Remote-Code-Execution on HackingPassion.com : root@HackingPassion.com-[~]

Internet Explorer Can Still Take Over a Fully Patched Windows PC in 2026

Mon, 08 Jun 2026 14:14:52 +0200

Internet Explorer can still take over a fully patched Windows machine, years after Microsoft retired it in 2022. The code that ran it was never removed from Windows, and a researcher just turned it into working remote code execution.

The researcher behind it, Igor Sak-Sakovskiy, published the work with Microsoft’s permission. The piece he pulled apart is called the WebBrowser control, the same code that drew web pages in Internet Explorer for decades. It still runs inside programs written in Visual Basic, .NET and C#, the kind of older business software and legacy tools that quietly kept the component alive. One detail makes it stranger. No official Microsoft document says this component is retired or about to be. People treat it as gone, while it keeps running underneath.

GitHub RCE CVE-2026-3854: One Semicolon, Millions of Private Repositories

Wed, 29 Apr 2026 11:54:47 +0200

GitHub RCE CVE. A semicolon broke GitHub. One character in a push option field, and a security researcher was running code on the backend servers that store private repositories from millions of users and organizations. The git service user that processes every push on those servers has filesystem access to every repository on the node, and that access does not check who the repository belongs to. Private code from banks, hospitals, governments, and individual developers all sits on the same shared infrastructure. The command that got the researcher there is something every developer already runs every day.

Microsoft Bing CVSS 10.0: CVE-2026-33819 Remote Code Execution Explained

Sat, 25 Apr 2026 11:10:39 +0200

Bing had a CVSS 10.0 vulnerability in its backend infrastructure, the same infrastructure that powers Edge, Windows Search, and Copilot integrations across Microsoft’s ecosystem. Microsoft fixed it on March 10 without saying a word publicly. The CVE showed up six weeks later, on April 23. Nobody outside the company knew this had been sitting in the infrastructure that hundreds of millions of people use every day.

The CVE number is 2026-33819. The vulnerability class is deserialization of untrusted data, and the idea behind it is simpler than it sounds.