Tracking
Vulnerabilities
The bugs that reshaped the industry, taken apart one at a time: the flawed assumption underneath, the path to exploitation, and what it cost the people who ran the software.
The library
9 write-ups — 7 of them known to have been exploited in the wild. Each one is the analysis I wanted to find when it landed.
- CVE-2024-309410.0critical
Backdoor in xz-utils liblzma
A multi-year social engineering campaign planted a backdoor in the xz release tarballs, hooking sshd via liblzma.
xz-utils
- CVE-2023-4966 Exploited9.4critical
CitrixBleed: session token leak in NetScaler ADC
An unauthenticated buffer over-read leaks session tokens from memory, allowing MFA to be bypassed by replaying a hijacked session.
Citrix PoC
- CVE-2022-22965 Exploited9.8critical
Spring4Shell: RCE in Spring Framework
Data binding in Spring MVC on JDK 9+ could be abused to reach class-loader properties and write a web shell, giving remote code execution.
VMware PoC
- CVE-2021-26855 Exploited9.8critical
ProxyLogon: pre-auth SSRF in Exchange
An SSRF in Microsoft Exchange chained to arbitrary file write for unauthenticated RCE. Mass-exploited against on-prem Exchange worldwide.
Microsoft PoC
- CVE-2019-0708 Exploited9.8critical
BlueKeep: pre-auth RCE in RDP
A use-after-free in Remote Desktop Services allowed unauthenticated, wormable remote code execution against a huge installed base of Windows hosts.
Microsoft PoC
- CVE-2021-44228 Exploited10.0critical
Log4Shell: JNDI lookup injection in Log4j 2
User-controlled strings reaching a Log4j 2 logging call trigger a JNDI lookup, giving remote code execution.
Apache PoC
- CVE-2017-0144 Exploited8.1high
EternalBlue: RCE in SMBv1
A flaw in Microsoft SMBv1 allowed remote code execution from a crafted packet. Weaponised by WannaCry and NotPetya into some of the costliest malware outbreaks on record.
Microsoft PoC
- CVE-2014-6271 Exploited9.8critical
Shellshock: arbitrary code execution in Bash
Bash evaluated trailing code in specially crafted environment variables, giving RCE through anything that passed attacker input into the environment — CGI especially.
GNU PoC
- CVE-2014-01607.5high
Heartbleed: memory disclosure in OpenSSL
A missing bounds check in the OpenSSL TLS heartbeat extension let anyone read up to 64KB of server memory per request — including private keys.
OpenSSL PoC