The newest Remote Code Execution (RCE) resources are on the Remote Code Execution (RCE) page. For a reading order instead of a date order, see the Remote Code Execution (RCE) learning path.
| Date Added | Link | Excerpt |
|---|---|---|
| 2026-10-31 2026 | Conference recordings are now online: Attack Techniques & Methods news 1 min read Talks | Talks from a recent conference cover several advanced attack techniques. These include pre-authenticated RCE via CVE-2025-54068 in Livewire, weaponizing Windows Defender's BTR.sys driver with BTR_CLI for antivirus/EDR disabling, and impersonating WSUS clients using ADCS for command execution on HTTPS-enabled systems. Further discussions highlight privilege escalation to SYSTEM on Windows 11 with VBS/HVCI/kCET enabled by hooking SSDT tables, and EDR evasion through GPU and Windows Cloud Filter for file-less execution and privilege escalation. |
| 2026-10-31 2026 | Gradle: deserialization of untrusted Java objects before authentication intermediate 2 min read AuthN Deser | Advisory regarding GHSA-xwqc-3h47-hg64, detailing a deserialization vulnerability in Gradle's client-daemon communication. Attackers with local access can exploit the daemon's pre-authentication deserialization of untrusted Java objects to achieve remote code execution or denial of service. This affects builds on shared or multi-user machines. Gradle has patched this by verifying authentication tokens before deserialization. Workarounds include avoiding shared build hosts and upgrading Gradle. The vulnerability highlights the risks of Java serialization, as noted in Gradle's ADR-0002. |
| 2026-10-31 2026 | Serena RCE via insecure pickle deserialization of LSP symbol cache intermediate 5 min read AI Deser Python Supply Chain | Library for detecting and mitigating RCE via insecure pickle deserialization in the Serena agent. Versions <= 1.7.1 are affected when a user opens or activates a malicious repository, allowing arbitrary code execution through a poisoned LSP symbol cache file located at `<repo>/.serena/cache/<language_id>/document_symbols.pkl`. This vulnerability, identified as CWE-502, bypasses existing trust checks and can lead to significant system compromise. |
| 2026-10-31 2026 | Xoscar unauthenticated RCE through actor message deserialization intermediate 4 min read AI Deser Python | Library for securing Xoscar actor message deserialization, addressing unauthenticated remote code execution vulnerabilities. Versions v0.1.0 through v0.11.2, and v0.12.0 with an unset `XOSCAR_AUTH_KEY`, are susceptible to arbitrary Python code execution on actor-pool ports reachable by untrusted peers. The fix involves upgrading to v0.12.0 and configuring a strong, shared `XOSCAR_AUTH_KEY` across all communicating processes to authenticate socket and UCX messages before deserialization. Network access controls remain critical for limiting reachability to intended cluster peers. |
| 2026-10-31 2026 | Server-Side Template Injection to RCE in a Lab intermediate 11 min read Python SSTI | Walkthrough of Server-Side Template Injection (SSTI) to Remote Code Execution (RCE) in a lab environment, detailing how unsanitized user input can be processed as code by template engines. The guide progresses from understanding SSTI and differentiating it from XSS, to detecting and identifying template engines like Jinja2 and Freemarker using specific probes and mathematical tests. It then demonstrates how to exploit Jinja2 in a Flask application by accessing sensitive configuration data such as the `SECRET_KEY`, and subsequently climbing the object model to achieve operating system command execution. The process includes using `tplmap` for confirmation and explores defender-side considerations. |
| 2026-10-31 2026 | ZDI-26-816 Ultralytics load_dataset_cache_file deserialization RCE news AI Deser Python | Writeup of ZDI-26-816, detailing a deserialization of untrusted data remote code execution vulnerability in Ultralytics' `load_dataset_cache_file` function. Exploitable via user interaction by visiting a malicious page or opening a malicious file, this flaw allows attackers to execute arbitrary code in the context of the current user. No concrete patch is available, with mitigation relying on restricting user interaction with the product. → zerodayinitiative.com |
