Security News > 2021 > October > CISA Urges Sites to Patch Critical RCE in Discourse
Discourse - the ultra-popular, widely deployed open-source community forum and mailing list management platform - has a critical remote code-execution bug that was fixed in an urgent update on Friday.
Discourse is widely used and wildly popular, being known for topping competing forum software platforms in terms of usability.
The issue has been patched in the latest beta, stable and tests-passed versions of Discourse.
The researcher, "Joernchen," told BleepingComputer that he reported the issue to the Discourse team immediately upon finding it on Oct. 10 and that the patch itself made it easy to figure out how an exploit would work.
Although the software-as-a-service versions of Discourse were fixed as of Wednesday, there might still be many vulnerable deployments.
Threatpost has reached out to Discourse for more details and to ask whether or not the team has seen any signs that the RCE has been exploited in the wild.
News URL
https://threatpost.com/cisa-critical-rce-discourse/175705/
Related news
- Hackers exploit critical Aviatrix Controller RCE flaw in attacks (source)
- CISA orders agencies to patch BeyondTrust bug exploited in attacks (source)
- Critical SimpleHelp Flaws Allow File Theft, Privilege Escalation, and RCE Attacks (source)
- Critical Flaws in WGS-804HPT Switches Enable RCE and Network Exploitation (source)
- SonicWall Urges Immediate Patch for Critical CVE-2025-23006 Flaw Amid Likely Exploitation (source)
- Patch now: Cisco fixes critical 9.9-rated, make-me-admin bug in Meeting Management (source)
- Zyxel CPE devices under attack via critical vulnerability without a patch (CVE-2024-40891) (source)
- CISA and FDA Warn of Critical Backdoor in Contec CMS8000 Patient Monitors (source)
- Netgear warns users to patch critical WiFi router vulnerabilities (source)
- CISA orders agencies to patch Linux kernel bug exploited in attacks (source)