The newest Remote Code Execution (RCE) resources are on the Remote Code Execution (RCE) page. For a reading order instead of a date order, see the Remote Code Execution (RCE) learning path.
| Date Added | Link | Excerpt |
|---|---|---|
| 2026-08-23 2026 | Microsoft Confirms Maximum-Severity Entra ID Vulnerability Exploited In Attacks news | Microsoft has confirmed a critical vulnerability in Entra ID (formerly Azure Active Directory) that has been actively exploited in attacks. The flaw, identified as CVE-2024-29988, allows authenticated attackers to bypass multi-factor authentication (MFA) and gain unauthorized access to user accounts. While the full scope of the exploitation and the potential impact are still being assessed, Microsoft has released guidance for mitigation and is urging customers to implement the suggested measures to protect their environments. |
| 2026-08-23 2026 | Microsoft Entra ID Vulnerability Fix Secures Enterprise Logins news 4 min read | Vulnerability analysis of CVE-2026-69836, a critical remote code execution flaw in Microsoft Entra ID, detailing its severity (CVSS 10.0), root cause (deserialization of untrusted data), and exploitability (network-based, no privileges or user interaction required). Microsoft has patched this issue, confirming it was not exploited in the wild, and highlighting the increasing role of AI in vulnerability discovery. |
| 2026-08-23 2026 | Microsoft Patches Critical Entra ID Flaw Rated a Perfect 10 on Severity Scale news 3 min read | Writeup on CVE-2026-69836, a critical Entra ID vulnerability rated 10.0 CVSS, allowing unauthenticated remote code execution via deserialization of untrusted data (CWE-502). This flaw, impacting Microsoft's identity platform, shares similarities with past Entra ID deserialization issues like CVE-2026-50652 and CVE-2026-57969. Microsoft has patched the issue server-side without requiring customer action, though transparency concerns regarding independent verification of fixes remain. |
| 2026-08-22 2026 | No Crash Required: Verifying the Citrix NetScaler SAML Patch for CVE-2026-8452 intermediate 14 min read AuthN | Tool for verifying the Citrix NetScaler SAML patch for CVE-2026-8452, a heap overflow vulnerability that can lead to remote code execution. This tool allows external verification of the patch status without causing disruption or crashes, by analyzing SAML requests and responses. It aids in identifying exploitation indicators and confirming patch implementation on Gateway and AAA virtual servers, also accounting for sibling vulnerabilities CVE-2026-8451 and CVE-2026-19490. → bishopfox.com |
| 2026-08-22 2026 | Microsoft Patches Entra ID RCE Vulnerability Exploited in Attacks news 3 min read | Library of security advisories detailing CVE-2026-69836, a maximum-severity vulnerability in Microsoft Entra ID. This deserialization flaw allowed unauthenticated remote code execution and was exploited in attacks before Microsoft mitigated the issue. While customers need no immediate action, security teams should review Entra ID environments for signs of compromise, focusing on privileged activity, application changes, and suspicious sessions, and implement Zero Trust principles to mitigate identity-based risks. → esecurityplanet.com |
| 2026-08-21 2026 | Microsoft Rolls Out 22 Fresh Security Patches news 2 min read | Updates from Microsoft address 22 security vulnerabilities, including a critical Entra ID zero-day (CVE-2026-69836) exploited for remote code execution. Other critical flaws patched include elevation-of-privilege bugs in Azure SQL Database (CVE-2026-69502, CVE-2026-68782, CVE-2026-68789, CVE-2026-66309), Azure Arc (CVE-2026-69555, CVE-2026-65816), and Exchange Online (CVE-2026-65801), along with RCE in Azure Managed Instance for Apache Cassandra (CVE-2026-65770). Additionally, Microsoft patched ShieldBreak (CVE-2026-69414), a Defender elevation-of-privilege vulnerability. → securityweek.com |
| 2026-08-21 2026 | Microsoft confirms maximum severity flaw in Entra ID targeted for exploitation news | Microsoft has confirmed a maximum severity vulnerability in Entra ID (formerly Azure AD) is actively being exploited. The flaw, classified as critical, poses a significant risk to organizations using the identity and access management service. While the exact impact and scope are still under investigation, the active exploitation suggests immediate attention is required for any entities relying on Entra ID. Further details on the vulnerability and mitigation steps are expected from Microsoft. → cybersecuritydive.com |
