https://exploit-intel.com/blog/tags/rce/EIP research articles tagged rce.en-usFri, 01 May 2026 12:00:00 -0400https://exploit-intel.com/blog/posts/cve-2026-41940-cpanel-whm-auth-bypass/https://exploit-intel.com/blog/posts/cve-2026-41940-cpanel-whm-auth-bypass/CVE-2026-41940: a CRLF session-injection in cPanel & WHM that turns six unauthenticated HTTP requests into root SSH. Source-level walkthrough and audit.Fri, 01 May 2026 12:00:00 -0400https://exploit-intel.com/blog/posts/cve-2025-62507-redis-stackforge-from-crash-to-rce-with-aslr/https://exploit-intel.com/blog/posts/cve-2025-62507-redis-stackforge-from-crash-to-rce-with-aslr/The public material available during this CVE-2025-62507 run was a crash PoC. StackForge pursued RCE, then repeated the work with ASLR enabled.Tue, 03 Mar 2026 18:00:00 -0400https://exploit-intel.com/blog/posts/cve-2025-15467-openssl-stackforge-autonomous-binary-exploit/https://exploit-intel.com/blog/posts/cve-2025-15467-openssl-stackforge-autonomous-binary-exploit/We forked Shannon again - this time for binary exploit development. Nine AI agents, GDB as an MCP tool, packet capture via SharkMCP, and a pipeline that turned an OpenSSL stack buffer overflow into three independent ROP chains with GDB-verified RCE. Eighty-five minutes. Twenty-five dollars. Here's how Stackforge works.Tue, 03 Mar 2026 12:00:00 -0400https://exploit-intel.com/blog/posts/cve-2025-26866-hugegraph-hessian-deserialization-autonomous-exploit/https://exploit-intel.com/blog/posts/cve-2025-26866-hugegraph-hessian-deserialization-autonomous-exploit/CVE-2025-26866 is a Hessian deserialization RCE in Apache HugeGraph PD. Our autonomous exploit pipeline CVEForge - which had completed 56 consecutive CVEs - hit a wall: an undocumented binary protocol, a non-standard serialization format, and a class blacklist blocking every known gadget chain. The agent spent $49 and four hours reverse-engineering SOFABolt, mapping sofa-hessian byte by byte, and finding a JDK-only gadget chain to bypass the blacklist. Then we took over to turn file creation into a proper root shell - navigating JNDI hardening, CC library defenses, and a gadget chain that silently dies on modern JDK. The result: a full Metasploit module.Sun, 01 Mar 2026 18:00:00 -0400https://exploit-intel.com/blog/posts/cveforge-from-shannon-to-autonomous-poc/https://exploit-intel.com/blog/posts/cveforge-from-shannon-to-autonomous-poc/We forked Shannon - the open-source AI pentesting framework - and wired it to the EIP MCP server. Six AI agents, one CVE number, 32 minutes: a working RCE PoC for a CVSS 10.0 vulnerability with zero existing public exploits. Here's how it happened.Wed, 25 Feb 2026 12:00:00 -0400