from custom include tags that re-parse markdown content in a non-sandboxed Jinja2 environment, bypassing an earlier fix for CVE-2026-46439. This affects Trestle versions 4.0.3 and earlier, enabling attackers to inject malicious template code through untrusted OSCAL data. |
| 2026-11-06 NEW 2026 | Stanza RCE via pickle deserialization in lemmatizer intermediate 2 min read AI Deser Python | Library for securing the Stanza NLP toolkit against arbitrary code execution. Versions 1.14.0 and later are vulnerable to Remote Code Execution (RCE) when loading attacker-supplied lemma checkpoints. This vulnerability arises because `torch.load` with `weights_only=True` does not inspect bytes values, allowing an unrestricted `pickle.loads` within `_unpack_pos_dict` to deserialize malicious payloads. A crafted checkpoint containing a `__reduce__` method can execute arbitrary commands upon model loading, as demonstrated by a Proof of Concept that created a file using `os.system`. The fix involves using the `RestrictedUnpickler` to deserialize the inner stream, preventing the execution of malicious code. |
| 2026-11-06 NEW 2026 | Agenta Jinja2 evaluator SSTI allows RCE intermediate 1 min read AI Python SSTI | Writeup of SSTI in Agenta's Jinja2 evaluator, allowing RCE (CWE-1336). Authenticated users can craft malicious Jinja2 templates, such as `{{ lipsum.__globals__['os'].popen('id').read() }}`, which are executed unsandboxed on the API server when template_format="jinja2" is used in AI critique evaluators or prompt templates. This vulnerability impacts self-hosted or managed Agenta platform deployments, granting arbitrary code execution and full filesystem access within the API server container. |
| 2026-11-06 NEW 2026 | LMCache unauthenticated pickle RCE on multiprocess transport intermediate 3 min read AI Deser Python | Writeup detailing CVE-2026-105192, an unauthenticated pickle RCE vulnerability in LMCache's multiprocess ZeroMQ transport. The issue stems from unsafe deserialization of device IPC descriptors, allowing attackers to execute arbitrary code as the LMCache process user. This vulnerability impacts versions 0.3.9 through 0.5.5 and release candidates of 0.5.6, with official container images potentially running as root. The fix replaces pickle with validated MessagePack descriptors, and workarounds include restricting network access and binding the transport to localhost. |
| 2026-11-05 NEW 2026 | PHP2Shell Activity Across Previdian Network news 6 min read | Writeup detailing observed remote code execution targeting PHP applications via vulnerabilities collectively known as PHP2Shell. The analysis details the exploitation chain, including initial fingerprinting, memory exhaustion, session upload progress manipulation, and the successful spawning of shell commands by Apache. Specific vulnerabilities CVE-2026-109618 and CVE-2026-109619 are mentioned, along with the affected PHP version (8.4.26) and configurations that facilitated exploitation, such as a single Apache worker and low PHP memory limits. The report contrasts successful exploitation on specially configured honeypots with failed attempts on standard WordPress and Roundcube deployments. |
| 2026-11-05 NEW 2026 | Escaping AWS Firecracker from guest userspace: VMM memory corruption (CVE-2026-122192) advanced 8 min read | Library for discovering and exploiting vulnerabilities in AWS Firecracker, including CVE-2026-122192, a VMM memory corruption allowing guest userspace escape. It also details FC-03, a seccomp policy bypass technique exploiting the io_uring interface, and outlines fixes in Firecracker v1.16.2 and v1.17.0. |
| 2026-11-05 NEW 2026 | PHP Security This Week: Two Exploited PHP RCE Bugs and 4 Package Fixes (26 Oct — 2 Nov 2026) news | This week's PHP security update highlights two actively exploited Remote Code Execution (RCE) vulnerabilities. Additionally, four PHP packages received fixes to address various security issues. The article covers the period from October 26th to November 2nd, 2026, and was generated with AI assistance before being reviewed by the author. |
