ALCASAR is a free Network Access Controller which controls the Internet consultation networks. It authenticates, attributes and protects users' access regardless their connected equipment (PC, smartphone, game console, etc.). I recently released an exploit for ALCASAR 2.8 (ALCASAR <= 2.8 Remote Code Execution Vulnerability Root). As a reminder, it was a trivial code execution via a unfiltered exec() call: $pattern = preg_replace('/www./','',$_SERVER['HTTP_HOST']); exec("grep -Re ^$pattern$ /etc/dansguardian/lists/blacklists/*/domains|cut -d'/' -f6", $output); A few days later, a new version corrects the vulnerability. Or maybe not...