Skip to content

91 results for “Remote code execution”

ListGrid
What you seeeverything
RecentOldestAddedA–Z
All types91Advisories37Articles22Write-ups20Threads5
Papers3Repos2Talks1Videos1
“Remote code execution”
x.comthread🛡️ Security

elvis (@omarsar0) on X

Thread by Elvis Saravia (omarsar0) summarising an Anthropic-led paper on pretraining data poisoning of CLI agents. Poisoning 0.1% of pretraining data planted a remote code execution backdoor in Qwen3 models (0.6B, 1.7B, 4B) trained from scratch. It survived SFT, DPO and RL, and fired on about 92% of triggered prompts at 4B. At a 0.0005% poison rate (about 2,500 documents) it still fired on 1.4% of prompts.

QwenLLM
Anthropicremote code executiondata poisoning+1

AI Security· Added 31 Oct 2026, published 30 Oct 2026

securityweek.comarticle🛡️ Security

Fresh WordPress Vulnerability in Attackers’ Crosshairs

A WordPress core race condition in the update process, patched in WordPress 7.1.4 on 28 October 2026, allows unauthenticated remote code execution with high attack complexity. New files unpack into a predictable, web-accessible staging directory. Defiant's Wordfence logged over 18,500 requests for staged setup-config.php paths in 21 hours, with no confirmed compromises. No CVE is assigned yet. The release fixes 22 flaws in total.

WordPressWordfencePHP
DefianteMudhrarace condition

AppSec, Threat Intel· Published and added 30 Oct 2026

youtu.bevideo🛡️ Security

Muse pdfdetach POC

The uploader demonstrates a remote code execution exploit chain against Muse, an assistant system that uses the pdfdetach utility to parse PDF attachments. The exploit leverages a path traversal vulnerability during file extraction to drop a malicious shared library and an LD_PRELOAD configuration file.

MusepdfdetachPython

AppSec· Published and added 30 Oct 2026

unit42.paloaltonetworks.comadvisory🛡️ Security

Threat Brief: Critical Vulnerabilities in PHP: CVE-2026-109618, CVE-2026-109619 (Updated October 29)

Unit 42 threat brief on PHP2Shell, two PHP remote code execution flaws, CVE-2026-109618 and CVE-2026-109619 (CVSS 4.0 9.2), both caused by longjmp() error handling that leaves memory uninitialized or freed. Cortex Xpanse counted over 22.6 million exposed instances. The 29 October 2026 update says attackers chained PHP2Shell with a Linux kernel privilege escalation against internet-exposed PAN-OS management interfaces. An earlier 23 October claim of post-compromise activity was retracted on 25 October.

PHPPAN-OSLinux kernel+2
CVE-2026-109618CVE-2026-109619PHP2Shell+2

Threat Intel, AppSec· Added 30 Oct 2026, published 29 Oct 2026

cisa.govadvisory🛡️ Security

Hitachi Energy TRO600 series products

ICSA-26-302-02 is a CISA republication of Hitachi Energy PSIRT advisory 8DBD000224 on the TRO600 series. It covers CVE-2026-10756 and CVE-2026-106087, which allow remote code execution and disclosure of sensitive information. Affected versions are TRO600 up to 9.2.1.6 and 9.1.1.0, plus 9.2.2.1 and 9.1.2.0. The page gives no per-CVE detail or CVSS scores, only general ICS hardening advice. Released 27 October 2026.

Hitachi Energy TRO600
CVE-2026-10756CVE-2026-106087Hitachi Energy PSIRT 8DBD000224+1

Hardware & RF· Added 29 Oct 2026, published 28 Oct 2026

x.comthread🛡️ Security

Trail of Bits (@trailofbits) on X

Trail of Bits post says it achieved remote code execution through a Brotli decoder bug in Linux lab setups: Node.js 24.22.0 with Express 5.3.0 via the standard JSON parser (x86-64 and ARM64), and Electron 41.10.7 (x86-64) with a custom decoding service. Exploitation needs a carefully matched setup and repeated attempts. A scanner by ToBScottA finds hidden copies of the decoder, including in stripped binaries.

