Home
News
Remote Code Execution

Tag

Remote Code Execution

News and blog posts tagged Remote Code Execution on AppSecNews.

News Vulnerabilities & Zero-Days 22 Oct 2026, 10:53 UTC

Patch now: CVSS 10 GitLab flaw lets unauthenticated attackers run code, affecting every release back to 2014

GitLab has fixed CVE-2026-110264, a maximum-severity flaw that could let an unauthenticated attacker execute code on self-managed GitLab servers through a crafted regular expression. Every version from 7.0 onward is affected.

Jay B.
News Vulnerabilities & Zero-Days 22 Oct 2026, 10:26 UTC

Node.js patches 10 flaws, including a Brotli bug that permits remote code execution and TLS certificate bypasses

Node.js released 26.12.1, 24.22.1 and 22.23.4 on 21 October 2026 to fix 10 vulnerabilities, four rated high, including a Brotli decoder flaw that permits remote code execution and two TLS hostname verification bypasses. The update also blocks the compromised eMudhra certificates.

Jay B.
News Vulnerabilities & Zero-Days 22 Oct 2026, 05:28 UTC

PHP2Shell confirmed: PHP patches two critical unauthenticated RCE flaws as first attacks are spotted

PHP has released 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to fix CVE-2026-109618 and CVE-2026-109619, two critical flaws that can allow unauthenticated remote code execution on servers handling web requests. Cloudflare and watchTowr report early attack activity.

Jay B.