| 2026-08-21 2026 | Critical Isolated-vm Vulnerability Leads to RCE on Host news 2 min read | Library advisory detailing a critical type confusion vulnerability in `isolated-vm`'s `ExternalCopy` function. This bug, a TOCTOU weakness in data transfer between JavaScript Isolates, allows attackers to hijack control flow and achieve RCE on the host system. Patches are available in `isolated-vm` versions 6.2.0 and 7.0.1. → securityweek.com |
| 2026-08-21 2026 | U.S. CISA adds TrueConf Server flaws to its Known Exploited Vulnerabilities catalog news 2 min read | Catalog entry listing CVE-2026-72529 and CVE-2026-72530, two critical vulnerabilities affecting TrueConf Server. CVE-2026-72529 is a remote code execution flaw exploitable via TCP port 4307, allowing unauthenticated attackers to execute arbitrary scripts. CVE-2026-72530 is a sandbox escape vulnerability on the same port, enabling attackers to break out of isolation and execute arbitrary code on the host system. These flaws, discovered by Vyacheslav Kopeytsev, have been added to CISA's Known Exploited Vulnerabilities catalog, mandating action for federal agencies. → securityaffairs.com |
| 2026-08-21 2026 | Critical Microsoft Entra ID vulnerability exploited in the wild (CVE-2026-69836) news | Writeup of CVE-2026-69836, a critical remote code execution flaw in Microsoft Entra ID exploited in the wild. Discovered by Microsoft Principal Security Engineer Robert Fitzpatrick, this deserialization vulnerability carried a CVSS score of 10.0 and allowed unauthenticated attackers to execute code over a network. Microsoft has fully mitigated the vulnerability, requiring no customer action. The exploit's origin, timeline, impact, and attacker actions remain undisclosed. → helpnetsecurity.com |
| 2026-08-21 2026 | Microsoft Entra ID Flaw (CVSS 10.0) Exploited in Wild Allows Remote Code Execution news 2 min read | Vulnerability CVE-2026-69836 is a critical (CVSS 10.0) remote code execution flaw in Microsoft Entra ID, arising from deserialization of untrusted data. While initially reported as exploited in the wild, Microsoft later corrected this, stating it was not exploited. The issue, discovered by Robert Fitzpatrick, allowed unauthorized attackers to execute code over a network. Microsoft has since fully mitigated the vulnerability, requiring no customer action. → thehackernews.com |
| 2026-08-21 2026 | CISA Gives Agencies Three Days to Patch a Critical Flaw in Ray news 4 min read | Library for patching CVE-2025-62593, a critical remote code execution flaw in the Ray distributed computing framework. Versions prior to 2.52.0 are exploitable via DNS rebinding combined with a weak User-Agent header check, allowing attackers to execute arbitrary commands with Ray process privileges. This vulnerability was added to CISA's Known Exploited Vulnerabilities catalog, mandating a three-day patching deadline for federal agencies under Binding Operational Directive 26-04. → startupfortune.com |
| 2026-08-20 2026 | UAT-10147: Chinese-speaking adversary integrates agentic AI into post-compromise operations news 15 min read | Toolchain detailing how the Chinese-speaking UAT-10147 adversary integrates agentic AI into post-compromise operations. The group leverages publicly disclosed vulnerabilities for initial access and employs AI-driven tooling for reconnaissance, exploit automation, payload generation, validation, and persistence. Observed offensive frameworks include Metasploit, ysoserial, PentestGPT, and DeepAudit, with specific Linux privilege escalation exploits like CVE-2022-0995 and CVE-2021-3156 also noted. This approach allows for efficient scaling of complex attacks and reduces the expertise required for advanced post-compromise activities. → blog.talosintelligence.com |
| 2026-08-20 2026 | Critical flaw patched in popular JavaScript sandbox used in AI projects news 1 min read | Library for running JavaScript code safely within an isolated process. This popular resource, used in AI agent automation frameworks like n8n and Activepieces, recently patched a critical sandbox escape vulnerability. The flaw, a type confusion in the C++ glue code binding to V8's Isolate feature, could have allowed attackers to hijack host control flow and achieve remote code execution. Developers promptly addressed the issue in versions 7.0.1 and 6.2.0. → csoonline.com |
