[EXPLOIT] CVE-2025-55182 [CRITICAL/PoC] CVSS: 10 | Vendor: #Meta

ReactorWriteUp-HackTheBox

🔗 https://t.co/e53CpR0MVG

ExploitGrid Daily Digest

🚨 Top Exploits: CVE-2025-24813 (CVSS: 10) Apache Softw... CVE-2025-55182 (CVSS: 10) Meta CVE-2025-57819 (CVSS: 10) FreePBX CVE-2026-27626 (CVSS: 10) olivetin CVE-2025-69872 (CVSS: 9.8)

..🧵👇

A design choice in a frontend framework led to full backend compromise for a huge number of web apps.

React2Shell, tracked as CVE-2025-55182, hit React Server Components in late 2025. It allowed unauthenticated remote code execution with a CVSS score of 10.0.

The bug came from architecture rather than a simple coding slip. It blurred the line between data and executable intent at the client-server boundary.

In his AppSec Israel 2026 talk, "When React Becomes an Attack Vector: Lessons from the React2Shell CVE" , on Tuesday, October 6, Ofir Elarat used the flaw as a case study in insecure design.

Speaker: Ofir Elarat , Developer, Orion Security

The talk built a threat model with three trust zones: the browser, the framework runtime and the application server. It traced root causes such as implicit trust in framework-generated calls and weak checking of serialized input.

It walked the attack chain from client to server at a high level. It also mapped the flaw to the OWASP Top 10 and OWASP ASVS. It also explained what the fix changed.

The defensive patterns are practical. Treat framework-managed calls as untrusted input. Layer defenses across client, framework and server, then log server-side execution.

According to the React team's advisory , versions 19.0.1, 19.1.2 and 19.2.1 fix the flaw. CISA added it to its Known Exploited Vulnerabilities catalog days after disclosure.

Ofir Elarat is a software engineer at Orion Security. He was previously a senior software engineer at Mixtiles. Before that, he spent six years as a developer and team lead in the Israel Defense Forces.

He writes about rendering strategies and AI tooling on his Medium blog .

AppSec engineers and developers who use React Server Components should treat framework internals as part of their threat model.

Does your threat model treat framework-generated calls as untrusted input?

💥 WORDPRESS ZERO-DAY ALERT!

Bricksforge plugin flaw (CVE-2026-85097, CVSS 9.8) exploited in the wild to upload webshells and achieve unauthenticated RCE.

Read full Blog: https://t.co/d11EvgvvuK

#Hacktober #CyberAwareness #sh3llc0d3 #shellcode #WordPress #ZeroDay

🚨 CVE-2026-85097: Bricksforge for WordPress has a public exploit for unauthenticated file upload leading to PHP code execution.

CVSS 9.8. ExploitGrid: 47.3/100, Medium. Exploitation reported in the wild.

Update to 3.1.8.10.

🔎 https://t.co/3IVcXRXJyB

🔥 EXPLOITED IN THE WILD — WordPress Bricksforge CVE-2026-85097

CVSS 3.1: 9.8 Critical (Wordfence)

Unauthenticated arbitrary file upload in the Bricksforge WordPress plugin (<= 3.1.8.9). It allows PHP uploads and remote code execution. Every site with Pro Forms active is exposed.

🎯 Patchstack saw attacks from 63 IPs, starting Oct 7, just hours before the CVE went public.

✅ Fixed: 3.1.8.10 (3.x) / 4.0.2 (4.x)

What to do: • Update now • Check uploads folders for unexpected .php files • Rotate stored API keys

Not in CISA KEV.

Full breakdown 👇 https://t.co/azpopLM4xu

#WordPress #Bricksforge #CVE #RCE #Webshell #CyberSecurity #Infosec

Our latest write-up explores CVE-2026-97229, its vulnerability mechanics, and what security researchers can learn from it.

Read the breakdown 👇

#CyberSecurity #CVE

🔥 GITLAB CI/CD CVSS 10.0 RCE!

Critical integer overflow (CVE-2026-97229) in pipeline regex engine enables remote code execution and runner takeover.

Read full Blog: https://t.co/YF8TmS3IQt

#Hacktober #CyberAwareness #sh3llc0d3 #shellcode #GitLab #AppSec

#NØØT_Security_Alerts 🚨 #ALERT — GITLAB CVSS 10.0: RESEARCHERS REPRODUCE CRITICAL REMOTE CODE EXECUTION IN CI/CD PROCESSING October 12, 2026 — Exploit Research Confirmed October 13

DISCLOSED BY: GitLab Security / Rapid7 Intelligence

PRODUCT: GitLab Community Edition and Enterprise Edition

CVE: CVE-2026-97229 SEVERITY: CRITICAL — CVSS 10.0 WEAKNESS: CWE-190 — Integer Overflow

AFFECTED VERSIONS: 19.2 before 19.2.8. 19.3 before 19.3.5. 19.4 before 19.4.2.

