The newest Remote Code Execution (RCE) resources are on the Remote Code Execution (RCE) page. For a reading order instead of a date order, see the Remote Code Execution (RCE) learning path.
| Date Added | Link | Excerpt |
|---|---|---|
| 2026-10-14 2026 | Playing It SFAPE: Code Execution in Isolated User Mode advanced 16 min read | Library for exploring code execution within Windows Virtualization-Based Security (VBS) enclaves, specifically focusing on Isolated User Mode (IUM). This library details vulnerabilities like CVE-2023-36880 and CVE-2024-21423 found in `prefs_enclave_x64.dll`, demonstrating how memory corruption within an enclave can lead to full control. It highlights the potential for VTL1 code reuse, similar to techniques used in projects like Mirage and Outflank's sleepmask, for advanced operating system attacks. → blog.doyensec.com |
| 2026-10-13 2026 | LG webOS sync-demo Preauth RCE news | This content describes a critical Pre-authentication Remote Code Execution (RCE) vulnerability found in LG's webOS operating system, specifically within the `sync-demo` component. This means an attacker could potentially execute arbitrary code on a vulnerable LG smart TV without needing any prior authentication. The summary title itself highlights the severity of this security flaw. |
| 2026-10-13 2026 | CVE-2026-91768: FastCGI allowed_clients compared only 96 of an IPv6 address's 128 bits news 5 min read | Writeup of CVE-2026-91768, a partial comparison vulnerability in PHP-FPM's `listen.allowed_clients` directive that allowed connections from 4,294,967,296 IPv6 addresses when only one was specified. Introduced in 2014, the flaw persisted until September 2026 due to incomplete IPv6 address comparisons within the `fcgi_is_allowed` function. The vulnerability, which could be exploited remotely without authentication, allowed bypassing access controls by comparing only 12 out of 16 bytes of IPv6 addresses, effectively treating an exact match as a /96 prefix match. |
| 2026-10-13 2026 | I Found a $90k Remote Code Execution Vulnerability in Google news 4 min read Deser | Writeup detailing a $90,000 RCE vulnerability discovered in Google's DevSite OAuth flow. The vulnerability arose from a Flask session cookie containing a pickle-serialized object that included the OAuth client secret. This secret was reused as the Flask `SECRET_KEY`, allowing an attacker to forge session cookies and execute arbitrary Python code via the `pickle.loads` function during the OAuth callback processing. The writeup covers session cookie analysis, pickle deserialization vulnerabilities, and the chain from exposed secrets to unauthenticated RCE, highlighting specific affected Google domains. |
| 2026-10-12 2026 | Telegram Desktop vulnerability allowed any user file to be stolen news 10 min read | Library for understanding a Telegram Desktop vulnerability that enables arbitrary file reads. The attack chain exploits a local socket communication flaw, allowing command injection and the use of an internal `interpret://` URI scheme. This scheme, intended for release publishing, reads specified files and sends them to a channel without authorization checks, enabling theft of sensitive user data like session keys. |
| 2026-10-10 2026 | A JPEG, a Race, and a Ghost: Breaking Discourse's Image Pipeline intermediate 12 min read | Library detailing two vulnerabilities in Discourse's default configuration: a cache poisoning attack leading to CSP bypass and JavaScript execution for anonymous users via a modified `color_scheme_id` cookie, and an arbitrary file read stemming from a TOCTOU race condition in the image upload pipeline, exploitable with Trust Level 0 and involving ImageMagick and GhostScript. → slcyber.io |
| 2026-10-10 2026 | MXC - a sandboxed code execution system beginner 3 min read | Library for sandboxed code execution on Windows, Linux, and macOS. MXC supports multiple containment backends like ProcessContainer, LXC, and Bubblewrap, governed by detailed filesystem, network, and UI policies. It offers Rust, .NET, and Node SDKs for integrating into applications, along with diagnostics to aid in policy tuning and troubleshooting access-denied failures. The system allows for provisioning, starting, executing, and deprovisioning persistent containers, providing fine-grained control over untrusted workloads. |