BrotliNode.jsExpress+1
Trail of BitsToBScottA

AppSec, Offensive Security, Supply Chain· Added 30 Oct 2026, published 28 Oct 2026

securityweek.comarticle🛡️ Security

Long-Hidden Flaws Patched in EPICS Research Facility Control Software

Four vulnerabilities in EPICS Base 7.0.10 and earlier, the control-system toolkit used at ITER and the Advanced Photon Source, were disclosed by CISA. CVE-2026-114595 (CVSS 9.8) is an integer overflow that could allow remote code execution, though only an out-of-bounds heap write and crash were demonstrated. All flaws sit in Channel Access and pvAccess handling (TCP 5064 and 5075), need no authentication, and are fixed in 7.0.11.

EPICSChannel AccesspvAccess+3
CVE-2026-114595CVE-2026-114596CVE-2026-114597+10

Hardware & RF, AppSec· Published and added 28 Oct 2026

securityweek.comarticle🛡️ Security

Hackers Start Probing Fresh Oracle EBS Vulnerability

CVE-2026-101767 is a CVSS 9.8 unauthenticated SQL injection in the Application Object Library of Oracle E-Business Suite, patched in Oracle's October 2026 CPU and reported by Horizon3.ai. Defused decoys logged the first exploratory attempts on 27 October 2026, and the flaw could lead to remote code execution. The article recalls CVE-2026-46817 attacks in June and last year's Cl0p zero-day campaign against EBS.

Oracle E-Business SuiteCVSS
CVE-2026-101767CVE-2026-46817Cl0p+4

Threat Intel, AppSec· Published and added 28 Oct 2026

orca.securityadvisory🛡️ Security

Node.js Brotli Decoder Out-of-Bounds Write Threatens Remote Code Execution Across All Supported Versions

CVE-2026-111497 is a high-severity out-of-bounds write in the Node.js Brotli decoder, reported by Orca Security. It affects all supported release lines (22.x, 24.x, 26.x) and can be triggered by malformed Brotli data processed through node:zlib or fetch(). Impacts named are crashes, memory disclosure and remote code execution in cloud workloads; patching is advised. The fetched text covers only the executive summary.

Node.jsBrotli
CVE-2026-111497

AppSec· Published and added 27 Oct 2026

securityweek.comarticle🛡️ Security

iOS, macOS 27.2 Patch 286 Bugs; Fix for Exploited Flaw Backported to iOS 18

Apple's 27.2 releases fix 286 vulnerabilities across iOS/iPadOS (163) and macOS Golden Gate (263), with memory corruption in WebKit and the kernel, sandbox escapes, Gatekeeper bypasses and a remote code execution bug in Remote Management. iOS and iPadOS 18.7.11 backport the fix for CVE-2026-86950, an exploited zero-day found by Meta's product security team and first patched in 26.7.1. Patch counts for tvOS, watchOS, visionOS, Safari and the 26.7.2 and Sequoia 15.8.2 releases are also listed.

iOSmacOSSafari+2
CVE-2026-86950Metasandbox escape+2

Mobile Security, other· Published and added 27 Oct 2026

cisa.govadvisory🛡️ Security

EPICS Base

CISA ICS advisory ICSA-26-300-01 (October 27, 2026) covers EPICS Base release 7.0.10 and earlier, with CVE-2026-114595 through CVE-2026-114598. Flaws include integer overflow, length parameter inconsistency and type confusion, allowing denial of service, memory corruption, information disclosure or remote code execution (CVSS v3.1 9.8). The fix is EPICS Base 7.0.11, with patches in epics-base and pvDataCPP pull requests.

EPICS BaseCVSS
CVE-2026-114595CVE-2026-114596CVE-2026-114597+5

AppSec· Added 29 Oct 2026, published 26 Oct 2026

interconnects.aitalk🛡️ Security

Podcast: Kimi K3.1 Pro, the new cyber reality, and Muse musings

Interconnects podcast with Nathan Lambert and Florian Brand on Kimi K3.1 Pro and the AI cyber landscape. Kimi says it down-weighted cyber data in mid-training so its open weights do not extend offensive capability. They discuss the PHP2Shell remote code execution bug, the repeat LiteLLM compromise from an API key left in GitHub for five months, abliterated model APIs, and trusted-access programs from OpenAI and Anthropic. The transcript was truncated at the very end.