| 2026-11-05 NEW 2026 | Google Issues Patches for Critical Android Flaw That Could Allow RCE Without User Interaction news 3 min read Mobile | Vulnerability Report on CVE-2026-58868, a critical heap buffer overflow in Android's FrameDecoder.cpp, enabling RCE without user interaction. This flaw, affecting Android 14 through 17, is addressed by the 2026-11-01 security patch level. The report also details CVE-2026-58882, a critical RDoS vulnerability in WAP Push message handling, and mentions other critical issues in the kernel, MediaTek modem code, and Qualcomm components, all included in Google's November security bulletin. → thehackernews.com |
| 2026-11-05 NEW 2026 | CISA flags WordPress RCE flaw as actively exploited in attacks news 2 min read | Library for WordPress, addressing CVE-2026-119977, a Time-of-check Time-of-use (TOCTOU) race condition allowing remote code execution. This flaw, actively exploited in the wild and added to CISA's Known Exploited Vulnerabilities (KEV) Catalog, requires patching during the upgrade window. The advisory also references the wp2shell vulnerability chain (CVE-2026-63030 and CVE-2026-60137), previously exploited for webshell deployment and data theft. → bleepingcomputer.com |
| 2026-11-05 NEW 2026 | From a Profile Picture Upload to RCE: Hunting an ASP.NET/IIS Vulnerability intermediate Bug Bounty Recon | This content details a security researcher's journey discovering a Remote Code Execution (RCE) vulnerability in an ASP.NET/IIS environment. The process involved reconnaissance, analyzing application logic, and specifically examining file upload functionalities. The focus is on the technical steps taken to uncover the RCE vulnerability. |
| 2026-11-04 NEW 2026 | PHP2Shell revisited: What Intigriti’s insights tell us about real-world risk news 5 min read | Insights report analyzing the real-world exploitability of PHP2Shell (CVE-2026-109618, CVE-2026-109619), comparing it to Log4Shell. Intigriti's data shows significantly fewer accepted PHP2Shell reports with validated impact, highlighting that severity scores don't always reflect actual risk due to attack prerequisites and infrastructure configurations. The report emphasizes the need for measured vulnerability response over sensationalism, especially with the prevalence of AI-generated fake proof-of-concept scripts. → intigriti.com |
| 2026-11-04 NEW 2026 | Android’s November 2026 Updates Patch Over 200 Vulnerabilities news 1 min read Mobile | Updates addressing over 200 vulnerabilities in Android's November 2026 security release include critical-severity flaws like CVE-2026-58868 in the Framework component, enabling remote code execution without user interaction. Patches also target critical remote code execution, elevation of privilege, and denial-of-service vulnerabilities within the System component, along with numerous high-severity issues across various hardware and software subcomponents including Kernel, Arm, MediaTek, Unisoc, and Qualcomm. → securityweek.com |
| 2026-11-04 NEW 2026 | Red Hat Patches 9.8-Rated Linux TCP RCE Flaw While Ubuntu Releases Fixes for Testing news 3 min read | Library implementing fixes for CVE-2026-98432, a critical 9.8-rated Linux kernel use-after-free vulnerability in IPv4 TCP. This flaw, present since Linux 4.4, allows remote unauthenticated attackers to trigger a race condition by sending connection requests with IPv4 Record Route or Timestamp options, potentially leading to remote code execution. Patches are available for Red Hat Enterprise Linux and Ubuntu's testing channel, with interim mitigation options including an nftables rule or disabling Multipath TCP, though these have limitations. → thehackernews.com |
| 2026-11-04 NEW 2026 | Black October 2026: PHP2Shell, Node2Shell, eMudhra — The Month Trust Broke news Supply Chain | In "Black October 2026," trust was significantly eroded by a series of critical security incidents. The month saw the discovery of PHP2Shell and Node2Shell, enabling remote code execution. Compounding these issues, eMudhra, a certificate authority, was compromised. Furthermore, poisoned software packages were distributed, increasing the attack surface. These events collectively highlight a severe breakdown in security infrastructure and trust within the tech ecosystem. |