| 2026-10-10 2026 | Death By A Thousand PaperCuts (PaperCut Pre-Auth RCE Chain and Patch Bypasses WT-2026-0141-0144/CVE-2026-82077/CVE-2026-82078/CVE-2026-81578) advanced 14 min read | Walkthrough of PaperCut pre-auth RCE chain and patch bypasses, including WT-2026-0143, WT-2026-0144 (CVE-2026-82077), CVE-2026-82078, and CVE-2026-81578. The analysis details how vulnerabilities and subsequent patch bypasses were discovered and chained, culminating in an unauthenticated remote code execution exploit against PaperCut's print management software. → labs.watchtowr.com |
| 2026-10-09 2026 | How We Found Thousands of Exposed NVIDIA GPUs and a Way to Disrupt Them (CVE-2026-47483) news 8 min read Bug Bounty | Writeup detailing CVE-2026-47483, a high-severity vulnerability in NVIDIA DCGM Exporter that enables unauthenticated attackers to cause denial of service and information disclosure by triggering uncontrolled resource consumption. Researchers discovered over 2,000 exposed GPU servers online, revealing significant NVIDIA hardware like Blackwell, H100s, and consumer RTX cards, often hosted by neocloud providers. NVIDIA released a security bulletin for CVE-2026-47483, which has a CVSS score of 8.2. |
| 2026-10-09 2026 | A Single POST Freezes Any Next.js Server news 4 min read Bug Bounty | Writeup of CVE-2026-23870 detailing a Denial of Service vulnerability in React Server Components. This vulnerability, found in React versions prior to 19.0.6, 19.1.7, and 19.2.6, allows an attacker to freeze a Next.js server by crafting a single POST request with numerous nested form data pointers. The issue stems from React's inefficient parsing of nested form data, causing excessive CPU usage and making the server unresponsive to legitimate requests. The fix involves optimizing the form data parsing to scan fields only once per request, preventing the exponential complexity. |
| 2026-10-08 2026 | CVE-2026-102489 Deep-Dive: Zammad Session Leak to RCE advanced 3 min read AuthN | Writeup of CVE-2026-102489 detailing a session hijack vulnerability in Zammad. This vulnerability, when triggered by a crafted WebSocket request, leaks session cookies from error messages, allowing attackers to obtain valid admin session cookies. These cookies can then be used to write arbitrary files to the application directory, specifically by overwriting the password reset email template, leading to remote code execution as the `zammad` user through Ruby's ERB rendering. → horizon3.ai |
| 2026-10-07 2026 | You Won’t Hear About These, Even In Myths (Atlassian Jira, Confluence (and more) Pre-Auth Arbitrary File Read CVE-2026-21589) news 9 min read API Sec | Writeup on CVE-2026-21589, an arbitrary file read vulnerability affecting Atlassian Jira, Confluence, and Bitbucket. The vulnerability stems from the `atlassian-plugins-webresource*.jar` library, which mishandles path traversal attempts using double colons (`::`) as a substitute for slashes. This allows unauthenticated attackers to read arbitrary files on affected systems by exploiting the `Router.unescapeSlashes` and `ResourceFactory.createResourceWithRelativePath` functions. → labs.watchtowr.com |
| 2026-10-06 2026 | Wordpress libheif RCE intermediate | This content describes a Remote Code Execution (RCE) vulnerability in WordPress related to the libheif library. → fortbridge.co.uk |
| 2026-10-06 2026 | Open Build Service, one year later: command execution through Mercurial argument injection intermediate 7 min read | Tool identifying CVE-2026-56004, a command execution vulnerability in Open Build Service's `obs_scm` service. The flaw arises from Mercurial argument injection when the `revision` parameter is improperly handled, allowing attackers to exploit Mercurial's `--config` option to execute arbitrary shell commands on the build server, posing a significant risk to software supply chains. |
| 2026-10-04 2026 | RCE and bad crypto in Internxt's 'post-quantum' cloud storage advanced 13 min read | Writeup detailing critical vulnerabilities in Internxt's cloud storage, including remote code execution via protocol handlers and session/key leakage through unauthenticated public key sharing and insecure redirection. The analysis highlights architectural flaws in their cryptographic implementation, such as a flat key hierarchy and weak password hashing (MD5 with 3 iterations), rendering their "post-quantum" security claims unreliable and enabling potential data interception by Internxt or malicious third parties. |