| 2026-08-20 2026 | Critical Flaw in isolated-vm Can Lead to Sandbox Escape RCE Threat news 5 min read | Library flaw in isolated-vm allows sandbox escape RCE. A time-of-check to time-of-use vulnerability in the ExternalCopy mechanism, tracked as GHSA-864f-rcv7-6rh4, enables malicious code within a Node.js sandbox to corrupt host process memory. This critical bug, affecting a library used by over a million projects weekly, can lead to host process hijacking and remote code execution. Developers should upgrade to isolated-vm versions 7.0.1 or 6.2.0. → devops.com |
| 2026-08-20 2026 | ThreatsDay: Gogs 10.0 RCE n8n Workflow-to-RCE $10M Reward GLM-5.3 AI Exploit and More news 11 min read | Library for identifying threats, including signed driver abuse via Microsoft Defender's BTR.sys, Iran-based Mabna Institute's $10 million reward for data theft, Grandoreiro malware's DLL sideloading campaign using Duplicate Files Finder, ClickFix campaigns leveraging DCRCVDrv.sys for BYOVD attacks, and guardrail-free AI services like Kriminal AI. → thehackernews.com |
| 2026-08-20 2026 | Critical Elementor Pro bug exposes WordPress sites to RCE attacks news 3 min read | Writeup of CVE-2026-32475, a critical RCE vulnerability in Elementor Pro versions prior to 4.2.2. The flaw arises from the File Upload module's differing handling of empty filename uploads between validation and processing loops, allowing attackers to craft multipart uploads containing malicious PHP payloads. Exploitation requires a published Elementor form with a File Upload field and the multiple file upload option enabled. Attackers can determine the uploaded payload's filename via timing brute-force or autoresponder emails and trigger its execution by requesting its URL, granting arbitrary code execution. Patchstack, who identified the vulnerability, recommends updating Elementor Pro and thoroughly checking the `wp-content/uploads/elementor/forms/` directory for rogue files. → bleepingcomputer.com |
| 2026-08-20 2026 | Isolated-vm Flaw Lets Sandboxed JavaScript Escape to Host for Potential RCE news 2 min read | Library flaw in isolated-vm, specifically a type confusion in ExternalCopy's handling of the transferList option, enables guest-to-host sandbox escapes. This vulnerability (GHSA-864f-rcv7-6rh4) affects versions prior to 7.0.0 and can lead to memory corruption, denial-of-service via segmentation faults, and potential remote code execution in the host process. The issue stems from flaws in the C++ binding layer, not V8's core isolation. → thehackernews.com |
| 2026-08-20 2026 | Attackers Exploit Zimbra SNMP Flaw for Unauthenticated Remote Code Execution news 1 min read | Writeup on CVE-2026-73570, an unauthenticated command injection flaw in Zimbra Collaboration (ZCS) affecting the zimbra-snmp package. Exploited in the wild, the vulnerability allows remote code execution as the Zimbra user via crafted SMTP requests. CERT Polska advises checking logs for suspicious service restarts and file creations in `/opt/zimbra/jetty/webapps/`, `/opt/zimbra/jetty_base/webapps/`, and `/tmp/`. This follows previous Zimbra targeting, including APT29's use of CVE-2025-66376 for XSS to deploy the ZimReaper payload. → thehackernews.com |
| 2026-08-20 2026 | Critical Zimbra RCE flaw now actively exploited in attacks news 2 min read | Writeup on CVE-2026-73570, a critical command injection vulnerability in Zimbra Collaboration Suite that allows unauthenticated attackers to execute arbitrary operating system commands. This flaw, patched in version 10.1.20, has been actively exploited in the wild. CERT Polska has observed malicious activity, including suspicious file creation and service restarts, and advises administrators to check logs for indicators of compromise. Past Zimbra vulnerabilities have been exploited by threat actors like Vivern, APT29, and APT28. → bleepingcomputer.com |
| 2026-08-20 2026 | Elementor Pro Flaw Could Let Unauthenticated Attackers Upload PHP and Execute Code news 3 min read | Writeup detailing CVE-2026-32475, a critical vulnerability in Elementor Pro versions prior to 4.2.2, enabling unauthenticated remote code execution. This unrestricted file upload flaw within the Forms module's File Upload field allows attackers to bypass extension checks by submitting dual file parts, resulting in a PHP file being written to a public directory. Exploitation requires a published Elementor page with a Form widget and a File Upload field, a common configuration across many WordPress sites. → thehackernews.com |
