Remote Code Execution Archives • Daily CyberSecurity

QNAP Warns PHP2Shell Flaws Hit QTS and QuTS hero, Urges Users to Take NAS Offline QNAP PHP2Shell vulnerabilities affect QTS and QuTS hero NAS devices

QNAP PHP2Shell vulnerabilities affect QTS and QuTS hero NAS devices

QNAP Warns PHP2Shell Flaws Hit QTS and QuTS hero, Urges Users to Take NAS Offline

Do Son October 22, 2026

TL;DR QNAP says the QNAP PHP2Shell vulnerabilities affect QTS, QuTS hero, QuTScloud and several QNAP apps. The...

PHP2Shell Exploited in the Wild as PoC Exploits and Full Details Go Public PHP2Shell remote code execution flaws exploited in the wild after PoC release

PHP2Shell remote code execution flaws exploited in the wild after PoC release

PHP2Shell Exploited in the Wild as PoC Exploits and Full Details Go Public

Do Son October 22, 2026

TL;DR Attackers are now exploiting PHP2Shell, a pair of critical PHP remote code execution flaws tracked as...

Node.js Fixes 10 Flaws, Including Brotli RCE and TLS Hostname Bypasses Node.js security release fixes Brotli remote code execution and TLS hostname bypass flaws

Node.js security release fixes Brotli remote code execution and TLS hostname bypass flaws

Node.js Fixes 10 Flaws, Including Brotli RCE and TLS Hostname Bypasses

Do Son October 21, 2026

TL;DR On October 21, 2026, the Node.js project shipped versions 22.23.4, 24.22.1 and 26.12.1 to fix 10...

PHP Releases Fixes and Full Details for Two Critical Unauthenticated RCE Flaws PHP RCE vulnerabilities CVE-2026-109618 and CVE-2026-109619 allow unauthenticated remote code execution

PHP RCE vulnerabilities CVE-2026-109618 and CVE-2026-109619 allow unauthenticated remote code execution

PHP Releases Fixes and Full Details for Two Critical Unauthenticated RCE Flaws

Do Son October 21, 2026

TL;DR On October 21, 2026, the PHP team released PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12 to fix...

Oracle E-Business Suite Flaw CVE-2026-101809 Scores CVSS 10.0 A CVSS 10.0 E-Business Suite vulnerability, CVE-2026-101809, lets unauthenticated attackers take over Workflow

A CVSS 10.0 E-Business Suite vulnerability, CVE-2026-101809, lets unauthenticated attackers take over Workflow

Oracle E-Business Suite Flaw CVE-2026-101809 Scores CVSS 10.0

Do Son October 21, 2026

TL;DR Oracle fixed a CVSS 10.0 E-Business Suite vulnerability, CVE-2026-101809, in its October 2026 Critical Patch Update....

MariaDB Fixes Three CVSS 9.9 Flaws Among Seven New Vulnerabilities MariaDB critical vulnerabilities could lead to remote code execution on database servers

MariaDB Fixes Three CVSS 9.9 Flaws Among Seven New Vulnerabilities

Do Son October 21, 2026

TL;DR MariaDB disclosed seven more security flaws on October 16, 2026, including three rated CVSS 9.9. These...

Oracle Critical Patch Update October 2026 Fixes 1,209 CVEs Oracle Critical Patch Update for October 2026 fixes 1,209 CVEs, including six CVSS 10.0 bugs such as CVE-2026-101809 in E-Business Suite.

Oracle Critical Patch Update for October 2026 fixes 1,209 CVEs, including six CVSS 10.0 bugs such as CVE-2026-101809 in E-Business Suite.

Oracle Critical Patch Update October 2026 Fixes 1,209 CVEs

Do Son October 21, 2026

TL;DR The Oracle Critical Patch Update for October 2026 ships 1,295 security updates that fix 1,209 unique...

Advantech Patches 30 Flaws in ADAM-3600 Industrial RTU, Including Critical RCE Bugs Advantech ADAM-3600 vulnerabilities allow remote code execution on industrial RTUs

Advantech ADAM-3600 vulnerabilities allow remote code execution on industrial RTUs

Advantech Patches 30 Flaws in ADAM-3600 Industrial RTU, Including Critical RCE Bugs

Do Son October 21, 2026

TL;DR Singapore’s Cyber Security Agency disclosed 30 Advantech ADAM-3600 vulnerabilities on October 20, 2026. Seven are critical,...

PHP Prepares Emergency Fix as Cloudflare Reports Early Attacks on Critical Flaws PHP security release for critical remote code execution flaws CVE-2026-109618 and CVE-2026-109619

PHP security release for critical remote code execution flaws CVE-2026-109618 and CVE-2026-109619

PHP Prepares Emergency Fix as Cloudflare Reports Early Attacks on Critical Flaws

Do Son October 20, 2026

TL;DR The PHP team will ship a security release on October 21, 2026, at 14:00 UTC to...

Technical Details and PoC Exploit Published for Critical Drupal Field UI RCE (CVE-2026-108097) Drupal RCE vulnerability CVE-2026-108097 in Field UI with public PoC research

Drupal RCE vulnerability CVE-2026-108097 in Field UI with public PoC research

Technical Details and PoC Exploit Published for Critical Drupal Field UI RCE (CVE-2026-108097)

Do Son October 20, 2026

TL;DR FORTBRIDGE researcher Adrian Tiron has published a full technical analysis and lab exploit code for CVE-2026-108097,...

