Threats tagged 'remote'

ARTEX is an AI-powered autonomous hacking platform used by cybercriminals to conduct large-scale, financially motivated attacks. It leverages AI agents to discover and exploit web vulnerabilities such as Remote Code Execution (RCE) and conduct supply chain attacks with minimal human interaction. The platform, originally open-source, has been forked and remains publicly accessible despite being closed by its developer. ARTEX operators primarily use Chinese AI models and deploy attacks broadly, targeting various industries including gray-market code-signing certificate shops. Misconfigurations expose many ARTEX instances publicly, enabling remote access to administrative interfaces and operator data.

A stack-based buffer overflow vulnerability in Ashlar-Vellum Cobalt XE file parsing allows remote attackers to execute arbitrary code. Exploitation requires user interaction, such as opening a malicious file or visiting a malicious page. The vulnerability is assigned CVE-2026-121744 with a high severity rating by ZDI.

A heap-based buffer overflow vulnerability exists in Ashlar-Vellum Cobalt's LI file parsing functionality. This flaw allows remote attackers to execute arbitrary code if a user opens a malicious file or visits a malicious page. The vulnerability requires user interaction for exploitation. It has been assigned CVE-2026-121752 and a CVSS rating of 7.8 by the Zero Day Initiative.

A use-after-free vulnerability in Ashlar-Vellum Cobalt XE file parsing allows remote attackers to execute arbitrary code. Exploitation requires user interaction, such as opening a malicious file or visiting a malicious page. The vulnerability has a high severity rating of 7.8 assigned by ZDI.

A heap-based buffer overflow vulnerability exists in Ashlar-Vellum Cobalt AR file parsing that allows remote attackers to execute arbitrary code. Exploitation requires user interaction, such as opening a malicious file or visiting a malicious page. The vulnerability is assigned CVE-2026-121743 with a high severity rating by ZDI.

A use-after-free vulnerability in Ashlar-Vellum Cobalt XE file parsing allows remote attackers to execute arbitrary code. Exploitation requires user interaction, such as opening a malicious file or visiting a malicious page. The vulnerability is rated high severity with a CVSS score of 7.8 assigned by ZDI.

CVE-2026-119084 is a remote code execution vulnerability in Amazon Redshift JDBC Driver versions prior to 2.3.0. The issue arises from unsafe class loading when processing JDBC connection URL parameters or AWS credentials profile fields, allowing arbitrary class execution.

Two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, known as PHP2Shell, allow unauthenticated remote code execution on affected servers. Emergency patches were released on October 21, 2026, for PHP versions 7.4, 8.0, 8.1, and supported 8.2–8.5 branches. Despite patches, millions of servers remain vulnerable. Exploitation attempts began shortly before patches were public, with confirmed real-world attacks including compromises of Palo Alto Networks devices. A third related vulnerability in Brotli (CVE-2026-111497) was patched later. Another unpatched PHP vulnerability (CVE-2026-115560) requires unusual configurations and is scheduled for a regular fix. Mitigation requires patching and auditing systems for compromise signs. Detection tools and updated security solutions can help identify exploitation attempts.

Google's November 2026 Android security updates address over 200 vulnerabilities, including a critical remote code execution flaw in the Framework component that requires no user interaction. The updates also fix multiple critical, high-severity, and denial-of-service vulnerabilities across Framework, System, Kernel, and various hardware components. The patches are delivered in two parts via security patch levels 2026-11-01 and 2026-11-05, covering a broad range of Android subsystems and vendor components.

A critical remote code execution vulnerability exists in Quest Foglight for Databases via the baseRmiServiceExporter component. This flaw allows unauthenticated remote attackers to execute arbitrary code on affected systems. The vulnerability is tracked as CVE-2026-92190 and has a CVSS rating of 9.8 assigned by the Zero Day Initiative.

A remote code execution vulnerability exists in Quest Foglight for Databases via the extractAndCreateUploadInfoList function. Exploitation requires authentication. The vulnerability has a high severity rating assigned by ZDI.

A critical remote code execution vulnerability exists in Quest Foglight for Databases due to missing authentication in the ForgeMBeanServerSupport component. This flaw allows remote attackers to execute arbitrary code without requiring authentication.

A remote code execution vulnerability exists in Quest Foglight for Databases via the installLicense directory traversal. Exploitation requires authentication. The vulnerability has a high severity rating assigned by ZDI.

A remote code execution vulnerability exists in Quest Foglight for Databases via the loadEvolveLicense directory traversal. Exploitation requires authentication. The vulnerability has a high severity rating of 8.8 assigned by ZDI and is tracked as CVE-2026-92195.

A remote code execution vulnerability exists in Quest Foglight for Databases via the loadManageServerLicense component. Exploitation requires authentication. The vulnerability has a high severity rating assigned by ZDI.

A remote code execution vulnerability exists in Quest Foglight for Databases via the paFnUploadFileAndCreateInfo directory traversal functionality. Exploitation requires authentication. The vulnerability has a high severity rating assigned by ZDI.

Quest Foglight for Databases contains a remote code execution vulnerability in the runScript functionality that requires authentication. Exploiting this flaw allows remote attackers to execute arbitrary code on affected installations. The vulnerability is rated high severity with a CVSS score of 8.8 by the Zero Day Initiative.

A remote code execution vulnerability exists in Quest Foglight for Databases due to a directory traversal issue in the unzipFile functionality. Exploitation requires authentication. The vulnerability has a high severity rating and allows remote attackers to execute arbitrary code on affected systems.

A critical remote code execution vulnerability exists in Quest Foglight for Databases that allows unauthenticated remote attackers to execute arbitrary code by controlling file paths. This vulnerability is identified as CVE-2026-92189 and has a CVSS rating of 9.8.

Quest Foglight for Databases contains a server-side template injection vulnerability in the renderTemplateString function that allows authenticated remote attackers to execute arbitrary code. This vulnerability requires authentication to exploit and has been assigned CVE-2026-92196 with a high severity rating by the Zero Day Initiative.