--- title: "#remote-code-execution articles | Hashnode" description: "Explore 39 articles tagged #remote-code-execution on Hashnode. Tutorials, guides, and how-tos from the community." url: "https://hashnode.com/tag/remote-code-execution" --- Tag # #remote-code-execution 39 posts · 2 followers [Oghenemaro Ikelegbe](https://hashnode.com/@Maro101) · [5d ago](https://hashnode.com/posts/ms-paint-a-zero-click-flaw-hits-windows-lovable-drawing-app/6af1f791d9ada987ed02922f) ### [MS Paint: A "Zero-Click" Flaw Hits Windows' Lovable Drawing App](https://cybersage.hashnode.dev/ms-paint-a-zero-click-flaw-hits-windows-lovable-drawing-app?utm_source=hashnode&utm_medium=feed) Microsoft confirmed a flaw in MS Paint that could let attackers run code remotely. Here’s what happened and the fixed version 2 min read · [cybersage.hashnode.dev](https://cybersage.hashnode.dev/ms-paint-a-zero-click-flaw-hits-windows-lovable-drawing-app?utm_source=hashnode&utm_medium=feed) [Arshad](https://hashnode.com/@arshadakl) · [Oct 22](https://hashnode.com/posts/php-developers-wanted-a-patch-hackers-wanted-a-poc-nobody-slept/6ad9df325331ad9bdc7c07e6) ### [PHP Developers Wanted a Patch. Hackers Wanted a PoC. Nobody Slept](https://blog.arshadakl.in/php-developers-wanted-a-patch-hackers-wanted-a-poc-nobody-slept?utm_source=hashnode&utm_medium=feed) Discover PHP2Shell, the critical PHP zero-days, and how AI agents are accelerating vulnerability research, PoC development, and security threats. 5 min read · [blog.arshadakl.in](https://blog.arshadakl.in/php-developers-wanted-a-patch-hackers-wanted-a-poc-nobody-slept?utm_source=hashnode&utm_medium=feed) [1](https://hashnode.com/posts/php-developers-wanted-a-patch-hackers-wanted-a-poc-nobody-slept/6ad9df325331ad9bdc7c07e6) [Vũ Nhật Lâm](https://hashnode.com/@kami61) · [Oct 13](https://hashnode.com/posts/manus-agentic-ai-email-prompt-injection-en/6ace015ddcf80668e294f03e) ### [One Email Was Enough: When a Guardrail Detects the Attack and Still Can't Stop It](https://blog.fiscybersec.com/manus-agentic-ai-email-prompt-injection-en?utm_source=hashnode&utm_medium=feed) Summary Salt Labs, the research arm of Salt Security, turned the agentic AI platform Manus into a path to remote code execution with a single email. The victim did not have to click a link, download a 9 min read · [blog.fiscybersec.com](https://blog.fiscybersec.com/manus-agentic-ai-email-prompt-injection-en?utm_source=hashnode&utm_medium=feed) [1](https://hashnode.com/posts/manus-agentic-ai-email-prompt-injection-en/6ace015ddcf80668e294f03e) [Yogeshwar Peela](https://hashnode.com/@exploitnotes) · [Oct 12](https://hashnode.com/posts/tryhackme-plottedtms-writeup/6acce2b1df63bf7d3af1baa0) ### [TryHackMe: PlottedTMS Writeup](https://exploitnotes.hashnode.dev/tryhackme-plottedtms-writeup?utm_source=hashnode&utm_medium=feed) Explore the TryHackMe Plotted room walkthrough covering SQL injection, PHP web shell upload,cron-based privilege escalation, and doas misconfiguration 8 min read · [exploitnotes.hashnode.dev](https://exploitnotes.hashnode.dev/tryhackme-plottedtms-writeup?utm_source=hashnode&utm_medium=feed) [Yogeshwar Peela](https://hashnode.com/@exploitnotes) · [Oct 12](https://hashnode.com/posts/tryhackme-gallery-writeup/6acce4c9df3ff43cd5520a9b) ### [TryHackMe: Gallery Writeup](https://exploitnotes.hashnode.dev/tryhackme-gallery-writeup?utm_source=hashnode&utm_medium=feed) Explore the TryHackMe Gallery walkthrough covering SQL injection, PHP webshell upload, leaked credentials, sudo misconfiguration, and nano privilege. 