The newest Remote Code Execution (RCE) resources are on the Remote Code Execution (RCE) page. For a reading order instead of a date order, see the Remote Code Execution (RCE) learning path.
| Date Added | Link | Excerpt |
|---|---|---|
| 2026-09-14 2026 | A revisit of remote Spectre attacks on Cloudflare Workers advanced 14 min read | Analysis of Spectre attacks against Cloudflare Workers, revisiting techniques discovered in 2021 and building an updated proof-of-concept on the production environment. This research uncovered a limitation in Cloudflare's Dynamic Process Isolation (DyPrIs) defense, successfully demonstrating a remote Spectre attack that leaked up to 12 bit/s with 99% accuracy. The attack leveraged speculative type confusion and out-of-bounds memory accesses to infer cache states. Improvements to DyPrIs, integration of the V8 Sandbox, and an in-process isolation mechanism have since been implemented to mitigate these memory disclosure risks. → blog.cloudflare.com |
| 2026-09-13 2026 | Magento StyleSmuggler RCE: Report Poisoning to Code Execution intermediate | This document details a Remote Code Execution (RCE) vulnerability in Magento, dubbed "StyleSmuggler." The exploit leverages a report poisoning technique to achieve code execution. Attackers can manipulate report generation to inject malicious code, ultimately leading to a full compromise of the Magento instance. The severity of this vulnerability makes it a critical concern for Magento users. → fortbridge.co.uk |
| 2026-09-13 2026 | Beltdown2: Escaping the Cursor CLI sandbox intermediate 6 min read | Library for escaping the Cursor CLI's macOS Seatbelt sandbox by leveraging a vulnerable `core.fsmonitor` hook in Git. This technique bypasses the sandbox by exploiting the fact that Cursor's internal `git` process runs unsandboxed and honors repository-supplied hooks, allowing arbitrary code execution outside the confined workspace. The provided writeup details the exploit chain and demonstrates a proof-of-concept that writes to `$HOME` despite sandbox restrictions, contrasting it with a blocked sandboxed shell command, and notes that Cursor has since implemented universal Git hardening to address this vulnerability class. |
| 2026-09-12 2026 | CVE-2026-82329: Unauthenticated Administrative Access in JFrog Artifactory via an Empty Cluster Join Key news 7 min read AuthN | Writeup of CVE-2026-82329, an unauthenticated administrative access vulnerability in JFrog Artifactory. This flaw, rated CVSS 9.8, allows any attacker with network access to obtain administrator privileges by exploiting an empty cluster join key in JFrog Access. Exploitation chains a forged join request to an unauthenticated endpoint, resulting in an admin-scoped token. The vulnerability affects multiple self-managed Artifactory versions prior to the patched releases: 7.111.21, 7.117.28, 7.125.20, 7.133.29, 7.146.38, or 7.161.20. CISA has added this critical CVE to its Known Exploited Vulnerabilities catalog due to in-the-wild exploitation. → bishopfox.com |
| 2026-09-11 2026 | 🕵️♂️ SonicWall SMA1000 (CVE-2026-15409): SSRF to Erlang RCE chained into automated DCSync from the appliance advanced 19 min read SSRF | Library for analyzing CVE-2026-15409, a critical SSRF vulnerability affecting SonicWall SMA1000 appliances. This library demonstrates the exploitation chain, including reaching Erlang services for RCE and subsequent use of Impacket's secretsdump for Active Directory credential theft, leading to DCSync attacks. It details the process of extracting LDAP configurations and decrypting stored passwords, revealing opportunistic targeting across multiple countries and sectors. |
| 2026-09-11 2026 | No Extensions? You Forgot One: Writing Shared Objects to RCE via SQLite's dbpage intermediate 15 min read | Library for achieving Remote Code Execution via SQLite by exploiting the `sqlite_dbpage` virtual table. This technique allows low-level write access to database pages, enabling the crafting and writing of Shared Object (.so) files directly through SQL queries. The method bypasses SQLite's mandatory header and magic bytes by relocating the ELF Program Header Table to work around immutable offsets, ultimately leading to RCE when the target process is forced to load the malicious module. |