| 2026-10-03 2026 | 8 out of 10 Banks HATE This One Weird 3SKey RCE intermediate 8 min read | Library for authentication with hardware signing tokens like 3SKeys, SConnect (v2.16.0.0), had a critical remote code execution vulnerability (CVE-2026-18397) due to a hand-rolled RSA-2048 token validation implementation. This flaw allowed any site or iframe to silently download and execute a DLL by exploiting an uninitialized memory validation bypass, enabling the loading of "plugins" and impacting systems used by banks and national authentication services. |
| 2026-10-03 2026 | Bypassing Secure Boot via Unbounded RLE8 Splash Images in U-Boot (CVE-2026-71972) advanced 2 min read | Advisory for CVE-2026-71972 details an unbounded RLE8 splash image vulnerability in U-Boot. A crafted RLE8 BMP image, loaded from attacker-writable storage before boot stage authentication, can write past the framebuffer's bounds, corrupting adjacent memory and enabling secure boot bypass. Affected versions include U-Boot through 2026.10-rc5, with a fix available in commit 5201e83342d64c2f438ea35158575f28225e752e. |
| 2026-10-02 2026 | How to Spot a Compromised MikroTik Router beginner 16 min read | Reference detailing techniques for detecting compromised MikroTik routers, focusing on identifying attacker configurations. It covers SSH port forwarding (`forwarding-enabled`), built-in SOCKS proxies (`/ip socks`), and the web proxy (`/ip proxy`), highlighting specific artifacts like `forwarding-enabled: local` and `redirect-to` rules. The document explains how these features, when improperly configured or exposed to the WAN, can facilitate pivoting and traffic manipulation, referencing historical abuse via CVE-2018-14847. |
| 2026-10-02 2026 | Server Mismatch: WordPress plugin vulnerabilities when relying on .htaccess files intermediate 10 min read | Writeup on WordPress plugin vulnerabilities arising from overreliance on `.htaccess` files. When plugins installed on non-Apache servers, such as Nginx, ignore `.htaccess` directives, sensitive files like backup `.procstat` files in Everest Backup or database backup manifests in BackWPUp can be exposed to unauthenticated attackers. This research highlights security risks when plugin security relies solely on server-specific configurations. |
| 2026-10-02 2026 | One Port to Root: Weaponizing Check Point Management CVE-2026-93616 advanced 13 min read | Tool for weaponizing Check Point Management CVE-2026-93616, an unauthenticated remote code execution vulnerability. The flaw allows an attacker to write arbitrary files as root via directory traversal and file upload on TCP 19009, leading to root code execution by planting a cron job. Bishop Fox validated the exploit chain against R81.10 and R82.10 servers and developed a detection tool to check patch state externally. → bishopfox.com |
| 2026-10-01 2026 | How I Found a $113,337 AF_ALG Linux Local Privilege Escalation Before Copy Fail advanced 17 min read AuthZ | Writeup of CVE-2025-39964, a Linux AF_ALG privilege escalation vulnerability discovered by Muhammad Alifa Ramdhan. This vulnerability, found in the Linux kernel's cryptographic API, allows an ordinary user to gain root privileges and escape Docker containers. The article details the interaction with AF_ALG sockets, the `sendmsg()` system call, and the internal handling of user data via scatterlists, explaining the race condition in shared socket contexts that leads to out-of-bounds access. |
| 2026-09-30 2026 | Critical RCE Alert: Full takeover of HashiCorp Vault and OpenBao. OpenBao is patched. Vault remains exposed news 10 min read AuthZ | Writeup detailing an unauthenticated to RCE exploit chain affecting HashiCorp Vault and OpenBao, combining vulnerabilities GHSA-j6wc-jpvg-xfxq, GHSA-x8fg-h69x-p28f, GHSA-mjch-vcw3-hhmf, and GHSA-fg5x-7whg-6c28. The exploit leverages ACME validation bypass and non-canonical URL access to escalate privileges, cross namespace boundaries, and ultimately achieve RCE via snapshot restore. |