| 2026-11-03 2026 | Supermicro BMC ipmi cves news | Supermicro's Baseboard Management Controller (BMC) firmware, specifically its IPMI (Intelligent Platform Management Interface) interface, has been found to have several critical vulnerabilities (CVEs). These flaws could allow attackers to gain unauthorized access to server management functions, potentially leading to remote code execution, data breaches, and system compromise. The vulnerabilities highlight the importance of keeping BMC firmware updated and securing access to management interfaces. |
| 2026-11-03 2026 | WordPress pingback and Brotli RCE news | A critical vulnerability has been discovered in WordPress related to its pingback feature and Brotli compression. This flaw allows for Remote Code Execution (RCE), meaning attackers could potentially take control of a website running WordPress. → fortbridge.co.uk |
| 2026-11-03 2026 | CVE-2026–92744 — Unauthenticated SYSTEM RCE in the Delinea Privilege Manager Agent news AuthN | A critical SYSTEM Remote Code Execution (RCE) vulnerability, CVE-2026–92744, has been identified in the Windows agent for Delinea Privilege Manager. This flaw allows unauthenticated attackers to execute arbitrary code with SYSTEM privileges, posing a significant security risk. The vulnerability was recently reported. |
| 2026-11-03 2026 | Les failles critiques PHP2Shell dorénavant exploitées news | Critical PHP2Shell vulnerabilities are now being actively exploited. Experts confirmed remote code execution via PHP2Shell on October 26, 2026. The successful attack evidence necessitates immediate action and patching. |
| 2026-11-03 2026 | PHP2Shell-Everything you need to know beginner | PHP2Shell refers to two significant vulnerabilities in PHP that allowed attackers to execute code on the server without requiring user sign-in. This enabled unauthorized access and theft of user data and accounts. The article provides comprehensive information on these flaws. |
| 2026-11-03 2026 | Exploiting PHP 8.4: From Out-of-Memory Conditions to Remote Code Execution (PHP2Shell)— — CWL intermediate | This content details the exploitation of a vulnerability in PHP 8.4, leading from out-of-memory conditions to remote code execution (RCE). The lab explores how these conditions can be leveraged to gain control. The specific vulnerability allows an attacker to transition from causing memory exhaustion to achieving full command execution on the server. |
| 2026-11-03 2026 | PHP2Shell: Understanding Two Critical PHP Runtime Vulnerabilities Through GDB advanced | This content likely explores two critical PHP runtime vulnerabilities using the GDB debugger. The focus is on understanding these flaws at a deeper, more technical level, going beyond typical application-layer issues like unescaped queries or authorization failures. The techniques shared are intended to help researchers and developers gain a better grasp of how these vulnerabilities work within the PHP runtime environment. |
| 2026-11-03 2026 | Hiding in Plain Sight: A Hands-On Look at Confluence’s Widget Connector Flaw intermediate | This article details CVE-2019-3396, a vulnerability in Confluence's Widget Connector. Unlike complex exploits, this flaw was easily discoverable, highlighting how significant vulnerabilities can be overlooked. The author provides a walkthrough of the exploit, emphasizing its accessibility and the potential for widespread impact due to its straightforward nature. The content focuses on the practical demonstration of the vulnerability rather than speculative discussion. |
| 2026-11-02 2026 | ZDI-26-845 MLflow deserialization of untrusted data news AI Deser Python | Advisory ZDI-26-845 details an MLflow Statsmodels deserialization of untrusted data vulnerability. Remote attackers can execute arbitrary code on affected MLflow installations by tricking users into visiting a malicious page or opening a malicious file. The flaw in the `_load_model` function arises from insufficient validation of user-supplied data, leading to deserialization of untrusted input. This vulnerability was fixed in MLflow 3.15.0. → zerodayinitiative.com |
