PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Dissecting and Exploiting CVE-2025-62507: Remote Code Execution in Redis

jfrog.com | research | CVE-2025-62507 | #rce | #exploit | #cve | #jfrog | #research | #redis | #buffer-overflow | #cve-2025-62507 | #jfrog-com
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

JFrog dissects and exploits CVE-2025-62507, a stack buffer overflow in Redis's XACKDEL command (fixed in 8.3.2, CVSS 8.8), achieving RCE where no public proof-of-concept existed.
CVE
CVE-2025-62507
Published
Collected

Related coverage

research · github.com
php2shell: Pure HTTP Full-Chain RCE and ASLR Bypass on Stock PHP 8.4 Configurations
Overcomes historical constraints where PHP heap exploitation required display_errors=On, restricted memory limits, or target application vulnerabilities, demonstrating reliable pure-HTTP RCE and ASLR defeat against standard production ini configurations.
research · crowdstrike.com
CrowdStrike Protects Customers from Threats Delivered via PHP2Shell
The Falcon platform provides out-of-the-box visibility and detection coverage for post-exploitation activities of CVE-2026-109618 and CVE-2026-109619.
blog · jfrog.com
The Year the Vulnerability Backlog Changed Shape
AI coding tools are swelling vulnerability backlogs at machine speed. Discover how CISOs can adapt supply chain security and governance for the agentic era.
blog · aikido.dev
How to patch PHP2Shell with free Aikido Images
PHP2Shell is a pair of critical remote code execution (RCE) vulnerabilities in PHP, CVE-2026-109618 and CVE-2026-109619. Both score 9.2 on CVSS v4.0, and either one can let an unauthenticated attacker run code on a server that handles PHP requests. Cloudflare reports that exploitation has started.
vulnerability · wiz.io
[CVE-2026-111497] Broccoli2shell: Everything You Need To Know About The Critical Brotli Decoder Vulnerability
Detect and mitigate CVE-2026-111497, a critical Brotli decoder vulnerability enables remote code execution.
vulnerability · bugpwn.com
open62541: Integer Overflow → Heap Overflow → RCE.
Original research: how a 16 bit size field overflow in open62541's custom DataType machinery lets a malicious OPC UA server corrupt a connecting client's heap, up to remote code execution. CVE-2026-116014, CVSS 9.2. Root cause, networked PoC, and the official fix. By BUG|PWN.
Back