A public proof-of-concept for the vBulletin RCE vulnerability CVE-2026-61511 is now live. Here's how the eval() injection works and who still needs to patch.

Public Exploit Lands for vBulletin’s Pre-Auth RCE, CVE-2026-61511 on Latest Hacking News | Cyber Security News, Hacking Tools and Penetration Testing Courses.

WordPress 6.9.5 and 7.0.2 fix wp2shell, a core REST API bug chaining route confusion and SQL injection into unauthenticated remote code execution.

wp2shell: WordPress Patches a Pre-Auth RCE That Needed No Plugins on Latest Hacking News | Cyber Security News, Hacking Tools and Penetration Testing Courses.

A three-line SVG gave XBOW SYSTEM access on Bing's servers through a default ImageMagick setting. Here's the exploit chain and a checklist for anyone running a similar image pipeline.

How the Bing Images RCE Flaws Actually Worked, and How to Check Your Own Pipeline on Latest Hacking News | Cyber Security News, Hacking Tools and Penetration Testing Courses.

A practical checklist for the Fastjson RCE vulnerability (CVE-2026-16723): how the exploit chain works, four questions to answer this week, and how to mitigate it before a patch exists.

How the Fastjson RCE Vulnerability Actually Works, and How to Check You’re Exposed on Latest Hacking News | Cyber Security News, Hacking Tools and Penetration Testing Courses.

The critical libssh2 CVE-2026-55200 flaw inverts SSH security: the remote server attacks the connecting client, no credentials needed. A public PoC is out and the official patched release has not shipped.

libssh2 CVE-2026-55200 Shows Why Outbound SSH Is an Attack Surface on Latest Hacking News | Cyber Security News, Hacking Tools and Penetration Testing Courses.