// tag
Security incidents tagged RCE. Newest first.
› GitLab CE/EE (self-managed)
GitLab released a critical patch on Oct 21 2026 for CVE-2026-110264: an integer overflow in the bundled Onigmo / regex compiler that can allow an unauthenticated attacker to execute code on self-managed GitLab. CVSS 10.0; every CE/EE version from 7.0 (2014) is in range. Instances that only applied the Oct 12 regex fix remain vulnerable and must upgrade again.
› Linux kernel: ksmbd (in-kernel SMB server) and SMB Direct, skbuff/NFQUEUE networking, vmwgfx, nvmet
On Oct 21, Trend Micro's Zero Day Initiative sent several unpatched Linux kernel vulnerability reports to security@kernel.org but Cc'd the public linux-kernel and subsystem lists, so full technical details (code paths, KASAN traces) are now public before fixes ship. The worst are two ksmbd (in-kernel SMB server) remote code execution bugs that ZDI scores CVSS 9.0: an SMB Direct integer underflow (needs an RDMA device and a writable share) and a protocol-dispatch race (needs a guest share). Also leaked: an skb_zerocopy local privilege escalation (CVSS 7.8), a vmwgfx out-of-bounds write LPE, and an nvmet info leak. No CVEs yet and no fixed mainline or stable release; the ksmbd race fix sits in the ksmbd maintainer tree and an SMB Direct fix is in a branch aimed at Linux 7.5. No exploitation reported. Only machines running ksmbd are exposed to the RCEs.
› ISC BIND 9 (named) DNS server
ISC disclosed a remotely exploitable memory-corruption bug in BIND 9's named on Oct 21. An attacker who captures a GSS-TSIG signed UDP message (the Kerberos signing used for Active Directory-style dynamic DNS updates) can replay it while the negotiated key is still valid and, combined with crafted queries to a zone they control, may get remote code execution, or at least crash named. CVSS 8.1 (High). No workaround. Affects BIND 9.11.0 through 9.18.50, 9.20.0 through 9.20.29 and 9.21.0 through 9.21.26. Fixed in 9.20.30 and 9.21.27; ISC lists no 9.18 fix. ISC knows of no active exploitation. Debian trixie has a fixed package; Debian bookworm and Ubuntu are still waiting.
› Node.js
On Oct 21 2026 Node.js shipped security updates for 22.x, 24.x and 26.x fixing ten vulnerabilities. The headline issue is CVE-2026-111497, a high-severity Brotli decoder out-of-bounds write that can enable remote code execution when attacker-controlled Brotli data is decoded. The same release also fixes TLS hostname/IP bypasses and DNS NUL truncation, and refreshes the bundled CA store for the eMudhra incident.
› EG Secure Solutions SiteGuard Server Edition patched
EG Secure Solutions SiteGuard Server Edition contains an OS command injection vulnerability which may allow an attacker to execute arbitrary OS commands with root or SYSTEM privileges on the system running the affected product. Added to CISA KEV on 2026-10-20.
› PHP
Two critical remote-code-execution flaws in PHP core (CVE-2026-109618 and CVE-2026-109619, aka “PHP2Shell”) were disclosed early after an embargo leak. Both score CVSS 9.2 and can let an unauthenticated attacker run code on servers serving PHP web requests, especially Apache mod_php. Patches shipped Oct 21 2026 (appliance vendors such as QNAP are still preparing fixes); exploitation attempts were observed before and after the patch, and watchTowr / AWS report active scanning.
› Plex Media Server
Four Plex Media Server flaws (CVE-2026-96652/96654/96655/96656), together called Plex2Shell, chain to unauthenticated admin-token theft and code execution. Researcher Zach Main published details Oct 16 and a PoC shortly after; exploitation of internet-facing servers (cryptominers + residential proxies) began by Oct 17. Fixed in 1.43.3.10861 (released earlier in August); CISA added the chain to KEV with a federal deadline of Oct 23.
› Ahsay AhsayCBS patched
Ahsay AhsayCBS contains a command injection vulnerability that could allow a remote attacker to execute operating system commands via manipulation of the random parameter in the Replication Receiver component’s /rps/api/json/UpdateReceivers.do endpoint. This vulnerability can be chained with CVE-2026-105133. CISA added CVE-2026-105134, CVE-2026-105133 to the Known Exploited Vulnerabilities catalog on 2026-10-14 based on evidence of active exploitation.