| 2026-11-02 2026 | PHP2Shell x Burp Suite: detection within a day of disclosure intermediate 3 min read Burp | Library for detecting PHP2Shell vulnerabilities (CVE-2026-109618, CVE-2026-109619) across the Burp Suite ecosystem. It offers passive and active detection methods, including a Java custom scan check, a DAST-compatible BCheck, and updates to the ActiveScan++ extension. These detection capabilities were rapidly developed and released, with future integration into Burp Scanner and inclusion in Burp AT for agent-assisted pentesting. → portswigger.net |
| 2026-11-02 2026 | fsspec ReferenceFileSystem SSTI leads to RCE (CVE-2026-104851) news Python SSTI | Writeup of CVE-2026-104851 in fsspec, detailing how control over a "references" JSON document, parsed via `fsspec.filesystem("reference", fo=URL)` or `xarray.open_dataset("reference://...")`, allows attackers to achieve arbitrary Python code execution through un-sandboxed jinja2 template rendering. This vulnerability mirrors the pattern seen in CVE-2024-34359 within llama-cpp-python. → advisories.gitlab.com |
| 2026-11-02 2026 | Wizarr authenticated Jinja2 SSTI to RCE (CVE-2026-108264) news Python SSTI | A critical (CVSS 9.1) vulnerability, CVE-2026-108264, has been identified in Wizarr. This bug allows authenticated users to exploit Server-Side Template Injection (SSTI) in the wizard step rendering, leading to Remote Code Execution (RCE). While not currently known to be exploited, it affects the wizarrrr/wizarr component. Users should consult affected ranges and fixed versions for updates. |
| 2026-11-02 2026 | Frappe Framework SSTI in message fields (CVE-2026-119144) news 1 min read Python SSTI | Writeup detailing CVE-2026-119144, a high-severity server-side template injection vulnerability in Frappe Framework, affecting releases prior to 15.111.0 and 16.21.0. The vulnerability allows authenticated attackers to execute unrestricted template expressions via user-controlled message fields, impacting confidentiality, integrity, and availability with a CVSS score of 8.7. The recommended remediation is to upgrade to patched versions 15.111.0 or 16.21.0. |
| 2026-11-02 2026 | From SQL Injection to RCE — HTB SQL Injection Skills Assessment intermediate SQLi | This content describes a hacking challenge on Hack The Box (HTB) focused on SQL injection skills. The assessment guides users through escalating from an initial SQL injection vulnerability to achieving Remote Code Execution (RCE). The goal is to test and improve participants' abilities in identifying and exploiting SQL injection flaws to gain deeper system access. |
| 2026-11-02 2026 | Intigriti Bug Bytes #241 - October 2026 🚀 advanced 11 min read Bug Bounty | Library for analyzing CVE-2026-109618 & CVE-2026-109619 PHP2Shell vulnerabilities; covers attack chains, impact, and immediate/long-term mitigation. Explores AI's impact on bug bounty trends, with a focus on increasing high-severity findings and researcher engagement. Discusses proactive security for AI companies, ID verification changes in bug bounty programs, and CTF results from Intigriti 1026. Includes resources on LLM prompt injection, AI report writing, bug bounty starter kits, HexStrike AI for automated recon, Claude-OSINT skills, K8s-PEAS for Kubernetes, Microsoft Edge exploit chains using logic bugs, and Discord RCE via Twitch embed. → intigriti.com |
| 2026-11-01 2026 | I got RCE on the sandboxes of Instinct and Muse! intermediate 7 min read | Writeup detailing "vulnerable dependency seeding," a new class of AI agent attack that targets the agent's sandbox environment rather than prompt injection. This technique exploits known vulnerabilities in software components that AI agents build, such as React2Shell (CVE-2025-66478) on Instinct and ExifTool (CVE-2021-22204) on Muse, to achieve remote code execution within the agent's isolated environment. The attack bypasses traditional defenses by leveraging the agent's legitimate functionality to introduce vulnerable software and then exploiting it via various delivery methods. |
