The Exploit Archives

CVE-2021-44228 allowed attackers to execute code through a single string.. Triggering one of the largest vulnerability responses on the internet. In this episode of The Exploit Archives , we break down how Log4Shell worked, why it spread so far, and the lessons it exposed about modern software dependencies. Support the show: ⁠⁠⁠⁠⁠⁠⁠The Exploit Archives⁠⁠⁠⁠ ⁠ Youtube: ⁠⁠⁠⁠⁠⁠ ⁠The Exploit Archives -...

CVE-2018-7600 - a crafted request turned thousands of websites into attacker control panels. In this episode of The Exploit Archives , we break down how Drupal was compromised again, how it worked and why RCE is still one of the worst outcomes for web platforms. Support the show: ⁠⁠⁠⁠⁠⁠The Exploit Archives⁠⁠⁠⁠ Youtube: ⁠⁠⁠⁠⁠⁠ The Exploit Archives - Youtube Weekly episodes! Tags: CVE breakdown, cyb...

CVE-2014-3704 - a single vulnerability in Drupal, one of the web's biggest content management. In this episode of The Exploit Archives , we break down how this silent bug in Drupal's code turned into global exploitation within hours, why thousands of sites were compromised, and what lessons it left behind. Stay tuned for Part Two. Support the show: The Exploit Archives Youtube: ⁠⁠⁠⁠⁠The Ex...

CVE-2024-3094 - a backdoor hidden inside XZ Utils, the tiny compression library bundled into millions of Linux systems. In this episode of The Exploit Archives , we break down how a trusted maintainer slipped in the malicious code, how close it came to being unleashed, and what this betrayal means for the future of open-source security. Support the show: ⁠⁠⁠⁠The Exploit Archives⁠⁠⁠⁠ Youtube: ⁠⁠⁠⁠T...

CVE-2025-23334, CVE 2025-23320, CVE-2025-23319 - three vulnerabilities in NVIDIA's Triton Inference Server that chain together, getting more critical each time. In this episode of The Exploit Archives , we break down this "Triple Threat", how these flaws work, why they matter for AI security, and what lessons they hold for protecting machine learning infrastructure. Support the show:...

CVE-2021-41096 - a flaw in Rucky , the open-source Android app that turns your phone into a “Rubber Ducky” style hacking tool. It exposed just how dangerous weak cryptography can be. In this episode of The Exploit Archives , we break down how the flaw worked, why it mattered, and how a simple cryptographic misstep turned a pentesting tool into a potential attack vector. Support the show: ⁠⁠The Exp...

CVE-2017-5753 & CVE-2017-5715 – better known as Spectre – exposed a terrifying truth: your CPU could be exploited. This wasn’t a software flaw. It was a vulnerability baked into the hardware of nearly every modern processor. And it wasn’t just theoretical. Attackers could steal passwords, encryption keys, and sensitive data... without ever touching the system. In this episode of The Exploit Archiv...

CVE-2021-3156 - was one of the most shocking privilege escalation bugs ever found in Linux. Hidden in sudo for nearly a decade, this flaw let any user with shell access become root instantly - no passwords, no exploit chains, just power. In this episode of The Exploit Archives , we break down how the bug worked, why it was so dangerous, and how a quiet code review uncovered a flaw sitting in plain...

CVE-2022-1388 — an authentication bypass in F5’s BIG-IP systems that gave attackers the keys to the kingdom. No password. No login. Just one carefully crafted request… and full root access. In this episode of The Exploit Archives , we break down how this critical flaw let remote attackers take over enterprise infrastructure, why so many systems were exposed, and how the exploit unfolded in the wil...

CVE-2021-21973: It was quiet, it was technical, and it was everything cybercrime groups needed to get their foot in the door. In this episode of The Exploit Archives , we unravel how this vulnerability let attackers pivot deep inside Enterprise environments - no login, no malware, just a crafted request and a misconfigured proxy. From reconnaissance to lateral movement, this wasn't just an exploit...

CVE-2019-0708 — a critical remote desktop vulnerability in Microsoft Windows, better known as BlueKeep. It had the potential to become the next WannaCry — wormable, deadly, and lurking in millions of systems. In this episode of The Exploit Archives , we explore how BlueKeep works, the panic it caused in the infosec world, and why—despite the hype—it never exploded the way experts feared. Support t...

CVE-2017-11882 is a remote code execution vulnerability in Microsoft’s legacy Equation Editor. A flaw that silently persisted for over 17 years. In this episode of The Exploit Archives , we break down how attackers embedded weaponised payloads into Word documents and triggered silent exploits with zero user interaction. Learn how this vulnerability worked, why it stuck around for so long, and how...