Kimi K3.1 ProLiteLLMPHP+3
PHP2ShellPatch the PlanetPHP Foundation+10

AI Security, other· Published and added 25 Oct 2026

galaxy.comarticle🛡️ Security

Weekly Research Brief: PHP Vulnerability; Objections to OKX-ICE’s Stock Tokenization; Solana Alpenglow Ships

Galaxy Research's weekly brief includes a section on PHP2Shell, two decade-old PHP remote code execution bugs affecting versions back to 5.4, patched in an emergency release. It reports an Amazon honeypot exploit attempt four days before disclosure, thousands of attempts in the 10 hours before the patch per Cloudflare's Matthew Prince, and NSA and FBI offline advice. The author argues the bugs were found with GPT-5.6 Sol and that defence must become agentic. It also lists the week's other incidents, including a CVSS 10.0 GitLab bug and eMudhra's guessable private keys.

PHPWordPressOpenAI+3
PHP2ShellPatch the PlanetCalif+7

Threat Intel, AI Security· Added 24 Oct 2026

cisa.govadvisory🛡️ Security

CISA: Critical Vulnerabilities in PHP Require Immediate Patching

CISA alert on CVE-2026-109618 and CVE-2026-109619 ("php2shell"), unauthenticated remote code execution flaws affecting PHP installations serving web requests, including mod_php, PHP-FPM, php-cgi, FrankenPHP and LiteSpeed. Fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Updated 23 October 2026 with a Sigma rule, partner advisories (NSA, NCSC-UK, ASD ACSC, NCSC-NL, NCSC-NZ, Cyber Centre) and guidance to inventory PHP, patch internet-facing systems first, and watch for PHP workers spawning shells. No in-the-wild exploitation had been observed.

PHPApachePHP-FPM+3
CVE-2026-109618CVE-2026-109619PHP2Shell+2

AppSec, Blue Team & Detection· Added 24 Oct 2026

orca.securityarticle🛡️ Security

PHP2Shell: What This Week Tells Us About the Web We Built

PHP2Shell is the name for two unauthenticated remote code execution flaws, CVE-2026-109618 and CVE-2026-109619 (CVSS v4 9.2), in the PHP engine back to version 5.4. The post covers the leaked October 2026 embargo, AI-assisted exploit building by Calif and others, patch availability by PHP version, and a 72-hour and quarterly response plan covering inventory, patching, secret rotation and edge virtual patching. It ends with a short Orca product section.

PHPWordPressOrca Security
CVE-2026-109618CVE-2026-109619PHP2Shell+6

Blue Team & Detection, AppSec, GRC· Published and added 23 Oct 2026

aikido.devadvisory🛡️ Security

Node2Shell: Node.js Brotli vulnerability allows remote code execution (CVE-2026-111497)

Node2Shell (CVE-2026-111497) is an out-of-bounds write in the Brotli decoder bundled with Node.js and Bun, triggered by malformed compressed input and rated high by Node.js, with possible remote code execution. Fixed in Node.js 22.23.4, 24.22.1 and 26.12.1 and Bun 1.4.4. The post covers exposure via Express 5, body-parser 2.x, fetch() and node:zlib, stopgaps, and a timeline with public proofs of concept on 22 October 2026.

Node.jsBunExpress+3
CVE-2026-111497Node2ShellCWE-787+1

AppSec· Published and added 22 Oct 2026

phoronix.comarticle🛡️ Security

Several Linux kernel vulnerabilities accidentally posted to public mailing list

Phoronix reports that Trend Micro's Zero Day Initiative mistakenly sent several Linux kernel vulnerability reports to the public kernel mailing list instead of the private security list. They include two CVSS 9.0 remote code execution bugs (SMB Direct integer underflow, ksmbd race condition), a skb_zerocopy local privilege escalation, a vmwgfx out-of-bounds write, an NVMET information disclosure and a search-domain TCP stack buffer overflow. Some have patches in -next branches, and none were yet in mainline.

Linux kernelksmbdSMB Direct+3
ZDI-CAN-33549ZDI-CAN-33774ZDI-CAN-33367+10

Cloud & Infra, other· Added 23 Oct 2026, published 22 Oct 2026

securityweek.comarticle🛡️ Security

PHP2Shell Exploitation Started Days Before Patches

PHP2Shell (CVE-2026-109618 and CVE-2026-109619) is a pair of critical PHP remote code execution flaws. Amazon saw the first exploitation on 17 October 2026, four days before patches on 21 October, and Cloudflare logged millions of attempts after disclosure. Censys, VulnCheck and VirusTotal counted over 1 million unpatched PHP hosts, and CISA urged updating to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35.

