Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Dirty Cert: Cisco Smart Software Manager's Silently Patched RCE

starlabs.sg | research | #rce | #zero-day | #vulnerability-research | #tls | #cisco | #certificate | #command-injection | #vulnerability-analysis | #nginx | #post-auth

Summary

Post-auth RCE in Cisco Smart Software Manager (CSSM): command injection in nginx certificate upload, where openssl checks run via childProcess.execSync. Cisco silently patched it in 10-202608.
Published
Collected

original ↗

Related coverage

research · starlabs.sg
When AI Makes 0-Days Feel Like N-Days
The author used AI to find a UAF bug in Linux net/sched and built an LPE exploit for CentOS 9 at TyphoonPwn 2026. AI sped things up, but deep subsystem knowledge still mattered.
research · swarm.ptsecurity.com
Cisco Hyperflex: How We Got RCE Through Login Form and Other Findings
An assessment of Cisco HyperFlex HX that found three vulnerabilities: command injection in the installer VM (CVE-2021-1497, CVSS 9.8) and the data platform (CVE-2021-1498), plus a file upload flaw (CVE-2021-1499) — including RCE reached through the login form.
research · idnsec.com
Mitigating RCE Impact Like in OpenAI Hack with Defense-in-Depth
Using HacktronAI's OpenAI Discourse hack disclosure, this article covers sandboxing, runtime protection, and AI-assisted defense to shrink the blast radius of RCE across interconnected apps.
research · projectzero.google
Finding and exploiting ntpd vulnerabilities
A Google Project Zero guest post telling how one of the researchers found and exploited vulnerabilities in the ntpd network time server.
tool · github.com
Comment2Shell: Zero-Click Pre-Auth RCE Exploit Kit for WordPress (CVE-2026-93485)
Affects all WordPress installations from version 4.7.0 through 7.1.0 without requiring credentials or interaction beyond opening a post. Administrators should verify upgrading to 7.1.1 or backported releases, and monitor server logs for suspicious comment payloads and unexpected plugin uploads.
vulnerability · idnsec.com
[CVE-2026-93485] Comment2XSS: Zero-Click Pre-Auth XSS to Potential RCE in WordPress Core
An unauthenticated stored XSS (CVE-2026-93485) in WordPress core's wpautop() turns crafted comments into zero-click XSS, escalating to RCE via the admin session. Fixed in 7.1.1, backported to 4.7.36.
back