--- title: "Blog: CVE analysis and vulnerability research" url: https://radicalnotion.ai/blog type: directory description: "Analysis of exploited and high-impact vulnerabilities." updated: 2026-11-06 source: RadicalNotion.AI license: CC BY-NC 4.0 (https://creativecommons.org/licenses/by-nc/4.0/) --- # Blog Every entry links to its markdown twin. Drop the `.md` suffix for the HTML page, or request the HTML URL with `Accept: text/markdown`. - [OpenSSH 'sshhole' Bug: Any Long Password Unlocks Locked Alpine Accounts](https://radicalnotion.ai/blog/openssh-sshhole-bug-any-long-password-unlocks-locked-alpine-accounts-20261106000137.md) (2026-11-06): A newly disclosed OpenSSH flaw, CVE-2026-123158 or 'sshhole', lets attackers log into locked accounts on Alpine Linux and other musl-based systems by typing any password longer than 256 characters. Public exploits are already circulating, and fixes shipped within a day of the report. - [PHP2Shell: Critical PHP Flaw Turns Out-of-Memory Errors Into Remote Takeover](https://radicalnotion.ai/blog/php2shell-critical-php-flaw-turns-out-of-memory-errors-into-remote-takeover-20261021171440.md) (2026-10-21): A critical PHP flaw (CVE-2026-109618, CVSS 9.2) lets unauthenticated attackers turn out-of-memory errors into remote code execution and heap memory leaks. Apache mod\_php and FrankenPHP are most exposed. Patch to 8.2.35, 8.3.36, 8.4.27 or 8.5.12 now. - [PHP2Shell: Critical PHP Flaw Lets Attackers Hijack Web Servers Unauthenticated](https://radicalnotion.ai/blog/php2shell-critical-php-flaw-lets-attackers-hijack-web-servers-unauthenticated-20261021164259.md) (2026-10-21): A critical PHP use-after-free (CVE-2026-109619, CVSS 9.2) lets unauthenticated attackers turn one failed request into code execution on the next. Researchers demonstrated it against default WordPress, Drupal and Joomla installs. Patches are out now. - [Ray AI Dashboard RCE Exploited via DNS Rebinding: Patch Now (CVE-2025-62593)](https://radicalnotion.ai/blog/ray-ai-dashboard-rce-exploited-via-dns-rebinding-patch-now-cve-2025-62593-20260825182333.md) (2026-08-25): A critical RCE in Ray AI compute engine lets malicious ads or sites execute code on developers' machines via Firefox and Safari. CISA KEV, active exploitation; fixed in 2.52.0. - [Oracle's Perfect 10: CVSS 10.0 WebLogic Proxy Bug Lands in CISA KEV](https://radicalnotion.ai/blog/oracles-perfect-10-cvss-100-weblogic-proxy-bug-lands-in-cisa-kev-20260825181033.md) (2026-08-25): CVE-2026-21962, a CVSS 10.0 flaw in Oracle HTTP Server and the WebLogic Server Proxy Plug-in, went from a quiet January patch line item to a confirmed, actively exploited threat when CISA added it to the Known Exploited Vulnerabilities catalog on August 24, 2026. Patch now. - [Critical SharePoint RCE (CVE-2026-58644) Under Active Attack After Patch Sat Hidden for a Month](https://radicalnotion.ai/blog/critical-sharepoint-rce-cve-2026-58644-under-active-attack-after-patch-sat-hidden-for-a-month-20260716224227.md) (2026-07-16): A critical deserialization flaw in Microsoft SharePoint (CVSS 9.8) is being actively exploited in the wild, and its patch quietly shipped in June before public disclosure on July 14. Organizations that skipped a monthly update may already be compromised. - [Critical Splunk Enterprise Flaw (CVE-2026-20253) Under Active Exploitation: Pre-Auth RCE via PostgreSQL Sidecar](https://radicalnotion.ai/blog/critical-splunk-enterprise-flaw-cve-2026-20253-under-active-exploitation-pre-auth-rce-via-postgresql-20260619125623.md) (2026-06-19): A critical CVSS 9.8 vulnerability in Splunk Enterprise's PostgreSQL sidecar allows unauthenticated attackers to achieve remote code execution. CISA has added it to the KEV catalog amid confirmed in-the-wild exploitation. - [Critical Oracle PeopleSoft RCE Flaw Actively Exploited in the Wild](https://radicalnotion.ai/blog/critical-oracle-peoplesoft-rce-flaw-actively-exploited-in-the-wild-20260612182627.md) (2026-06-12): A maximum-severity, no-authentication-required remote code execution vulnerability in Oracle PeopleSoft PeopleTools 8.61 and 8.62 is being actively exploited, giving attackers full control