Another week, another stack of “how did this ship?” moments. The bugs are critical, the exploits are live, and somewhere a vendor is drafting a blog post about its “commitment to security.”
This Week's Hall of Shame: Top CVEs
CVE-2026-48558 — OIDC, but make it optional
The Gist: SimpleHelp versions 5.5.15 and earlier, plus 6.0 pre-release builds, contain an authentication bypass in the OIDC login flow with a CVSS 9.5. Attackers can remotely forge identity tokens without signature verification to gain a fully authenticated technician session, and the flaw is being exploited in the wild.
Why It Should Keep You Up at Night: This is the kind of bug that turns “identity provider integration” into “please impersonate whoever you want.” If your remote support platform can be convinced to trust unsigned tokens, you've basically replaced access control with vibes. In some setups, it can even sidestep MFA, because apparently the second factor was more of a suggestion.
Your Playbook:
- Upgrade SimpleHelp immediately to a fixed release beyond 5.5.15 and avoid vulnerable 6.0 pre-release versions in production.
- If OIDC is enabled, review technician account logins for anomalous sessions and rotate credentials or session tokens tied to remote support access.
Sources: Rapid Risk Radar | CVE Organization | Bleeping Computer | HelpNetSecurity
CVE-2026-52813 — Git repo, meet filesystem escape room
The Gist: Gogs before 0.14.3 is vulnerable to a path traversal flaw in organization names, scoring a perfect 10.0 CVSS. A remote unauthenticated attacker can use ../ sequences to write repositories to arbitrary filesystem locations and ultimately achieve RCE; exploitation has been observed in the wild.
Why It Should Keep You Up at Night: A self-hosted Git service writing files wherever an attacker points it is not a feature, despite what chaos engineers might claim after two coffees. The path traversal can be chained through nested repositories to overwrite hook configurations, which is a fancy way of saying “your code forge can become the attacker's code launcher.” If this box touches anything important, assume it just auditioned for lateral movement.
Your Playbook:
- Upgrade Gogs to version 0.14.3 immediately; anything earlier is playing filesystem roulette.
- Audit repository and organization names for traversal patterns, then inspect Git hook files and unexpected repository paths for signs of tampering.
Sources: Rapid Risk Radar | GitHub Security Advisories | CVE Organization | VulnCheck KEV
CVE-2026-52806 — Pull request to pull shell
The Gist: Gogs before 0.14.3 also contains an authenticated RCE flaw with a CVSS 9.9. By crafting a malicious branch name that injects the --exec flag into a git rebase command during “Rebase before merging,” an attacker with low privileges can execute code on the server, and it is being exploited in the wild.
Why It Should Keep You Up at Night: This one weaponizes a pull request branch name, which is impressively petty and catastrophically effective. If authenticated users can turn a merge operation into server-side command execution, your DevOps pipeline has effectively become community theater for attackers. The fact that the fix is the same version as the other Gogs disaster just adds a nice “buy one nightmare, get one free” energy.
Your Playbook:
- Upgrade all Gogs instances to 0.14.3 and disable risky merge workflows until patching is complete if emergency change windows are tight.
- Review pull request activity and merge logs for suspicious branch names or abnormal rebase behavior, then inspect the host for unauthorized processes or persistence.
Sources: Rapid Risk Radar | GitHub Security Advisories | CVE Organization | VulnCheck KEV
Industry Intel: What Else is On Fire This Week
-
Microsoft Accelerates Post-Quantum Cryptography Shift to 2029 — Nothing says “the future is here” like having to retool crypto because today's math might become tomorrow's antique mall. Read more
-
Phantom Squatting Uses AI-Hallucinated Domains for Phishing and Malware — We taught the machines to improvise, and naturally they started inventing fake domains for scams like a phishing jazz ensemble. Read more
-
Anthropic Restores Claude Fable 5 After U.S. Lifts Jailbreak-Linked Export Controls — Because apparently AI policy now updates with the pacing and clarity of a season finale nobody fully followed. Read more
Stay ahead of the threat landscape at Rapid Risk Radar — where CVEs get scored and prioritized so you don't have to panic-Google "is this bad" at 2am. Check out the platform and stop flying blind.