Topic

Remote Code Execution: news, advisories and analysis

80 articlesUpdated 23 Oct 2026

CyberSecureToday covers Remote Code Execution across 80 articles published between 9 Sep 2026 and 23 Oct 2026. The coverage includes 78 vulnerability advisories and 2 analysis or guidance pieces. 76 advisories are rated critical or high severity, and 19 involve flaws listed in CISA's Known Exploited Vulnerabilities catalog.

Stories on Remote Code Execution most often intersect with Active Exploitation, CVSS 9.8 and AI Security, with Technology, Cloud & SaaS the most affected sector. The most recent story, “OpenCode RCE Flaw Weaponizes Malicious Model Context Protocol Servers via OAuth Injection”, was published 23 Oct 2026. Every article is listed below, newest first, with the affected products, severity and remediation guidance in each piece.

Latest coverage

ResearchCloud & SaaS
OpenCode RCE Flaw Weaponizes Malicious Model Context Protocol Servers via OAuth Injection
A critical vulnerability in OpenCode allows malicious Model Context Protocol servers to execute arbitrary shell commands on Windows and WSL hosts during OAuth.
Priya Raman23 Oct 202612 min read
ThreatsCloud & SaaS
GitLab Patches Maximum-Severity CVSS 10.0 Unauthenticated RCE Flaw Spanning 12 Years of Releases
GitLab has released emergency security updates resolving CVE-2026-110264, a critical CVSS 10.0 integer overflow in the Onigmo regular expression compiler enabling unauthenticated RCE.
CST Editorial Desk22 Oct 202612 min read
ThreatsCloud & SaaS
Critical 'PHP2Shell' Core Runtime Flaws Trigger Unauthenticated RCE Across Millions of Web Servers
Emergency updates in PHP 8.5, 8.4, 8.3, and 8.2 fix the 'PHP2Shell' dual memory corruption flaws (CVE-2026-109618 and CVE-2026-109619), exposing servers to pre-execution code execution.
CST Editorial Desk22 Oct 202613 min read
ThreatsCloud & SaaSCritical
MariaDB Critical RCE Chain Exploits SYS_REFCURSOR Use-After-Free and ST_Area Over-Read
A critical exploit chain in MariaDB combined a cursor-array use-after-free with a geospatial memory disclosure to achieve command execution from low-privilege accounts.
CST Editorial Desk18 Oct 202616 min read
ThreatsCloud & SaaSHigh
AWS Amplify CLI Prototype Pollution Flaw in Velocity Template Engine Enabled Local Code Execution
A prototype chain traversal flaw in AWS Amplify's velocity template engine allowed attackers with malicious VTL files to execute arbitrary local commands.
Aisha Noor18 Oct 202614 min read
ThreatsCloud & SaaSCritical
LMCache Insecure Deserialization Flaw Exposes vLLM AI Inference Nodes to Unauthenticated Root RCE
A critical unauthenticated deserialization flaw in LMCache (CVE-2026-105192) allows remote attackers to execute arbitrary code with root privileges on vLLM clusters.
Aisha Noor18 Oct 202610 min read
ThreatsCloud & SaaSCritical
Cisco NX-OS Heap Buffer Overflow in NX-API Allows Unauthenticated Root Code Execution
A critical heap buffer overflow in Cisco NX-OS Software (CVE-2026-76471) allows unauthenticated remote attackers to execute arbitrary code with root OS privileges.
CST Editorial Desk18 Oct 20269 min read
ThreatsCloud & SaaSCritical
Adobe Commerce BlockStrap Template Injection Flaw Allows Unauthenticated Storefront Takeover
A CVSS 10.0 template injection flaw in Adobe Commerce and Magento (CVE-2026-103849) allows unauthenticated remote attackers to execute arbitrary code.
CST Editorial Desk18 Oct 202610 min read
ThreatsCloud & SaaSCritical
Windows OLE Untrusted Pointer Dereference Flaw Enables Network-Based Remote Code Execution
A critical untrusted pointer dereference vulnerability in Windows OLE (CVE-2026-96924) enables remote, unauthenticated code execution without user interaction.
CST Editorial Desk18 Oct 20269 min read
ThreatsCloud & SaaSCritical
Google Chrome Emergency Update Resolves Critical ANGLE Graphics Buffer Overflow Flaw CVE-2026-110152
Google issues an emergency Chrome update for desktop and Android fixing a critical buffer overflow (CVE-2026-110152) in the ANGLE graphics engine allowing remote code execution.
Mei-Lin Chen17 Oct 20268 min read
ThreatsCloud & SaaSCritical
Palo Alto Networks Patches Critical Command Injection Flaw CVE-2026-0313 in Cortex XSOAR Security Automation Engines