| 2026-09-30 2026 | Here We Go Again (Citrix NetScaler DTLS Preauth Memory Overflow CVE-2026-88772) news 11 min read | Writeup of CVE-2026-88772, a pre-authentication DTLS memory overflow in Citrix NetScaler. This vulnerability, exploited in the wild, allows an attacker to craft malicious DTLS records that cause an oversized data copy into a fixed-size buffer, leading to a crash or potential code execution. The analysis details the DTLS packet structure, NetScaler buffer handling, and the patch that introduces size checks before copying fragmented data, preventing the overflow. → labs.watchtowr.com |
| 2026-09-30 2026 | Zilliz / Attu | 2.6.5 news 16 min read AuthZ | Writeup on Zilliz Attu 2.6.5 detailing two vulnerabilities: missing authentication in the Playground feature, allowing arbitrary HTTP/HTTPS request proxying to public URLs, and insecure input validation, enabling requests to private IP addresses normally blocked. Bishop Fox researchers demonstrated that these could be combined to gain administrative access to the Kubernetes namespace in cloud deployments. Updating to Attu version 3.0.0 is recommended. → bishopfox.com |
| 2026-09-29 2026 | CVE-2026-32740: RCE in a PIE Next.js sharp/libheif Stack news | CVE-2026-32740 is a critical Remote Code Execution (RCE) vulnerability impacting Next.js applications that utilize the `sharp` and `libheif` libraries, particularly when compiled as Position-Independent Executables (PIE). This flaw allows attackers to execute arbitrary code on vulnerable systems, posing a significant security risk. Further details on mitigation and patching are recommended. → fortbridge.co.uk |
| 2026-09-29 2026 | RCE in OpenCode (GHSA-632h-h47v-g4x4) news 7 min read | Writeup detailing GHSA-632h-h47v-g4x4, a remote code execution vulnerability in the OpenCode AI coding agent. The flaw stems from a content-type confusion in the `/global/upgrade` API endpoint, allowing exploitation via a malicious npm package tarball and a specially crafted webpage. This enables an attacker to achieve code injection by tricking OpenCode into installing a tarball containing malicious preinstall scripts, leading to arbitrary code execution on the victim's machine. OpenCode 1.18.22 addresses this vulnerability. → securitylabs.datadoghq.com |
| 2026-09-29 2026 | Oh Look, The Foot Gun Went Off Again (Citrix NetScaler PreAuth Command Injection CVE-2026-88771) news 11 min read | Writeup detailing the pre-authentication command injection vulnerability in Citrix NetScaler, identified as CVE-2026-88771. This analysis dissects the exploitation of improper input validation within the NetScaler ADC and Gateway appliances, highlighting its zero-day status and active exploitation in the wild. The writeup examines the specific code changes involving `grep`, `sed`, and `awk` within the `ns_monuploadd_err.pl` script that contributed to the vulnerability, offering a technical deep-dive into the flaw's root cause. → labs.watchtowr.com |
| 2026-09-28 2026 | EDR Evasion: Process Injection Without WriteProcessMemory advanced 5 min read | Library for EDR evasion techniques, demonstrating process injection without the traditional `WriteProcessMemory` or `VirtualAllocEx` APIs. This method leverages named pipes for console programs like `nslookup.exe` or `netsh.exe`, writing payloads directly into the target process's memory. Detection should shift focus from API calls to monitoring `VirtualProtectEx` usage and named pipe read/write operations. The associated GitHub repository, `InjectSetConsole`, provides the proof-of-concept code. |
| 2026-09-28 2026 | How one Twitch chat message became code execution on a streamer’s PC intermediate 6 min read | Tool for exploiting OBS Browser Sources, this writeup details how a Twitch chat message can lead to code execution on a streamer's PC. The attack leverages an unsandboxed Chromium renderer within OBS, combined with CVE-2024-7971, a type confusion vulnerability in V8, to achieve arbitrary code execution on the host machine. The exploit chain begins with an XSS vulnerability in a chat overlay, which then utilizes the V8 bug to bypass OBS's disabled sandbox. |
