PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

7 of the Most Memorable CVEs of 2019

bishopfox.com | blog | #rce | #zero-day | #risk-management | #cve | #year-in-review | #patching | #vulnerabilities
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

A year-end retrospective on seven memorable 2019 CVEs, spanning Pulse Secure's pre-auth file read (CVE-2019-11510), Telerik deserialization RCE (CVE-2019-18935), and a Microsoft zero-day.
Published
Collected

Related coverage

blog · aikido.dev
How to patch PHP2Shell with free Aikido Images
PHP2Shell is a pair of critical remote code execution (RCE) vulnerabilities in PHP, CVE-2026-109618 and CVE-2026-109619. Both score 9.2 on CVSS v4.0, and either one can let an unauthenticated attacker run code on a server that handles PHP requests. Cloudflare reports that exploitation has started.
blog · crowdstrike.com
October 2026 Patch Tuesday: 1,413 CVEs Include Three Zero-Days and 75 Critical Vulnerabilities
Microsoft has released security updates for 1,413 vulnerabilities, including one exploited zero-day, two publicly disclosed zero-days, and 75 critical, in its October 2026 Patch Tuesday rollout.
blog · jfrog.com
The Year the Vulnerability Backlog Changed Shape
AI coding tools are swelling vulnerability backlogs at machine speed. Discover how CISOs can adapt supply chain security and governance for the agentic era.
vulnerability · wiz.io
[CVE-2026-111497] Broccoli2shell: Everything You Need To Know About The Critical Brotli Decoder Vulnerability
Detect and mitigate CVE-2026-111497, a critical Brotli decoder vulnerability enables remote code execution.
Critical · vulnerability · github.com
php2shell-zeros: Unpatched 0-Day RCE Flaws and Weaponized Exploit Chains in PHP and NativePHP
These surviving flaws bypass earlier patches and demonstrate that core PHP deserialization and memory management remain fundamentally fragile, posing critical unauthenticated RCE risks to WordPress and production PHP services.
vulnerability · bugpwn.com
open62541: Integer Overflow → Heap Overflow → RCE.
Original research: how a 16 bit size field overflow in open62541's custom DataType machinery lets a malicious OPC UA server corrupt a connecting client's heap, up to remote code execution. CVE-2026-116014, CVSS 9.2. Root cause, networked PoC, and the official fix. By BUG|PWN.
Back