› Palo Alto Networks PAN-OS patched
Palo Alto Networks PAN-OS contains a code injection vulnerability that could allow an authenticated attacker with network access to execute arbitrary code with root privileges on the firewall. Added to CISA KEV on 2026-10-14.
› Ivanti Connect Secure (ICS)
Volexity observed threat actor UTA0576 chaining an Ivanti Connect Secure authentication-bypass / RCE zero-day (CVE-2026-104935) with additional flaws from about Oct 1–3 2026 to get unauthenticated root on fully patched appliances, re-exploiting in memory without planting webshells. Ivanti patched CVE-2026-104935 on Oct 13; CISA added it to KEV. One privilege-escalation piece of the chain was still being fixed at disclosure.
› Microsoft SharePoint patched
Microsoft SharePoint contains a code injection vulnerability which could allow an authorized attacker to execute code over a network. Added to CISA KEV on 2026-09-25.
› WordPress Core patched
WordPress Core contains a remote file inclusion vulnerability which could allow an unauthenticated attacker to make page-template resolution include a chosen readable local `.php` file outside the active theme directories, leading to remote code execution. Added to CISA KEV on 2026-09-25.
› N-able N-central patched
N-able N-central contains a static code injection vulnerability that could allow for pre-authentication remote code execution. Added to CISA KEV on 2026-09-08.
› Kestra Kestra OSS patched
Kestra OSS contains an OS command injection vulnerability that could allow an unauthenticated remote attacker to create and execute arbitrary workflows without credentials. Added to CISA KEV on 2026-09-02.
› Sangoma Switchvox patched
Sangoma Switchvox contains a SQL injection vulnerability which allows an unauthenticated remote attacker to execute arbitrary SQL statements against the backend PostgreSQL database using a single crafted request, including database operations and remote code execution. Added to CISA KEV on 2026-09-02.
› Gitea Gitea patched
Gitea contains a code injection vulnerability that allows an attacker with repository write access to send a malicious patch to the diffpatch API endpoint to plant an executable Git hook and run shell commands as the Gitea service account. Added to CISA KEV on 2026-08-25.
› Synacor Zimbra Collaboration Suite (ZCS) patched
Zimbra Collaboration Suite (ZCS) contains an OS command injection vulnerability which could allow an unauthenticated attacker to send specially crafted SMTP requests that may result in execution of arbitrary operating system commands as the Zimbra user. Added to CISA KEV on 2026-08-21.
› TrueConf Server patched
TrueConf Server contains a code injection vulnerability that could allow an unauthorized remote attacker with network access via port 4307/TCP to use a specially crafted script to break out of the isolated environment and execute arbitrary code on the host system. CISA added CVE-2026-72530, CVE-2026-72529 to the Known Exploited Vulnerabilities catalog on 2026-08-20 based on evidence of active exploitation.
› Microsoft Internet Key Exchange (IKE) Service Extensions patched
Microsoft Internet Key Exchange (IKE) Service Extensions contains a double free vulnerability that could enable remote code execution. Added to CISA KEV on 2026-08-18.
› Ray-Project Ray patched
Ray-Project Ray contains a code injection vulnerability that could allow remote code execution. Developers using Ray as a development tool may be exposed to this vulnerability exploitable through Firefox and Safari. Added to CISA KEV on 2026-08-17.
› Progress LoadMaster patched
Progress LoadMaster contains a command injection vulnerability that allows an un-authenticated attacker to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in multiple command endpoints. Added to CISA KEV on 2026-08-07.
› JetBrains TeamCity patched
JetBrains TeamCity contains a deserialization of untrusted data vulnerability that could allow unauthenticated remote code execution via the agent polling protocol. Added to CISA KEV on 2026-08-05.
› IBM Langflow patched
Langflow contains a code injection vulnerability that allows unauthenticated attackers to achieve full remote code execution on default Langflow deployments. Added to CISA KEV on 2026-08-04.
› Arista VeloCloud Orchestrator patched
Arista VeloCloud Orchestrator On-Prem contains an OS command injection vulnerability that may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator. Added to CISA KEV on 2026-07-27.
› WordPress Core patched
WordPress Core contains a SQL injection vulnerability when a plugin or theme passes untrusted input to the parameter. This vulnerability can be chained with CVE-2026-63030 to allow an unauthenticated attacker to gain remote code execution on default WordPress installations. CISA added CVE-2026-60137, CVE-2026-63030 to the Known Exploited Vulnerabilities catalog on 2026-07-21 based on evidence of active exploitation.