Palo Alto Networks fixes a high-severity command injection flaw in Cortex XSOAR (CVE-2026-0313) that allows network actors to execute arbitrary operating system commands.
CST Editorial Desk17 Oct 20269 min read
ThreatsCloud & SaaSCritical
Claude Agent SDK Argument Injection Flaw Enables Command Execution via MCP Configuration
Anthropic resolves a critical argument injection defect in Claude Agent SDK (CVE-2026-96620, CVSS 9.2) that allows untrusted session parameters to execute arbitrary OS commands.
Aisha Noor17 Oct 20268 min read
ThreatsCloud & SaaSCritical
Mage OSS Critical Authentication Bypass Flaw CVE-2026-111823 Exposes Enterprise ETL Data Pipelines to Remote Takeover
A critical vulnerability in Mage OSS (CVE-2026-111823, CVSS 9.8) enables unauthenticated attackers to forge OAuth sessions and seize administrative control of cloud data pipelines.
CST Editorial Desk17 Oct 20269 min read
ThreatsCloud & SaaSCritical
NGINX Plus & Open Source HTTP/3 QUIC Stream Use-After-Free Flaw CVE-2026-97205 Remediated
F5 NGINX resolves a critical use-after-free vulnerability in HTTP/3 QUIC stream processing (CVE-2026-97205) allowing worker process termination and code execution.
CST Editorial Desk15 Oct 20268 min read
ThreatsCloud & SaaSCritical
NGINX Heap Overflow in Regex Map Handling Threatens Worker Processes
F5 NGINX patches critical heap buffer overflow CVE-2026-93479 in ngx_http_core_module where regex map variables lead to worker crash and code execution.
CST Editorial Desk15 Oct 20268 min read
ThreatsCloud & SaaSCritical
Ivanti Endpoint Manager SQL Injection Enables Unauthenticated Code Execution
Ivanti patches critical SQL injection vulnerability CVE-2026-89310 in Endpoint Manager Core Server enabling unauthenticated remote code execution.
CST Editorial Desk14 Oct 20268 min read
ThreatsCloud & SaaSCritical
JTL-Connector for WooCommerce Unrestricted File Upload Flaw CVE-2026-87855 Patched
JTL patches a critical arbitrary file upload vulnerability in JTL-Connector for WooCommerce (CVE-2026-87855) allowing unauthenticated web shell execution.
Priya Raman14 Oct 20268 min read
ThreatsCloud & SaaSCritical
ProFTPD mod_copy Flaw Weaponized to Copy Server Files and Execute Code
ProFTPD resolves a critical access control flaw in mod_copy (CVE-2015-3306) where unauthenticated attackers copy arbitrary server files and execute remote code.
CST Editorial Desk14 Oct 20268 min read
ThreatsCloud & SaaSCritical
ONLYOFFICE Document Server Path Traversal Flaw Enables Remote Code Execution
ONLYOFFICE patches a critical path traversal vulnerability in Document Server DocService (CVE-2021-3199) allowing arbitrary file overwrite and remote code execution.
CST Editorial Desk14 Oct 20268 min read
ThreatsCloud & SaaSCritical
Windows Remote Management (WinRM) Command Injection Flaw CVE-2026-96951 Enables System Hijack
Microsoft addresses a critical Windows Remote Management command injection vulnerability (CVE-2026-96951) allowing remote code execution via WSMAN SOAP requests.
CST Editorial Desk14 Oct 20268 min read
ThreatsCloud & SaaSCritical
Ivanti Connect Secure SAML Bypass Opens Gateways to Pre-Auth Code Execution
Ivanti discloses critical vulnerability CVE-2026-104935 in Connect Secure and Policy Secure gateways allowing pre-auth SAML remote code execution.
Mei-Lin Chen14 Oct 20269 min read
ThreatsCloud & SaaSCritical
Apache Struts 2 Dynamic Method Invocation Flaw Weaponized for Remote Code Execution
Apache Struts resolves critical vulnerability S2-032 (CVE-2016-3081) where dynamic method invocation enables arbitrary remote command execution via OGNL payloads.
CST Editorial Desk13 Oct 20269 min read
ThreatsCloud & SaaSCritical
Microsoft Semantic Kernel Vulnerability Allows Remote Code Execution via Malicious Agent Plugin Deserialization (CVE-2026-78610)
A critical remote code execution flaw in Microsoft Semantic Kernel allows threat actors to compromise host systems via crafted agent plugin manifests.
CST Editorial Desk13 Oct 20268 min read
ThreatsCloud & SaaSHigh
Ollama Local AI Model Registry Deserialization Flaw Enables Host Remote Code Execution
A high-severity vulnerability in Ollama allows unauthenticated network actors to trigger remote code execution when pulling tampered GGUF model manifests.
CST Editorial Desk10 Oct 20268 min read