| 2026-09-11 2026 | Forgejo =16.0.3 Critical RCE news | Forgejo version 16.0.3 has a critical Remote Code Execution (RCE) vulnerability. This flaw allows an attacker to execute arbitrary code on the server, posing a significant security risk. |
| 2026-09-11 2026 | Mind the Config: Detecting and Weaponizing NetScaler CVE-2026-19490 news 12 min read AuthZ | Library for detecting and weaponizing NetScaler CVE-2026-19490, a critical CVSS 9.3 authentication bypass in SAML handling. The library includes a detection tool that safely probes NetScaler ADC and Gateway appliances for this vulnerability without triggering crashes. It maps various configuration paths from safe checks to root command execution, detailing how an unauthenticated request can lead to pre-authentication crashes, internal network proxying, or full appliance root access, depending on the SAML configuration and global authorization settings. → bishopfox.com |
| 2026-09-10 2026 | Out of Bounds, Out of Sandbox: RCE in Go JavaScript Engine advanced 16 min read | Library detailing a Remote Code Execution (RCE) vulnerability in the Goja JavaScript engine, found within applications like Grafana k6, PocketBase, Nuclei, and Zendesk. The vulnerability arises from an out-of-bounds heap write in `TypedArray` methods (`with` and `toReversed`) due to an incorrect offset calculation, exacerbated by Go's `unsafe` package bypassing runtime bounds checking. Successful exploitation involves heap spraying and manipulating `ArrayBuffer` structures to achieve arbitrary read/write capabilities, ultimately leading to sandbox escape and code execution. → slcyber.io |
| 2026-09-10 2026 | Fortinet Privileged Access Agent: Any Site Could Control Your Proxy and Watch Your Tab news 2 min read AuthZ | Writeup on CVE-2026-84388, a CVSS 9.1 vulnerability in Fortinet's Privileged Access Management Chrome extension. This flaw allows any website to control the user's browser proxy settings for the session and stream screen recordings from newly opened tabs to an attacker's server, enabling trivial phishing attacks. The exploit bypasses token validation and uses DOM manipulation to auto-approve consent dialogs, granting attackers full control. Fortinet has released a fix for the extension, which has over 1 million users. |
| 2026-09-10 2026 | Off Guard: Breaking LiteLLM from authentication bypass to cloud compromise advanced 12 min read AI AuthZ | Library for securing LiteLLM deployments that exposes vulnerabilities including MCP authentication bypass (CVE-2026-59822) allowing arbitrary Bearer token sessions, unauthenticated admin access, and post-authentication cloud credential theft via pass-through endpoints lacking URL validation. The research found nearly 10% of scanned LiteLLM instances used default keys or no authentication, enabling pre-authentication RCE and IAM compromise, with patches now available and CVE-2026-59822 appearing in CISA's KEV catalog. → wiz.io |
| 2026-09-09 2026 | Two critical remote bugs found in ArangoDB news 5 min read | Writeup detailing two critical vulnerabilities, GHSA-rrgq-978q-36mq and GHSA-rvhw-4hpw-9vrx, found in ArangoDB. The first vulnerability, a path traversal flaw using URL encoding, bypasses authentication for unauthenticated superuser access to all data. The second, an improper access control in task registration, allows an authenticated user with database write permissions to achieve root-level remote code execution by leveraging a single JSON field to run arbitrary commands and access sensitive files like `/etc/shadow`. |
| 2026-09-08 2026 | The £3 WiFi Extender With a Backdoor in Every Unit beginner 22 min read | Library for analyzing the security of low-cost, white-labeled hardware, focusing on a £3 WiFi extender. The analysis details reading the device's SPI flash chip using a Bus Pirate, carving out the kernel and filesystem, and discovering a hardcoded root password accessible via an unconditionally started telnet daemon. This process highlights inherited security risks from original design manufacturers and the importance of physical access for deep hardware security assessments. |
| 2026-09-08 2026 | StyleSmuggler fix: patch the Magento and Adobe Commerce RCE intermediate 4 min read | Library providing a secure, drop-in replacement for vulnerable Magento and Adobe Commerce packages, addressing the unauthenticated StyleSmuggler RCE vulnerability (AIKIDO-2026-248927, AIKIDO-2026-123768, AIKIDO-2026-724507). The fix sanitizes template styles at two injection points, preventing PHP execution during email rendering without requiring a full Magento version upgrade, thus avoiding extension conflicts and extensive regression testing. This mitigation is crucial as Adobe has not yet released an official patch or CVE for the actively exploited zero-day. → aikido.dev |