| 2026-10-30 2026 | The Last Proof of Human Craft: Forging a Microsoft Edge Full Chain with Logic Bugs Only! advanced 12 min read | Tool for crafting a Microsoft Edge full chain exploit, relying solely on logic bugs. This technique bypasses memory corruption vulnerabilities, demonstrating a sophisticated attack discovered at Pwn2Own Berlin 2026. The exploit chains four logic flaws, including a UXSS derived from an open redirect and bypassing browser security features like popup blockers and origin checks. It targets EdgeCAGuidanceNavigationThrottle, leveraging Windows features and Microsoft's own whitelists to achieve a sandbox escape without any AI involvement, earning significant recognition and awards. |
| 2026-10-30 2026 | TightVNC Viewer Pre-auth RCE news | A critical pre-authentication remote code execution (RCE) vulnerability has been discovered in TightVNC Viewer. This flaw allows an attacker to execute arbitrary code on a target system without requiring any prior authentication. Exploiting this vulnerability could lead to a complete compromise of the affected machine. Users are advised to update to the latest version of TightVNC Viewer to mitigate this security risk. |
| 2026-10-30 2026 | Axis Camera Station Deep-Dive: Unauth RCE to Decrypting Every Camera Credential (CVE-2025-30026/30023 + CVE-2026-63286) advanced 5 min read | Writeup detailing RCE and credential decryption vulnerabilities in AXIS Camera Station. Exploits CVE-2025-30023 and CVE-2025-30026 for SYSTEM-level RCE, enabling access to the application's Firebird database. Discovered CVE-2026-63286, a weak AES-256-CBC encryption scheme for camera credentials, deriving the key from the host's NTFS Volume Serial Number and hard-coded constants, allowing decryption of sensitive information like camera credentials and JWT signing keys. |
| 2026-10-30 2026 | TeamViewer RCE Vulnerability (CVE-2026-11585) news 8 min read | Library for analyzing a remote code execution vulnerability in TeamViewer (CVE-2026-11585). The vulnerability stems from an integer overflow in the `CBitmapBuffer` constructor's calculation of the screen buffer size. An attacker can craft specific `DisplayParams` messages to cause the viewer to allocate a buffer smaller than declared, leading to heap buffer overflows when processing screen updates. This allows for denial-of-service by crashing TeamViewer or potentially achieving arbitrary code execution. The writeup details the arithmetic mistake, the bypass of bounds checks, and how an attacker can control the undersized buffer and trigger out-of-bounds writes. |
| 2026-10-30 2026 | Chained PHP2Shell exploit roots 25 servers, including US Government servers advanced 11 min read | Toolchain detailing a chained exploit for Palo Alto Networks PAN-OS firewalls, combining custom PHP2Shell (CVE-2026-109618/CVE-2026-109619) for remote code execution with the Fragnesia kernel privilege escalation (CVE-2026-46300). This attack chain, leveraging AI-assisted development and precise memory profiling for specific PAN-OS versions, allows unauthenticated attackers to achieve root access and compromise Active Directory, as seen in a campaign targeting US government servers. |
| 2026-10-30 2026 | What are shell vulnerabilities? PHP2Shell, Node2Shell (HTTP2Shell), React2Shell and Log4Shell explained beginner 7 min read | Library detailing memory corruption vulnerabilities like PHP2Shell (CVE-2026-109618, CVE-2026-109619) and Node2Shell (CVE-2026-111497) in Brotli, alongside logic flaws such as Log4Shell (CVE-2021-44228) in Log4j and React2Shell (CVE-2025-55182) in React Server Components. These vulnerabilities, often inherited through dependencies, allow remote code execution through specially crafted input, bypassing authentication and impacting various languages and runtimes like PHP, Node.js, and Java. → aikido.dev |
| 2026-10-29 2026 | Turning the Valve - Exploiting RCE and LPE in the Steam Platform intermediate 23 min read AuthZ | Library detailing the exploitation of local privilege escalation (LPE) and remote code execution (RCE) vulnerabilities within the Steam platform. The research delves into the platform's architecture, specifically examining the communication mechanisms between the unprivileged client and the privileged service process via named pipes. It details vulnerabilities found in interfaces such as `IClientInstallUtils`, `IClientModuleManager`, `ISecure Desktop Capture`, and `BYOVD`, demonstrating how these flaws can be leveraged to gain elevated privileges or execute arbitrary code. |
