CVE-2022-23597: Remote code execution on Element Desktop

An unauthenticated stored XSS (CVE-2026-93485) in WordPress core's wpautop() turns crafted comments into zero-click XSS, escalating to RCE via the admin session. Fixed in 7.1.1, backported to 4.7.36.

By James Forshaw, Project Zero In my previous blog post I discussed an issue with the Windows Kernel’s handling of Restricted Tokens which allowed me to escape the Chrome GPU sandbox. Originally I’d planned to use Firefox for the proof-of-concept as Firefox uses the same effective sandbox level as the Chrome GPU process for its content renderers. That means a FF content RCE would give code execution in a sandbox where you could abuse the Windows Kernel Restricted Tokens issue, making it much more serious.

Trail of Bits details Electron CVE-2025-55305: overwriting V8 heap snapshot files bypasses code integrity checks, enabling local backdoors in Signal, 1Password, Slack, and other Chromium-based apps.

Post-auth RCE in Cisco Smart Software Manager (CSSM): command injection in nginx certificate upload, where openssl checks run via childProcess.execSync. Cisco silently patched it in 10-202608.

Using HacktronAI's OpenAI Discourse hack disclosure, this article covers sandboxing, runtime protection, and AI-assisted defense to shrink the blast radius of RCE across interconnected apps.

The authors reverse-engineered Chrome's January 2026 fix for CVE-2026-0899, an out-of-bounds access in V8, built a trigger PoC, and defeated a stubborn CHECK to reach arbitrary read/write.