Another week, another parade of internet-connected regret. Vendors keep shipping code like QA is a myth invented by accountants, and here we are.
This Week's Hall of Shame: Top CVEs
CVE-2026-9082 — Drupal’s SQL Injection Speedrun
The Gist: A critical SQL injection bug in Drupal core carries a CVSS 9.8 and is remotely exploitable with no privileges or user interaction required. It’s being exploited in the wild, there’s public proof-of-concept code, and affected versions span a frankly impressive chunk of the Drupal family tree. Why It Should Keep You Up at Night: This is the kind of bug that turns a public-facing CMS into an attacker’s snack dispenser: database compromise, site takeover, data theft, and possibly a very awkward Monday. If your org still treats “we’ll patch after testing” as a personality trait, this is your reminder that attackers do not respect change windows.
Your Playbook:
- Upgrade Drupal core immediately to a fixed release: 10.4.10, 10.5.10, 10.6.9, 11.1.10, 11.2.12, 11.3.10, or later as applicable to your branch.
- Prioritize internet-facing Drupal instances for emergency patching and review logs, database activity, and admin account changes for signs of exploitation.
Sources: Rapid Risk Radar | CVE Organization | CVEShield | The Hacker News
CVE-2026-45659 — SharePoint Does Deserialization, Badly
The Gist: Microsoft Office SharePoint has a high-severity deserialization flaw with a CVSS 8.8 that allows an authorized attacker to execute code over the network. There’s public POC material and a patch is available, though there’s no confirmed in-the-wild exploitation yet — which is usually the calm before the scan storm. Why It Should Keep You Up at Night: “Authorized attacker” sounds comforting right up until you remember compromised low-privilege accounts are basically a standard feature of modern intrusions. Once code execution lands on SharePoint, the attacker is standing in one of the organization’s juiciest document and workflow hubs like they own the place.
Your Playbook:
- Apply Microsoft’s security update for CVE-2026-45659 to all SharePoint environments without waiting for your next leisurely patch cycle.
- Audit SharePoint accounts and permissions, especially low-privileged or stale accounts, and monitor for suspicious process execution or unusual application behavior after authentication.
Sources: Rapid Risk Radar | MSRC Security Updates | CVE Organization | HelpNetSecurity
CVE-2026-9312 — GitHub Enterprise’s Internal Sightseeing Tour
The Gist: GitHub Enterprise Server is affected by a critical SSRF flaw, CVSS 9.2, that lets an unauthenticated attacker craft requests to internal services via an upload endpoint. The bug impacts all versions prior to 3.22 and was fixed in 3.16.20, 3.17.17, 3.18.11, 3.19.8, 3.20.4, and 3.21.1. Why It Should Keep You Up at Night: SSRF is the gift that keeps on taking: internal service access, credential exposure, and a lovely opportunity for attackers to poke around systems that were never meant to see daylight. The only silver lining is no reported wild exploitation yet, which in security terms means “you still have time to do the obvious thing.”
Your Playbook:
- Upgrade GitHub Enterprise Server to a fixed version immediately: 3.16.20, 3.17.17, 3.18.11, 3.19.8, 3.20.4, 3.21.1, or later.
- Review network paths and internal service exposure from your GitHub Enterprise deployment, and inspect upload endpoint activity for anomalous request patterns or path traversal attempts.
Sources: Rapid Risk Radar | CVE Organization
Industry Intel: What Else is On Fire This Week
- 5 Steps to Managing Shadow AI Tools Without Slowing Down Employees — Because apparently every department now has three unsanctioned AI copilots and one of them is absolutely pasting customer data into a chatbot. Read more
- Gitea Vulnerability Exposes Private Container Images without Authentication — Nothing says “defense in depth” like private images being public if you just ask with enough confidence. Read more
- AI Chatbot Recommendations Redirect Users to Cryptojacking Malware Sites — Your helpful AI assistant, now with bonus malware referrals, because the future insisted on being extremely stupid. Read more
Stay ahead of the threat landscape at Rapid Risk Radar — where CVEs get scored and prioritized so you don't have to panic-Google "is this bad" at 2am. Check out the platform and stop flying blind.