over ERP systems holding sensitive HR, financial, and operational data. - [CVE-2026-7473: Arista EOS Tunnel Bypass Flaw Exploited in the Wild, No Patch Planned](https://radicalnotion.ai/blog/cve-2026-7473-arista-eos-tunnel-bypass-flaw-exploited-in-the-wild-no-patch-planned-20260611140027.md) (2026-06-11): A critical flaw in Arista EOS allows unauthenticated attackers to inject traffic into internal network segments by abusing tunnel decapsulation endpoints — and Arista says no software patch is coming. The vulnerability is actively being exploited and has been added to CISA's Known Exploited Vulne... - ['Copy Fail': Linux Kernel Flaw Lets Any Local User Become Root](https://radicalnotion.ai/blog/copy-fail-linux-kernel-flaw-lets-any-local-user-become-root-20260430041433.md) (2026-04-30): A publicly exploitable Linux kernel vulnerability dubbed 'Copy Fail' allows any unprivileged local user to silently overwrite root-owned binaries and seize full system control. Kernels from version 4.14 through 6.18.21 are affected, and a working Python exploit is already public. - [SlashAndGrab: The ScreenConnect Flaw Ransomware Gangs Love](https://radicalnotion.ai/blog/slashandgrab-the-screenconnect-flaw-ransomware-gangs-love-20260428232130.md) (2026-04-28): A trivially exploited authentication bypass in ConnectWise ScreenConnect — requiring nothing more than appending a slash to a URL — hands attackers SYSTEM-level control over entire managed IT networks, and ransomware crews are already cashing in. - [April 2026 CNA Anomalous Behavior](https://radicalnotion.ai/blog/april-2026-cna-anomalous-behavior.md) (2026-04-14): Patterns of CNA behavior for April 2026 worth noting - [CVE-2023-22515: The Confluence Flaw That Hands Attackers the Keys to Your Kingdom](https://radicalnotion.ai/blog/cve-2023-22515-the-confluence-flaw-that-hands-attackers-the-keys-to-your-kingdom-20260325154900.md) (2026-03-25): A perfect CVSS 10.0 vulnerability in Atlassian Confluence lets anyone on the internet create an admin account with a single HTTP request. Nation-state actors and ransomware gangs are already exploiting it. - [Cisco Firewall Management Center Hit with Perfect 10.0 Critical RCE Flaw](https://radicalnotion.ai/blog/cisco-firewall-management-center-hit-with-perfect-100-critical-rce-flaw-20260304223729.md) (2026-03-04): Cisco discloses CVE-2026-20131, a maximum-severity unauthenticated remote code execution vulnerability in its Secure Firewall Management Center. Attackers can gain root access by sending a single crafted request — no credentials required. - [CVSS 10.0: Cisco SD-WAN Auth Bypass Exploited in the Wild](https://radicalnotion.ai/blog/cvss-100-cisco-sd-wan-auth-bypass-exploited-in-the-wild-20260226183051.md) (2026-02-26): A perfect-10 authentication bypass in Cisco's SD-WAN Controller and Manager lets unauthenticated attackers seize control of enterprise wide-area networks. Cisco confirms active exploitation, CISA issues Emergency Directive 26-03. - [Old Cisco SD-WAN Flaw Now Under Active Attack — Patch Immediately](https://radicalnotion.ai/blog/old-cisco-sd-wan-flaw-now-under-active-attack-patch-immediately-20260226150238.md) (2026-02-26): A 2022 privilege escalation vulnerability in Cisco SD-WAN software is now being actively exploited in the wild, four years after patches were released. Attackers with any valid local credential can chain two path traversal bugs to seize complete root control of routers, controllers, and orchestra... - [FileZen Under Active Attack: Command Injection Flaw Gives Hackers Full System Control](https://radicalnotion.ai/blog/filezen-under-active-attack-command-injection-flaw-gives-hackers-full-system-control-20260224191956.md) (2026-02-24): A critical OS command injection vulnerability in Soliton's FileZen file-sharing appliance is being actively exploited in the wild, giving attackers full remote code execution. A patch has been available since January — but many systems remain exposed. - [Chinese Hackers Exploited Dell Backup Flaw for Months Using Hard-Coded Password](https://radicalnotion.ai/blog/chinese-hackers-exploited-dell-backup-flaw-for-months-using-hard-coded-password-20260218190045.md) (2026-02-18): A