Redis RESTORE Flaw CVE-2026-25243 Now Exploited in the Wild, Honeypots Show Redis RESTORE vulnerability CVE-2026-25243 exploited in the wild against Redis servers

Redis RESTORE vulnerability CVE-2026-25243 exploited in the wild against Redis servers

Redis RESTORE Flaw CVE-2026-25243 Now Exploited in the Wild, Honeypots Show

Do Son October 20, 2026

TL;DR On October 16-17, 2026, Defused’s honeypots caught attackers exploiting CVE-2026-25243, a Redis RESTORE vulnerability rated CVSS...

Next.js Fixes Two Critical Unauthenticated RCE Flaws in Out-of-Band Update Next.js security update fixes unauthenticated remote code execution flaws

Next.js security update fixes unauthenticated remote code execution flaws

Next.js Fixes Two Critical Unauthenticated RCE Flaws in Out-of-Band Update

Do Son October 15, 2026

TL;DR Vercel shipped Next.js 16.4.1 and 15.5.28 on October 14, 2026, in an out-of-band release. The Next.js...

Palo Alto PAN-OS RCE Vulnerability CVE-2026-0322 Actively Exploited in the Wild

Do Son October 14, 2026

TL;DR Palo Alto Networks disclosed CVE-2026-0322, a high-severity Palo Alto PAN-OS RCE flaw in the firewall management...

Public PoC Exploit Disclosed for CVSS 10.0 GitLab Remote Code Execution Flaw CVE-2026-97229 Affecting 25,766 Hosts GitLab RCE vulnerability CVE-2026-97229 proof-of-concept exploit disclosed

GitLab RCE vulnerability CVE-2026-97229 proof-of-concept exploit disclosed

Public PoC Exploit Disclosed for CVSS 10.0 GitLab Remote Code Execution Flaw CVE-2026-97229 Affecting 25,766 Hosts

Do Son October 14, 2026

TL;DR GitLab patched CVE-2026-97229, a maximum-severity (CVSS 10.0) integer overflow flaw in its CI/CD regular expression compiler....

Public Proof-of-Concept Disclosed for CVE-2026-103572 Remote Code Execution in Visual Studio Copilot and SSMS Visual Studio Copilot RCE vulnerability CVE-2026-103572 path validation bypass

Visual Studio Copilot RCE vulnerability CVE-2026-103572 path validation bypass

Public Proof-of-Concept Disclosed for CVE-2026-103572 Remote Code Execution in Visual Studio Copilot and SSMS

Do Son October 14, 2026

TL;DR Microsoft released an October Patch Tuesday update to fix CVE-2026-103572, an Important remote code execution flaw...

SuiteCRM Patches Eight Vulnerabilities, Including Critical Remote Code Execution Flaw SuiteCRM vulnerabilities enabling remote code execution, SQL injection and privilege escalation

SuiteCRM vulnerabilities enabling remote code execution, SQL injection and privilege escalation

SuiteCRM Patches Eight Vulnerabilities, Including Critical Remote Code Execution Flaw

Do Son October 14, 2026

TL;DR SuiteCRM published eight security advisories on October 12, 2026, fixing flaws in versions 7 and 8...

Unpatched Shopware Flaw CVE-2026-104937 Turns Stored XSS Into Admin Takeover and RCE Shopware vulnerability CVE-2026-104937 stored XSS leading to admin token theft and remote code execution

Shopware vulnerability CVE-2026-104937 stored XSS leading to admin token theft and remote code execution

Unpatched Shopware Flaw CVE-2026-104937 Turns Stored XSS Into Admin Takeover and RCE

Do Son October 14, 2026

TL;DR CERT/CC disclosed CVE-2026-104937 on October 13, 2026, a stored XSS flaw in Shopware 6.7. The Shopware...

NVIDIA Fixes 18 AI Software Flaws, Led by CVSS 10.0 Bug in AIStore NVIDIA AIStore vulnerabilities enabling remote code execution in AI storage and training tools

NVIDIA AIStore vulnerabilities enabling remote code execution in AI storage and training tools

NVIDIA Fixes 18 AI Software Flaws, Led by CVSS 10.0 Bug in AIStore

Do Son October 13, 2026

TL;DR NVIDIA released six security bulletins on October 13, 2026, fixing 18 flaws in its AI software...

Wazuh Fixes 15 Vulnerabilities, Including Two Critical Root Code Execution Flaws Wazuh vulnerabilities enabling remote code execution as root on SIEM managers and agents

Wazuh vulnerabilities enabling remote code execution as root on SIEM managers and agents

Wazuh Fixes 15 Vulnerabilities, Including Two Critical Root Code Execution Flaws

Do Son October 13, 2026

TL;DR Wazuh 4.14.8 fixes 15 security flaws in the open-source SIEM and XDR platform. Two of these...

IBM Patches Three Critical Flaws in IBM i, Db2 Mirror and Maximo AI Service IBM critical vulnerabilities in IBM i, Db2 Mirror and Maximo enabling remote code execution