| 2026-08-20 2026 | I escaped the WebAssembly's sandbox and got arbitrary shell execution on the host. advanced 7 min read | Library enabling WebAssembly modules to be compiled into C via wasm2c. This library's table allocator contains an unchecked `calloc` that, when it returns `NULL` due to allocation failure (e.g., due to address space limits), allows a guest module to write to arbitrary host memory. This vulnerability, dating back to commit `ab9e0b55`, can be exploited to leak libc addresses, forge table entries, and ultimately achieve arbitrary shell execution via `system()`, demonstrated by a proof-of-concept on Linux. |
| 2026-08-20 2026 | Yet another RCE in Gogs, but it's fixed this time! news 15 min read | Library for identifying Remote Code Execution vulnerabilities, including CVE-2026-52813 and CVE-2026-52810, within the Gogs Git hosting platform. It details a path traversal flaw in organization name handling, allowing the creation of bare repositories in arbitrary locations, and explains how this can be leveraged with Git hooks for RCE. The library also addresses an XSS vulnerability in Gogs' Jupyter rendering library (GHSA-6vxv-wg6j-5qwp). → aikido.dev |
| 2026-08-19 2026 | Moroccos DGSSI Warns of Critical Apple Vulnerabilities news 1 min read | Advisory from Morocco's DGSSI warns of critical vulnerabilities in iOS, iPadOS, and macOS. Attackers could exploit these flaws to execute remote code, access confidential data, or elevate privileges. CVE-2026-3783 is noted as actively exploited. Vulnerabilities primarily affected WebKit, with others in ImageIO, audio processing, the kernel, and telephony on iOS, impacting versions prior to iOS/iPadOS 26.6.1 and 18.7.10, and macOS Tahoe 26.6.2. |
| 2026-08-19 2026 | CISA Urges Immediate Patching of Exploited Microsoft VMware Apple Vulnerabilities news 1 min read | Reference of CISA's urging for immediate patching of four actively exploited vulnerabilities affecting Microsoft, VMware, and Apple products. This includes CVE-2026-33824 (Windows IKE double free), CVE-2026-55040 (SharePoint weak authentication), CVE-2026-59310 (VMware vCenter code execution), and CVE-2026-65400 (macOS Screen Sharing authentication bypass). Exploitation of these flaws has been observed in autonomous hacking campaigns, manual targeting, and for deploying malware like Monero miners. → securityweek.com |
| 2026-08-19 2026 | Yet another RCE in Gogs but it's fixed this time! news 15 min read | Library for discovering and patching application vulnerabilities, detailing RCE via path traversal in Gogs (CVE-2026-52813). The library highlights a path traversal vulnerability in Gogs' organization creation endpoint, allowing attackers to write bare Git repositories to arbitrary filesystem locations. This technical deep dive, including manual code patching for an unpatched bypass, also addresses a logic bug (CVE-2026-52810) and an XSS vulnerability in a Jupyter rendering library (GHSA-6vxv-wg6j-5qwp). → aikido.dev |
| 2026-08-19 2026 | Critical RCE flaw in Windows IKE Extension now actively exploited news 2 min read | Vulnerability CVE-2026-33824, a critical remote code execution flaw in Windows IKE Extension, is actively exploited by attackers. This "double free" issue allows unauthenticated adversaries to achieve code execution by sending crafted packets via UDP ports 500 or 4500 to unpatched Windows systems. CISA has added this vulnerability to its actively exploited catalog and mandated urgent patching for federal agencies, recommending traffic blocking or firewall rule configuration for those unable to update immediately. → bleepingcomputer.com |
| 2026-08-19 2026 | Hacking your life with AI can get you hacked: How AI orchestration platforms ship RCE by design intermediate 7 min read AI | Writeup on critical vulnerabilities in AI orchestration platforms like NocoBase, Flowise, Langflow, Dify, Activepieces, Kestra, and Apache Airflow. These platforms, widely used for building AI agents and automating workflows, suffer from a fundamental security flaw: assuming any user interacting with a workflow can be trusted to run code on the host. The research uncovered numerous vulnerabilities including shell injection, prompt injection leading to RCE, and sandbox bypasses, with some exploitable by unauthenticated users. Vendors often viewed these findings as "working as designed," as code execution is central to their functionality, but the lack of robust defenses means inherent permissive threat models are passed to users, exposing sensitive data. → endorlabs.com |
