--- title: "#rce articles | Hashnode" description: "Explore 128 articles tagged #rce on Hashnode. Tutorials, guides, and how-tos from the community." url: "https://hashnode.com/tag/rce" --- Tag # #rce 128 posts · 6 followers [404 Founders](https://hashnode.com/@404-founders) · [Oct 29](https://hashnode.com/posts/oracle-ebs-cve-2026-101767-tcf-servlet-rce/6ae358c4e76a8381d87fe36a) ### [Oracle EBS CVE-2026-101767: Unauthenticated SQL Injection That Chains to RCE](https://404-founders.com/blog/oracle-ebs-cve-2026-101767-tcf-servlet-rce?utm_source=hashnode&utm_medium=feed) CVE-2026-101767 chains SQL injection through Oracle EBS TCF servlet to OS command execution. Probing started one day after the October 2026 CPU patch. 5 min read · [404-founders.com](https://404-founders.com/blog/oracle-ebs-cve-2026-101767-tcf-servlet-rce?utm_source=hashnode&utm_medium=feed) [404 Founders](https://hashnode.com/@404-founders) · [Oct 26](https://hashnode.com/posts/node2shell-brotli-rce-cve-2026-111497/6ae1f10d08b9ff56dc65ada9) ### [Node2Shell: How a Boolean Return Value Became a Critical Brotli RCE](https://404-founders.com/blog/node2shell-brotli-rce-cve-2026-111497?utm_source=hashnode&utm_medium=feed) CVE-2026-111497 Brotli decoder out-of-bounds write gives RCE in Node.js, Python, Bun. Express 5 decompresses by default. Patch now. 9 min read · [404-founders.com](https://404-founders.com/blog/node2shell-brotli-rce-cve-2026-111497?utm_source=hashnode&utm_medium=feed) [404 Founders](https://hashnode.com/@404-founders) · [Oct 22](https://hashnode.com/posts/alert-gitlab-cve-2026-110264-rce/6ada4e4a4601ccec5f7882df) ### [GitLab CVE-2026-110264: CVSS 10.0 RCE Hits 12 Years of Releases](https://404-founders.com/blog/alert-gitlab-cve-2026-110264-rce?utm_source=hashnode&utm_medium=feed) GitLab patches CVE-2026-110264, a CVSS 10.0 unauthenticated RCE in Onigmo regex engine affecting every self-managed release since 7.0 (2014). Upgrade now. 7 min read · [404-founders.com](https://404-founders.com/blog/alert-gitlab-cve-2026-110264-rce?utm_source=hashnode&utm_medium=feed) [1](https://hashnode.com/posts/alert-gitlab-cve-2026-110264-rce/6ada4e4a4601ccec5f7882df) [Lưu Tuấn Anh](https://hashnode.com/@anhlt120) · [Oct 22](https://hashnode.com/posts/from-pdf-file-uploads-to-server-hijacking-an-in-depth-analysis-of-the-ghostscript-vulnerability-cve-2026-39919/6ad9795871b5a7056efdcc61) ### [From PDF file uploads to server hijacking: An in-depth analysis of the Ghostscript vulnerability CVE-2026-39919](https://blog.fiscybersec.com/from-pdf-file-uploads-to-server-hijacking-an-in-depth-analysis-of-the-ghostscript-vulnerability-cve-2026-39919?utm_source=hashnode&utm_medium=feed) Introduction to Ghostscript If you are running a WordPress website, a content management system (CMS) or an online application portal, chances are your server is running Ghostscript every day without 14 min read · [blog.fiscybersec.com](https://blog.fiscybersec.com/from-pdf-file-uploads-to-server-hijacking-an-in-depth-analysis-of-the-ghostscript-vulnerability-cve-2026-39919?utm_source=hashnode&utm_medium=feed) [1](https://hashnode.com/posts/from-pdf-file-uploads-to-server-hijacking-an-in-depth-analysis-of-the-ghostscript-vulnerability-cve-2026-39919/6ad9795871b5a7056efdcc61) [c0wking](https://hashnode.com/@c0wking) · [Oct 6](https://hashnode.com/posts/sophos-firewall-rce-certificate-dn-command-injection/6ac464b8c62b78091f24aae0) ### [A Certificate Name That Runs as Root: Five Bugs in Sophos Firewall, Found with Codex](https://blogs.night-wolf.io/sophos-firewall-rce-certificate-dn-command-injection?utm_source=hashnode&utm_medium=feed) A certificate's Distinguished Name reaches a shell as root on Sophos Firewall, letting a certificate/VPN-only admin take over the appliance. 