remote code execution5 articles
Oracle EBS Flaw Under Active Probing Days After Patch Dropped
A critical vulnerability in Oracle E-Business Suite (CVE-2026-101767, CVSS 9.8) is already being actively probed by threat actors just days after Oracle released a patch. The flaw is an unauthenticated SQL injection in the Thin Client Framework servlet that can be chained to achieve remote code execution, potentially exposing sensitive financial, payroll, HR, and procurement data. Users are strongly advised to apply the patch immediately or implement available workarounds, such as blocking access to the vulnerable endpoint and restricting network access to the EBS web tier.
CISA Adds PHP2Shell RCE Flaws to Active Exploitation List as 32 Million Servers Sit Unpatched
CISA has added two critical PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619), both scored 9.2 on the CVSS scale, to its Known Exploited Vulnerabilities catalog after confirmed active exploitation of honeypot systems. Both flaws enable unauthenticated remote code execution and affect a vast number of systems, with over 32.51 million PHP services still running vulnerable versions. Patches are available in PHP versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35, with federal agencies given until October 29, 2026, to apply the fixes.
PHP Blames Chainguard for Blowing Critical Disclosure After AI Finds Huge Vulnerabilities
PHP maintainers have accused supply chain security company Chainguard of breaking an agreed embargo by publishing patched software images over six hours before the planned coordinated disclosure of two critical remote code execution vulnerabilities (CVE-2026-109618 and CVE-2026-109619), collectively known as PHP2shell. Chainguard CEO Dan Lorenc defended the decision, arguing that active exploitation was already underway — with proof-of-concept exploits circulating on social media and real-world attacks being reported — making early release of the fixes justified. The vulnerabilities affect virtually every version of PHP released in the last decade and are considered highly serious, given that PHP powers an estimated 70% of all websites globally.
Half a Million WordPress Sites Running Vulnerable Form Plugin — 300,000 Still Unpatched
A critical remote code execution vulnerability (CVE-2026-15748, CVSS 9.8) has been discovered in the Forminator Forms WordPress plugin, affecting all versions up to 1.56.1. The flaw allows unauthenticated attackers to bypass file type validation and upload executable files, potentially leading to full site compromise — but only poses a significant risk when a Custom File Upload Storage root has been configured. The bug was patched in version 1.56.2 on July 31, though roughly 300,000 of the plugin's 600,000+ installations are still running a vulnerable version.
ServiceNow RCE Flaw Exploited Within Days of Patch — But Who's Actually Behind It?
A critical remote code execution vulnerability in ServiceNow (CVE-2026-6875) is reportedly being exploited in the wild just days after patches were released on July 14 and technical details were publicly disclosed. Threat intelligence firm Defused observed exploitation activity on July 18, though closer analysis revealed the payload was identical to a published proof-of-concept rather than an independently developed exploit. ServiceNow states it has found no evidence of compromise on its hosted instances, and there is speculation the activity may originate from security researchers rather than malicious threat actors.