RCE

October is Cybersecurity Awareness Month, and Citrix just handed attackers a gift. Three zero-days in NetScaler ADC and Gateway — exploited in the wild before patches existed, chained together for persistent access, and added to CISA’s Known Exploited Vulnerabilities catalog within days of disclosure. If your organization runs a customer-managed NetScaler appliance, this one isn’t theoretical. Here’s the full breakdown: what happened, how the attack chain worked, and what red teamers and defenders need to know right now. ...

Server-Side Template Injection (SSTI) is one of the most dangerous web vulnerabilities you’ll encounter. A simple {{7*7}} in the right field can hand you full remote code execution on a production server. This guide covers everything — detection, fingerprinting, exploitation, WAF bypass, and defense — for every major template engine in 2026. What Is SSTI? Web frameworks use template engines to render dynamic content — think Flask with Jinja2, PHP apps with Twig, Java apps with FreeMarker. When user input is concatenated directly into a template string rather than passed as a variable, the template engine evaluates it. That’s SSTI. ...

Command injection is one of the most dangerous vulnerability classes in web security. Not because it’s subtle — it’s actually one of the most direct paths to full system compromise. You inject a shell command through a web input, the server executes it, and suddenly you’re running arbitrary code on someone’s infrastructure. OWASP has kept injection in its Top 10 for over a decade for good reason. When you find command injection, the game changes. It’s not “I can read a record I shouldn’t.” It’s “I own this server.” ...