| 2026-10-29 2026 | PHP2Shell Won't Be the Last. Here's Where the Next One Will Show Up First. news 7 min read Supply Chain | Library for assessing application security risks, focusing on threats like PHP2Shell. It details the discovery and exploitation of CVE-2026-109618 and CVE-2026-109619, highlighting how vulnerabilities in core engines like PHP can bypass application code. The library emphasizes the need for continuous outside-in testing, robust inventory management, and rapid response capabilities, especially in an era where AI accelerates vulnerability discovery and exploit development, demanding patch and mitigation timelines measured in hours. → snyk.io |
| 2026-10-28 2026 | Reviving GLPI Agent Abuse with ESC17 intermediate 8 min read | Library for exploiting GLPI Agent abuse using ESC17, enabling RCE on managed hosts without server compromise. The library, GLPwnIou, mimics the GLPI deploy mechanism, allowing attackers to deliver malicious commands and binaries. ESC17 empowers attackers to request certificates for server authentication, facilitating a man-in-the-middle position to trick GLPI agents into connecting to a rogue server, circumventing previous TLS certificate checking mitigations. |
| 2026-10-28 2026 | From Arbitrary File Read to Shell: Yet Another RCE in Telerik intermediate 27 min read | Library for discovering vulnerabilities in Telerik UI for ASP.NET AJAX, leading to unauthenticated remote code execution. It chains an arbitrary file read in RadImageEditor (CVE-2026-18672) with an unrestricted file upload via RadEditor's file browser (CVE-2026-19219), contingent on specific `web.config` keys. The library details how to leverage these flaws by manipulating `_ClientState` and `dialogParametersHolder` form fields to read sensitive configuration and execute code. |
| 2026-10-28 2026 | A community translation can run attacker-chosen code in an exported Godot game intermediate 6 min read | Writeup detailing arbitrary GDScript execution in exported Godot games via manipulated .po translation files. Affected versions include Godot 4.1 onwards, where the `Plural-Forms` header is evaluated by a general expression evaluator. This allows attackers to inject malicious GDScript through the header, potentially leading to high-impact local attacks (CVSS 3.1 7.8). Developers can mitigate this by strictly validating the `Plural-Forms` header against the gettext grammar before loading untrusted .po files. |
| 2026-10-28 2026 | PHP2Shell: Exploitation Attempts and Remediation Trends intermediate 8 min read | Library detailing exploitation attempts and remediation trends for PHP2Shell vulnerabilities, including CVE-2026-109618 and CVE-2026-109619. It examines observed attack techniques, such as those using multipart bodies to exhaust memory, and analyzes why these attempts have failed, noting issues with request size limits and memory leak stages. The library also tracks remediation progress, indicating a decrease in vulnerable machines and affected organizations following disclosure. → wiz.io |
| 2026-10-28 2026 | Responder Guidance for PHP2Shell (CVE-2026-109618 and CVE-2026-109619) news 7 min read | Library for PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619, which enable unauthenticated remote code execution. These critical memory-corruption flaws affect the PHP core engine and are fixed in newer PHP versions. The guide details how exploitation works via out-of-memory corruption and stale global state, and discusses configuration factors like SAPI, opcache, and display_errors that influence reachability and execution. Partial mitigations are provided, but patching is strongly recommended as they do not offer a complete fix. → bishopfox.com |
| 2026-10-26 2026 | Breaking the AWS MCP Python Sandbox advanced 10 min read AI Python | Library for bypassing AWS MCP Python sandbox restrictions. This resource details how to exploit the `aws___run_script` tool by abusing Python's structural pattern matching (`match/case`) to bypass AST validation and runtime checks. By manipulating `__match_args__` and constructing dunder names using `chr()`, an attacker can achieve arbitrary attribute reads, ultimately leading to system command execution within the AWS Lambda sandbox. |
| 2026-10-26 2026 | Broccoli2Shell: Brotli decoder RCE in Node.js, Python and more intermediate 6 min read Deser Supply Chain | Library for detecting and mitigating Brotli decompression vulnerabilities, particularly the Broccoli2Shell RCE affecting Node.js, Python (including requests, urllib3, and aiohttp), and other software that uses the vulnerable C decoder (versions 1.0.3-1.2.0). It highlights how Brotli decompression can occur via HTTP responses, request bodies, and direct decoder calls, impacting applications that fetch URLs or accept encoded uploads. The library references CWE-252 and CWE-787 and points to specific fixes in Google's brotli repository and affected project versions. |
