Month: September 2026

PHP mail() Command Injection to Remote Code Execution (RCE)

by

Author: NullSecurityX Published: February 7, 2026 Source: https://nullsecurityx.medium.com/php-mail-command-injection-to-remote-code-execution-rce-b2991e929ca3 Summary This writeup walks through a long-standing class of vulnerability in PHP web applications: passing unsanitized user input into the fifth argument ($additional_parameters) of the built-in mail() function. Because PHP’s mail() shells out to the system Mail Transfer Agent (typically sendmail), attacker-controlled data in that argument is … Read more

Gray Rabbits and the Tale of a One-Click Backdoor

by

Author: Alexandru-Cristian Bardaș Published: September 10, 2026 Source: https://www.gendigital.com/blog/insights/research/one-click-backdoor-sogou Summary Gen Threat Labs disclosed CVE-2026-51990, a critical remote code execution flaw in Sogou Input Method, the Tencent-owned Chinese-language IME installed on hundreds of millions of Windows machines. A single crafted link was enough to reach a six-year-old, sandbox-disabled Chromium engine bundled inside the product and … Read more