| 2026-11-01 2026 | IBM webMethods Integration insecure deserialization (CVE-2026-12118) news Deser | This content describes a security vulnerability in IBM WebMethods Integration, identified by CVE-2026-12118 and cataloged as CPAI-2026-14682. The vulnerability stems from insecure deserialization, a common security flaw where untrusted data is processed in a way that can lead to arbitrary code execution or other malicious actions. |
| 2026-11-01 2026 | Telegram Android Vulnerability Allow Code Execution Through Voice Calls news Mobile | A critical vulnerability in Telegram's Android app could allow attackers to execute arbitrary code on a user's device. This exploit is triggered through specially crafted voice calls. The vulnerability has been patched by Telegram. Details of the flaw are limited, but it highlights the potential risks associated with complex communication features. |
| 2026-11-01 2026 | CSC 2026 Payslip Portal: Go template SSTI to file write intermediate 10 min read SSTI | Toolchain analysis of CSC 2026 Payslip Portal details a three-bug vulnerability chain. First, a Go payslip portal's session cookie encryption lacks authentication, enabling a padding oracle attack to forge HR credentials. This allows access to `/api/hr/template`, yielding `flag1`. Second, server-side template injection via the template preview functionality, using `wkhtmltopdf`, permits writing arbitrary files as the service user. This is leveraged to overwrite `rules/current.go`, a file interpreted by `yaegi` at runtime. Finally, the compromised interpreter executes malicious Go code, read from the overwritten `rules/current.go`, to access and exfiltrate `flag2` from `/etc/payslip/flag2`. |
| 2026-11-01 2026 | Mautic insecure deserialization in segment filters and custom fields intermediate 1 min read Deser | Library of security advisories for Mautic, detailing an insecure deserialization vulnerability (GHSA-5r63-8h35-j3mw) in segment filters and custom fields. This PHP object injection flaw allows arbitrary code execution, data manipulation, and denial of service by exploiting gadget chains within Mautic's dependencies. Exploitation requires high privileges or write access to Mautic's database. Patched versions include 7.2.0, 6.0.10, and 5.2.12. |
| 2026-11-01 2026 | Craft CMS low-priv condition filter escapes Twig sandbox to RCE intermediate 1 min read SSTI | Library for Craft CMS that addresses a low-privilege condition filter vulnerability (GHSA-v4q3-2g5g-wjj6). This bug allows authenticated users to escape the Twig sandbox by exploiting how column filters delegate property lookups via Yii ArrayHelper, bypassing Twig's SecurityPolicy. Exploitation enables recovery of `GeneralConfig::securityKey` and subsequent RCE by crafting signed parameters passed to `View::renderObjectTemplate()`, ultimately invoking native PHP callables as the web server user. |
| 2026-11-01 2026 | Mautic Twig sandbox escape in theme templates intermediate 1 min read SSTI | Library Advisory regarding a Twig sandbox escape in Mautic theme templates, an incomplete fix for GHSA-9fx4-7cmj-47vg. An authenticated user with `core:themes:create` permission can upload a malicious theme, leading to server-side template injection and arbitrary code execution. This vulnerability allows attackers to execute OS commands, read sensitive files, write to the filesystem, and pivot to internal services. Patched versions include 7.2.2, 6.0.10, and 5.2.12. |
| 2026-11-01 2026 | ZDI-26-839 MLflow PickleEvaluationArtifact deserialization RCE news AI Deser Python | Writeup of ZDI-26-839, a deserialization RCE vulnerability in MLflow's PickleEvaluationArtifact component. This flaw arises from insufficient validation of user-supplied pickle file data, allowing remote attackers to execute arbitrary code in the context of the MLflow process by tricking a target into visiting a malicious page or opening a malicious file. The vulnerability is fixed in MLflow 3.13.0. → zerodayinitiative.com |
