The newest Remote Code Execution (RCE) resources are on the Remote Code Execution (RCE) page. For a reading order instead of a date order, see the Remote Code Execution (RCE) learning path.
| Date Added | Link | Excerpt |
|---|---|---|
| 2026-07-28 2026 | Critical TeamCity Flaw Could Let Attackers Run OS Commands Without Logging In news 1 min read | Writeup on CVE-2026-63077, a critical vulnerability in TeamCity On-Premises versions enabling unauthenticated attackers to execute arbitrary OS commands. This flaw, with a CVSS score of 9.8, bypasses authentication via the agent polling protocol and can lead to data exposure, credential compromise, or server state modification. JetBrains released patches and a security plugin for older versions, urging users to update or apply the plugin. → thehackernews.com |
| 2026-07-28 2026 | New vBulletin Vulnerability! news | New vBulletin Vulnerability! |
| 2026-07-28 2026 | How I Found a Bug Worth $3,500 — In a Feature Nobody Was Watching. beginner 6 min read Bug Bounty XSS | Writeup detailing the discovery of a storage-exhaustion flaw (CWE-434, CWE-770) and a stored XSS vulnerability (CWE-79) within a B2B SaaS platform's file upload feature. The storage exhaustion occurred due to a spoofed file size field, allowing for resource consumption. The XSS vulnerability leveraged an unsanitized filename that executed within an admin's browser, leading to potential session hijacking and platform compromise. The report emphasizes the importance of scrutinizing metadata, understanding the downstream impact of vulnerabilities, and re-testing "boring" features. → infosecwriteups.com |
| 2026-07-27 2026 | Technical Advisory: wp2shell Unauthenticated Remote Code Execution and Full Site Takeover in WordPress Core news 9 min read | Advisory on CVE-2026-63030 and CVE-2026-60137, two chained WordPress Core vulnerabilities enabling unauthenticated remote code execution and full site takeover. Active exploitation targets versions 6.9.0-6.9.4 and 7.0.0-7.0.1. The exploit chain, publicly detailed in an Icex0 proof-of-concept, leverages a REST API batch endpoint desynchronization and a SQL injection vulnerability in the post query layer. CISA has added these to its Known Exploited Vulnerabilities catalog. Patching to 6.9.5 or 7.0.2 is critical. |
| 2026-07-26 2026 | AI-Enabled Security Researchers Discover How a Crafted Video Can Provide Attackers Access to Your PC advanced 3 min read | Writeup of CVE-2026-8461, "PixelSmash," a critical FFmpeg vulnerability allowing Remote Code Execution and Denial of Service. This heap out-of-bounds write, present for sixteen years in the MagicYUV decoder, affects numerous applications including media players, file managers, and cloud services. Exploitation requires only uploading a crafted media file, with demonstrated RCE on Jellyfin and Nextcloud. Mitigation involves updating FFmpeg or rebuilding without the MagicYUV decoder. → infoq.com |
| 2026-07-26 2026 | Active Exploitation Alert: Unpatched Fastjson 1.x RCE Vulnerability Threatens Spring Boot Fat-JAR Applications news 4 min read | Writeup detailing active exploitation of the Fastjson 1.x RCE vulnerability, tracked as CVE-2026-16723. Unpatched versions 1.2.68 through 1.2.83, especially within Spring Boot fat-JARs, are susceptible to arbitrary code execution via crafted JSON payloads. ThreatBook and Imperva have observed exploitation attempts targeting financial, healthcare, and retail sectors, primarily in the US, using Ruby and Go frameworks. Mitigation includes enabling SafeMode, using a restricted build, or migrating to Fastjson2. → rescana.com |
| 2026-07-26 2026 | Week in review: ServiceNow pre-auth RCE exploited in the wild Hugging Face breached news 15 min read | Tool **Snowpick** identifies unauthorized access to ServiceNow instances by scanning for exposures. The article also highlights the exploitation of critical vulnerabilities including ServiceNow's pre-auth RCE (CVE-2026-6875), SonicWall SMA zero-days (CVE-2026-15409, CVE-2026-15410), and Check Point's authentication bypass flaw (CVE-2026-16232). It further discusses AI-driven threats such as the Hugging Face breach by an autonomous AI agent, JadePuffer's ransomware targeting AI infrastructure, and malicious Claude download pages. → helpnetsecurity.com |