| 2026-09-26 2026 | Compromising OBS Studio with a Twitch chat message. intermediate 6 min read | Writeup detailing how CVE-2024-7971, a V8 type confusion vulnerability, was exploited to achieve code execution on an OBS Studio streamer's PC via a single Twitch chat message. This attack leveraged an unsandboxed Chromium renderer within OBS's browser source, chaining a cross-site scripting (XSS) vulnerability in a Twitch chat overlay with the V8 exploit. The exploit achieved native code execution without requiring sandbox escape, directly compromising the streamer's machine. |
| 2026-09-26 2026 | Master Key Included: Detecting SolarWinds ARM CVE-2026-28326 intermediate 11 min read Deser | Library for detecting CVE-2026-28326, an unauthenticated RCE in SolarWinds Access Rights Manager. This vulnerability stems from a hardcoded, static client-authentication secret used with a .NET deserialization sink over gRPC on TCP 55555. The flaw allows attackers with network reach to port 55555 to execute code as NT AUTHORITY\SYSTEM. Patching to version 2026.2.1.7 or later is recommended, along with restricting access to TCP 55555. → bishopfox.com |
| 2026-09-25 2026 | Leveraging undocumented CodeConnection APIs in a CodePipeline build job or SageMaker Studio Notebook to enumerate, clone, push and delete code repositories. intermediate 14 min read AuthZ | Library documenting privilege escalation techniques within AWS CodePipeline and SageMaker Studio when using CodeConnections. The "Full clone" artifact format enables CodeBuild jobs to enumerate, clone, push, and delete repositories accessible by the CodeConnection, leveraging an undocumented CodeBuild endpoint. This bypasses intended security controls if IAM permissions are not strictly restricted, potentially allowing attackers to compromise source code providers. |
| 2026-09-25 2026 | Getting root on OnePlus 15 from an untrusted app, via an audio debug service and a vendor HAL advanced 10 min read Mobile | Library for exploiting two vulnerabilities in OnePlus devices, specifically the AtlasService's `setEvent` and the OLC2 HAL's `doShell`, allowing an untrusted app to achieve root privileges. The AtlasService vulnerability enables an app to set an audio debug property, leading to the execution of arbitrary commands as the `dumpstate` user via `/system_ext/bin/audioDumpInfo`. Subsequently, the `dumpstate` user can leverage the OLC2 HAL's `doShell` to execute commands as root within the `vendor_qti_init_shell` SELinux domain, which possesses all Linux capabilities. |
| 2026-09-24 2026 | Uncensored Qwen 3.8 27b helped write a LSASS Dumper which bypassed EDR while I made myself coffee intermediate 3 min read AI | Tool for bypassing EDR using an uncensored AI model. This tool demonstrates how AI can be leveraged to create executables for sensitive operations, such as dumping LSASS process memory, that evade EDR detection. The process involves using an uncensored Qwen 3.8 27B model to modify an existing LSASS dumper, applying techniques like altered process spawning, reduced access masks, random sleeps during minidump creation, modified output paths, and scrubbed embedded strings to achieve stealth. |
| 2026-09-24 2026 | Breaking the Superuser Guardrails of managed-PostgreSQL Providers intermediate 17 min read SQLi | Analysis of vulnerabilities in managed PostgreSQL provider security hardening extensions, detailing how these extensions temporarily grant superuser privileges to authorized users. This research identifies risks associated with extensions like Supabase's `supautils`, Azure's `azure.so`, and Aiven's `aiven_extras`, highlighting 76 reported vulnerabilities that could allow attackers to bypass protections and gain unauthorized access, potentially leading to cross-tenant compromises and direct operating system interaction via features like `COPY TO/FROM PROGRAM`. |
| 2026-09-24 2026 | Is This A Joke? In The Auth Header? (F5 BIG-IP UnAuth Heap-Overflow to RCE CVE-2026-94127) news 9 min read AuthN | Writeup on CVE-2026-94127, an F5 BIG-IP heap overflow vulnerability, detailing how an overly large "Authorization" header can lead to Remote Code Execution. The analysis reveals the vulnerability stems from insufficient size validation before copying the header's content into a heap buffer within the TMOS operating system, a flaw previously exploitable and now patched. The writeup traces the vulnerability's discovery through patch diffing and explains its trigger mechanism via the OAuth profile's `/f5-oauth2/v1/userinfo` endpoint. → labs.watchtowr.com |