| 2026-11-01 2026 | How a Pydantic Object Defeated a Jinja2 Sandbox: SSTI to RCE intermediate 9 min read Python SSTI | Library for analyzing Pydantic object vulnerabilities within Jinja2 sandboxes. This resource details how a deprecated `parse_raw` method in Pydantic models, when exposed to a sandboxed Jinja2 environment, can lead to Server-Side Template Injection (SSTI) and Remote Code Execution (RCE). It highlights that name-based sandboxing mechanisms are insufficient against modern application objects that expose deserialization functionalities, and emphasizes enumerating the context rather than solely focusing on payload construction. |
| 2026-10-31 2026 | Intigriti Bug Bytes #241 - October 2026 🚀 news 11 min read Bug Bounty XSS | Library of intigriti's Bug Bytes newsletter, featuring insights into PHP2Shell (CVE-2026-109618 & CVE-2026-109619), AI's impact on bug bounty programs, and a customer story on proactive security. It also highlights a Microsoft Edge exploit chain using logic bugs, a Discord RCE via Twitch embed, a Chrome full-chain bounty, and XSS in Cloudflare. The entry also covers prompt injection vulnerabilities, bug bounty reporting, and tools like HexStrike AI and Claude-OSINT. → intigriti.com |
| 2026-10-31 2026 | The 23-Year-Old Flaw at the Heart of CPAN: An RCE in the Perl Infrastructure advanced Supply Chain | A critical, 23-year-old Remote Code Execution (RCE) vulnerability has been discovered within CPAN (Comprehensive Perl Archive Network), the central repository for Perl modules. This flaw, present for over two decades, resides in the Perl infrastructure itself and could potentially impact a vast number of Perl users and projects. The implications are significant as it allows attackers to execute arbitrary code on affected systems, posing a serious security risk. Further details about the exact nature of the exploit and its mitigation are expected to be released. |
| 2026-10-31 2026 | Spring4Shell Step by Step: How CVE 2022 22965 Turns Data Binding Into Remote Code Execution in a… intermediate Bug Bounty | Spring4Shell (CVE-2022-22965) is a critical vulnerability in the Spring Framework that allows remote code execution (RCE). It exploits how Spring handles data binding, specifically when users can control the `class.module.classLoader` header in HTTP requests. This can lead to attackers injecting malicious code and executing arbitrary commands on vulnerable servers. The vulnerability affects specific configurations of Spring MVC and Spring WebFlux, requiring attackers to also have a way to deploy arbitrary files to the server. |
| 2026-10-31 2026 | ProxyShell Step by Step: How Three Exchange Flaws Chain Into Remote Code Execution in a Lab intermediate Bug Bounty | This content details a step-by-step demonstration of the ProxyShell exploit, which chains three Microsoft Exchange vulnerabilities to achieve remote code execution. The exploit leverages flaws in Exchange's Extended Web Access (EWS), Remote PowerShell (RPS), and the Server Message Block (SMB) protocol. By chaining these vulnerabilities, an attacker can bypass authentication and execute arbitrary code on a vulnerable Exchange server. The process is illustrated within a lab environment, providing a practical understanding of the attack's methodology. |
| 2026-10-31 2026 | TryHackMe SSTI: SSTI to RCE intermediate 5 min read SSTI | Library that demonstrates Server-Side Template Injection (SSTI) to Remote Code Execution (RCE) across multiple template engines: Smarty, Pug, and Jinja2. The resource guides users through identifying the template engine, confirming injectability with payloads like `{'Hello'|upper}` or `#{7*7}`, and then exploiting vulnerabilities through engine-specific mechanisms such as PHP `system()` in Smarty, Node.js `child_process.spawnSync` in Pug, and Python object traversal with `subprocess` or stable globals in Jinja2. It also covers a second-order SSTI in Form Tools CMS using Smarty's `shell_exec` modifier. |