TAG
#rce
Stories connected through a shared idea, actor, technology or theme.
Bifrost HTTP transport receives a new unauthenticated RCE disclosureThe CVE describes unauthenticated plugin-path submission through POST /api/plugins when management authentication is disabled, allowing native code execution on affected dynamically linked builds. The published static Docker image is expected to be limited to SSRF, but operators should still upgrade or enable management authentication.→PaperCut releases an emergency patch after confirmed exploitationPaperCut's security bulletin recorded confirmed exploitation and customer incidents affecting all NG and MF versions, then announced an emergency patch for versions 25 and 26 at 02:10 AEST. The company advised restricting public access to affected servers while work continued on the version 24 patch.→CISA orders urgent remediation for actively exploited Ray RCE flawCISA said attackers are exploiting CVE-2025-62593, a critical Ray vulnerability with a CVSS v4 score of 9.4. The browser-based attack can reach developer machines or private networks through DNS rebinding, and Ray 2.52.0 contains the fix.→