| 2026-09-24 2026 | Send GitLab an email, push to main intermediate 8 min read Supply Chain | Library for analyzing GitLab's incoming email feature, which embeds a persistent, account-wide token instead of a project-specific credential. This token, disguised as an issue-creation email address, can be exploited to push code to protected branches, run CI/CD jobs, access secrets, and exfiltrate data from any accessible project, even bypassing IP restrictions. The analysis details how attackers can leverage the `-merge-request@` suffix and a `.patch` attachment to execute malicious code via `.gitlab-ci.yml`. → aikido.dev |
| 2026-09-23 2026 | ATT&CKing TACACS+ to Pwn Your Network via a Pre-Auth RCE - elttam intermediate 28 min read | Writeup of a pre-authentication RCE vulnerability (CVE-pending) in the legacy `tac_plus` daemon for TACACS+, discovered in the same code base as older vulnerabilities. The writeup details the TACACS+ protocol, its history, and previous research, followed by the proof of concept, a PSK oracle enabling practical exploitation, and the disclosure process. It highlights the ongoing relevance of TACACS+ in enterprise environments, the challenges of maintaining aging software, and the potential for exploitation via network device login forms, even without prior network access. → elttam.com |
| 2026-09-23 2026 | vCenter pre-auth RCE: CVE-2026-59309/59310 news 23 min read | Library for analyzing VMware vCenter vulnerabilities, including CVE-2026-59309 and CVE-2026-59310. This resource details a method to reconstruct security patch information by diffing RPM packages and file hashes, enabling the identification of critical pre-authentication remote code execution flaws. It specifically outlines the path traversal vulnerability (CWE-22) within the syslog receiver, allowing arbitrary file writes that can escalate to RCE by manipulating syslog message headers. |
| 2026-09-23 2026 | WordPress: Unauthenticated path traversal leading to conditional RCE intermediate | Library for identifying and mitigating an unauthenticated path traversal vulnerability in WordPress's page-template resolution, potentially leading to conditional RCE. Exploitation requires specific theme configurations (e.g., `page-templates` directory in themes like Twenty Twelve, Twenty Fourteen, Neve, Hestia, Sydney) and a readable `.php` file, such as `pearcmd.php`, especially when `register_argc_argv` is enabled. This affects WordPress versions prior to 7.1.2, with patches backported to 4.7. |
| 2026-09-22 2026 | Inside BambooToken’s Linux implant: shell and file control over MQTT intermediate 7 min read | Analysis of BambooToken’s Linux implant reveals a backdoor that leverages MQTT for command and control, featuring a shell worker for executing commands via `/bin/sh -c` and a file worker for managing files with operations like `dir`, `download`, and `upload`. The implant uses a repeating XOR key for message obfuscation and encodes MQTT topics into lowercase hexadecimal strings. Black Lotus Labs has identified this implant, listing its SHA-256 hash in their collection of indicators of compromise. |
| 2026-09-22 2026 | Three memory-safety bugs in Godot's untrusted-file parsers intermediate 7 min read | Writeup detailing three memory-safety bugs in Godot 4.7, discovered with an LLM agent. The vulnerabilities, affecting untrusted file parsers for .hdr images, .res binary resources, and translation files, stem from missing bounds checking and can lead to buffer overflows. These issues are present in long-standing codebases, dating back to 2014 and 2017. The author reported the bugs to the Godot security team, highlighting potential exploitation in exported games that load external files, drawing parallels to past CVEs like CVE-2021-26825 and CVE-2021-26826. |
| 2026-09-22 2026 | Windows Exploitation Techniques: Dangling COM Object Registrations intermediate 7 min read | Library for abusing dangling COM object registrations on Windows, leveraging CVE-2026-66804. This technique involves exploiting a missing server DLL for a system-wide COM object and using custom COM marshaling, specifically through the IMarshal interface, to load a malicious DLL into a privileged process like `dllhost.exe` running as SYSTEM. The exploit targets COM services that do not have custom marshaling mitigations enabled, such as the Shell Create Object Handler. → projectzero.google |