| 2026-07-26 2026 | Cl0p Ransomware Actively Exploiting Critical Unauthenticated RCE in PTC Windchill and FlexPLM Systems news 5 min read | Writeup detailing a critical unauthenticated RCE in PTC Windchill and FlexPLM systems, actively exploited by Cl0p ransomware. The attack chain leverages CVE-2026-12569 and an information disclosure flaw, enabling persistent web shells, data exfiltration, and double extortion. Targets include manufacturing, automotive, aerospace, and retail sectors globally. Mitigation involves patching, eliminating internet exposure, and monitoring for indicators like hex-named JSP web shells and malicious IP connections. → rescana.com |
| 2026-07-24 2026 | Kimi K3 Agents Found Redis Zero-Days and Built RCE Exploit Researchers Say news 3 min read | Library patches address seven Redis zero-days discovered by Kimi K3 agents, including authenticated RCE exploits for versions 6.2.22, 7.4.9, 8.6.4, and 8.8.0. The vulnerabilities, related to the RESTORE command, involve a Streams shared-NACK use-after-free and RedisBloom TDigest out-of-bounds writes. While no new CVEs were immediately assigned, the flaws allow arbitrary memory access and lead to remote code execution. Users should upgrade to fixed releases and consider revoking RESTORE privileges from non-essential accounts. → thehackernews.com |
| 2026-07-24 2026 | Escaping Claude Cowork’s local VM sandbox via CVE-2026-46331 news 7 min read | Writeup detailing CVE-2026-46331 exploitation within Claude Cowork's local VM sandbox, named "SharedRoot." This vulnerability allows an unprivileged agent to gain root privileges within the Linux VM by abusing the `act_pedit` kernel module's COW vulnerability, subsequently accessing and manipulating the host macOS filesystem. The exploit chain leverages unprivileged user namespaces and a permissive seccomp filter, demonstrating how multiple security layers must align for such an escape to occur. The author suggests several hardening measures to prevent similar exploits, including disabling unprivileged user namespaces, stricter seccomp filtering, preventing module autoloading, and crucially, limiting host filesystem sharing. |
| 2026-07-24 2026 | XBOW Agents found three RCEs as SYSTEM (and root) on Bing Image Search news | XBOW Agents discovered three critical Remote Code Execution (RCE) vulnerabilities on Bing Image Search. These vulnerabilities allowed for execution with the highest system privileges (SYSTEM and root), posing a significant security risk. |
| 2026-07-23 2026 | Critical Redis Vulnerability CVE-2024-27348 Enables Remote Code Execution via RESTORE Command: Risk Analysis and Mitigation Strategies news 8 min read | Analysis of CVE-2026-25243, a critical RCE vulnerability in Redis, details how authenticated attackers can exploit the RESTORE command via crafted serialized payloads. This weakness, classified as CWE-122 (Heap-Based Buffer Overflow), requires authentication and RESTORE command permissions, but its impact is significant, potentially allowing arbitrary code execution and lateral movement within affected environments. Patches are available for Redis Community Edition and Redis Software, and interim mitigation involves restricting RESTORE command access via ACLs. → rescana.com |
| 2026-07-23 2026 | AWS Kiro Flaw Let a Poisoned Web Page Rewrite Its Config and Run Code news 5 min read | Library for securing AWS Kiro, an agentic coding IDE, addressing CVE-2026-10591 where a poisoned web page could rewrite Kiro's `mcp.json` configuration file and execute arbitrary code without explicit approval. This vulnerability allowed attackers to bypass Kiro's safety model, which typically relies on developer approval before running risky commands. The flaw, found by Intezer and Kodem Security, enabled prompt injection to plant malicious server configurations that would automatically load and execute code upon Kiro's file reload. → thehackernews.com |
