#remote-code-execution

2 articles

Two loops disagreed about empty fields — and that was an unauthenticated PHP upload on any Elementor form

2026-08-20Security

CVE-2026-32475 is a CVSS 9.0 in Elementor Pro's Forms module. Validation and file-moving run in separate loops that handle empty entries differently, so submitting two file parts for one field skips the extension blocklist entirely. All versions to 4.2.1 are affected; 4.2.2 fixes it.

CISA gave agencies three days, not the usual three weeks — the Windows flaw was patched in April and is being exploited now

2026-08-19Security

CVE-2026-33824 is a double free in the Windows IKE Service Extensions, reachable by anyone who can send a UDP packet to port 500 or 4500. Microsoft fixed it in April without flagging exploitation. CISA added it to the exploited catalogue on 18 August and set a three-day patch deadline, which is not what that directive normally allows.