| 2026-08-19 2026 | Oracle Products Multiple Vulnerabilities news | Analysis of multiple vulnerabilities affecting Oracle Products including Oracle Database, Oracle E-Business Suite, Oracle Java SE, Oracle MySQL, Oracle Virtualization, and Oracle WebLogic Server. These flaws can lead to remote code execution, elevation of privilege, denial of service, spoofing, security restriction bypass, data manipulation, sensitive information disclosure, and cross-site scripting. Users should consult Oracle's official website for available fixes and mitigation strategies. → hkcert.org |
| 2026-08-19 2026 | Mozilla Products Multiple Vulnerabilities news 1 min read | Writeup of multiple vulnerabilities in Mozilla Products including Firefox and Thunderbird. Exploitation could lead to remote code execution, security restriction bypass, information disclosure, denial of service, elevation of privilege, and spoofing. Affected versions include Firefox prior to 154, Firefox ESR prior to 153.1 and 140.14, and Thunderbird prior to 140.14, 153.1, and 154. Specific CVEs include CVE-2026-74934 through CVE-2026-75874. → hkcert.org |
| 2026-08-18 2026 | Palo Alto Products Multiple Vulnerabilities news 1 min read | Writeup detailing multiple vulnerabilities in Palo Alto Products, including Cloud NGFW, GlobalProtect App (versions 6.0, 6.2, 6.3), PAN-OS (versions 10.2, 11.1), and Prisma Access (version 10.2). Exploitation can lead to elevation of privilege, security restriction bypass, information disclosure, remote code execution, and data manipulation. Specific CVEs mentioned are CVE-2026-0301, CVE-2026-0297, CVE-2026-0296, CVE-2026-0299, CVE-2026-0298, and CVE-2026-0295. → hkcert.org |
| 2026-08-18 2026 | 300000 WordPress Sites Potentially Exposed to Hacking Due to Form Plugin Flaw news 1 min read | Writeup of CVE-2026-15748 in Forminator Forms, a critical arbitrary file upload vulnerability impacting over 300,000 WordPress sites. This flaw, with a CVSS score of 9.8, allows unauthenticated attackers to achieve remote code execution by bypassing file type validation in the `handle_file_upload` function and leveraging custom file upload storage configurations. The vulnerability affects versions up to 1.56.1 and was patched in 1.56.2. → securityweek.com |
| 2026-08-18 2026 | CISA gives feds 3 days to fix actively exploited Ray RCE bug news | CISA has issued a directive demanding federal agencies patch a critical Remote Code Execution (RCE) vulnerability in Ray within three days. The bug is currently being exploited in the wild, posing a significant security risk. Agencies must identify affected systems and apply necessary updates to mitigate the threat. This urgent action highlights the severity of the vulnerability and CISA's commitment to protecting federal networks from active exploitation. → theregister.com |
| 2026-08-18 2026 | U.S. CISA adds a Ray-Project Ray flaw to its Known Exploited Vulnerabilities catalog news 1 min read | Writeup of CVE-2025-62593, a critical remote code execution vulnerability in Progress LoadMaster's Ray AI compute engine. CISA added this flaw to its Known Exploited Vulnerabilities catalog due to its exploitable nature via DNS rebinding attacks, allowing attackers to execute arbitrary code on developer machines. The vulnerability, present in versions before 2.52.0, stems from insufficient protection against browser-based attacks relying on the User-Agent header. Ray 2.52.0 addresses this issue. → securityaffairs.com |
| 2026-08-18 2026 | CISA Flags Actively Exploited Ray Flaw That Can Trigger Browser-Based RCE news 2 min read | Writeup on CVE-2025-62593, an actively exploited Ray vulnerability, detailing how DNS rebinding attacks on browsers like Firefox and Safari can lead to remote code execution, particularly impacting developers. This flaw, stemming from a lack of authentication on critical endpoints, allows attackers to execute arbitrary shell code by tricking users into visiting malicious websites or viewing ads. Unpatched Ray instances are also targeted by the RondoDox botnet and for cryptocurrency mining in the ShadowRay 2.0 campaign. The vulnerability has been addressed in Ray version 2.52.0. → thehackernews.com |