| 2026-09-07 2026 | From Padding Oracle to Shell: Unauthenticated RCE in Telerik UI for ASP.NET AJAX advanced 48 min read Deser | Library for unauthenticated RCE in Telerik UI for ASP.NET AJAX, chaining an AES-CBC padding oracle vulnerability with other flaws. Affecting versions 2010.1.309 through 2026.2.519, exploitation requires a reachable RadAsyncUpload control with a custom encryption key configured. Exploitation is possible even with customErrors set to On by using timing analysis. |
| 2026-09-05 2026 | Dirty Frag (CVE-2026-43284): the Linux kernel bug that turns read access into root advanced 8 min read | Analysis of Dirty Frag (CVE-2026-43284, CVE-2026-43500, CVE-2026-46300), a Linux kernel vulnerability allowing privilege escalation by writing to read-only files via the page cache. The bug affects networking code, specifically ESP and RxRPC, and can be exploited in container environments to gain root access to the host kernel. The analysis details affected components, exposure checks using `uname -r` and `lsmod`, monitoring strategies with audit and EDR tools, and vendor-specific mitigation information. → aikido.dev |
| 2026-09-04 2026 | PostgreSQL Hit by 12-Year-Old Vulnerability Allowing Server Takeover news 3 min read | Library for securing PostgreSQL instances, addressing CVE-2026-6471 (PostGREShell), a critical vulnerability allowing server takeover via missing authorization in logical decoding. This flaw enables attackers with REPLICATION privileges to execute arbitrary code on the server, escalating to full superuser access and persistent backdoor installation. The vulnerability affects PostgreSQL versions from 9.4 up to 18.x prior to specific patched releases. → securityaffairs.com |
| 2026-09-04 2026 | Hackers exploit chained SonicWall gaps for remote code execution news | Analysis of chained SonicWall vulnerabilities, CVE-2026-83548 and CVE-2026-83549, highlights a sophisticated attack enabling remote code execution on SMA1000 appliances. Exploiting a server-side request forgery in Appliance Work Place and OS command injection in Appliance Management Console, threat actors gain unauthorized command execution. These vulnerabilities are actively exploited and listed in CISA's Known Exploited Vulnerabilities catalog, requiring immediate hotfix application. → msspalert.com |
| 2026-09-04 2026 | SonicWall Warns of Actively Exploited Vulnerabilities in SMA1000 Appliances news 1 min read | Analysis of CVE-2026-83548 and CVE-2026-83549 details two zero-day vulnerabilities in SonicWall SMA1000 appliances chained for remote code execution. CVE-2026-83548, a critical pre-authentication SSRF with command injection (CVSS 10), allows unauthorized actions, while CVE-2026-83549, a high-severity OS command injection (CVSS 7.8), permits command execution by privileged attackers. Both are listed in CISA's KEV Catalog, requiring urgent patching for affected models. |
| 2026-09-04 2026 | Over 440000 Exploit Attempts Target Super Forms and Elementor Pro RCE Flaws news 2 min read | Writeup detailing exploit attempts against WordPress plugins Super Forms and Elementor Pro, specifically targeting CVE-2026-14894 and CVE-2026-32475. These vulnerabilities allow unauthenticated attackers to upload arbitrary files, including PHP web shells, leading to remote code execution. Over 440,000 exploit attempts were observed, with attackers leveraging the vulnerabilities to create admin accounts, exfiltrate data, and compromise entire WordPress sites. → thehackernews.com |
| 2026-09-04 2026 | SonicWall SMA1000 Zero-Days Under Active Attack: Patch Now news 2 min read | Vulnerability Advisory for CVE-2026-83548 and CVE-2026-83549 affecting SonicWall SMA1000 appliances. These zero-day vulnerabilities, a pre-authentication SSRF (CVE-2026-83548) and a post-authentication RCE (CVE-2026-83549), are being actively exploited and can be chained for unauthenticated operating system command execution. Immediate patching to updated hotfix versions is critical for affected SMA1000 6210, 7210, and 8200v models. Organizations should also investigate systems for compromise and implement post-compromise remediation steps. → esecurityplanet.com |
