RCE
9 articles with this tag
CVE-2026-87902 — Unauthenticated file inclusion in WordPress core (conditional RCE): explainer and fix
Unauthenticated local file inclusion in WordPress core 4.7–7.1.1 (CWE-98), leading to RCE when theme and server conditions line up. Fixed 22 September (7.1.2 and every branch back to 4.7); CISA added it to KEV on 25 September. This site's view: an EPSS of 3% does not matter once it is in KEV. Update, and also turn off PHP's register_argc_argv to remove the server-side condition RCE needs.
Insecure deserialization: the risk of letting external data choose the object type, and how to prevent it
The danger in deserialization is not that bad values arrive; it is that some formats let external data decide which type of object to construct. So the damage does not stop at corrupted data — OWASP lists denial of service, access control bypass and remote code execution. Two defenses: switch to a pure data format so nothing chooses types for you, and sign serialized messages so unsigned ones are never restored. And some mechanisms cannot be made safe by configuration at all; the only fix is not using them.
CVE-2026-0770 — Unauthenticated remote code execution in Langflow (explainer & fixes)
An unauthenticated RCE in Langflow's validate endpoint (CVE-2026-0770, CWE-829). Untrusted input reaches Python exec() via the exec_globals parameter, yielding arbitrary code execution without authentication (CVSS 9.8, in CISA KEV, actively exploited). As of publication ZDI/GitHub Advisory/NVD list no fixed version; ZDI's recommended mitigation is to restrict interaction with the product. The main response is to stop exposing it — network isolation + authentication — plus updating to the latest release. Langflow has had repeat validate-endpoint RCEs, so don't rely on a single patch.
CVE-2026-63030 / CVE-2026-60137 — Unauthenticated SQLi to RCE in WordPress core (explainer & fixes)
A REST API batch-endpoint route-confusion flaw in WordPress core (CVE-2026-63030, CWE-436) chains with the WP_Query author__not_in SQL injection (CVE-2026-60137, CWE-89) to reach unauthenticated SQLi → RCE (CVSS 9.8, in CISA KEV). Both are fixed in the same release. The main fix is updating core to 6.8.6 / 6.9.5 / 7.0.2, plus a compromise check. WordPress is core software with an enormous install base, so updating is the top priority.
CVE-2026-48939 — Unauthenticated upload to RCE in iCagenda (Joomla): explainer & fixes
iCagenda (Joomla events-calendar extension) 3.2.1–3.9.14 and 4.0.0–4.0.7 has an unauthenticated arbitrary file upload → RCE (CVSS 10.0, in CISA KEV). Access control on the public event-registration form's attachment handler was reportedly enforced only at the view layer, not the controller. The main fix is updating to 3.9.15 or 4.0.8, plus a compromise check. The durable defense is designing out the 'unauthenticated upload → RCE' pattern.
CVE-2026-48908 — Unauthenticated upload to RCE in SP Page Builder (Joomla): explainer & fixes
SP Page Builder for Joomla (by JoomShaper) ≤ 6.6.1 has an unauthenticated arbitrary file upload → RCE (CVSS 10.0, in CISA KEV). The custom-icon upload reportedly ran no auth or type validation. The main fix is updating to 6.6.2, plus a compromise check (rogue admins, web shells). The durable defense is designing out the 'unauthenticated upload → RCE' pattern.
File upload vulnerabilities — preventing web shells and RCE by design
The problem with an upload vulnerability isn't 'receiving a file' — it's where you put it and whether it can execute. Unauthenticated endpoint + no type validation + stored under the web root + scripts run there = web shell → RCE. Defend in layers: (1) auth/permission + CSRF on the endpoint, (2) server-side allow-list + content inspection, (3) store outside the web root (or disable execution), (4) randomize names, never trust user paths. Don't rely on one control; have something that can stop the attack at every step.
What is RCE (Remote Code Execution) — why it's the worst class of bug
RCE lets an attacker run arbitrary code on your server — straight to takeover, the worst class. How far the damage spreads is set by the running process's privileges. The core defenses are fast patching, CVE monitoring, and least privilege.
An API key leaked from AI-written code and was used for fraudulent charges: the cause was an unpatched CVSS 10.0 vulnerability
The bill spike was a symptom. The cause was an unpatched, published CVSS 10.0 RCE. An anonymized case, distilled into defensive lessons.