PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

A Saga of Code Executions on Zimbra

blog.viettelcybersecurity.com | blog | #rce | #vulnerability-research | #pre-auth | #email-security | #zimbra
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Research into Zimbra Collaboration Suite finds at least one potential remote code execution vulnerability across all Zimbra versions, notable for a product with little security history since 2013.
Published
Collected

Related coverage

research · slcyber.io
More Critical Bugs in Adobe Experience Manager: Pre-Auth RCE
Chaining an unauthenticated bulk import, an in-band XXE, leaked IMS credentials and Groovy execution into full pre-auth RCE on Adobe Experience Manager Cloud.
research · blog.viettelcybersecurity.com
Các lỗ hổng mới liên tục xuất hiện trên Zimbra - Phần I
First part on Zimbra surveys the critical 2022 flaws (CVE-2022-27924, CVE-2022-27925, CVE-2022-30333, CVE-2022-37042) with patch timeline, noting 72,000+ exposed servers and wide use in Vietnam.
research · github.com
Steal My Bitcoin Challenge Writeup: PHP 8.4.26 Session Upload Progress Memory Exhaustion Analysis
Provides a detailed binary-level case study on PHP Zend memory manager behavior and worker state persistence after fatal out-of-memory errors.
Critical · vulnerability · github.com
php2shell (CVE-2026-109618 / CVE-2026-109619): PHP Pre-Auth RCE PoC, Source Patch & Comprehensive Defense Guide
Provides critical stopgap mitigations, source-level patches, and multi-web-server WAF rules for teams securing PHP deployments, especially for unpatched legacy and end-of-life installations.
research · crowdstrike.com
CrowdStrike Protects Customers from Threats Delivered via PHP2Shell
The Falcon platform provides out-of-the-box visibility and detection coverage for post-exploitation activities of CVE-2026-109618 and CVE-2026-109619.
vulnerability · netspi.com
PHP2Shell Unauthenticated RCE on PHP: CVE-2026-109618 & CVE-2026-109619
# PHP2Shell Unauthenticated RCE on PHP: CVE-2026-109618 & CVE-2026-109619 October 21, 2026 ### Team NetSPI The PHP project has disclosed two critical vulnerabilities, CVE-2026-109618 and...
Back