| 2026-09-04 2026 | Critical Elementor Pro flaw exploited to take over WordPress sites news 2 min read | Writeup of CVE-2026-32475, a critical vulnerability in Elementor Pro for WordPress, details how attackers exploit faulty file-upload validation in Elementor Pro Forms. By submitting an empty file as the first array element and a malicious PHP file as the second, attackers bypass validation, upload arbitrary PHP files to `/wp-content/uploads/elementor/forms/`, and execute commands remotely. This flaw, present in versions 4.2.1 and earlier, has seen widespread exploitation attempts since its patch on August 19. → bleepingcomputer.com |
| 2026-09-04 2026 | File upload to RCE intermediate | This post details a pentesting scenario where a file upload vulnerability led to Remote Code Execution (RCE). The author guides readers through the process of identifying and exploiting this type of flaw, offering a practical example encountered during a security assessment. The content focuses on the techniques and methodologies used to discover and leverage the RCE vulnerability stemming from insecure file handling. → infosecwriteups.com |
| 2026-09-04 2026 | MECCHA CHAMELEON can't hide from the RCE advanced 9 min read | Library for discovering arbitrary file write vulnerabilities, specifically demonstrating a delayed RCE in MECCHA CHAMELEON. The library leverages an exposed Blueprint function, `Finish Recording Output`, within Unreal Engine maps. This function allows arbitrary file writes by manipulating paths and bypassing file extension checks using null bytes, ultimately enabling the execution of arbitrary code upon system restart. → aikido.dev |
| 2026-09-04 2026 | Critical Cisco Nexus 9000 Flaw Lets Unauthenticated Remote Attackers Run Code as Root news 6 min read | Writeup on CVE-2026-20212, a critical Cisco Nexus 9000 flaw allowing unauthenticated remote code execution as root. Exploitation of this vulnerability, which affects specific Silicon One-based Nexus 9000 models, can also crash the S1HAL process. Cisco also released patches for seven IOS XR vulnerabilities, with CVE-2026-20274 and CVE-2026-20279 rated 9.8. Temporary mitigations include infrastructure access control lists (iACLs) and Live Protect shields. → thehackernews.com |
| 2026-09-04 2026 | Cisco Warns of Unpatched Secure Email Flaws Patches Critical Switch Vulnerabilities news 2 min read | Writeup detailing Cisco's recent security advisories, highlighting unpatched vulnerabilities in Secure Email (CVE-2026-20354, CVE-2026-20355) enabling man-in-the-middle attacks and plaintext interception. It also covers patches for critical flaws in IOS XR and Nexus 9000 series switches, including CVE-2026-20274, CVE-2026-20279, and CVE-2026-20212, which could lead to remote code execution and authentication bypass. A high-severity DoS vulnerability (CVE-2026-20281) in certain Cisco IP phones is also noted. → securityweek.com |
| 2026-09-04 2026 | Microsoft Edge Multiple Vulnerabilities news 1 min read | Writeup detailing multiple vulnerabilities in Microsoft Edge, including CVE-2026-84323 through CVE-2026-84359. Exploitation can lead to remote code execution, denial of service, security restriction bypass, information disclosure, elevation of privilege, data manipulation, and spoofing. Users should update to version 152.0.4191.62 or later to patch these issues. → hkcert.org |
| 2026-09-04 2026 | Google Chrome Multiple Vulnerabilities news 1 min read | Bulletin detailing multiple critical vulnerabilities in Google Chrome, including CVE-2026-85046 which is actively exploited in the wild. Exploitation can lead to remote code execution within a sandbox via crafted HTML pages, denial of service, information disclosure, security restriction bypass, and elevation of privilege. Patches are available for Linux, macOS, and Windows versions. → hkcert.org |
| 2026-09-03 2026 | HPE patches critical ArubaOS-CX remote code execution flaw news 3 min read | Writeup detailing HPE's patch for a critical remote code execution flaw in ArubaOS-CX, identified as CVE-2026-73749. This buffer overflow vulnerability allows unauthenticated remote attackers to execute code with elevated privileges by sending crafted packets to an affected daemon process. The bulletin also addresses numerous other vulnerabilities, including CVE-2026-73750, CVE-2026-73751, CVE-2026-73752, CVE-2026-73753, CVE-2026-73782, CVE-2026-73781, CVE-2026-73780, CVE-2026-73779, and CVE-2026-73778, with HPE urging customers to upgrade to specific fixed release branches. → bleepingcomputer.com |