| 2026-08-18 2026 | Unauthenticated RCE in CircleCI's MCP server: Host/Origin allowlist bypassed by any non-browser client (GHSA-xv5j-cwgj-22r4) news 4 min read AuthZ | Writeup on GHSA-xv5j-cwgj-22r4 detailing an unauthenticated RCE vulnerability in CircleCI's MCP server. Attackers can bypass Host/Origin header validation by sending a simple HTTP request with "Host: localhost" and no Origin header, gaining full control over CI/CD pipelines, build secrets, and cloud identities. The writeup highlights the inherent security risks in the MCP ecosystem and praises CircleCI's swift and professional handling of the disclosure. |
| 2026-08-17 2026 | Video Call Exploit Chains Two Flaws in Unisoc Modems news | A security vulnerability has been discovered in Unisoc modems that can be exploited during video calls. This exploit chains together two separate flaws, allowing an attacker to potentially gain unauthorized access or control. The specific details of how the exploit works are not provided, but it highlights a security risk within the modem's video calling functionality. Further information and the full technical analysis are available at the provided link. → darkreading.com |
| 2026-08-17 2026 | Forminator WordPress Flaw Can Enable Unauthenticated RCE via Malicious PHP Uploads news 3 min read | Library for securing WordPress sites against critical vulnerabilities including CVE-2026-15748 in Forminator Forms, which allows unauthenticated arbitrary PHP file uploads via crafted forms with File Upload and Select fields, and CVE-2026-15826 in User Profile Builder, enabling unauthenticated administrator takeover through a flawed login function and username validation bypass. → thehackernews.com |
| 2026-08-17 2026 | UNISOC Modem Flaw Enables Remote Code Execution via Video Calls news 2 min read | Analysis of UNISOC modem vulnerability, CWE-1189 (Improper Isolation of Shared Resources), demonstrates how a flaw in modem firmware can lead to kernel-level remote code execution. This research, by SSD Secure Disclosure, details an exploit chain where modem code execution bypasses memory protection units and accesses Android kernel memory. The vulnerability was exploited by placing a video call over VoLTE on affected devices like the Xiaomi Redmi A5 and Motorola E13, enabling modification of kernel code. → infosecurity-magazine.com |
| 2026-08-17 2026 | Unisoc VoLTE Video Call Exploit Chain Can Give Attackers Full Android Kernel Access news 3 min read | Writeup of a two-stage exploit chain for Unisoc modem firmware, enabling full Android kernel access via a VoLTE video call. This chain, building on a previous March 2026 RCE vulnerability, requires attacker control of a private 4G network and the victim answering the call. The privilege-escalation flaw, CWE-1189, exploits shared physical memory between the modem and application processors to modify kernel memory, confirmed on devices like Motorola E13 and Xiaomi Redmi A5. No fix has been released by Unisoc, and it is distinct from CVE-2025-31718. → thehackernews.com |
| 2026-08-17 2026 | Evooo1Bot Linux Botnet Exploits Known Flaws to Turn Edge Devices Into SOCKS5 Proxies news 2 min read | Library for detecting and understanding the Evooo1Bot Linux botnet, which leverages the Mirai source code to turn edge devices into SOCKS proxies. Evooo1Bot features encrypted C2 communications, an SSH brute-force scanner, and an exploit arsenal targeting numerous known vulnerabilities, including CVE-2007-3010, CVE-2016-6277, CVE-2018-14558, CVE-2019-14931, CVE-2020-10987, CVE-2021-46422, CVE-2022-37055, CVE-2024-29269, CVE-2025-10123, CVE-2025-55583, CVE-2021-36260, CVE-2022-26134, CVE-2022-29464, CVE-2022-30525, CVE-2023-1389, CVE-2024-4577, CVE-2024-10914, CVE-2025-1974. → thehackernews.com |
| 2026-08-17 2026 | CVE-2026-6837: Command Injection in Zyxel export-cgi PKCS#12 Export Handling news 4 min read | Writeup of CVE-2026-6837, a command injection vulnerability in Zyxel's export-cgi script, specifically within the PKCS#12 export handling. The vulnerability arises from unsanitized input being passed to a `system()` call, allowing attackers to execute arbitrary commands. The exploit chain was developed using emulation with tools like QEMU and Bubblewrap, and demonstrated via crafted `curl` requests. Zyxel has released an advisory listing 18 affected AP models. |
| 2026-08-17 2026 | AMA with Black Hat Speakers Lidor B. & Elad Meged (Pre-Auth RCE in Enterprise Java, Hijacking AI Coding Agents) news 5 min read AI Talks | AMA with Black Hat speakers Lidor B. and Elad Meged, covering pre-auth remote code execution in enterprise Java via routing logic, unsafe deserialization, and template evaluation. The discussion also delves into hijacking AI coding agents like Claude Code, Gemini CLI, and Codex by exploiting a single GitHub issue, leading to RCE and credential theft. The speakers will share insights into the future of offensive security with AI and their experiences in vulnerability research. |
