🎯 Remote code execution

The items that name it 26

• PHP2Shell Attacks Root Palo Alto Firewalls but Fail Against WordPress
  articleas techniques2026-10-30

  Cato found 41% of attacks on CVE-2026-109618 attempted RCE, mostly command execution, followed by deserialization attempts.

• elvis (@omarsar0) on X
  threadas techniques2026-10-30

  The goal of the planted backdoor in the CLI agent when the trigger appears.

• CISA says max severity GitLab flaw now exploited in the wild
  articleas techniques2026-10-30

  Unauthenticated attackers run arbitrary code on the GitLab server via a crafted regular expression in a CI/CD configuration

• Drupal Commerce Core Vulnerability Exploited Against Online Stores
  articleas techniques2026-10-30

  CVE-2026-108097 (Field UI) and CVE-2026-108099 (Entity List) are critical RCE bugs announced on October 14. Exploitation needs certain other contributed modules or custom code, in some cases without authentication.

• Drupal warns of critical Commerce Core flaw exploited in attacks
  articleas techniques2026-10-30

  Impact of CVE-2026-108097 and CVE-2026-108099, which Drupal patched about two weeks before the article

• Muse pdfdetach POC
  videoas techniques2026-10-30

  Executing arbitrary code by dropping a malicious shared library and an LD_PRELOAD configuration file

• What are shell vulnerabilities? PHP2Shell, Node2Shell (HTTP2Shell), React2Shell and Log4Shell explained
  articleas techniques2026-10-29

  Common trait of shell vulnerabilities: one crafted unauthenticated request gets code running on the server.

• CISA warns of Fragnesia Linux flaw chained in PHP2Shell attacks
  articleas techniques2026-10-29

  Adel Karimi's honeypots recorded RCE against an Apache mod_php installation running PHP 8.4.26.

• Hitachi Energy TRO600 series products
  advisoryas techniques2026-10-28

  The vulnerabilities in TRO600 can be exploited for remote code execution to carry out further attacks, and for disclosure of sensitive information

• Hackers Start Probing Fresh Oracle EBS Vulnerability
  articleas classification.key entities2026-10-28
• Introducing the Cloudflare PHP Capture the Flag challenge
  articleas techniques2026-10-27It is written here as Remote code execution (RCE).

  Participants must show attacker-controlled PHP code or command execution in the sandbox through an authorized POST request

• PHP critical vulnerabilities rated 9.2 as attacks emerge and sites go offline
  articleas techniques2026-10-21It is written here as Remote code execution: attackers run their own code on affected servers, potentially altering websites or stealing data.
• ︎ (@0xocdsec) on X
  threadas classification.key entities2026-10-20It is written here as RCE.
• Malicious 'Pyronut' Package Backdoors Telegram Bots with Remote Code Execution | Blog | Endor Labs
  writeupas classification.key entities2026-10-12
• SonicWall and Splunk Patch Critical Vulnerabilities
  articleas techniques2026-10-08It is written here as Remote code execution (RCE).

  enabled by two high-severity SonicWall SMA1000 vulnerabilities

• Android’s October 2026 Updates Patch 25 Vulnerabilities
  articleas techniques2026-10-07It is written here as Remote code execution (RCE).

  1 System issue

• [tl;dr sec] #348 - Google's PageBreak Scanner, Perplexity's Agent Security Tool, Defending Agentically
  articleas techniques2026-10-01

  PageBreak validates it by triggering outbound DNS

• Agentic Hacks, Real Proofs: Inside Google's PageBreak Project
  articleas classification.key entities2026-09-24It is written here as RCE.
• Hackers breach OpenAI using Claude tools, gaining access to employee accounts and the company
  articleas techniques2026-09-18It is written here as Remote Code Execution (RCE).

  Achieved via orchestrated memory crash from the heap overflow, granting access to Discourse forum's local server environment

• 91 Vulnerabilities Patched in Spring Application Framework
  articleas techniques2026-08-24

  One of the exploitation methods enabled by the high-severity vulnerabilities; also the category of the critical Spring for GraphQL flaw (CVE-2026-59285).

• Dark-Moon
  repoas techniques2026-08-05It is written here as Remote code execution (rce).

  Focus area selectable via FOCUS flag

• The OpenAI and Hugging Face security incident: why AI agents need deterministic guardrails | Blog | Endor Labs
  articleas techniques2026-07-31

  Achieved on Hugging Face production servers via chained credentials and zero-days.

• The AI agent sandbox escape that breached Hugging Face: what happened, and what to fix
  writeupas classification.key entities2026-07-27
• Strix
  repoas techniques2026-07-15It is written here as RCE.

  Server-side vulnerability tested by Strix

• レッドエージェント POVシリーズのご紹介
  articleas techniques2026-06-17It is written here as Remote Code Execution (RCE).

  Validated code execution paths with proof of exploitability found across a significant share of tested environments

• Cisco Warns of New Zero-Day ISE Auth Bypass (CVSS 10.0) Exploited in Active Attacks
  advisoryas techniques

  Achieving arbitrary command execution, in some cases with root privileges, across multiple Cisco products (e.g., CVE-2026-76460, CVE-2026-76423, CVE-2026-20176, CVE-2026-20305/20306, CVE-2026-20324, CVE-2026-20242).