Vulnerabilities
OpenAI Codex RCE via Unsanitized Config Setting (CVE‑2026‑19592)
A remote code execution flaw in OpenAI Codex allows attackers to run arbitrary code when a user opens a malicious file or visits a crafted page. The vulnerability stems from missing sanitization of configuration settings and requires user interaction. OpenAI has released a patch; defenders should update immediately.
What happened
OpenAI Codex was found to contain a flaw that lets an attacker execute arbitrary code on the host if a user opens a malicious file or visits a malicious webpage. The issue originates from the handling of configuration files where input is not properly sanitized, allowing injection of executable code. The vulnerability is identified as CVE‑2026‑19592 with a CVSS score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).
Impact
Any installation of Codex that processes user‑supplied configuration files is at risk. Successful exploitation runs code with the privileges of the current user, potentially compromising the entire system. The flaw requires user interaction, so it is not a purely remote exploit.
What to do
- Verify that your Codex deployment is running the latest patched version (see OpenAI release notes or CVE record).
- Apply the vendor‑issued patch immediately; if a patch is not yet available, restrict file access and disable the ability to load external configuration files.
- Audit existing configuration files for unsanitized values and enforce strict validation rules.
- Monitor for unexpected process creation or execution of code originating from configuration files.
OpenAI has confirmed the issue and issued a fix. Defenders should treat this as a high‑severity RCE and act swiftly.
Related vulnerabilities
Active Exploitation of Critical WordPress RCE Vulnerability CVE-2026-87902
Threat actors are actively exploiting a critical 9.2-rated remote code execution vulnerability in WordPress, tracked as CVE-2026-87902, shortly after public disclosure. Unauthenticated attackers leverage insecure page-template resolution via get_page_template() to include local PHP files such as pearcmd.php, provided specific directory and file prerequisites are met. Defenders must audit theme configurations, apply official updates, and monitor for unauthorized file writes.
Read briefing
OpenOffice Versions <4.1.17 Vulnerable to Remote Code Execution (CVE‑2026‑59265, CVE‑2026‑63277)
Multiple CVEs have been identified in OpenOffice versions older than 4.1.17 that enable remote code execution. The flaws allow an attacker to trigger arbitrary code on a target system via crafted documents. Defenders must apply the vendor’s patches immediately or upgrade to a supported release.
Read briefing
CVE-2026-108448: Outlook RCE Vulnerability - Update Confirmation
A remote code execution (RCE) vulnerability in Microsoft Outlook (CVE-2026-108448) was initially addressed in October 2026 updates but was not formally documented in the security bulletin. Defenders should verify October 2026 updates are applied; no further action is needed if already patched.
Read briefing
CVE-2026-108449: Microsoft Word RCE - Update Reminder
A remote code execution vulnerability in Microsoft Word (CVE-2026-108449) was initially addressed in October 2026 updates but was not formally documented in the security bulletin. Defenders should confirm October 2026 updates are applied to mitigate potential risk.
Read briefing