10 min read · [blogs.night-wolf.io](https://blogs.night-wolf.io/sophos-firewall-rce-certificate-dn-command-injection?utm_source=hashnode&utm_medium=feed) [c0wking](https://hashnode.com/@c0wking) · [Oct 6](https://hashnode.com/posts/from-graph-editor-to-webshell-finishing-the-job-cve-2026-40079-left-open/6ac464dc8fde15740683b35a) ### [From Graph Editor to Webshell: Finishing the Job CVE-2026-40079 Left Open](https://blogs.night-wolf.io/from-graph-editor-to-webshell-finishing-the-job-cve-2026-40079-left-open?utm_source=hashnode&utm_medium=feed) A Cacti user with only the Graphs realm can inject OS commands via unescaped graph-item fields and drop an unauthenticated PHP webshell. 17 min read · [blogs.night-wolf.io](https://blogs.night-wolf.io/from-graph-editor-to-webshell-finishing-the-job-cve-2026-40079-left-open?utm_source=hashnode&utm_medium=feed) [Jebitok](https://hashnode.com/@w1t3r) · [Sep 23](https://hashnode.com/posts/beach-bar-web-x-boot2root-rce-x-django-tryhackme/6ab36fadffd00c942c116202) ### [Beach Bar: Web x Boot2Root - RCE X Django (TryHackMe)](https://www.sharonjebitok.com/beach-bar-web-x-boot2root-rce-x-django-tryhackme?utm_source=hashnode&utm_medium=feed) Link to the challenge on TryHackMe: Beach Bar Concierge Briefing Welcome back to the Byte Lotus — this time the sand is warm, the deck lights are coming up, and the beach bar's jukebox takes requests 16 min read · [sharonjebitok.com](https://www.sharonjebitok.com/beach-bar-web-x-boot2root-rce-x-django-tryhackme?utm_source=hashnode&utm_medium=feed) [Yogeshwar Peela](https://hashnode.com/@exploitnotes) · [Sep 10](https://hashnode.com/posts/tryhackme-olympus-writeup/6aa27ae3a238c961e5e2b2b7) ### [TryHackMe - Olympus Writeup](https://exploitnotes.hashnode.dev/tryhackme-olympus-writeup?utm_source=hashnode&utm_medium=feed) Olympus TryHackMe writeup covering Victor CMS SQL injection, credential cracking, file upload RCE, SUID abuse, SSH access, and root shell. 10 min read · [exploitnotes.hashnode.dev](https://exploitnotes.hashnode.dev/tryhackme-olympus-writeup?utm_source=hashnode&utm_medium=feed) [Jebitok](https://hashnode.com/@w1t3r) · [Sep 9](https://hashnode.com/posts/shells-listeners-fundamentals-tryhackme/6aa10fa94d3f6d171a297725) ### [Shells & Listeners Fundamentals (TryHackMe)](https://www.sharonjebitok.com/shells-listeners-fundamentals-tryhackme?utm_source=hashnode&utm_medium=feed) Link to the challenge on TryHackMe: Shells & Listeners Fundamentals Introduction In many real-world assessments, a minor bug becomes a foothold. Imagine a file upload feature that fails to validate co 25 min read · [sharonjebitok.com](https://www.sharonjebitok.com/shells-listeners-fundamentals-tryhackme?utm_source=hashnode&utm_medium=feed) [Jebitok](https://hashnode.com/@w1t3r) · [Sep 6](https://hashnode.com/posts/challenge-expose-tryhackme/6a9d282a456a0bbdeb02ec5d) ### [Challenge: Expose (TryHackMe)](https://www.sharonjebitok.com/challenge-expose-tryhackme?utm_source=hashnode&utm_medium=feed) Challenge on TryHackme: Expose Introduction Expose is a TryHackMe room focused on the risks of leaving unnecessary services running on a machine. The attack surface includes FTP, SSH, DNS, HTTP on a n 11 min read · [sharonjebitok.com](https://www.sharonjebitok.com/challenge-expose-tryhackme?utm_source=hashnode&utm_medium=feed)