› Fortinet FortiSandbox patched
Fortinet FortiSandbox, FortiSandbox Cloud, and FortiSandbox PaaS contain an OS command injection vulnerability that allows an unauthenticated attacker to execute unauthorized commands via specifically crafted HTTP requests. CISA added CVE-2026-25089, CVE-2026-39808 to the Known Exploited Vulnerabilities catalog on 2026-07-16 based on evidence of active exploitation.
› Joomlack Page Builder patched
Joomlack Page Builder contains an improper access control vulnerability that could allow for remote code execution via unauthenticated arbitrary file upload. Added to CISA KEV on 2026-07-07.
› Ivanti Sentry patched
Ivanti Sentry (formerly known as MobileIron Sentry) contains an OS command injection vulnerability which could allow a remote unauthenticated user to achieve root-level remote code execution. This vulnerability can be successfully exploited in cases where the Sentry appliance is in an unmanaged state with its endpoints externally reachable. The use of mTLS with EPMM or restricted HTTPS access through Neurons for MDM makes interfaces inaccessible to external actors. Added to CISA KEV on 2026-06-11.
› BerriAI LiteLLM patched
BerriAI LiteLLM contains a command injection vulnerability that could allow any authenticated user, including holders of low-privilege internal-user keys, to run arbitrary commands on the host. CISA added CVE-2026-42271, CVE-2026-48710 to the Known Exploited Vulnerabilities catalog on 2026-06-08 based on evidence of active exploitation.
› Drupal Core patched
Drupal Core contains a SQL injection vulnerability that could allow for privilege escalation and remote code execution via specially crafted requests sent with the database abstraction API. Added to CISA KEV on 2026-05-22.
› Ivanti Endpoint Manager Mobile (EPMM) patched
Ivanti Endpoint Manager Mobile (EPMM) contains an improper input validation vulnerability that allows a remotely authenticated user with administrative access to achieve remote code execution. Added to CISA KEV on 2026-05-07.
› Apache ActiveMQ patched
Apache ActiveMQ contains an improper input validation vulnerability that allows for code injection. Added to CISA KEV on 2026-04-16.
› F5 BIG-IP patched
F5 BIG-IP APM contains a stack-based buffer overflow vulnerability that could allow a threat actor to achieve remote code execution. Added to CISA KEV on 2026-03-27.
› Langflow Langflow patched
Langflow contains a code injection vulnerability that could allow building public flows without requiring authentication. Added to CISA KEV on 2026-03-25.
› Broadcom VMware Aria Operations patched
Broadcom VMware Aria Operations formerly known as vRealize Operations (vROps) contains a command injection vulnerability that allows an unauthenticated attacker to execute arbitrary commands, potentially leading to remote code execution during support‑assisted product migration. Added to CISA KEV on 2026-03-03.
› Roundcube Webmail patched
RoundCube Webmail contains a deserialization of untrusted data vulnerability that allows remote code execution by authenticated users because the _from parameter in a URL is not validated in program/actions/settings/upload.php. CISA added CVE-2025-49113, CVE-2025-68461 to the Known Exploited Vulnerabilities catalog on 2026-02-20 based on evidence of active exploitation.
› BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA) patched
BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA)contain an OS command injection vulnerability. Successful exploitation could allow an unauthenticated remote attacker to execute operating system commands in the context of the site user. Successful exploitation requires no authentication or user interaction and may lead to system compromise, including unauthorized access, data exfiltration, and service disruption. Added to CISA KEV on 2026-02-13.
› React Native Community CLI patched
React Native Community CLI contains an OS command injection vulnerability which could allow unauthenticated network attackers to send POST requests to the Metro Development Server and run arbitrary executables via a vulnerable endpoint exposed by the server. On Windows, attackers can also execute arbitrary shell commands with fully controlled arguments. Added to CISA KEV on 2026-02-05.
› Sangoma FreePBX patched
Sangoma FreePBX Endpoint Manager contains an OS command injection vulnerability that could allow for a post-authentication command injection by an authenticated known user via the testconnection -> check_ssh_connect() function. An attacker can leverage this vulnerability to potentially obtain remote access to the system as an asterisk user. Added to CISA KEV on 2026-02-03.
› SolarWinds Web Help Desk patched
SolarWinds Web Help Desk contains a deserialization of untrusted data vulnerability that could lead to remote code execution, which would allow an attacker to run commands on the host machine. This could be exploited without authentication. Added to CISA KEV on 2026-02-03.
