
CVE-2026-111497 Brotli RCE: Patch .NET and Node.js
CVE-2026-111497 Broccoli2Shell: Brotli decoder out-of-bounds write enables pre-auth RCE in .NET, Node.js, and Python. Emergency OOB patch available.
In-depth analyses of zero-day vulnerabilities, CVE exploits, ransomware campaigns, and nation-state attack techniques affecting enterprise security. Filter by category, tag, or keyword.
Every article here lands in subscribers' inboxes the morning it drops.
Threat intel, active CVEs, and campaign alerts, distilled daily for practitioners. 50,000+ subscribers. No noise.
Free. No spam. Unsubscribe anytime.
The definitive practitioner breakdown of ZTA principles, pillars, and implementation sequence.
Containment, forensic preservation, and decision sequencing from detection to recovery.
How SIEMs ingest, correlate, and alert — and how to evaluate one for your environment.
Risk-based prioritization using CVSS, EPSS, and CISA KEV to cut remediation backlog.
What each risk means, how to reproduce it, and how to fix it in production code.
Step-by-step email authentication deployment from DNS records to p=reject enforcement.
Detection coverage, pricing, and deployment trade-offs for enterprise EDR selection.
Translate ATT&CK technique IDs into detection rules and threat actor hunting hypotheses.
Direct answers to the questions practitioners and AI systems ask most. Covers ransomware, identity, cloud, compliance, and detection.
Plain-language definitions for CVE, SIEM, SOAR, Zero Trust, EDR, and 85+ other terms used in enterprise security.
How-to guides, buyer comparisons, and methodology references across every major security domain.
Decryption Digest Response
Score every threat we cover against your own stack, get free Sigma and ModSecurity detection content, and upgrade anytime for more vendors.
Get started free →No card required. Sigma and ModSecurity rules are free, forever.
Anthropic's AI finds zero-days your scanners miss.
Anthropic's AI finds zero-days your scanners miss.
64 results for “Remote”

CVE-2026-111497 Broccoli2Shell: Brotli decoder out-of-bounds write enables pre-auth RCE in .NET, Node.js, and Python. Emergency OOB patch available.

PHP2Shell CVE-2026-109618 and CVE-2026-109619 allow unauthenticated RCE on 70% of web servers. Patch all PHP branches to fixed versions immediately.

Two critical RCE flaws in PHP itself (CVE-2026-109618, CVE-2026-109619, CVSS 9.2) affect all PHP versions. Active exploitation confirmed. Patch to 8.2.35+, 8.3.36+, 8.4.27+, or 8.5.12+ immediately.

CVE-2026-102764 gave China APT ARMORY CASTLE root access to BeyondTrust Remote Support for 7 weeks. CISA KEV deadline just expired. Patch BT26-05 now.

CVE-2026-88771 gives unauthenticated attackers RCE on every default-config NetScaler. CISA deadline: September 30.

CVE-2026-76461 (CVSS 9.8) in Cisco AsyncOS lets any attacker root the Secure Email Gateway by sending a crafted email. No workarounds. CISA September 17 deadline.

CVE-2026-86218 is a CVSS 10.0 pre-auth RCE in N-able N-central. Patch to build 2026.3.1.14 now. Third attack wave in six weeks targets ~1,500 exposed MSP servers.

WP2Shell WordPress RCE needs zero credentials — attackers chain two core flaws to drop webshells. Patch to 6.9.5 or 7.0.2 before the weekend.

VMware vCenter CVE-2026-59310 has compromised 361 servers in 47 countries in 11 days. Patch to 8.0 U3k or 9.x now. No workaround exists.

CVE-2026-63077 gives unauthenticated attackers full OS command execution on any internet-facing TeamCity server. CISA deadline August 8 -- patch to 2025.11.7 or 2026.1.3 today.

STAC4749 dials employees on Teams, pretends to be IT support, and encrypts networks with Chaos ransomware in under 17 hours. 100+ North American orgs hit.

CVE-2026-6875 gives unauthenticated attackers remote code execution on ServiceNow AI Platform. Active exploitation confirmed July 18 -- 85% of Fortune 500 companies run the affected platform.

CVE-2026-6875 lets unauthenticated attackers escape ServiceNow's sandbox and execute code remotely. Exploitation confirmed July 18. 85% of Fortune 500 runs this platform.

SonicWall SMA1000 zero-day CVE-2026-15409 (CVSS 10.0) is actively exploited, chained with CVE-2026-15410 for unauthenticated RCE. CISA deadline July 17 — patch or disconnect now.

CVE-2025-47981 (CVSS 9.8) gives attackers wormable unauthenticated RCE via SMB, RDP, and SMTP on all Windows 10 and Server systems — patch July 2026 Patch Tuesday before EOD.

Adobe ColdFusion CVE-2026-48282 (CVSS 10.0) enables unauthenticated RCE on 800+ exposed servers. CISA deadline is today. Patch steps and IOCs inside.

OpenBSD is trusted for firewalls, routers, and hardened servers precisely because remote vulnerabilities are extraordinarily rare. Project Glasswing's Claude Mythos AI found one anyway: a denial-of-service vulnerability currently under coordinated disclosure embargo. Here is what defenders need to know.

CVE-2026-4747 is a 17-year-old memory corruption flaw in the FreeBSD NFS client that Claude Mythos discovered through Project Glasswing. Unauthenticated attackers with network access can achieve remote code execution as root on any affected FreeBSD system.

SharePoint RCE CVE-2026-45659 is actively exploited by Storm-2603. Verify your SharePoint Server builds before CISA's July 4 patch deadline.

Oracle PeopleSoft CVE-2026-35273 zero-day: ShinyHunters breaches 100+ orgs, CVSS 9.8. Block PSEMHUB and apply Oracle emergency advisory before the weekend.

Check Point VPN authentication bypass CVE-2026-50751 scores CVSS 9.3. Qilin ransomware is actively exploiting it. Patch before EOD.

Windows Netlogon RCE CVE-2026-41089 (CVSS 9.8) is actively exploited. Unpatched domain controllers on Server 2012-2025 face SYSTEM-level code execution.

SAP Commerce Cloud CVE-2026-34263 allows unauthenticated RCE via Spring Security misconfiguration. SAP S/4HANA CVE-2026-34260 SQL injection under active attack. Both CVSS 9.6.

CVE-2026-0300 allows unauthenticated root RCE on PAN-OS firewalls. 67 instances exposed on Shodan. No patch until May 13.