CVE-2026-41940: cPanel & WHM Pre-Auth RCE - Two Write Paths, One Filter
CVE-2026-41940: a CRLF session-injection in cPanel & WHM that turns six unauthenticated HTTP requests into root SSH. Source-level walkthrough and audit.
rce Security Research
5 articles in this topic.
May 2026
1 article- 22 min read
March 2026
3 articles- 17 min read
CVE-2025-62507: Redis Stack Overflow to RCE in 68 Minutes - Then We Turned ASLR On
The public material available during this CVE-2025-62507 run was a crash PoC. StackForge pursued RCE, then repeated the work with ASLR enabled.
- 22 min read
CVE-2025-15467: From OpenSSL Stack Overflow to Three ROP Chains in 64 Minutes - Introducing Stackforge
We forked Shannon again - this time for binary exploit development. Nine AI agents, GDB as an MCP tool, packet capture via SharkMCP, and a pipeline that turned an OpenSSL stack buffer overflow into three independent ROP chains with GDB-verified RCE. Eighty-five minutes. Twenty-five dollars. Here's how Stackforge works.
- 28 min read
CVE-2025-26866: From Undocumented Binary Protocol to Root Shell - AI Agent Meets Java Deserialization
CVE-2025-26866 is a Hessian deserialization RCE in Apache HugeGraph PD. Our autonomous exploit pipeline CVEForge - which had completed 56 consecutive CVEs - hit a wall: an undocumented binary protocol, a non-standard serialization format, and a class blacklist blocking every known gadget chain. The agent spent $49 and four hours reverse-engineering SOFABolt, mapping sofa-hessian byte by byte, and finding a JDK-only gadget chain to bypass the blacklist. Then we took over to turn file creation into a proper root shell - navigating JNDI hardening, CC library defenses, and a gadget chain that silently dies on modern JDK. The result: a full Metasploit module.
February 2026
1 article- 10 min read
CVE-2025-53833: Autonomous PoC Generation with CVEForge - From CVE Number to Root Shell in 32 Minutes
We forked Shannon - the open-source AI pentesting framework - and wired it to the EIP MCP server. Six AI agents, one CVE number, 32 minutes: a working RCE PoC for a CVSS 10.0 vulnerability with zero existing public exploits. Here's how it happened.