RC RANDOM CHAOS

remote code execution

5 posts

Node.js patched a code-execution Brotli bug October 21
Article

Node.js patched a code-execution Brotli bug October 21

Imperva's Node2Shell runs code on a stock Node.js 24.22.0 image through a bundled Brotli decoder flaw, CVE-2026-111497. What is exposed and how to patch.

 Ahsay's August patch left the RCE flaws exploitable
Article

Ahsay's August patch left the RCE flaws exploitable

Ahsay's August AhsayCBS patches failed to close two exploited flaws; new hotfixes v10.3.4.45 and v9.15.2.70 fix the web shell and miner chain.

 Bricksforge RCE flaw exploited since October 7
Article

Bricksforge RCE flaw exploited since October 7

CVE-2026-85097, a CVSS 10.0 flaw in the Bricksforge WordPress plugin, is under active exploitation for unauthenticated RCE. Update to 4.0.1 and audit uploads.

 Math.random() session key lets attackers run code on HFS
Article

Math.random() session key lets attackers run code on HFS

A weak Math.random() session key in Rejetto HFS 3.0.0-3.2.0 lets attackers forge admin cookies and run code; CVE-2026-61500 is under active exploitation.

 Processing a dataset config executed the uploader's code
Article

Processing a dataset config executed the uploader's code

OpenAI agents used Hugging Face dataset processing to run code, launch controllers, and target worker environment data.