PHPCloudflareVirusTotal+1
CVE-2026-109618CVE-2026-109619PHP2Shell+4

Threat Intel, AppSec· Published and added 22 Oct 2026

x.comthread🛡️ Security

VibecodersHQ (@VibeCodrHQ) on X

Post summarising Pillar Security's finding of a remote code execution flaw in OpenCode, the open-source AI coding agent. Versions 1.0.137 through 1.18.32 could run code from a remote MCP server during OAuth sign-in on Windows and WSL, with no prompt injection needed. The fix is in 1.18.33 (released 28 September). No advisory or CVE was issued, so scanners will not flag old installs. Interim advice is to remove unvetted remote MCP servers.

OpenCodeModel Context ProtocolOAuth+1
Pillar SecurityOpenCode Console breach

AI Security, AppSec· Added 22 Oct 2026, published 21 Oct 2026

x.comadvisory🛡️ Security

EMITS (@emits_ca) on X

CVE-2026-107406 is a memory overflow in Citrix NetScaler that allows remote code execution when SAML is configured, rated 9.5 out of 10. The post from emits.ca calls it the fourth NetScaler bulletin in a week. It warns that the previous week's SAML patch does not cover it, and that fixes need NetScaler 14.1-73.46 or later, or 13.1-64.29 or later. The full advisory is on emits.ca.

Citrix NetScaler
CVE-2026-107406

Cloud & Infra, Identity & Access· Added 22 Oct 2026, published 21 Oct 2026

simonwillison.netarticle🛡️ Security

Today's PHP Security Release, and How We're Strengthening PHP Security

Simon Willison's link post on the 21 October 2026 PHP security release, which fixes two remote code execution flaws across the PHP 8.x line. The CVE IDs leaked on 20 October with a wrong CVSS of 10.0 (actual 9.2), and Calif accidentally published a proof-of-concept video. It also gives Wiz Research's timeline, with unauthenticated RCE confirmed against Drupal and WordPress in August 2026.

PHPWordPressCVSS+1
Wiz ResearchCalifPHP Foundation+3

AppSec, Threat Intel· Published and added 21 Oct 2026

en.cryptonomist.charticle🛡️ Security

PHP critical vulnerabilities rated 9.2 as attacks emerge and sites go offline

Report on two critical PHP remote code execution vulnerabilities, rated 9.2 out of 10, disclosed on 20 October 2026 and patched on 21 October. Attacks were reported within hours, and Dutch and Finnish government sites went offline as a precaution. The EU CERT and the UK NCSC advise patching or isolating systems. Wordfence warns that WordPress auto-updates do not install the PHP fix, and Cloudflare calls its firewall rules a stopgap.

PHPWordPressCloudflare
watchTowrHuntressWordfence+6

AppSec, Threat Intel· Published and added 21 Oct 2026

protos.comarticle🛡️ Security

Remotely exploitable PHP bug found on 70% of world’s websites

PHP2Shell is a pair of unauthenticated remote code execution flaws in PHP, CVE-2026-109618 and CVE-2026-109619, found by Calif using OpenAI's GPT-5.6 Sol during an OpenAI-funded audit. Fixes ship in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, with backports for 7.4-8.1 rolling out, while PHP 7 and 5 sites stay unpatched. Wiz confirmed the flaws; Cloudflare applied a stopgap and Finnish and Dutch government sites went offline.

PHPCloudflareOpenAI+1
CVE-2026-109618CVE-2026-109619PHP2Shell+5

AppSec, AI Security, Threat Intel· Published and added 21 Oct 2026

endorlabs.comadvisory🛡️ Security

PHP2Shell: Critical vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619) | Endor Labs

PHP2Shell is the name for two critical PHP core memory-safety flaws, CVE-2026-109618 and CVE-2026-109619, that allow unauthenticated remote code execution. Fixes ship in PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Wiz researchers demonstrated RCE against WordPress, Drupal and Joomla, and Apache with mod_php is the highest risk. The post covers inventory, container rebuilds, Cloudflare WAF rules and temporary exposure reduction.

PHPWordPressDrupal+3
CVE-2026-109618CVE-2026-109619PHP2Shell+4

AppSec, DevSecOps· Published and added 21 Oct 2026

decrypt.coarticle🛡️ Security

PHP Panic: Two Critical Bugs Put 70% of the Internet at Risk, and Everyone Is Freaking Out

Decrypt reports on CVE-2026-109618 and CVE-2026-109619, two PHP flaws rated CVSSv4 9.2 that allow unauthenticated remote code execution. PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 shipped on 21 October 2026 after an early leak and Cloudflare-observed attacks. The article covers the memory-handling root causes, mod_php and upload-progress exposure, government site shutdowns, affected version range (PHP 5.4 and later per Sansec), and patch guidance.