› Ivanti Endpoint Manager Mobile (EPMM) patched
Ivanti Endpoint Manager Mobile (EPMM) CVE-2026-1340 — unauthenticated RCE via code injection — was exploited in limited attacks disclosed late January 2026. CISA later ordered federal agencies to patch within days in April when adding/prioritizing the KEV entry.
› Ivanti Endpoint Manager Mobile (EPMM) patched
Ivanti Endpoint Manager Mobile (EPMM) contains a code injection vulnerability that could allow attackers to achieve unauthenticated remote code execution. Added to CISA KEV on 2026-01-29.
› SmarterTools SmarterMail patched
SmarterTools SmarterMail contains an unrestricted upload of file with dangerous type vulnerability that could allow an unauthenticated attacker to upload arbitrary files to any location on the mail server, potentially enabling remote code execution. CISA added CVE-2025-52691, CVE-2026-23760 to the Known Exploited Vulnerabilities catalog on 2026-01-26 based on evidence of active exploitation.
› Cisco Unified Communications Manager patched
Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager Session Management Edition (Unified CM SME), Cisco Unified Communications Manager IM & Presence Service (Unified CM IM&P), Cisco Unity Connection, and Cisco Webex Calling Dedicated Instance contain a code injection vulnerability that could allow the attacker to obtain user-level access to the underlying operating system and then elevate privileges to root. Added to CISA KEV on 2026-01-21.
Blog: Detecting PHP2Shell and Other PHP Vulnerabilities with ZAP PHP2Shell is the latest big “named” vulnerability. ZAP can now tell you if a site is running a vulnerable version of PHP, and it does so without sending a single extra request. t.co/9G4DtEhMM6 #php2shell
#PHP2Shell is a big one. Here are my takeaways. 1. These flaws reach back more than a decade. PHP’s maintainers identified one underlying problem in 2024, but its full impact wasn’t clear until AI-assisted research demonstrated its exploitability. What seems impractical to exploit today could easily be exploitable tomorrow as models advance. 2. Much of the web runs on PHP, and a lot of it is on versions that are out of support. Some get a source backport you must build yourself. Some get nothing. Attackers aren't hunting the servers you just patched. They're hunting the ones you forgot you own. There is going to be a very long tail on remediating these vulnerabilities, and we will see many downstream breaches over the coming months. 3. The patching window has completely collapsed. While we’ve exponentially found more vulnerabilities and exponentially created more patches, we’ve hit the sound barrier on operationally rolling them out. Even more concerning is the increase in exploitation occurring before or on the day of disclosure. When a flaw gets exploited, almost 90% of the time it’s hit on or before the day it’s disclosed. As defenders, you need to be looking at your watch, not a calendar! 4. Coordinated disclosure in open source is really hard. It runs on trust, not contracts. There were many people in the loop, and for good reason. Lots of great people doing incredible work. However, I expect leaked disclosures will be the norm, not the exception, as we move forward in the Agent-state era. The @a16z chart below says it all.
An update on PHP2Shell and the eMudhra certificate compromise. We've confirmed that Appwrite is not affected by PHP2Shell. Appwrite Cloud is also patched for eMudhra in every region. Here's what we've checked and what self-hosted users should do. 🧵
Linuxカーネルの未修正脆弱性が、再現コードつきで公開メーリングリストに流れた。 t.co/VzG4TT7bJz 送ったのはTrend Micro傘下のZDI。 宛先にはsecurity@kernel.orgが指定されていたが、Ccに公開リスト（linux-kernel等）が含まれていた。 CVSS 9.0が2件。 いずれもカーネル内蔵SMBサーバーksmbdの問題で、RDMAデバイスとSMB Directを使う構成が影響を受ける。 Linuxカーネルのナンバー2、Greg Kroah-Hartman氏はパッチなしで公開リストに送られたことを問題視し、報告プロセスの修正を求めている。 ZDIの正式なアドバイザリ公開は2027年2月予定。 技術詳細はすでに読める。
Trend Micro's ZDI posted unpatched Linux kernel bugs to the public mailing list by mistake. - ksmbd race: RCE, CVSS 9.0 - SMB Direct underflow: RCE, CVSS 9.0 - skb_zerocopy: local privilege escalation No mainline fix yet. Anyone actually running ksmbd in production? t.co/OAxNNSvdtG
BIND 9 DNS: replaying GSS-TSIG signed UDP messages can corrupt memory in named. Worst case: remote code execution. CVSS 8.1, no workaround. No known exploits yet. Upgrade to 9.20.30 / 9.21.27. On 9.18? Check with ISC. t.co/s2ChkYWdYG
+26 more on the incident pages above.
