Remote code execution (RCE)

A security flaw can sometimes let an attacker make another computer run code remotely. An RCE advisory describes a capability under particular conditions; it does not show that every installation has been attacked.

Remote code execution means causing a system elsewhere to run code. In a security advisory, it usually describes something an attacker could achieve by exploiting a weakness, rather than authorised remote administration.

The details decide who is exposed: the affected software and version, the configuration and any access conditions. A serious vulnerability is not the same thing as evidence that every system using that software has been compromised.

For example, NHS England’s October 2026 PHP2Shell alert identifies two PHP vulnerabilities that can allow remote code execution or access to sensitive process memory. It distinguishes affected versions and published fixes from evidence of exploitation. That example illustrates why organisations need to identify their own affected systems; it does not establish that AI caused the vulnerabilities or attacks.