| 2026-10-26 2026 | Broccoli2shell: Everything You Need To Know About The Critical Brotli Decoder Vulnerability intermediate 3 min read Supply Chain | Writeup of CVE-2026-111497, dubbed Broccoli2Shell, detailing an out-of-bounds write vulnerability in the Brotli decoder. This flaw affects numerous technologies like Node.js, Bun, and Envoy Proxy, enabling remote code execution via crafted compressed data. Exploitation requires processing untrusted Brotli input, exposing cloud environments and internet-facing applications. Recommendations include applying security updates, identifying vulnerable workloads, and reviewing application exposure to Brotli-compressed data. → wiz.io |
| 2026-10-25 2026 | Full source release: autonomous root chain for TCL 50C721 Android TV via CVE-2022-22706 (Mali GPU page-cache write) advanced Mobile | This release provides the full source code for achieving an autonomous root chain on the TCL 50C721 Android TV. The exploit leverages CVE-2022-22706, a vulnerability related to a Mali GPU page-cache write. This allows for a complete takeover of the device's root privileges. |
| 2026-10-24 2026 | Imperia CMS SiteActive TEMPLATE Unauthenticated SSTI Remote Code Execution (CVE-2026-110355) news 4 min read SSTI | Writeup detailing CVE-2026-110355, an unauthenticated Server-Side Template Injection (SSTI) leading to Remote Code Execution in Imperia CMS's SiteActive component. The vulnerability, present in versions 11.7.2 and below on CGI-enabled installations, allows an attacker to inject PHP code via the `TEMPLATE` parameter in `/cgi-bin/site_active.pl`. This injected code is then processed by the `Imperia::Template::Convert` module and executed via the `PHPExec` plugin, enabling arbitrary command execution. The vendor patched this in Imperia CMS 11.8.0. |
| 2026-10-24 2026 | Evolving Threat: http2shell is an RCE in Node, Python, and more news Python | A new vulnerability, http2shell, has been discovered, posing a significant threat as it allows for Remote Code Execution (RCE) across multiple platforms including Node.js and Python. This exploit targets implementations of the HTTP/2 protocol, enabling attackers to gain unauthorized control over affected systems. Details on specific affected versions or potential mitigations are not provided in this brief summary, but the discovery highlights a critical security concern for applications using HTTP/2. |
| 2026-10-24 2026 | Understanding PHP2Shell: Everything you need to know about CVE-2026-109618 & CVE-2026-109619 news 8 min read | Writeup detailing PHP2Shell, a critical remote code execution vulnerability impacting approximately 70% of web servers. This analysis covers CVE-2026-109618 and CVE-2026-109619, which exploit PHP's memory management and error handling subsystems, allowing for full code execution or memory disclosure. It outlines four attack chains, including OOM corruption via mod_php, stale global state via fatal-error backtrace, stale session state via upload progress, and memory disclosure. Recommendations include updating PHP, applying WAF rules from vendors like Akamai and Cloudflare, and maintaining an asset inventory. → intigriti.com |
| 2026-10-24 2026 | Node2Shell evolves to HTTP2Shell. Brotli flaw (CVE-2026-111497) blast radius affects many libraries & apps using HTTPs. news 10 min read | Library addressing CVE-2026-111497, a critical out-of-bounds write in Google's Brotli decoder affecting versions 1.0.3 through 1.2.0. This vulnerability, also known as "Node2Shell," can lead to memory leaks, crashes, or arbitrary code execution for attackers sending crafted Brotli-compressed streams. The flaw impacts Node.js, Python packages like requests and httpx, curl, Bun, and Envoy, among others. Patches are available for libbrotli, Python, and various runtimes, with recommendations including upgrading affected libraries or disabling Brotli decoding as a workaround. → aikido.dev |
| 2026-10-23 2026 | Reversing a DPRK-linked toolkit that backdoors VS Code, Cursor, Discord and npm, with an Ethereum dead-drop C2 and a DEV#POPPER variant advanced Supply Chain | This content details a sophisticated toolkit, linked to North Korea (DPRK), that compromises popular developer tools like VS Code, Cursor, Discord, and npm. The toolkit establishes a command and control (C2) channel using an Ethereum "dead-drop" mechanism, a novel approach for covert communication. Furthermore, it incorporates a variant of the DEV#POPPER malware. The summary focuses on the identification of the threat actor, the targeted software, the unique C2 infrastructure, and the specific malware variant identified. |