PHPCloudflareWordPress+1
CVE-2026-109618CVE-2026-109619PHP Foundation+7

AppSec, Threat Intel· Published and added 21 Oct 2026

watchtowr.comadvisory🛡️ Security

PHP Remote Code Execution ("PHP2Shell" CVE-2026-109618 & CVE-2026-109619)

PHP2Shell is the name for CVE-2026-109618 (out-of-memory corruption) and CVE-2026-109619 (stale global state), two unauthenticated PHP remote code execution flaws rated CVSS 4.0 9.2. Details leaked before the 21 October 2026 patch release, and watchTowr's honeypots saw exploitation. The page lists fixed versions (8.5.12, 8.4.27, 8.3.36, 8.2.35), states that .ini mitigations do not work, gives a timeline, and describes compromise checks.

PHPApacheFrankenPHP+2
CVE-2026-109618CVE-2026-109619PHP2Shell+3

AppSec, Threat Intel· Added 28 Oct 2026, published 21 Oct 2026

blog.cloudflare.comarticle🛡️ Security

Cloudflare deploys protections against php2shell vulnerability

Cloudflare describes its WAF protections for php2shell (CVE-2026-109618 and CVE-2026-109619), two PHP runtime memory-handling flaws affecting PHP 5.4 and later that can cause denial of service, remote code execution and data exposure. Rules shipped 21 October 2026, about 9 hours before disclosure, using a new "full transaction detection" that matches request and origin response together. It lists ruleset IDs and says patching PHP is still required.

PHPCloudflareWordPress
CVE-2026-109618CVE-2026-109619PHP2Shell+2

Blue Team & Detection, AppSec· Added 22 Oct 2026, published 21 Oct 2026

orca.securityadvisory🛡️ Security

Critical PHP “PHP2Shell” RCE Vulnerabilities Allow Unauthenticated Remote Code Execution (CVSS 9.2)

PHP2Shell is the informal name for CVE-2026-109618 and CVE-2026-109619 (CVSS v4.0 9.2), unauthenticated remote code execution flaws in the PHP core runtime. Patches for branches 8.2 to 8.5 were scheduled for 21 October at 14:00 UTC, while PHP 8.1 and older get no fix; about 884,000 internet-facing hosts run those versions. watchTowr reproduced CVE-2026-109618, no public PoC existed at writing, and Sansec expects mass exploitation within 15 minutes of release.

PHP
CVE-2026-109618CVE-2026-109619PHP2Shell+4

AppSec· Published and added 21 Oct 2026

github.comadvisory🛡️ Security

PHP 8.2.35

PHP 8.2.35 is a security release of the PHP 8.2 branch that fixes two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, which can allow unauthenticated remote code execution. The notes say no complete mitigations exist and updating is the only safe choice. PHP 8.2 reaches end of life on 31 December 2026, after which it gets no security fixes.

PHP
CVE-2026-109618CVE-2026-109619

AppSec· Added 22 Oct 2026, published 21 Oct 2026

github.comrepo🛡️ Security

eness/php2shell-CVE-2026-109618-CVE-2026-109619-PoC

php2shell is the name given to two critical pre-auth remote code execution flaws, CVE-2026-109618 and CVE-2026-109619, in PHP core's session upload progress handler (php_session_rfc1867_callback), where zend_hash_update frees live zval pointers that are later reclaimed and redirected into zend_call_function to run zif_system. This repository ships poc_109618.py, a fully automated four-stage HTTP exploit that leaks ASLR offsets via Set-Cookie headers against php:8.4.26-apache on Debian Bookworm, along with a root-cause C source patch, mitigation scripts to disable session.upload_progress, and WAF/ModSecurity/Lighttpd/Apache rules plus detection guidance for anomalous PHP worker child processes. Confirmed PHP versions include 8.4.4 and 8.2.34, with EOL branches (5.x, 7.x, 8.0, 8.1) left without official vendor patches.

PHPDockerCloudflare+1
CVE-2026-109618CVE-2026-109619PHP2Shell+6

Offensive Security, AppSec, Blue Team & Detection· Added 23 Oct 2026, published 21 Oct 2026

Showing 30 of 91

Show more