PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

[CVE-2016-11061] Inside Xerox WorkCentre: Two Unauthenticated RCEs

swarm.ptsecurity.com | research | CVE-2016-11061 | #rce | #iot-security | #xerox | #printer-security | #cve-2016-11061
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Two unauthenticated RCEs in Xerox WorkCentre printers: CVE-2016-11061 (shell escaping in configrui.php) and a newer one via Apache-module preprocessor directives, plus a hardening checklist.
CVE
CVE-2016-11061
Published
Collected

Related coverage

research · github.com
Steal My Bitcoin Challenge Writeup: PHP 8.4.26 Session Upload Progress Memory Exhaustion Analysis
Provides a detailed binary-level case study on PHP Zend memory manager behavior and worker state persistence after fatal out-of-memory errors.
research · github.com
php2shell: Pure HTTP Full-Chain RCE and ASLR Bypass on Stock PHP 8.4 Configurations
Overcomes historical constraints where PHP heap exploitation required display_errors=On, restricted memory limits, or target application vulnerabilities, demonstrating reliable pure-HTTP RCE and ASLR defeat against standard production ini configurations.
research · crowdstrike.com
CrowdStrike Protects Customers from Threats Delivered via PHP2Shell
The Falcon platform provides out-of-the-box visibility and detection coverage for post-exploitation activities of CVE-2026-109618 and CVE-2026-109619.
research · slcyber.io
More Critical Bugs in Adobe Experience Manager: Pre-Auth RCE
Chaining an unauthenticated bulk import, an in-band XXE, leaked IMS credentials and Groovy execution into full pre-auth RCE on Adobe Experience Manager Cloud.
research · hunt.io
Operation CameraSwarm: Over 14,000 Dahua cameras compromised across Ukraine and Russia
This research provides technical context that security teams can use for monitoring and validation.
research · lab.ctbb.show
Achieving remote code execution in LangSmith Playground using unsafe template formatting
This post details the discovery and exploitation of a vulnerability in LangSmith Playground that allowed arbitrary code execution through unsafe template formatting
Back