| 2026-10-23 2026 | Markdown Is the New Executable: Attackers Are Dropping Agent Instructions Into Your Downloads Folder From the Web intermediate 15 min read | Library for detecting and preventing a novel attack vector where malicious `AGENTS.md` files, disguised as ordinary instructions, are dropped into user download folders by visiting websites. These files trick AI coding assistants like OpenAI Codex and Claude Code into executing arbitrary code or exfiltrating credentials by abusing the assistants' trust in files within their operating directories, exemplified by the exploitation of the `function-color` npm package. |
| 2026-10-23 2026 | [tl;dr sec] #351 - PHP2Shell, Autopatching Skills, AWS Pathrunner intermediate 9 min read AuthZ | Tool for automating AWS IAM privilege escalation, the modular framework pathrunner leverages the pathfinding.cloud catalog and manages identities as first-class objects. It deploys attacker infrastructure and generates HTML reports mapping exploitation steps to CloudTrail events. → tldrsec.com |
| 2026-10-23 2026 | Node2Shell: Node.js Brotli vulnerability allows remote code execution (CVE-2026-111497) news 6 min read Supply Chain | Library for Node.js and Bun addressing CVE-2026-111497, the Node2Shell vulnerability. This flaw in the Brotli decoder allows for remote code execution by malformed compressed input when an application decompresses Brotli data from an attacker-controlled source, affecting servers accepting requests, apps calling other servers, or code using `node:zlib` directly. → aikido.dev |
| 2026-10-22 2026 | PHP2Shell - quick mitigation pre-patch intermediate | PHP2Shell is a technique that allows attackers to execute arbitrary code on a server by exploiting vulnerabilities in how PHP handles shell commands. This exploit can be used to gain control of the system before official patches are available. Likely discusses methods for detecting and mitigating PHP2Shell attacks by implementing security measures that prevent or limit the execution of malicious shell commands, even in the absence of vendor patches. |
| 2026-10-22 2026 | CVE-2026-109618 and CVE-2026-109619 Are Two Directions Through the Same Pre-RINIT Window news 8 min read | Writeup on CVE-2026-109618 and CVE-2026-109619 detailing how the PHP session.upload_progress feature's callback, executed before module RINIT during multipart form data parsing, interacts with the basic extension's serializer state. This interaction, particularly when memory errors trigger `longjmp`, can lead to use-after-free vulnerabilities (CWE-416) by leaving the serializer's working state corrupted. The patch in PHP 8.5.12 mitigates this by introducing an early RINIT for specific globals and modifying serializer behavior for incomplete classes. |
| 2026-10-22 2026 | PHP2Shell (CVE-2026-109618/109619): first exploit requests arrived 5.5 hours before PHP shipped the fix, and the "scanners" carry Mirai-style loaders news 25 min read | Library detailing CVE-2026-109618 and CVE-2026-109619, two critical, unauthenticated RCE flaws in PHP core, nicknamed PHP2Shell. These vulnerabilities allow for remote code execution before application code even runs, with exploitation observed hours before official patches were released. The article details the technical specifics of each bug, including OOM corruption for CVE-2026-109618 and stale global state for CVE-2026-109619, and provides remediation steps such as patching to specific PHP versions (8.2.35, 8.3.36, 8.4.27, 8.5.12) or temporary workarounds like disabling upload progress. It also analyzes observed attack tooling, noting the use of Mirai-style loaders and attempts to exploit the vulnerabilities using leaked exploit details. |
| 2026-10-22 2026 | PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet news 11 min read | Writeup on PHP2Shell, an exploit chain demonstrating remote code execution and memory disclosure in core PHP, affecting versions dating back to 5.4. Developed using frontier AI models like Gemini 4 Argon, these vulnerabilities, grouped under CVEs with a CVSS score of 9.2, exploit memory-safety issues stemming from fatal error handling. The PHP2Shell exploit impacts widely used CMS platforms like WordPress, Drupal, and Joomla, as well as any application running on affected PHP versions, highlighting a potential turning point for AI-assisted vulnerability exploitation. → wiz.io |