| 2026-08-17 2026 | CVE-2026-33696: From a Schema Name to RCE in n8n news 3 min read | Writeup detailing CVE-2026-33696, a prototype pollution vulnerability in n8n's GSuiteAdmin node. This flaw allows an attacker with editor access to craft a malicious payload that pollutes `Object.prototype` with properties like `GIT_SSH_COMMAND`. This pollution can then be exploited via the Git node's clone operation to achieve remote code execution as the n8n process user, or cause a denial of service by crashing TypeORM. |
| 2026-08-17 2026 | When Filenames Become Attack Surfaces: Weaponizing NASA's CFITSIO Extended Filename Syntax advanced 12 min read Fuzzing | Library for weaponizing NASA's CFITSIO Extended Filename Syntax (EFS), allowing arbitrary file copies, forced downloads, and Server-Side Request Forgery (SSRF) by leveraging EFS features like the outfile clause and protocol handlers for HTTP, FTP, and other network protocols. The library also enables HTTP header injection by exploiting unescaped filename components in the HTTP driver. A Docker playground is available for reproducing these findings. → blog.doyensec.com |
| 2026-08-16 2026 | macOS Screen Sharing Vulnerability Exploited for Crypto Mining intermediate 4 min read | Library for securing macOS Screen Sharing by addressing CVE-2026-65400, a vulnerability allowing unauthenticated remote code execution. This flaw, exploitable when port 5900 is internet-facing, grants attackers root access to install Monero crypto miners. Apple has released patches for macOS Tahoe, Sequoia, and Sonoma. Users are advised to disable Screen Sharing when not in use and ensure systems are updated. |
| 2026-08-15 2026 | I went looking for a managed-Postgres provider. Instead, I found a vulnerability in a 4-star PostgreSQL extension available everywhere! and turned it into code execution at NeonDB, Supabase, Xata and many other PostgreSQL service companies advanced 29 min read Supply Chain | Library for discovering and exploiting vulnerabilities in managed PostgreSQL instances. It details a memory corruption bug in the popular PostGIS extension's `address_standardizer` function, chaining it with a separate memory disclosure to achieve RCE on providers like NeonDB, Supabase, and Xata. The research also encompasses broader systemic risks within the managed PostgreSQL industry, including further extension vulnerabilities and core PostgreSQL RCEs. |
| 2026-08-15 2026 | You’re Back In The Room (Citrix NetScaler Pre-Auth RCE CVE-2026-8452(?)) - watchTowr Labs news 18 min read | Writeup of a heap overflow vulnerability in Citrix NetScaler, potentially CVE-2026-8452, that allows unauthenticated remote code execution. The vulnerability arises during SAML signature validation when the NetScaler appliance copies attacker-controlled data from the `ds:SignedInfo` element into a fixed-size buffer without proper size checks, leading to memory corruption within the packet-processing engine. → labs.watchtowr.com |
| 2026-08-15 2026 | Escalating a Blind Upload to RCE via Path Traversal into Cron and DNS-Restricted Callback Bypass advanced AuthZ | A researcher discovered an unauthenticated blind file upload vulnerability on a bug bounty target. The vulnerability allowed controlling both the uploaded file content and its destination directory, enabling path traversal to sensitive server locations. While this initially seemed like a path to Remote Code Execution (RCE), the typical exploitation methods were blocked. The content ends before detailing how RCE was ultimately achieved or if any bounty was awarded. → infosecwriteups.com |
| 2026-08-14 2026 | Youre Back In The Room (Citrix NetScaler Pre-Auth RCE CVE-2026-8452(?)) news 18 min read | Library for analyzing the CVE-2026-8452 vulnerability in Citrix NetScaler ADC and Gateway, a heap overflow that allows unauthenticated remote code execution. This vulnerability occurs when the appliance is configured to use SAML, and an oversized `ds:SignedInfo` element in a SAML message causes a buffer overflow during signature canonicalization. The analysis details the `nsppe` binary, SAML structure, and the canonicalization process leading to the memory corruption. → labs.watchtowr.com |