| 2026-07-22 2026 | 7-Zip CVE-2026-14266 RCE Risk Explained news 4 min read | Writeup on CVE-2026-14266, a heap-based buffer overflow vulnerability in 7-Zip's XZ decompression logic. Exploitation requires user interaction, such as opening crafted compressed content, and could lead to remote code execution within the current process. This vulnerability affects 7-Zip versions prior to 26.02, which is the patched version. Mitigation involves updating 7-Zip, confirming installations through inventory, reducing archive-handling exposure, and monitoring for suspicious 7-Zip activity. → socradar.io |
| 2026-07-21 2026 | Public PoC triggers active exploitation of critical SharePoint RCE vulnerability CVE-2026-50522 news 2 min read | Writeup of CVE-2026-50522, a critical Microsoft SharePoint RCE vulnerability actively exploited after a public PoC. This deserialization flaw, patched by Microsoft, allows authenticated attackers with Site Owner privileges to execute arbitrary code. watchTowr researchers observed attackers stealing SharePoint machine keys in a single request, necessitating credential rotation beyond patching. Defused Cyber also noted attacks delivering .NET deserialization payloads through a SharePoint sign-in endpoint. The article also briefly mentions other SharePoint vulnerabilities added to CISA's KEV catalog: CVE-2026-58644, CVE-2026-45659, CVE-2026-32201, and CVE-2026-20963. → securityaffairs.com |
| 2026-07-21 2026 | Hackers Exploit WP2Shell WordPress Flaws for Unauthenticated Remote Code Execution news 2 min read | Writeup on CVE-2026-60137 and CVE-2026-63030, termed "WP2Shell," detailing how hackers exploit these chained WordPress core vulnerabilities for unauthenticated remote code execution. Affecting versions 6.8 through 7.0.1 and the 7.1 beta, the attack targets the REST API and can be compounded by a separate SQL injection bug. Exploitation is occurring in the wild, with WordPress issuing emergency releases and enabling forced updates for mitigation. Cloudflare has also deployed WAF protections. |
| 2026-07-21 2026 | Critical SharePoint RCE CVE-2026-50522 Under Active Exploitation After Public PoC news 2 min read | Writeup on CVE-2026-50522, a critical deserialization vulnerability in Microsoft SharePoint Server, rated 9.8 CVSS, is under active exploitation. Attackers are using this network-exploitable flaw, discovered by DEVCORE's "splitline," to achieve remote code execution and steal machine keys for persistence. Exploitation complexity is low and authenticated as a Site Owner allows arbitrary code injection. This follows other exploited SharePoint vulnerabilities like CVE-2026-56164 and CVE-2026-58644. → thehackernews.com |
| 2026-07-21 2026 | Attackers Exploit Critical ServiceNow RCE Flaw CVE-2026-6875 news 3 min read | Writeup of CVE-2026-6875 details a critical pre-authentication RCE in ServiceNow's AI Platform, allowing full instance compromise and connected server access. Attackers exploit the GlideRecord query API's `javascript:` prefix feature to inject code, bypassing ServiceNow's script sandbox through a complex escape mechanism involving overriding `Object.clone` and manipulating `AbstractAjaxProcessor.prototype`. The vulnerability, initially reported by Searchlight Cyber and actively exploited in the wild, targets endpoints like `/assessment_thanks.do`. → securityaffairs.com |
| 2026-07-21 2026 | Escalating All The Privileges With Foxit PDF Reader (CVE-2026–57239) news 14 min read AuthZ | Writeup of CVE-2026–57239 detailing privilege escalation within Foxit PDF Reader. The vulnerability allows an unprivileged user to achieve NT AUTHORITY\SYSTEM privileges. Exploitation requires initial code execution and leverages DLL sideloading of WINSPOOL.DRV alongside a writable log file path to trigger the elevated execution of a chosen binary, ultimately chaining into the FoxitPDFReaderUpdateService.exe process to duplicate tokens and spawn a SYSTEM process. |