| 2026-09-03 2026 | Critical remote code execution in vm2 a widely used Node.js sandbox library news 8 min read | Library of remote code execution vulnerabilities found in vm2, a Node.js sandboxing library, allowing arbitrary command execution. The CVSS 10.0 rated flaws stem from default configurations in the library's README, permitting sandboxed code to access the host system's real Node.js modules. Updates to version 3.11.7 address this specific escape but may not fully mitigate broader configuration risks when `require.external` is enabled without strict `require.root` settings, potentially allowing exploitation through external files. |
| 2026-09-03 2026 | SonicWall urges immediate patching of chained vulnerabilities news | SonicWall is issuing an urgent call for customers to patch chained vulnerabilities affecting their products. The company has released security advisories and patches to address these critical issues, which could be exploited together. Users are strongly encouraged to apply the updates promptly to safeguard their systems against potential compromise. → cybersecuritydive.com |
| 2026-09-03 2026 | Critical SonicWall SMA1000 Vulnerabilities CVE-2026-83548 CVE-2026-83549 Exploited in the Wild news 2 min read | Writeup detailing CVE-2026-83548 and CVE-2026-83549, critical vulnerabilities affecting SonicWall SMA1000 appliances. The SSRF flaw (CVE-2026-83548) can chain with command injection (CVE-2026-83549) for unauthenticated RCE, and both are actively exploited in the wild, added to CISA's KEV catalog. Immediate hotfixes are recommended, alongside evidence of compromise checks and potential re-imaging. → rapid7.com |
| 2026-09-03 2026 | Hackers exploit Sangoma Switchvox flaw to deploy reverse shells news 2 min read | Writeup on CVE-2026-9586, an unauthenticated SQL injection vulnerability in Sangoma Switchvox, enabling reverse shells and remote code execution. Researchers at Horizon3 demonstrated how crafted XML requests to the `/pa` endpoint allow attackers to execute OS commands, leading to active exploitation observed on internet-exposed Switchvox systems. System administrators are urged to upgrade to version 8.4.0.2 to mitigate this risk and check logs for compromise indicators. → bleepingcomputer.com |
| 2026-09-03 2026 | The $8,000 Shortcut: Hijacking Microsoft Edge via NTFS Directory Junctions intermediate AuthZ | An InfoSec Write-up details an $8,000 bug bounty discovery, where an NTFS directory junction vulnerability allowed for the hijacking of Microsoft Edge. This exploit leverages a classic Windows filesystem feature, effectively turning the Edge browser into a "Confused Deputy," enabling attackers to gain control. → infosecwriteups.com |
| 2026-09-03 2026 | Android App RCE via Dynamic Code Loading intermediate Mobile | This post details an Android app's Remote Code Execution (RCE) vulnerability, building on previous research into insecure content providers and notification hijacking. The exploit leverages a path traversal vulnerability alongside dynamic code loading within a document viewer app. The objective is to achieve RCE by manipulating these mechanisms. The author references a previous exploit in Adobe Acrobat Reader for Android (CVE-2021-40724) as a related example. → infosecwriteups.com |
| 2026-09-03 2026 | CISA Adds Seven Exploited Flaws as Attackers Deploy Reverse Shells and Crypto Miners news 4 min read | Catalog of seven exploited vulnerabilities added by CISA, including CVE-2026-83548 (SonicWall SMA 1000 server-side request forgery), CVE-2026-9586 (Sangoma Switchvox SQL injection), CVE-2026-82329 (JFrog Artifactory improper authentication), CVE-2026-48710 (Kludex Starlette HTTP request/response smuggling), CVE-2026-49869 (Kestra OSS command injection), and CVE-2026-59822 (Berri LiteLLM MCP Streamable HTTP endpoint improper authentication). Attackers are deploying reverse shells, crypto miners, and achieving RCE through these flaws, with notable exploitation chains involving LiteLLM and RAGFlow. → thehackernews.com |
