Posts Tagged ‘RCE’
wp2shell WordPress RCE: Patch Now
wp2shell WordPress RCE is now a two-CVE chain in CISA’s Known Exploited Vulnerabilities catalog — and it lets a completely unauthenticated attacker execute code on a default WordPress install with no plugins involved. If you run self-hosted WordPress and haven’t confirmed the July 17 auto-update landed, check today. What Happened wp2shell WordPress RCE combines two…
Read MoreCVE-2026-50522 SharePoint RCE: Patching Isn’t Enough
CVE-2026-50522 SharePoint RCE is now the third actively exploited remote code execution flaw hitting Microsoft’s on-premises collaboration platform in three weeks — and this one lets attackers steal cryptographic machine keys that remain valid long after the server is patched. If you run SharePoint Server 2016, 2019, or Subscription Edition on-premises, patching is no longer…
Read MoreServiceNow CVE-2026-6875 RCE: Sandbox Escape Exploited
ServiceNow CVE-2026-6875 RCE is now being actively exploited: a critical, unauthenticated sandbox-escape vulnerability in the ServiceNow AI Platform is under attack barely a week after the vendor shipped a fix, and ServiceNow’s own advisory has not yet caught up with independent confirmation of the exploitation. What Happened ServiceNow CVE-2026-6875 RCE traces back to a sandbox-escape…
Read MoreSonicWall SMA1000 CVE-2026-15409 RCE: Patch by July 17
SonicWall confirmed that the SonicWall SMA1000 CVE-2026-15409 RCE chain is being actively exploited: an unauthenticated attacker can force a target appliance into arbitrary requests, then pivot to full administrator-level command execution — no valid login required at any point. CISA added both flaws to its Known Exploited Vulnerabilities catalog, with a federal remediation deadline of…
Read MoreCVE-2026-48282 Adobe ColdFusion RCE Exploited in 2 Hours
CVE-2026-48282 Adobe ColdFusion RCE is now the fastest-weaponized CVSS-10.0 flaw DIESEC has tracked in 2026: attackers began exploiting Adobe’s maximum-severity ColdFusion vulnerability within two hours of public disclosure, and CISA has given US federal agencies until July 10 to patch. What Happened Adobe’s APSB26-68 security bulletin, released June 30, 2026, patched 11 CVEs across ColdFusion,…
Read More