7 min read · [exploitnotes.hashnode.dev](https://exploitnotes.hashnode.dev/tryhackme-gallery-writeup?utm_source=hashnode&utm_medium=feed) [Yogeshwar Peela](https://hashnode.com/@exploitnotes) · [Sep 22](https://hashnode.com/posts/tryhackme-adventure-time-writeup/6ab27264ae7f6a9040b5cb59) ### [TryHackMe: Adventure Time Writeup](https://exploitnotes.hashnode.dev/tryhackme-adventure-time-writeup?utm_source=hashnode&utm_medium=feed) Adventure Time TryHackMe writeup covering FTP EXIF clues, web puzzles, Morse, AES, Vigenère, Spoon, steganography, and Exim CVE-2019-10149. 11 min read · [exploitnotes.hashnode.dev](https://exploitnotes.hashnode.dev/tryhackme-adventure-time-writeup?utm_source=hashnode&utm_medium=feed) [Yogeshwar Peela](https://hashnode.com/@exploitnotes) · [Sep 22](https://hashnode.com/posts/tryhackme-python-playground-writeup/6ab26fe5d90980069bb54b19) ### [TryHackMe: Python Playground Writeup](https://exploitnotes.hashnode.dev/tryhackme-python-playground-writeup?utm_source=hashnode&utm_medium=feed) Python Playground TryHackMe writeup covering Python sandbox bypass, RCE, credential recovery, Docker container escape, and SUID privilege escalation. 8 min read · [exploitnotes.hashnode.dev](https://exploitnotes.hashnode.dev/tryhackme-python-playground-writeup?utm_source=hashnode&utm_medium=feed) [Yogeshwar Peela](https://hashnode.com/@exploitnotes) · [Sep 10](https://hashnode.com/posts/tryhackme-olympus-writeup/6aa27ae3a238c961e5e2b2b7) ### [TryHackMe - Olympus Writeup](https://exploitnotes.hashnode.dev/tryhackme-olympus-writeup?utm_source=hashnode&utm_medium=feed) Olympus TryHackMe writeup covering Victor CMS SQL injection, credential cracking, file upload RCE, SUID abuse, SSH access, and root shell. 10 min read · [exploitnotes.hashnode.dev](https://exploitnotes.hashnode.dev/tryhackme-olympus-writeup?utm_source=hashnode&utm_medium=feed) [Alireza Kalhor](https://hashnode.com/@alirezakalhor) · [Aug 25](https://hashnode.com/posts/cve-2026-17532-nonce-true-web-shell/6a8da410f2a515cc384a6475) ### [CVE-2026-17532: nonce: true => Web Shell](https://kalhor.hashnode.dev/cve-2026-17532-nonce-true-web-shell?utm_source=hashnode&utm_medium=feed) Unauthenticated XSS in a WordPress caching plugin (50,000+ sites) chains into 1-click RCE via a PHP type-juggling bug. Write-up + PoC lab inside. 7 min read · [kalhor.hashnode.dev](https://kalhor.hashnode.dev/cve-2026-17532-nonce-true-web-shell?utm_source=hashnode&utm_medium=feed) [404 Founders](https://hashnode.com/@404-founders) · [Aug 26](https://hashnode.com/posts/exchange-cve-2026-62911-62913-prerequisites/6a8ea4caf7eee8eaff6fa467) ### [Two Exchange Bugs, Two Very Different Prerequisites](https://404-founders.com/blog/exchange-cve-2026-62911-62913-prerequisites?utm_source=hashnode&utm_medium=feed) Two August Exchange flaws share a patch window, but the attack prerequisites are different enough that defenders should not treat them as one problem. 3 min read · [404-founders.com](https://404-founders.com/blog/exchange-cve-2026-62911-62913-prerequisites?utm_source=hashnode&utm_medium=feed)