| 2026-09-02 2026 | Critical SonicWall SMA 1000 Flaws Enable Unauthenticated RCE news | Critical vulnerabilities have been discovered in SonicWall's Secure Mobile Access (SMA) 1000 series, allowing unauthenticated Remote Code Execution (RCE). This means attackers can exploit these flaws to gain control of affected devices without needing any credentials. The severity of these bugs poses a significant risk to organizations relying on SonicWall SMA 1000 for secure remote access. Users are strongly advised to update their systems to patch these vulnerabilities. → darkreading.com |
| 2026-09-02 2026 | SonicWall SMA1000 Series: Critical Vulnerability Exploited (Sept. 2026) news 2 min read | Writeup on CVE-2026-83548 and CVE-2026-83549 affecting SonicWall SMA1000 Series appliances. The critical CVE-2026-83548 (CVSS 10.0) allows unauthenticated attackers to exploit a pre-authentication SSRF vulnerability. The high CVE-2026-83549 (CVSS 7.8) enables authenticated attackers to achieve OS command injection. Both vulnerabilities are actively exploited, with hotfixes available for affected models 6210, 7210, and 8200v. |
| 2026-09-02 2026 | WordPress backup plugin flaw exposes millions of sites to takeover attacks news 2 min read | Vulnerability in All-in-One WP Migration and Backup plugin, CVE-2026-19949, allows unauthenticated attackers to achieve remote code execution and site takeover via a second-order SQL injection. Attackers can plant crafted data through trackbacks, which executes during a site restore, exposing the secret import key. This enables the import of malicious archives with executable code, potentially leading to complete website control. The flaw impacts over five million active installations, with millions still running vulnerable versions despite a vendor fix. → bleepingcomputer.com |
| 2026-09-02 2026 | Attackers Exploit Two SonicWall SMA 1000 Zero-Days That May Form an Attack Chain news 1 min read | Writeup detailing two SonicWall SMA 1000 zero-day vulnerabilities, CVE-2026-83548 (pre-authentication SSRF) and CVE-2026-83549 (post-authentication command injection), that attackers are chaining for arbitrary code execution. SonicWall recommends upgrading to patched versions, reviewing for IoCs, and potentially re-imaging affected appliances. This follows previous exploitation of other SMA 1000 flaws by threat actor UTA0533. → thehackernews.com |
| 2026-09-02 2026 | Attackers Exploit Critical Switchvox Flaw to Deploy Reverse Shells Without Credentials news 2 min read | Writeup of CVE-2026-9586, a critical unauthenticated SQL injection vulnerability in Sangoma Switchvox SMB Edition 8.3 (104997), allowing remote code execution and reverse shell deployment without credentials. Attackers exploit this flaw by crafting a request that bypasses sanitization in the /pa endpoint's XML processing, directly injecting malicious SQL into PostgreSQL queries. Horizon3.ai and SRA Labs reported this vulnerability, with exploitation attempts observed in the wild targeting internet-exposed instances. Indicators of compromise include specific log entries and attacker IP addresses. → thehackernews.com |
| 2026-09-02 2026 | GeoNetwork Fixes Unauthenticated RCE Chain Affecting Government Geoportal Backends news 3 min read | Writeup on CVE-2026-63219 and CVE-2026-58400, two vulnerabilities in GeoNetwork chained to achieve unauthenticated RCE. The chain combines a missing authorization check on a formatter upload endpoint with an unsafe Saxon XSLT transformation engine, allowing attackers to execute arbitrary operating-system commands as the GeoNetwork process. Vulnerable versions are fixed in 4.4.12 and 4.2.17. → thehackernews.com |
| 2026-09-02 2026 | Researchers Use Claude to Port Pre-Auth RCE Exploit From One PLC Model to Another advanced 4 min read | Tool that leverages Anthropic's Claude AI to port a pre-authentication remote code execution (RCE) exploit for CVE-2021-31886 from one WAGO PLC model to another, demonstrating the potential for AI to accelerate exploit development against operational technology (OT) systems. The process involved interactive sessions with Claude, Ghidra, and live PLC hardware, culminating in the successful execution of attacker-supplied ARM shellcode and the development of functional network payloads. This research highlights the evolving threat landscape where AI significantly lowers the barrier for exploit creation, posing new challenges for industrial control system security. → thehackernews.com |