| 2026-09-20 2026 | CVE-2026-77179: Docker's hypervisor for Mac compromised (Docker Desktop, Docker Sandboxes) news 3 min read | Writeup of CVE-2026-77179, a Docker sandbox escape affecting Docker Desktop and Docker Sandboxes. This vulnerability allows a container to gain complete read and write access to the host filesystem by exploiting the virtio-fs implementation within Docker's VMM. The exploit involves manipulating symbolic links and file handles to trick the host's file server into resolving paths outside the intended container mount. Patches are available in Docker Sandboxes 0.42.0 and Docker Desktop 4.88.0. |
| 2026-09-18 2026 | The skb that wasn't freed - the Fragnesia primitive via Open vSwitch advanced 19 min read AuthZ | Library for exploiting the Fragnesia privilege escalation primitive, CVE-2026-90049, affecting Open vSwitch. This library details how Open vSwitch strips the SKBFL_SHARED_FRAG marker from packets, reintroducing a local privilege escalation vulnerability previously addressed by fixes for Copy Fail, Dirty Frag, and Fragnesia itself. The exploit bypasses security measures by leveraging OVS's generic netlink interface and its autoloadable module, enabling unprivileged users within namespaces to overwrite read-only memory. → blog.doyensec.com |
| 2026-09-18 2026 | MikroTrick: Inside the RouterOS Takeover Chain advanced 9 min read Recon | Writeup detailing the "MikroTrick" takeover chain affecting MikroTik RouterOS. This chain exploits CVE-2026-67279, allowing unauthenticated connections to reach post-login functionality, and CVE-2026-86060, which tricks the login helper into treating attacker-controlled data as a trusted administrative identity. Successful exploitation results in full administrative control of vulnerable RouterOS versions. → bishopfox.com |
| 2026-09-16 2026 | UANIA OS: Authenticated Remote Code Execution news 11 min read | Writeup detailing an authenticated remote code execution vulnerability in UANIA OS. The analysis begins with an examination of the web interface and an attempt to exploit the packet capture feature. While the filter field was properly sanitized, the download functionality allowed for arbitrary file reads by manipulating the `path` parameter, including accessing `/etc/passwd`. Further investigation revealed the underlying platform to be OpenWrt, leveraging its UBUS message bus exposed via rpcd. |
| 2026-09-16 2026 | Multiple Vulnerabilities in Frappe LMS Leading to Remote Code Execution news 5 min read | Writeup detailing multiple vulnerabilities in Frappe LMS, including CVE-2026-39405, a path traversal flaw in SCORM package uploads that allows for remote code execution. This vulnerability, when chained with CVE-2026-34606, a stored XSS flaw in profile bios exploitably by BeautifulSoup's get_text() function, enables a student user to achieve server-side RCE. The research demonstrates a manual exploitation path by replacing core API files and leverages XSS to trigger the RCE chain. |
| 2026-09-16 2026 | James Kettle’s ‘autonomous research cascade’, CRLF-powered desync attacks, RCE on humanoid robots – ethical hacker news roundup news | This ethical hacker news roundup highlights several significant security developments. James Kettle's "autonomous research cascade" is a notable achievement in automated vulnerability discovery. The piece also details CRLF-powered desync attacks, a class of vulnerabilities that can disrupt communication protocols. Finally, it reports on the alarming discovery of remote code execution (RCE) capabilities on humanoid robots, raising serious concerns about the security of emerging AI and robotics technologies. → yeswehack.com |
| 2026-09-15 2026 | IBM Db2 Mirror for i: pre-auth RCE and the road to QSECOFR intermediate 18 min read | Writeup detailing a pre-authentication remote code execution vulnerability in IBM Db2 Mirror for i. The exploit chain bypasses authentication by leveraging servlet path parameter manipulation, then utilizes a `skipVald` parameter to disable input validation, ultimately leading to arbitrary Java/JSP execution within the Liberty application server and potential QSECOFR access on the IBM i system. |