IMPACT: A crafted regular expression in GitLab CI/CD configuration can trigger memory corruption in Ruby’s Onigmo regular-expression compiler.

Successful exploitation enables operating-system command execution within a GitLab application process.

EXPLOITATION STATUS: CONFIRMED LABORATORY RCE.

Rapid7 independently reproduced arbitrary command execution against GitLab CE 19.4.1 with ASLR enabled.

The same exploit input failed against patched version 19.4.2.

No confirmed malicious in-the-wild exploitation.

EXPOSURE: The demonstrated attack requires placing malicious CI/CD configuration and a specially formed UTF-8 repository path into a repository.

On instances permitting untrusted users to register and create public projects, an attacker can satisfy these prerequisites without previously possessing an account.

Other configurations may require repository write permissions.

Forensic triage: Inspect unexpected .gitlab-ci.yml modifications, suspicious regular expressions and unusual UTF-8 repository paths.

Review CI lint activity, unexpected GitLab worker crashes and unauthorized command execution by the GitLab service account.

No verified attacker-specific IOCs published.

URGENT ACTION: Upgrade self-managed GitLab immediately:

19.2 → 19.2.8 19.3 → 19.3.5 19.4 → 19.4.2

Temporarily restrict untrusted project creation and repository modifications until patched.

https://t.co/xoSjlzMRY2 is already patched. GitLab Dedicated customers require no additional action.

SOURCE: https://t.co/l32yr6HRIW

INDEPENDENT EXPLOIT VALIDATION: https://t.co/6uxhAxqUgD

CONFIDENCE: HIGH — Official GitLab advisory and independently reproduced code execution against an official vulnerable image, followed by successful verification of the patched build.

ACTIVE EXPLOITATION: NOT VERIFIED.

#CyberSecurity #ThreatIntel #GitLab #RCE #DevSecOps #SupplyChainSecurity

Microsoft dropped a massive security update for October 2026, fixing a staggering 1,102 Windows bugs (part of over 1,400 CVEs overall).

It includes a fix for an actively exploited Windows Shell flaw (CVE-2026-96951), plus new "risk cohorts"

Microsoft закрыла рекордные 1411 уязвимостей, одна из них в Windows Shell уже используется в атаках

В октябрьский Patch Tuesday Microsoft исправила 1411 уязвимостей, 70 из них критические. Прежний рекорд сентября в 966 проблем продержался месяц. В выпуске 677 ошибок повышения привилегий, 317 RCE и 254 утечки данных. Ещё 348 уязвимостей компания закрыла раньше в октябре, в этот счёт они не вошли. Tenable насчитала 1407 CVE и 69 критических, но на статус рекорда это не влияет.

Главный риск несёт CVE-2026-96951 (CVSS 8,8) в Windows Shell. Она позволяет обойти Mark of the Web, то есть система перестаёт считать файл пришедшим из недоверенного источника. Microsoft подтвердила эксплуатацию, CISA внесла уязвимость в каталог KEV. Ещё две публично раскрытые проблемы: CVE-2026-108398 в .NET Framework обходит Windows Defender Application Control, CVE-2026-92707 в MessagePack-CSharp вызывает отказ в обслуживании.

Чтобы не дать атакующим использовать уже известную дыру, обновления лучше раскатывать по степени риска, а не по порядку. В первую очередь стоит закрыть CVE-2026-96951 на рабочих станциях, где открывают файлы из почты и интернета. Затем нужно проверить системы, которые 13 октября потеряли поддержку: Windows 11 24H2 Home и Pro и Windows 10 Enterprise LTSB 2016.

#Microsoft #PatchTuesday #Windows #MarkOfTheWeb

@ZerodayAlert

Microsoft October Patch Tuesday: 1,413 flaws patched - record breaker

CVE-2026-96951 Windows Shell 8.8 CVSS ALREADY EXPLOITED - bypasses Mark of the Web

Command-injection lets attacker strip MotW, malicious file looks trusted

CISA deadline Oct 16

Source: Microsoft / CISA - Developing #PatchTuesday #Microsoft #CVE202696951

🚨 IVANTI ZERO-DAY IN CISA KEV!

CISA mandates emergency patching for CVE-2026-104935—an active pre-auth authentication bypass in Ivanti Connect Secure VPN.

Read full Blog: https://t.co/Fxb87j0R4X

#Hacktober #CyberAwareness #sh3llc0d3 #shellcode #Ivanti #ZeroDay

CVE-2026-104935: Ivanti Connect Secure <= 22.8R2.4 - Authentication Bypass via X-DSCGI-PATH Header https://t.co/AmPLITNfzr

Ivanti Zero-Day Chain Gave Attackers Root Access to Fully Patched VPN CVE-2026-104935 affects Ivanti Connect Secure and it can be exploited for unauthenticated remote code execution with elevated privileges. #Ivant #VPN #ZeroDay #Security @SecurityWeek https://t.co/fwGTdfGFS8