| 2026-10-22 2026 | “Next Exploit Opportunities”: How a Threat Actor Used AI to Help Plan and Execute Multiple Types of Cybercrime Activities news 11 min read AI Secrets | Analysis of a threat actor, BUGSTER, details the weaponization of AI for cybercrime, including credential theft, VoIP fraud, Wi-Fi password cracking, and cryptocurrency reconnaissance. The actor leveraged AI-assisted scripts and reconnaissance reports, bypassing technical skill requirements, and successfully exfiltrated thousands of student records from an Indian university. The actor also planned VoIP fraud operations with AI guidance, utilizing the Hermes Agent framework and DeepSeek V4. This report highlights an emerging toolchain for cybercriminals adopting AI-enabled capabilities, driven by low cost and ease of access to such models. → unit42.paloaltonetworks.com |
| 2026-10-21 2026 | CVE-2026-46633: Proving exploitability of Twig sandbox bypass intermediate 9 min read SSTI | Writeup detailing exploit development for CVE-2026-46633, a Twig sandbox bypass. This research provides payloads for Error-Based, Time-Based Blind, Rendered, and Boolean Error-Based Blind exploitation, applicable to various Twig versions. It covers techniques such as leveraging traits and overriding class methods like `getSourceContext()` for code injection and achieving RCE, and includes corresponding SSTImap modules. |
| 2026-10-21 2026 | CVE-2026-106173 Deep-Dive: Fortinet FortiSIEM gRPC Path Traversal File Write to RCE advanced 4 min read | Writeup of CVE-2026-106173 details a critical arbitrary file write vulnerability in Fortinet FortiSIEM, exploitable via an unauthenticated gRPC service on port 27918. Attackers can leverage path traversal and null byte injection to overwrite critical system files, such as `/opt/charting/redishb.sh`, ultimately leading to remote code execution by manipulating files executed by cron jobs. → horizon3.ai |
| 2026-10-21 2026 | PHP rce CVE-2026-109618 news 2 min read | Writeup on CVE-2026-109618 and CVE-2026-109619, two PHP remote code execution vulnerabilities affecting versions 5, 7, and 8. Exploitation has been observed in the wild. These vulnerabilities, also known as "php2shell", allow unauthenticated attackers to execute code on a server. No official vendor advisory or patch is currently available, and organizations running PHP should prepare for rapid updates once a fix is confirmed. |
| 2026-10-21 2026 | What you need to know about PHP2shell. Critical vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619) news 3 min read | Library provides critical information on CVE-2026-109618 and CVE-2026-109619, two remote code execution vulnerabilities affecting all unpatched PHP versions. Patches are available for PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35, with exploitation already reported. The document details mitigation strategies, including updating PHP, using patched Aikido Images, and temporary workarounds like disabling `session.upload_progress.enabled` and setting `memory_limit = -1`. It also outlines signs of compromise and post-patch verification steps. → aikido.dev |
| 2026-10-20 2026 | CVE-2026-108097 Deep Dive: Turning a Drupal Field UI Callback Into RCE advanced | This content details a deep dive into CVE-2026-108097, a vulnerability in Drupal. The analysis reveals how a weakness in the Field UI callback can be exploited to achieve Remote Code Execution (RCE). The document likely explores the technical intricacies of the vulnerability, the methods used for exploitation, and potentially mitigation strategies for Drupal users. → fortbridge.co.uk |
| 2026-10-19 2026 | One parser, two bugs, many routers: Exploiting Broadcom WiFi across eCos, Linux advanced 5 min read | Writeup detailing remote code execution vulnerabilities in Broadcom's 802.11 implementation. Affecting millions of routers globally, these bugs enable unauthenticated attacks, information disclosure, and network key exfiltration. The analysis includes exploitation primitives, supply chain security concerns, and fingerprinting scripts for identifying affected devices, demonstrating the exploitable WPS EAP reassembly overflow on eCos and Linux platforms. |
| 2026-10-18 2026 | PhantomBuffer: Effective EDR Evasion Through Stealth Injection advanced 5 min read | Library for EDR evasion that utilizes stealth injection by leveraging Windows messages. PhantomBuffer bypasses traditional detection methods by employing `SendMessageW` with the `WM_SETTEXT` message to write payloads into target processes, avoiding the `WriteProcessMemory` API. This technique further enhances stealth by delegating thread execution redirection to the `cdb.exe` debugger, circumventing common EDR monitoring of `SetThreadContext` and `NtSetContextThread` APIs. |
