Everything Shell Bulletin has reported about Remote Code Execution: 7 stories, newest first. Part of our Vulnerabilities coverage.
Attackers can execute code remotely on unpatched PHP servers via two critical flaws. Patches are available for supported versions; isolate systems if you cannot update immediately.
Attackers with minimal permissions can run code on Argo CD servers by injecting Helm plugins into Git repositories or API uploads.
Attackers can run arbitrary commands on Piflow 2.0.0 and 2.0.1 systems without login credentials, risking total server control.
AWS patches a cross-site scripting flaw in Kiro IDE that lets attackers run code through malicious color theme names when users open workspaces.
A type confusion flaw in Microsoft RPC Runtime allows network-based remote code execution, rated 8.8 CVSS, affecting multiple Windows versions.
A researcher showed how forged Flask sessions on Google’s developer sites could run remote code. The vendor fixed the issue and paid a reward.
A critical vulnerability in Dromara Skyeye allows attackers to run scripts on servers without logging in.