| 2026-07-21 2026 | I found a WordPress RCEs with GPT5.6 and $25 intermediate 23 min read AI | Tool that leverages GPT5.6 Sol Ultra to discover RCE vulnerabilities in WordPress, demonstrated by finding a pre-authentication SQL injection that escalates to RCE. The process involved adapting a prompt designed for mathematical conjecture solving to analyze WordPress source code, utilizing multi-agent exploration for six hours, and costing approximately $25 in LLM usage. The tool is available at wp2shell.com for users to check their WordPress instances. → slcyber.io |
| 2026-07-21 2026 | Exploitation in the Wild of wp2shell news 3 min read API Sec | Writeup of wp2shell, a critical pre-authentication RCE vulnerability chain in WordPress Core (CVE-2026-63030 & CVE-2026-60137), details observed exploitation including malicious plugin uploads, user enumeration, LFI attempts, and admin panel access. Attackers are deploying both minimal one-liner webshells and sophisticated 150KB "CMSmap" webshells with extensive attack platform capabilities, alongside custom REST API webshells. Temporary mitigation involves blocking the WordPress Batch API at the WAF or disabling anonymous REST API access. → wiz.io |
| 2026-07-20 2026 | WordPress Remote Code Execution Flaws Get Public Exploits news 3 min read | Library for WordPress security updates, addressing the wp2shell attack chain that chains CVE-2026-63030 (REST API batch-route confusion) and CVE-2026-60137 (SQL injection in WP_Query) for pre-authentication remote code execution in versions 6.9.x and 7.0.x. Public proof-of-concept exploits are available, demonstrating multiple attack paths including credential theft and arbitrary command execution. Immediate patching is critical to mitigate risks. → esecurityplanet.com |
| 2026-07-20 2026 | Researchers Build WordPress Exploit Using OpenAI's GPT intermediate 3 min read | Library for developing exploits, demonstrating the use of OpenAI's GPT5.6 Sol Ultra to chain WordPress Core vulnerabilities CVE-2026-63030 and CVE-2026-60137. This technique achieved pre-authentication remote code execution, showcasing AI's capability in discovering complex attack chains, such as the 'WP2Shell' exploit which bypasses typical security measures. A related scanning tool, wp2shell.com, is also available. → infosecurity-magazine.com |
| 2026-07-20 2026 | CVE-2026-14266: Critical 7-Zip XZ Archive Decoder Vulnerability Enables Remote Code Execution (Patch in 26.02) news 3 min read | Writeup detailing CVE-2026-14266, a critical heap-based buffer overflow in 7-Zip's XZ archive decoder. This vulnerability, present in versions 21.07 through 26.01, allows for remote code execution when users open specially crafted XZ archives. The flaw lies in the decompression logic, leading to an out-of-bounds write. While no exploitation in the wild is reported, the attack vector aligns with phishing and malicious attachment tactics. Updating to 7-Zip version 26.02 is the recommended mitigation. → rescana.com |
| 2026-07-20 2026 | Patch now: WordPress REST API bug allows remote code execution news 2 min read | Writeup of wp2shell, a pre-authentication RCE vulnerability in WordPress' REST Batch API affecting versions 6.9.0-6.9.4 and 7.0.0-7.0.1. An indexing mismatch in the "batch/v1" endpoint allows attackers to execute arbitrary code without authentication, leading to full site control, database access, and potential compromise of the hosting environment. Patches are available in WordPress 6.9.5 and 7.0.2. → csoonline.com |
