Node2Shell / HTTP2Shell (CVE-2026-111497): Brotli Library RCE
On October 21, 2026, Node.js fixed CVE-2026-111497, a critical vulnerability now known as Node2Shell and, since October 24,…
Tag
Remote Code Execution
22 articles
PHP2Shell (CVE-2026-109618 & CVE-2026-109619): Pre-Auth RCE in PHP Core Puts Web Servers at Risk
PHP2Shell abuses PHP’s session upload progress feature. Learn the signs of exploitation, php.ini hardening steps, and how AppTrana…
WordPress CVE-2026-87902: Unauthenticated RCE Exploited Within Hours
CVE-2026-87902 is a critical WordPress Core RCE flaw, exploited within hours of patch. See affected versions, exploitation flow,…
Next.js CVE-2026-94545: Critical ImageResponse Vulnerability Enables RCE via SVG
Next.js CVE-2026-94545 (CVSS 9.5) enables RCE through next/og SVG image generation. Learn affected versions, the Satori root cause,…
CVE-2026-35273: ShinyHunters Resumes Oracle PeopleSoft Exploitation with WAF Bypass
ShinyHunters now bypasses WAF rules to exploit Oracle PeopleSoft CVE-2026-35273. See the new attack chain, detection steps, and…
SharePoint CVE-2026-55040 Actively Exploited: AI-Discovered RCE Chain
CVE-2026-55040, a critical SharePoint authentication bypass, is now being actively exploited. A proof-of-concept went public on August 11.…
CVE-2026-9198: Critical Langflow RCE Under Active Exploitation
CVE-2026-9198 lets attackers chain two Langflow API endpoints for unauthenticated RCE. CISA confirms active exploitation. See fixes and…
CVE-2026-6875: ServiceNow Sandbox Escape Leads to Pre-Auth RCE in AI Platform
Critical unauthenticated RCE vulnerability CVE-2026-6875 hits ServiceNow via a GlideRecord sandbox escape. Attackers are already exploiting unpatched instances.
WP2Shell: WordPress Core SQLi + REST API Chain to Pre-Auth RCE
WP2Shell chains CVE-2026-60137 and CVE-2026-63030 for unauthenticated RCE on WordPress Core. Patch to 6.8.6, 6.9.5, or 7.0.2 now,…
CVE-2026-48282: ColdFusion RDS Vulnerability Actively Exploited
CVE-2026-48282 is a critical ColdFusion RDS path traversal vulnerability under active exploitation. Learn the risks, IOCs, and how…
CVE-2026-33017: Langflow RCE Deploys Monero Miners on AI Servers
Langflow CVE-2026-33017 is under active exploitation. Attackers deploy Monero miners via unauthenticated RCE. Get IOCs, patch steps, and…
CVE-2026-42271: Unauthenticated RCE in LiteLLM AI Gateway
CVE-2026-42271 enables unauthenticated RCE in LiteLLM when chained with CVE-2026-48710. Learn wha is at risk and how to…