| 2026-09-02 2026 | Google Chrome Multiple Vulnerabilities news 1 min read | Bulletin detailing multiple vulnerabilities in Google Chrome, including remote code execution, elevation of privilege, security restriction bypass, denial of service, information disclosure, data manipulation, and spoofing. These issues affect versions prior to 152.0.7977.75 (Linux), 152.0.7977.75/.76 (Mac), and 152.0.7977.75/.76 (Windows). Fixes are available in Chrome 152.0.7977.75 and later. Affected CVEs include CVE-2026-84323 through CVE-2026-84359. → hkcert.org |
| 2026-09-02 2026 | SonicWall warns of actively exploited SMA1000 zero-day flaws news 2 min read | Advisory detailing actively exploited SMA1000 zero-day vulnerabilities, including command injection (CVE-2026-83548, CVE-2026-83549) chained with SSRF. These flaws affect SMA1000 6210, 7210, and 8200v models, posing a significant risk to large enterprises, government, and critical infrastructure due to their use as secure remote access appliances. This follows previous exploitation of SMA1000 vulnerabilities in July (CVE-2026-15409, CVE-2026-15410) and December (CVE-2025-40602). → bleepingcomputer.com |
| 2026-09-02 2026 | Off the Hook: Discovering and Observing Active Exploitation of Sangoma Switchvox CVE-2026-9586 news 3 min read | Writeup detailing CVE-2026-9586, an unauthenticated SQL injection leading to remote code execution in Sangoma Switchvox. The vulnerability arises from direct concatenation of the `PhoneIP` field, extracted from XML notifications, into unparameterized SQL queries. The analysis includes exploit examples, indicators of compromise found in `/var/log/switchvox/db-quirks.log`, and observations of active exploitation attempts in the wild. → horizon3.ai |
| 2026-09-02 2026 | GeoNetwork - Pre-Auth RCE via Unauthenticated File Upload and Unsafe XSLT Processor (4 CVEs, 121 government deployments, all patched) news 5 min read XXE | Writeup detailing four CVEs found in GeoNetwork, a geospatial metadata catalog. These include CVE-2026-63219, an unauthenticated file upload vulnerability; CVE-2026-55864, an SSRF in the SLD tool; CVE-2026-57582, a reflected XSS via unsanitized JavaScript sink; and CVE-2026-58400, a pre-authentication RCE achieved through an unsafe Saxon XSLT processor configuration. The writeup demonstrates chaining the file upload and XSLT vulnerabilities for RCE and reports over 120 affected government deployments. |
| 2026-09-02 2026 | From Patch to Exploit; Using Claude Code to reverse engineer an n-day in Papercut NG intermediate 15 min read | Library for reverse engineering n-days using Claude Opus, demonstrating unauthenticated code execution in Papercut NG by identifying and chaining SQL injection and an authentication bypass. The process involved patch diffing with Ghidra, analyzing Java bytecode, and utilizing custom agents for infrastructure management and tool execution, including Playwright for UI interaction. The library successfully bypassed patch mitigations and achieved its objective within 90 minutes. |
| 2026-09-01 2026 | Critical Langflow flaw exploited to steal OpenAI and AWS keys news 2 min read | Writeup of CVE-2026-0768, a critical unauthenticated remote code execution vulnerability in Langflow, an open-source AI application framework. Threat actors are actively exploiting this flaw to steal OpenAI and AWS API keys, along with other sensitive credentials. The vulnerability resides in Langflow's custom component editor code validator and affects versions prior to 1.4.2. This exploitation follows a pattern of previous critical flaws in Langflow, including CVE-2026-33017, CVE-2026-5027, CVE-2026-55255, CVE-2026-0770, and CVE-2026-9198. Users are strongly advised to upgrade to version 1.11.6 to mitigate these risks. → bleepingcomputer.com |
| 2026-09-01 2026 | Recently patched PaperCut zero-days used in data theft attacks news 2 min read | Writeup detailing the exploitation of two recently patched zero-day vulnerabilities in PaperCut NG and MF, identified as CVE-2026-81578 and CVE-2026-82078. These flaws allow attackers to bypass authentication and achieve remote code execution, and are actively being used for data theft, including dumping database tables via Derby. This follows a history of PaperCut vulnerabilities, such as CVE–2023–27350 and CVE-2023–27351, being exploited by various threat actors including ransomware gangs and state-backed groups. → bleepingcomputer.com |