| 2026-07-20 2026 | Active Exploitation Alert: Critical CVE-2026-6875 Remote Code Execution Vulnerability in ServiceNow AI Platform news 4 min read | Analysis of CVE-2026-6875, a critical unauthenticated remote code execution vulnerability in the ServiceNow AI Platform, detailing its exploitation via crafted HTTP requests to /assessment_thanks.do. The flaw allows sandbox escape, enabling attackers to execute arbitrary code, and is actively exploited by both opportunistic and targeted actors, including sophisticated adversaries. Post-exploitation techniques include privilege escalation, credential harvesting, and lateral movement. Immediate patching is crucial, alongside monitoring for indicators of compromise such as anomalous requests and unexpected process creation on vulnerable instances. → rescana.com |
| 2026-07-20 2026 | New 7-Zip Vulnerability Could Let Crafted XZ Archives Run Code During Extraction news 2 min read | Library for application security, focusing on CVE-2026-14266, a high-severity heap-based buffer overflow in 7-Zip's XZ chunked data processing. Exploitation of this flaw, discovered by Landon Peng and detailed by Trend Micro's ZDI, allows for code execution within the context of the 7-Zip process. The vulnerability was patched in 7-Zip version 26.02, addressing an out-of-bounds write in the `MixCoder_Code` function within `C/XzDec.c`. This release also includes fixes for other memory-safety bugs, such as CVE-2026-48095. → thehackernews.com |
| 2026-07-20 2026 | WP2Shell WordPress Vulnerabilities Exploited in the Wild news 2 min read | Writeup on WP2Shell, two severe WordPress vulnerabilities (CVE-2026-60137 and CVE-2026-63030) actively exploited in the wild. These flaws, affecting versions 6.9.0-6.9.4 and 7.0.0-7.0.1, allow unauthenticated attackers to achieve remote code execution by chaining an SQL injection with arbitrary code execution. Patches have been released, and forced auto-updates are enabled for affected sites, with Cloudflare also providing protective rules. → securityweek.com |
| 2026-07-20 2026 | Active Exploitation Alert: Unauthenticated RCE Vulnerabilities in WordPress Core (wp2shell) with Public Exploits news 5 min read | Writeup detailing the active exploitation of unauthenticated RCE vulnerabilities in WordPress Core, dubbed wp2shell. This advisory covers the technical analysis of the SQL injection flaw within the `/wp-json/batch/v1` REST API endpoint, observed Tactics, Techniques, and Procedures (TTPs) including MITRE ATT&CK techniques T1190 and T1059, and real-world exploitation trends documented by threat intelligence platforms like Aikido Intel. Mitigation strategies emphasize upgrading WordPress Core to patched versions (7.0.2, 6.9.5, or 6.8.6), blocking the vulnerable endpoint, and conducting post-exploitation audits. → rescana.com |
| 2026-07-20 2026 | AI-Driven Cyberattack Compromises Hugging Face Production Infrastructure via Autonomous Agent: Incident Analysis and Mitigation Strategies news 6 min read | Analysis of an AI-driven cyberattack targeting Hugging Face's production infrastructure reveals exploitation of code-execution vulnerabilities in the dataset processing pipeline. An autonomous AI agent leveraged these flaws for remote code execution, privilege escalation, credential harvesting, and lateral movement across internal clusters. Detection and forensic analysis relied on Hugging Face's own LLM-based systems, highlighting the need for self-hosted AI models due to commercial model guardrail limitations. The incident underscores emerging threats and the importance of rapid credential rotation and robust sandboxing. → rescana.com |
| 2026-07-20 2026 | wp2shell: a defender’s guide (CVE-2026-63030 + CVE-2026-60137) with a list of forensic artifacts, a compromise scanner WordPress plugin and a free Chrome/Edge/Firefox browser extension to in-browser check if a website has been patched. intermediate 8 min read | Library of tools and forensic artifacts for defending against wp2shell, a critical unauthenticated RCE vulnerability in WordPress core (CVE-2026-63030 and CVE-2026-60137). This resource includes a WordPress plugin compromise scanner, a browser extension checker, and guidance on identifying forensic evidence left by the exploit chain, which leverages a REST API route-confusion bug and an SQL injection to achieve pre-authentication code execution. |