perfect CVSS 10.0 vulnerability in Dell RecoverPoint for Virtual Machines ships with hard-coded Tomcat credentials that a Chinese-linked threat group has been exploiting since mid-2024 to deploy backdoors and ransomware. - [CVE-2008-0015: CISA Adds Actively Exploited Microsoft Video ActiveX Stack Overflow to KEV Catalog](https://radicalnotion.ai/blog/cve-2008-0015-cisa-adds-actively-exploited-microsoft-video-activex-stack-overflow-to-kev-catalog-20260218175434.md) (2026-02-18): CISA added CVE-2008-0015 to its Known Exploited Vulnerabilities catalog on February 17, 2026, confirming active exploitation of a critical stack-based buffer overflow in Microsoft's Video ActiveX control that allows complete system takeover via a malicious webpage. - [Metro4Shell: React Native Dev Server Flaw Exploited in the Wild to Hijack Developer Machines](https://radicalnotion.ai/blog/metro4shell-react-native-dev-server-flaw-exploited-in-the-wild-to-hijack-developer-machines-20260207213558.md) (2026-02-07): A trivially exploitable command-injection vulnerability in the React Native CLI's Metro development server is being actively exploited in the wild. CISA has added CVE-2025-11953 to its Known Exploited Vulnerabilities catalog — here's what every React Native team needs to know right now. - [OpenSSH VerifyHostKeyDNS Bypass: Decade-Old Logic Flaw Enables Server Impersonation](https://radicalnotion.ai/blog/openssh-verifyhostkeydns-bypass-decade-old-logic-flaw-enables-server-impersonation-20260130142348.md) (2026-01-30): A critical authentication bypass in OpenSSH (CVE-2025-26465) has lurked undetected since 2014, allowing attackers to impersonate any SSH server when a rarely-enabled option is configured. The vulnerability affects all releases from 6.8p1 through 9.9p1. - [Windows DWM Zero-Day Exploited in the Wild to Bypass ASLR Protections](https://radicalnotion.ai/blog/windows-dwm-zero-day-exploited-in-the-wild-to-bypass-aslr-protections-20260113235621.md) (2026-01-13): Microsoft patched CVE-2026-20805, a Desktop Window Manager information disclosure flaw actively exploited to defeat memory protections. CISA added it to the KEV catalog, requiring federal agencies to patch by February 3, 2026. - [MongoBleed: Critical Unauthenticated Memory Disclosure Hits MongoDB Server](https://radicalnotion.ai/blog/mongobleed-critical-unauthenticated-memory-disclosure-hits-mongodb-server-20251230154920.md) (2025-12-30): A critical vulnerability dubbed 'MongoBleed' allows unauthenticated attackers to extract sensitive data from MongoDB server memory through malformed Zlib headers. CISA confirms active exploitation in the wild. - [Unpatched DigiEver DVRs Under Active Attack by Mirai Botnets](https://radicalnotion.ai/blog/unpatched-digiever-dvrs-under-active-attack-by-mirai-botnets-20251228195109.md) (2025-12-28): A critical command injection flaw in DigiEver surveillance devices is being actively exploited by multiple botnets. The vendor has refused to patch, leaving thousands of devices permanently vulnerable. - [React2Shell: Chinese APTs Exploit Critical React Server Components RCE](https://radicalnotion.ai/blog/react2shell-chinese-apts-exploit-critical-react-server-components-rce-20251219045711.md) (2025-12-19): A maximum-severity (CVSS 10.0) vulnerability in React Server Components is being actively exploited by Chinese state-sponsored actors and ransomware groups. The flaw allows unauthenticated remote code execution on servers running default configurations of Next.js and other React frameworks. - [CISA KEV: Kentico CMS Bug Gives Attackers Admin Access Without a Password](https://radicalnotion.ai/blog/cisa-kev-kentico-cms-bug-gives-attackers-admin-access-without-a-password-20251218171344.md) (2025-12-18): A critical authentication bypass in Kentico Xperience CMS lets attackers log in with only a username, chain to file-write, and execute code. Fixed in 13.0.178; CISA confirms active exploitation since Dec 2024. --- Source: [RadicalNotion.AI](https://radicalnotion.ai/blog). Licensed CC BY-NC 4.0; attribute RadicalNotion.AI and link the source page when you reuse this data.