• PHP mail() Command Injection to Remote Code Execution (RCE)

    Author: NullSecurityX Published: February 7, 2026 Source: https://nullsecurityx.medium.com/php-mail-command-injection-to-remote-code-execution-rce-b2991e929ca3 Summary This writeup walks through a long-standing class of vulnerability in PHP web applications: passing unsanitized user input into the fifth argument ($additional_parameters) of the built-in mail() function. Because PHP’s mail() shells out to the system Mail Transfer Agent (typically sendmail), attacker-controlled data in that argument is…

  • Gray Rabbits and the Tale of a One-Click Backdoor

    Author: Alexandru-Cristian Bardaș Published: September 10, 2026 Source: https://www.gendigital.com/blog/insights/research/one-click-backdoor-sogou Summary Gen Threat Labs disclosed CVE-2026-51990, a critical remote code execution flaw in Sogou Input Method, the Tencent-owned Chinese-language IME installed on hundreds of millions of Windows machines. A single crafted link was enough to reach a six-year-old, sandbox-disabled Chromium engine bundled inside the product and…

  • Compromising Signal’s Contact Discovery Enclave

    Author: Nihal, V12 Published: August 26, 2026 Source: https://v12.sh/blog/signal Summary Researchers at V12 report two critical object-lifetime vulnerabilities in Signal’s Contact Discovery Service (CDSI) that let the untrusted host server break the Intel SGX enclave boundary the service relies on for privacy. CDSI lets a Signal client learn which of its phone contacts use Signal…

  • Escaping Google Cloud Application Integration Sandbox: Straight into Borg

    Author: nopnop (@__nopnop) Published: August 26, 2026 Source: https://nopnop.pro/2026/08/26/escaping-google-cloud-application-integration-sandbox/ Summary Security researcher nopnop documents a sandbox-escape vulnerability, CVE-2025-0982, in Google Cloud’s Application Integration service. The service’s JavaScript task feature ran customer code on the Rhino engine (a Java-based JavaScript interpreter), and a weakness in its custom Java sandbox let the author break out and execute…

  • 45M Weekly Downloads at Risk: Next.js CVE-2026-75604 (CVSS 9.0) Enables Unauthenticated Remote Code Execution

    Author: Do Son (SecurityOnline.info) Published: August 26, 2026 Source: https://securityonline.info/nextjs-rce-vulnerability/ Summary Vercel has patched two critical, unauthenticated remote code execution flaws in Next.js, the widely used full-stack JavaScript framework. The primary bug, CVE-2026-75604 (CVSS 9.0), is a Windows-only path traversal that can lead to RCE; a second flaw in the image-optimization path (CVSS 9.5) allows…

  • Two bytes to RCE: chaining rift + PoolSlip into an ASLR-independent nginx 1.30.0 exploit

    Author: y198 (published on the Verichains blog) Published: June 6, 2026 Source: https://blog.verichains.io/p/two-bytes-to-rce-chaining-rift-poolslip Summary This Verichains writeup chains two separately disclosed nginx rewrite-engine memory-corruption bugs — CVE-2026-42945 (“rift”), a heap-overflow write primitive, and CVE-2026-9256 (“PoolSlip”), a heap over-read leak primitive — into a single remote code execution exploit against nginx 1.30.0 that works with ASLR…

  • AWS CloudGoat EC2 SSRF Exploitation

    Author: Raj Chandel (published on Hacking Articles) Published: April 22, 2026 Source: https://www.hackingarticles.in/aws-cloudgoat-ec2-ssrf-exploitation/ Summary This Hacking Articles tutorial walks through the ec2_ssrf scenario in CloudGoat, Rhino Security Labs’ open-source “vulnerable by design” AWS training framework. It is a CTF-style, hands-on lab rather than a vulnerability disclosure — there is no CVE. The scenario chains a…

  • AWS: IAM UpdateLoginProfile Abuse

    Author: Raj Chandel (published on Hacking Articles) Published: January 16, 2026 Source: https://www.hackingarticles.in/aws-iam-updateloginprofile-abuse/ Summary This Hacking Articles tutorial demonstrates an AWS IAM privilege-escalation technique based on the iam:UpdateLoginProfile permission: a low-privileged IAM user who is allowed to call UpdateLoginProfile against a higher-privileged user can reset that user’s AWS Console password and then sign in as…

  • AWS: IAM AssumeRole Privilege Escalation

    Author: Fatima Aziz (published on Hacking Articles) Published: July 12, 2025 Source: https://www.hackingarticles.in/aws-iam-assumerole-privilege-escalation/ Summary This Hacking Articles tutorial demonstrates an AWS IAM privilege-escalation technique driven by misconfiguration rather than a software flaw: a low-privileged IAM user can assume a highly privileged IAM role when that role’s trust policy is written too permissively. By calling sts:AssumeRole…

  • AWS: IAM CreateAccessKey Privilege Escalation

    Author: Fatima Aziz (published on Hacking Articles) Published: July 16, 2025 Source: https://www.hackingarticles.in/aws-iam-createaccesskey-privilege-escalation/ Summary This Hacking Articles tutorial demonstrates a well-known AWS IAM privilege-escalation technique that stems from misconfiguration rather than any software flaw: a low-privileged IAM user who has been granted the iam:CreateAccessKey permission on other users can mint a fresh access key for…