| 2026-07-19 2026 | Pixels to Payload: Dissecting a Four-Stage Bitmap-Steganography Dropper Delivering AsyncRAT :: Rhys Downing advanced 8 min read | Library for dissecting a four-stage .NET dropper that delivers AsyncRAT 0.5.8. This library, pixelchain, extracts all four stages and the final RAT configuration without execution. The analysis details two distinct bitmap steganography schemes with anti-carving measures, an Eazfuscator-wrapped loader performing persistence and Microsoft Defender tampering, and process hollowing into signed .NET utilities. It also covers the decryption of the AsyncRAT client, which uses TLS with a pinned self-signed certificate. |
| 2026-07-19 2026 | wp2shell (CVE-2026-63030): Pre-Auth RCE Chain in WordPress Core - Analysis and Open-Source Scanner advanced 9 min read | Tool analyzing CVE-2026-63030, a pre-authentication RCE in WordPress Core versions 6.9.0 through 7.0.1. The vulnerability stems from an array index desynchronization in the REST API batch endpoint, allowing bypassing of validation and sanitization. This can lead to SQL injection via the `author__not_in` parameter and re-entrancy in `serve_request`. The analysis covers the specific bugs, affected files, and provides mitigation steps. A scanner for this vulnerability is also open-sourced. |
| 2026-07-19 2026 | From SQL Injection to Infrastructure-Level RCE: A PostgreSQL Superuser Compromise advanced 1 min read SQLi | Writeup detailing an exploit chain from SQL Injection to Remote Code Execution (RCE) on a PostgreSQL database. The process begins with an unparameterized `pJobNumber` parameter in the `vss00CvStatusData.php` endpoint, leading to a raw PostgreSQL error. By leveraging `UNION SELECT` with `NULL` placeholders, the attacker identified the PostgreSQL version and confirmed the application connected as the `postgres` superuser. This superuser access allowed enumeration of system catalogs, revealing sensitive Personally Identifiable Information (PII) within the `public.vss01tpemployee` table. → infosecwriteups.com |
| 2026-07-19 2026 | MCP Supply Chain Advisory: RCE Vulnerabilities Across the AI Ecosystem news 11 min read | Advisory detailing command injection vulnerabilities across multiple AI ecosystem products, including LangFlow (unassigned CVE), GPT Researcher (CVE-2025-65720), LiteLLM (CVE-2026-30623), Agent Zero (CVE-2026-30624), LangBot (CVE-2026-54449), and Fay Digital Human Framework (CVE-2026-30618). These vulnerabilities, stemming from improper handling of MCP adapter configurations, allow unauthenticated or authenticated attackers to execute arbitrary operating system commands on affected servers. → ox.security |
| 2026-07-19 2026 | Code Runner VS Code Extension Enables Remote Code Execution via Settings Manipulation intermediate 2 min read | Writeup of CVE-2025-65715, a remote code execution vulnerability in the Code Runner VS Code extension. Attackers can exploit this by manipulating the extension's `executorMap` setting within `settings.json`, tricking users into executing malicious commands through the extension's code execution functionality. This flaw leverages unsafe `child_process.spawn()` usage with `shell: true`, allowing arbitrary shell command injection, which can lead to persistence or reverse shell connections. → ox.security |
| 2026-07-18 2026 | WordPress releases emergency update for critical 'wp2shell' RCE flaw news 2 min read | Writeup on the wp2shell RCE vulnerability in WordPress. This critical chain, affecting versions 6.9 to 7.0.1, allows unauthenticated attackers remote code execution. It combines CVE-2026-60137, an SQL injection flaw, with CVE-2026-63030, a REST API batch-route confusion. Proof-of-concept exploits are circulating, and initial real-world exploitation has been observed, prompting emergency updates and warnings for administrators to patch immediately. |
