Threats tagged 'rce'

This is a research dashboard providing dated evidence and detailed case studies on global cyber incidents across multiple sectors including critical infrastructure, finance, healthcare, and AI. It compiles 18 incident dossiers with evidence classifications, source links, and tools for infrastructure dependency analysis and emergency preparedness. The dashboard is a static snapshot as of November 2, 2026, and is not a live alerting service.

This analysis from Microsoft Security Research examines the characteristics of software vulnerabilities that have been exploited in real-world attacks. Out of approximately 383,000 disclosed vulnerabilities through September 2026, only about 2,000 (0.5%) have been linked to actual exploitation. Exploited vulnerabilities disproportionately enable system takeover, such as remote code execution (RCE), privilege escalation, and authentication bypass. The study classifies vulnerabilities by impact and platform, highlighting that exploitation is concentrated in vulnerabilities that provide attackers with significant control. Patching remains critical but is often slow, necessitating focused defensive efforts on high-impact vulnerabilities.

This report summarizes multiple significant cyber threats and incidents disclosed in early November 2026. Major breaches include a $6.3 billion cryptocurrency theft from Binance via compromised internal infrastructure, a malicious JavaScript attack on Polymarket's platform, and data breaches affecting Japan Airlines and the Florida Department of Education. The report also highlights the use of AI by threat actors such as the GOLD OGRE ransomware group and North Korean cyber operators to enhance attack capabilities. Several critical vulnerabilities are noted, including CVE-2026-111497 (HTTP2Shell) affecting Brotli decompression, a critical Linux kernel TCP networking flaw (CVE-2026-98432), and a Drupal Commerce Core access control vulnerability (CVE-2026-118539). Cisco patched a high-severity SSL VPN crash vulnerability (CVE-2026-76418) that was exploited in the wild. Additional threat intelligence includes malware campaigns and advanced persistent threat activity targeting various sectors globally.

A remote code execution vulnerability exists in Microsoft Qlib's StaticDataLoader component. Exploitation requires user interaction, such as visiting a malicious webpage or opening a malicious file. The vulnerability allows remote attackers to execute arbitrary code on affected systems.

A remote code execution vulnerability exists in Microsoft Qlib due to unsafe deserialization in the RestrictedUnpickler component. Exploitation requires user interaction, such as visiting a malicious webpage or opening a malicious file. The vulnerability has a high severity rating with a CVSS score assigned by ZDI as 7.8.

A remote code execution vulnerability exists in Microsoft Qlib's MLflowRecorder component due to deserialization of untrusted data. Exploitation requires user interaction, such as visiting a malicious webpage or opening a malicious file. The vulnerability has a high severity rating of 7.8 assigned by ZDI.

TànPhá V3 is an open-source, modular penetration testing framework designed for Termux on Android and lightweight Linux environments. It automates discovery, fingerprinting, vulnerability assessment, validation, and reporting using a state-machine architecture. The tool supports multiple exploitation vectors including SQL injection, command injection, file upload, local file inclusion, and a stateful PHP remote access trojan (RAT). It features automatic CSRF token bypass for authenticated scans and basic web application firewall evasion. The project is actively maintained with plans for advanced evasion techniques and additional modules in future releases. It is intended solely for authorized security testing and educational purposes.

CVE-2026-98432 is a memory corruption vulnerability in the Linux kernel's IPv4 TCP handshake path affecting kernel versions 4.4 and later. This flaw could lead to remote code execution. AWS has released updated kernel packages for Amazon Linux 2 and Amazon Linux 2023 to address this issue. Customers running self-managed Linux instances are advised to update and reboot their systems. AWS-managed services are being updated by AWS with no customer action required.

A high-severity unauthenticated race condition vulnerability in WordPress's Core update process allows remote code execution. The flaw arises from predictable, web-accessible staging directories during updates, enabling attackers to exploit a narrow time window while WordPress unpacks updates. WordPress 7.1.4 and earlier branches have been patched to randomize staging directories and prevent unsafe configuration promotion. Exploitation attempts began shortly after patch release, but no successful compromises have been reported.

php2shell comprises two PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619) that allow unauthenticated remote code execution. Exploitation requires tailoring the attack to the specific PHP environment, making widespread mass exploitation difficult. However, network appliances running identical builds are vulnerable to a single calibrated exploit. Exploitation has been confirmed in the wild, including attacks on PAN-OS firewall management servers. Patching is available and strongly recommended, especially for internet-facing management interfaces and end-of-life PHP versions.

A remote code execution vulnerability exists in MLflow's PickleEvaluationArtifact deserialization process. Exploitation requires user interaction, such as visiting a malicious page or opening a malicious file. The vulnerability has a high severity rating of 7.8 assigned by ZDI and is tracked as CVE-2026-118623.

A remote code execution vulnerability exists in MLflow's SHAP load_explainer functionality. Exploitation requires user interaction, such as visiting a malicious page or opening a malicious file. The vulnerability has a high severity rating assigned by ZDI with a CVSS score of 7.8.

A remote code execution vulnerability exists in MLflow's Statsmodels _load_model function. Exploitation requires user interaction, such as visiting a malicious webpage or opening a malicious file. The vulnerability is assigned CVE-2024-37052 and has a high severity rating by ZDI with a CVSS score of 7.8.

JNISleuth-MCP is an open-source tool designed to assist analysts in unpacking and analyzing stripped Android native (.so) malware libraries. It automates the recovery of JNI RegisterNatives bindings, deobfuscates ARM64 OLLVM indirect branches, and bypasses anti-Frida tracing techniques using a stealth Dobby agent. The tool integrates with reverse engineering platforms like Ghidra and IDA Pro to provide unified cross-boundary analysis from Java to native code, facilitating malware triage and research.

CVE-2026-101767 is a critical unauthenticated SQL injection vulnerability in Oracle E-Business Suite's Application Object Library. It allows remote attackers to execute arbitrary code and fully compromise the affected component. The flaw was patched in Oracle's October 2026 CPU, and exploitation attempts were observed shortly after the patch release.

A type confusion vulnerability in Apple Safari's jsToWasm IC entrypoint allows remote attackers to execute arbitrary code. Exploitation requires user interaction, such as visiting a malicious webpage or opening a malicious file. The vulnerability is assigned CVE-2026-86974 with a high severity rating of 8.8 by ZDI.

A numeric truncation error vulnerability in Valkey's clusterCreatePublishMsgBlock function allows remote authenticated attackers to execute arbitrary code. The vulnerability requires authentication and has been rated with a high severity score by the Zero Day Initiative.

A remote code execution vulnerability exists in Ultralytics due to unsafe deserialization in the torch_load function. Exploitation requires user interaction, such as visiting a malicious webpage or opening a malicious file. The vulnerability has been assigned CVE-2026-118613 and a CVSS rating of 7.8 by the Zero Day Initiative.

A remote code execution vulnerability exists in Ultralytics' check_det_dataset component, allowing attackers to execute arbitrary code if a user interacts with malicious content. The vulnerability requires user interaction such as visiting a malicious page or opening a malicious file. It has been assigned CVE-2026-118614 and a CVSS rating of 7.8 by the Zero Day Initiative.