| 2026-10-16 2026 | Wanted to download an ISO, ended up writing a kernel exploit advanced 13 min read | Library for kernel exploit development, enabling root access on TP-Link EAP770 Wi-Fi 7 access points. This writeup details a path to disable flawed hardware offloading features, bypassing privilege restrictions. The exploit chain leverages CVE-2022-0185, an integer underflow vulnerability, combined with pipe-buffer manipulation to achieve arbitrary write capabilities in the kernel, requiring root privileges to execute. |
| 2026-10-15 2026 | AhsayCBS Deep-Dive: Auth Bypass to RCE intermediate 5 min read AuthZ | Writeup of CVE-2026-105133 and CVE-2026-105134, detailing an authentication bypass vulnerability in AhsayCBS API components and a file write path traversal leading to remote code execution. Attackers can chain these flaws to write webshells into the application's filesystem, enabling SYSTEM and root command execution. The analysis unpacks the Java application's structure, identifies the authentication bypass in the `JSONApi.execute()` method via the "FromServlet":"Y" flag, and explains how `AddSysUser` allows creating new administrators without verification. It further details the path traversal in `FileService.a()` and `getReplicatedPath()`, demonstrating how to write malicious `.jsp` files into web-served directories, ultimately leading to webshell execution. → horizon3.ai |
| 2026-10-15 2026 | Artifactory Under Attack: In-the-Wild Exploitation of CVE-2026-42016, CVE-2026-42018 & CVE-2026-82329 news 12 min read AuthZ | Analysis of CVE-2026-42016, CVE-2026-42018, and CVE-2026-82329 impacting JFrog Artifactory details how attackers chain these vulnerabilities to bypass authentication and achieve administrative control. Exploitation involves gaining an anonymous user token via CVE-2026-42018, escalating privileges with CVE-2026-42016, or directly obtaining admin access through CVE-2026-82329. Post-exploitation activities include creating persistent admin accounts, deploying malicious Groovy plugins, and installing Rust-based backdoors for C2 communication. → wiz.io |
| 2026-10-15 2026 | Unit 42 Uncovers PEERSTITCH, a Stealthy FortiGate Implant news 12 min read Mobile | Library for detecting PEERSTITCH, a stealthy ARM64 malware, which exploits CVE-2024-47575 on FortiManager and CVE-2025-61624 on FortiOS. PEERSTITCH operates in memory, communicating through legitimate process traffic, evading conventional detection. The attack chain involves exfiltrating configurations and credentials from over 500 FortiGate firewalls, enabling long-term access, traffic interception, and backdoor deployment. → unit42.paloaltonetworks.com |
| 2026-10-15 2026 | Submit and Execute: Weaponizing Reflected XSS in Siemens Teamcenter's Login Redirect (CVE-2026-58113) intermediate 12 min read XSS | Library for demonstrating CVE-2026-58113, a reflected XSS vulnerability in Siemens Teamcenter's login redirect. This flaw allows an attacker to craft a link that, when opened by an authenticated user, executes JavaScript without any further user interaction. The vulnerability leverages the redirect page's automatic form submission and the `onformdata` event handler to achieve zero-interaction code execution, which can then be used to perform state-changing actions on behalf of the victim. → bishopfox.com |
| 2026-10-14 2026 | Vghost (CVE-2026-74580): Linux kernel vhost stale IOTLB cache leading to universal LPE and Guest-to-Host escape vector advanced 3 min read | Library describing Vghost (CVE-2026-74580), a Linux kernel vhost vulnerability. This defect stems from a stale IOTLB cache, enabling local privilege escalation to root via arbitrary kernel read/write or a guest escape through QEMU heap overwrite and control-flow hijacking when using vIOMMU and iommu_platform. The vulnerability was reproduced on Ubuntu, RHEL, Amazon Linux, Azure Linux, and Oracle Linux distributions, with fixes available in newer kernel versions. |
| 2026-10-14 2026 | We Let AI Fuzz Adobe Reader for a Week. It Found a Critical Zero-Day CVE-2026-81983 news 7 min read Fuzzing | Writeup detailing CVE-2026-81983, a critical integer overflow vulnerability in Adobe Acrobat's image pipeline. This vulnerability, discovered by an LLM-generated fuzzer, allows an out-of-bounds write by crafting a 16-bit image within a PDF. The bug stems from a 32-bit multiplication for a byte-swap loop that incorrectly calculates the buffer size, leading to an overrun. Adobe's patch implements a 64-bit range check to prevent this overflow. |