Metasploit's April Arsenal: RCE for FreeScout, Grav CMS, and a Ghostly Windows Logon Trick
You're scripting a payload drop into a vulnerable web app. Suddenly, Metasploit's fresh modules light up your console — RCE in FreeScout via a sneaky .htaccess bypass. This week's wrap-up isn't just code; it's a blueprint for modern breaches.
⚡ Key Takeaways
- New RCE modules for FreeScout (unauth) and Grav CMS (auth) expand Metasploit's web attack surface. 𝕏
- Generic HTTP os_cmd_exec catches broad misconfigs; Windows logon persistence via registry is stealthy. 𝕏
- Contributor-driven updates highlight open-source speed — a persistent edge over closed tools. 𝕏
Worth sharing?
Get the best Cybersecurity stories of the week in your inbox — no noise, no spam.
Originally reported by Rapid7 Blog
Related Stories
Security Tools
Metasploit's March 2026 Update Arms Attackers Against Printers, Dev Spaces, and Email Gateways
Security Tools
Metasploit's Fresh Strike: Cisco Zero-Day Bypass and msfvenom Warp Speed
Vulnerabilities & CVEs
Metasploit's March 2026 Punch: FreePBX and AVideo Ripe for Ransack
Nation-State Threats