#rce
-
Linode investigates security incident tied to CVE-2026-98432
Linode's status page has posted a customer advisory about a recently disclosed remote code execution vulnerability. Akamai says it is taking mitigation steps and monitoring the platform.
-
WordPress Core Flaw Hit by Tens of Thousands of Attacks a Day Right After Patch Release
Attackers began going after a remote code execution flaw in WordPress Core soon after it was patched. Wordfence says it blocked nearly 63,000 attempts in 24 hours.
-
Telegram for Android Flaw Let Attackers Run Code Through a Voice Call
Security startup NebuSec has disclosed a flaw in Telegram for Android: an attacker with an ordinary account only had to call the victim and wait for them to answer. The bug is fixed in version 12.10.4.
-
PHP2Shell flaws confirmed exploited in the wild for the first time
Researchers have recorded the first successful remote code execution via PHP2Shell — a pair of critical flaws that PHP developers have already patched. Until now, every exploitation attempt had come up empty.
-
Researchers remotely neutralize abandoned Popcorn Time client
A Popcorn Time fork called Time4Popcorn left millions of computers open to remote code execution for years. Eye Security exploited the very same flaw to shut down its dangerous updater.
-
Ruby Fixes Three Regex Engine Bugs Behind Four Critical GitLab RCE Flaws
Ruby has shipped 4.0.9, 3.4.12 and 3.3.13 to fix flaws in the Onigmo regex engine that drove four critical GitLab patches in a month. Any app that compiles a regular expression from attacker-controlled text is at risk.
-
Node2Shell: Crafted Brotli Data Runs Attacker Code on an Official Node.js Build
Imperva researchers showed that an application on an official Node.js build can be made to run attacker-supplied code by feeding it a crafted Brotli stream (CVE-2026-111497). Node.js shipped fixes on October 21.
-
Two CVSS 9.0 KSMBD RCE Flaws Go Public on Mailing Lists Before Any Kernel Fix
KSMBD, the Linux kernel's built-in SMB server, is exposed to two remote-code-execution flaws rated 9.0, with no mainline fix yet — and the reports landed on public mailing lists.
-
Node.js Brotli Decoder Flaw Threatens Remote Code Execution Across All Supported Versions
On October 21 Node.js shipped updates for its three supported release lines, fixing 10 flaws. The most serious is a bug in the bundled Brotli decompression code that the project says could allow remote code execution.
-
Critical GitLab Flaw (CVSS 10.0) Threatens RCE Across 12 Years of Releases
On October 21 GitLab shipped fixes for a flaw that lets an attacker run code on a self-managed server without logging in. The weakness reaches back to version 7.0, released in 2014.
-
PHP Rushes Out-of-Cycle Fix for Two Critical RCE Flaws
PHP's security team scheduled an emergency release for October 21 for two critical vulnerabilities rated 9.2 on CVSS v4.0. watchTowr researchers say both allow remote code execution, but no details have been published yet.
-
PHP preps emergency patches after two critical flaws leak early
The PHP security team is urging administrators to brace for urgent updates after details of two critical vulnerabilities leaked ahead of their planned disclosure.
-
F5 ships out-of-band patches for critical NGINX flaws
F5 has closed several NGINX web server vulnerabilities, including three critical ones that could let attackers run code on affected systems.
-
Hackers exploit SiteGuard WAF flaw to run commands as root and SYSTEM
A critical OS command injection flaw has been found in the statistics feature of the SiteGuard Server Edition firewall. Attacks are already underway.
-
Drupal patches two critical RCE flaws, warns exploits may come fast
Drupal has fixed two critical bugs that allow remote code execution on any supported version of the CMS and is urging administrators to update without delay.
-
Critical BlockStrap flaw threatens Magento servers
Researchers warn that the maximum-severity vulnerability CVE-2026-103849 in Magento and Adobe Commerce could let attackers run arbitrary PHP code on store servers.
-
NGINX Patches Five Bugs, Including Possible RCE and a TLS Flaw That Can Skip Client-Cert Checks
On October 14, NGINX shipped versions 1.30.6 and 1.31.7 fixing five vulnerabilities — one of them present in every release since May 2005.
-
Next.js Ships Out-of-Band Patch for Two Critical RCE Flaws
On October 14 Vercel fixed two critical remote-code-execution flaws — in React Server Components and in the librsvg library — plus a high-severity denial-of-service bug.
-
Palo Alto Networks patches exploited RCE flaw in PAN-OS
The company has shipped updates for PAN-OS zero-day CVE-2026-0322, already being leveraged in attacks against firewalls.
-
Cisco Patches New Actively Exploited Secure Email Gateway Zero-Day
A flaw in the gateway's malware-protection feature let remote, unauthenticated attackers run commands as root. Cisco says it saw the bug exploited in the wild in October 2026.
- More