22 stories tagged remote-code-execution, newest first.
384 points by theanonymousone | 200 comments
Aikido blog post explaining CVE-2026-111497, a critical Brotli decoder out-of-bounds write affecting Node.js, Python, and HTTP libraries, with patch versions and workarounds.
683 points by petecooper | 244 comments
A Tell HN post in which a user apologizes for unknowingly breaking the coordinated disclosure embargo on two PHP remote code execution CVEs, followed by community discussion.
395 points by artooro | 92 comments
GitLab's critical patch release notes for versions 19.5.1 and backports, fixing a CVSS 10.0 regex compiler integer overflow RCE and other security issues.
761 points by ejohnso49 | 394 comments
PHP Foundation blog post on a PHP security release fixing two critical RCE vulnerabilities, how they were found, the disclosure leak, and how PHP security work is being strengthened.
1036 points by tuyuri | 562 comments
GitHub release page for PHP 8.2.35, a security release fixing two critical unauthenticated remote code execution vulnerabilities; PHP 8.2 reaches end of life December 2026.
398 points by danlark1 | 184 comments
Wiz Research blog post detailing PHP2Shell, critical memory-safety and pre-auth RCE vulnerabilities in the core PHP engine found with help of frontier AI models.
204 points by soeckly | 101 comments
A security writeup describing how a self-contained Flask session secret on Google DevSite enabled forged sessions and remote code execution across seven Google domains for a $90,000 bounty.
41 points by tau255 | 23 comments
Orange Cyberdefense SCRT blog post describing how a vulnerable Twitch chat overlay in an unsandboxed OBS Browser Source plus a V8 bug enabled code execution on a streamer's PC.
779 points by negura | 473 comments
NVD vulnerability detail page for CVE-2026-85046, reportedly an actively exploited sandbox remote code execution flaw affecting Chromium.
381 points by infosecau | 209 comments
Searchlight Cyber research post by Adam Kues describing finding a WordPress remote code execution vulnerability using GPT5.6 for about $25.
424 points by bo0tzz | 89 comments
Wiz Research blog post detailing CVE-2026-3854, a critical flaw in GitHub's internal git infrastructure enabling remote code execution on GitHub.com and GitHub Enterprise Server.
737 points by riffraff | 450 comments
CVE record CVE-2026-20841 published by Microsoft describing a remote code execution vulnerability in the Windows Notepad app.
343 points by MrBruh | 144 comments
Blog post describing a remote code execution vulnerability found by decompiling AMD's AutoUpdate software, which AMD declined to fix.
406 points by CyberShadow | 135 comments
Security advisory describing an unauthenticated remote code execution vulnerability in the OpenCode AI coding assistant's local HTTP server, fixed in later versions.
657 points by spiridow | 219 comments
Kudelski Security research post describing how a pull request to CodeRabbit led to remote code execution and write access to about one million repositories.
357 points by dgl | 147 comments
A blog post explaining CVE-2025-48384, a Git vulnerability where carriage return handling allows remote code execution via git clone --recursive on Unix-like systems.
490 points by MrBruh | 230 comments
A blog post describing a one-click remote code execution vulnerability found in ASUS's preinstalled DriverHub driver software.
1062 points by xyzeva | 268 comments
A security researcher's blog post describing how a Firebase misconfiguration in ToDesktop, an Electron app bundler used by Cursor and others, allowed code execution on millions of users.
385 points by NetBender | 280 comments
Security researcher evilsocket's writeup of a remote code execution attack on GNU/Linux and UNIX systems via CUPS and cups-browsed, plus notes on the disclosure process.
781 points by robinhoodexe | 290 comments
Qualys security advisory describing CVE-2024-6387 (regreSSHion), a signal handler race condition enabling unauthenticated remote code execution in OpenSSH's sshd on glibc Linux.
443 points by memcorruption | 113 comments
A security research blog post explaining how Lua bytecode flaws in the game Factorio can be exploited for memory corruption and remote code execution.
1207 points by junon | 743 comments
Bluesky post by Filippo Valsorda sharing preliminary analysis that the xz backdoor enables gated, unreplayable RCE via a hooked RSA_public_decrypt verifying an Ed448 signature.