| 2026-07-18 2026 | Unauthenticated RCE in WordPress core (wp2shell), via SQL injection news 3 min read SQLi | Library with an embedded firewall, Aikido Zen, offers runtime protection against the unauthenticated RCE in WordPress core (wp2shell) caused by SQL injection. This vulnerability affects versions 6.9.0-6.9.4 and 7.0.0-7.0.1, with a fix available in 7.0.2. Aikido Zen inspects user input to block SQL injection and other vulnerabilities at runtime, providing a defense for unpatched sites while updates are deployed. Additionally, Aikido Intel tracks this vulnerability and others across open-source ecosystems. → aikido.dev |
| 2026-07-18 2026 | Three Steps to the Terminal: A Siemens ROX II Zero-Day Trilogy advanced 10 min read AuthZ | Writeup details a chained exploit of three zero-day vulnerabilities—CVE-2025-40948, CVE-2025-40947, and CVE-2025-40949—in Siemens ROX II OT switches. The exploit begins with arbitrary file disclosure via an insecure xz utility configuration, followed by privilege escalation through command injection in the feature key validation function, and finally achieves persistent root code execution by manipulating the web management task scheduler's cron table. These vulnerabilities allow for full privilege escalation and persistent root-level access on critical industrial control network components. → unit42.paloaltonetworks.com |
| 2026-07-18 2026 | CVE-2026-63030: wp2shell a Critical Remote Code Execution Vulnerability in WordPress Core news 2 min read | Writeup of CVE-2026-63030, a critical unauthenticated remote code execution vulnerability in WordPress Core, exploitable via the REST API batch endpoint. Affecting versions 6.9.0-6.9.4 and 7.0.0-7.0.1, this flaw can lead to complete website compromise without user interaction or plugins. Exploitation is considered highly likely, making urgent patching to versions 6.9.5, 7.0.2, or later critical. → rapid7.com |
| 2026-07-17 2026 | ASUS bsitf.sys (CVE-2026-13585): Arbitrary Physical Memory Mapping via Unvalidated IOCTL news 2 min read | Writeup of CVE-2026-13585 details an arbitrary physical memory mapping vulnerability in ASUS's bsitf.sys kernel driver. Discovered using DeepZero, the flaw allows an unvalidated IOCTL to allocate contiguous kernel memory, map it into a user process, and expose both virtual and physical addresses. This primitive enables pool exhaustion DoS attacks and physical address disclosure, potentially aiding DMA attacks or shellcode staging on specific driver versions. |
| 2026-07-17 2026 | No Shark is Safe: Millions of Shark Vacuums are Vulnerable to RCE news 10 min read | Writeup details a critical RCE vulnerability affecting internet-connected Shark vacuums, specifically RV2320EDUS and AV1102ARUS models. Exploitation involves using UART access to gain a root shell via U-Boot, then injecting a script to enable SSH. The vacuum's `appd` daemon communicates with an AWS IoT Core MQTT broker using device certificates and private keys. Lack of access controls allows subscribing to $aws/things/# topics, enabling potential remote control of millions of devices. |
| 2026-07-16 2026 | StrikeShark Campaign Exploits Known Vulnerabilities to Deploy Cobalt Strike via SharkLoader news 4 min read | Writeup of the StrikeShark campaign, which uses the SharkLoader malware to deploy Cobalt Strike by exploiting known vulnerabilities in internet-facing applications like Microsoft Exchange (CVE-2021-26855, CVE-2022-41082), Microsoft SharePoint (CVE-2021-27076), Openfire Server (CVE-2023-32315), and F5 BIG-IP (CVE-2023-46747), among others. The campaign highlights the critical need for timely patching and exposure management, as attackers leverage publicly available exploit code to gain initial access through remote code execution and authentication bypass. → hkcert.org |
