What it really takes to exploit high-profile CVEs, tested rather than assumed.
4 articles
Exploit analysis
PHP2Shell can enable pre-authentication remote code execution, but exploitability depends on the server’s exact build and runtime configuration, not merely its PHP version. This research presents 42 binary-verified x86_64 RCE profiles covering 42 of 110 supported vulnerable PHP releases, plus three separately documented special-case experimental profiles.
Exploit analysis
CVE-2025-24813 has been making headlines with a critical 9.8 CVSS score, raising concerns across the industry. But after diving deep into its internals, our R&D team came to a different conclusion: this vulnerability is far harder to exploit than it seems.
Exploit analysis
In 2020, SAP disclosed CVE-2020-6219, a deserialization-based Remote Code Execution (RCE) vulnerability in the Crystal Report Viewer. Fast forward to 2025, and we revisited this flaw developing a practical exploitation path that highlights just how dangerous it remains in real-world scenarios.
Exploit analysis
How a popular Ruby gem exposed thousands of applications to remote code execution. A technical analysis of the vulnerability that affected major platforms worldwide.
We use optional Google Analytics cookies to understand how the site is used. Nothing is sent to Google unless you allow analytics. You can change this choice at any time in our Cookies Policy.