Another week, another parade of vendors discovering that “secure by default” was apparently an optional side quest. Grab your patch calendar and your least favorite coffee mug.
This Week's Hall of Shame: Top CVEs
CVE-2026-63030 — WordPress does route confusion, attackers do the rest
The Gist: WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 carries a critical 9.8 flaw in a REST API batch endpoint route confusion issue that can be chained with CVE-2026-60137 for SQL injection and remote code execution. It’s being exploited in the wild, and yes, there’s a public POC, because apparently we all needed that.
Why It Should Keep You Up at Night: This is WordPress, which means the blast radius is less “single app problem” and more “entire neighborhood forgot to lock the door.” A bug chain that turns route confusion into SQLi and then into RCE is the kind of upgrade path attackers adore and defenders loathe, like a loyalty program for bad decisions.
Your Playbook:
- Upgrade immediately to WordPress 6.9.5 or 7.0.2, depending on your branch.
- Review logs for suspicious REST API batch endpoint activity and signs of SQLi payloads targeting query parameters, especially anything tied to
author__not_in.
Sources: Rapid Risk Radar | CVE Organization | CISA Known Exploited | EUVD
CVE-2026-50522 — SharePoint serves deserialization à la catastrophe
The Gist: Microsoft Office SharePoint is dealing with a critical 9.8 deserialization of untrusted data flaw that allows unauthenticated remote code execution over the network. It’s exploited in the wild, there’s a POC, and a patch is available, which is great because “internet-facing SharePoint RCE” is not a phrase anyone wants in their week.
Why It Should Keep You Up at Night: SharePoint has a long and storied tradition of making defenders sigh deeply into the void, and this one keeps the brand consistent. Unauthenticated network RCE on collaboration infrastructure is how a normal Tuesday turns into a forensic billing event.
Your Playbook:
- Apply Microsoft’s security update for CVE-2026-50522 without waiting for the next maintenance window fairy to bless it.
- Hunt for suspicious SharePoint worker process behavior, unexpected child processes, and outbound connections from SharePoint servers that have no business chatting with the internet.
Sources: Rapid Risk Radar | MSRC Security Updates | CVE Organization | Qualys Blog
CVE-2021-27137 — Old router bug, new botnet energy
The Gist: CVE-2021-27137 is a high-severity 8.1 buffer overflow in DD-WRT before 45724, caused by an unsafe strcpy in UPnP handling reachable via an unauthenticated M-SEARCH request. It’s actively exploited, though exploitation depends on UPnP being enabled, which is the networking equivalent of leaving the side gate open and hoping raccoons respect boundaries.
Why It Should Keep You Up at Night: Old router bugs never really die; they just get recruited into botnets with annoyingly effective marketing. Even with the narrower exposure requirements, internet-exposed or poorly segmented devices can become someone else’s disposable infrastructure faster than you can say “why is this thing still in production?”
Your Playbook:
- Update DD-WRT to version 45724 or later and disable UPnP where it isn’t absolutely required.
- Restrict management and service exposure to trusted internal interfaces, and scan for unexpected M-SEARCH traffic or signs of botnet activity on affected routers.
Sources: Rapid Risk Radar | CISA Known Exploited | CVEShield | Bleeping Computer
Industry Intel: What Else is On Fire This Week
-
Why Modern SOCs Need Multi-Layered Detections — Because relying on one shiny detection control is basically the security equivalent of bringing a pool noodle to a sword fight. Read more
-
Police Dismantle Kratos Phishing Kit Built to Steal Microsoft 365 Sessions and Bypass MFA — Nice reminder that attackers are industrializing MFA bypass while some orgs are still congratulating themselves for finally turning MFA on. Read more
-
Trojanized Newtonsoft.Json Fork Hides Game-Rigging Code in a Working Library — Supply chain compromise remains the gift that keeps on taking, now with bonus “it still works fine” camouflage for maximum developer heartbreak. Read more
Stay ahead of the threat landscape at Rapid Risk Radar — where CVEs get scored and prioritized so you don't have to panic-Google "is this bad" at 2am. Check out the platform and stop flying blind.