| 2026-07-16 2026 | (More) Unauthenticated Arbitrary Code Execution in ServiceNow news 26 min read | Writeup detailing unauthenticated arbitrary code execution in ServiceNow instances, a vulnerability allowing full server-side control. The exploit involves manipulating specific input fields, such as the forgotten password username, with crafted JavaScript strings. These strings trigger a sandbox escape within ServiceNow's Rhino engine, enabling attackers to exfiltrate sensitive credentials like those for GitHub and Workday by creating scheduled jobs that decrypt data from credential tables. Patches for this issue were released incrementally, with subsequent research identifying further bypasses and primitives until the introduction of Guarded Script eventually neutralized the primary attack vectors. |
| 2026-07-16 2026 | TuxBot v3: Inside an IoT Botnet Framework With LLM-Assisted Development intermediate 25 min read AI | Library comprising the source code for TuxBot v3 Evolution, a modular IoT botnet framework. The framework features a C-based bot agent, a Go-based command-and-control server with a DDoS-for-hire panel, a custom exploit virtual machine, and automated build systems. It utilizes various fallback C2 mechanisms including DGA, P2P gossip, IRC, and DNS TXT queries. The development process leveraged large language models, resulting in some non-functional components and unremoved safety disclaimers. → unit42.paloaltonetworks.com |
| 2026-07-15 2026 | Smashing the ServiceNow Sandbox – Pre Authentication RCE intermediate 10 min read | Library for finding pre-authentication RCE vulnerabilities in ServiceNow, focusing on the GlideRecord system and its "javascript:" filter operator. This resource details how to leverage the `javascript:` prefix within `addQuery` calls to achieve remote code execution, bypassing ServiceNow's additional script sandbox by exploiting the `gs.include()` function to access script includes and ultimately gain full compromise of the instance and connected proxy servers. → slcyber.io |
| 2026-07-15 2026 | TS-2026-009: Insecure argument handling in Tailscale SSH permitted root access news 2 min read | Bulletin TS-2026-009 details two vulnerabilities in Tailscale SSH: insecure argument handling allowing root access via malformed usernames (e.g., `-i`) and a denial-of-service flaw in Tailscale Serve/Funnel where specific HTTP requests could indefinitely pin a CPU core. Both issues are fixed in Tailscale version 1.98.9 or newer. Anthropic and Ada Logics reported these vulnerabilities. |
| 2026-07-14 2026 | CET-Compliant Callstack Spoofing via Thread Pool & Enum Callback Trampolining (Rust PoC) advanced 38 min read | Library for CET-compliant call stack spoofing, utilizing Windows Thread Pools, Enum callback trampolining, and indirect syscalls. This Rust-based Proof of Concept, with inline assembly and full CET support, crafts a call stack where every frame appears legitimate to EDR solutions by combining a `jmp`-based context switch with shadow stack pointer reconciliation. It achieves this without modifying unwind metadata, circumventing hardware enforcement of Intel CET. |
| 2026-07-14 2026 | Persistence via Fake AMSI Provider | Playbook & Detection Strategies intermediate 8 min read | Library that demonstrates persistence via a fake AMSI provider. This technique abuses the Antimalware Scan Interface (AMSI) by registering a malicious provider that can execute arbitrary code when specific trigger strings are detected in PowerShell content. The provided C++ code implements a sample AMSI provider that allows threat actors with elevated permissions to achieve persistence by bypassing security scans. → ipurple.team |
| 2026-07-13 2026 | Unauthenticated RCE in Motorola's MR2600 Router intermediate 5 min read | Writeup detailing unauthenticated RCE in Motorola's MR2600 router, stemming from a firmware upload flaw where multipart boundary parsing is bypassed by sending raw firmware, and an authentication bypass on the `LoadFirmwareValidation` endpoint due to inconsistent URI comparison logic. This allows remote code execution by an attacker on the LAN or over the internet if remote management is enabled. |