Another week, another parade of critical bugs that somehow made it out the door wearing a fake mustache labeled “secure by design.” Let’s see which vendors turned patch management into performance art this time.
This Week's Hall of Shame: Top CVEs
CVE-2026-65400 — Screen Sharing, Credentials Optional
The Gist: Apple patched a critical authentication flaw in Screen Sharing, scored CVSS 9.8, that lets an attacker on the network authenticate without valid credentials. It’s being exploited in the wild, and yes, there’s already public proof-of-concept code because apparently subtlety is dead.
Why It Should Keep You Up at Night: If you’ve got exposed or reachable Apple endpoints on a shared network, this is the kind of bug that turns “remote assistance” into “remote trespassing.” Authentication bypass on a remote access feature is about as comforting as finding out your front door lock was actually decorative.
Your Playbook:
- Patch immediately to macOS Sequoia 15.7.9, macOS Sonoma 14.8.9, or macOS Tahoe 26.6.1, depending on your fleet.
- Restrict Screen Sharing to trusted management networks only and review logs for unexpected remote access activity.
Sources: Rapid Risk Radar | CISA Known Exploited | HelpNetSecurity | The Hacker News
CVE-2026-59310 — vCenter Takes a Shortcut to RCE
The Gist: This critical VMware vCenter flaw is a directory traversal issue in the Syslog server that can let a network-accessible attacker execute arbitrary code. It carries a CVSS 9.8, is actively exploited, and has public PoC material because of course the internet saw “vCenter RCE” and said, “go on.”
Why It Should Keep You Up at Night: vCenter is the management brain of a lot of virtual infrastructure, so compromise here is less “one bad server” and more “welcome to the control room.” A traversal bug leading to RCE in core infrastructure software is the kind of thing that keeps incident responders hydrated and miserable.
Your Playbook:
- Patch vCenter on an emergency basis and verify all internet exposure and unnecessary network paths to management interfaces are eliminated.
- Hunt for suspicious activity around the Syslog server component, unexpected file access patterns, and signs of execution originating from vCenter.
Sources: Rapid Risk Radar | CISA Known Exploited | The Hacker News | VulnCheck KEV
CVE-2026-64849 — MLflow SSRF Goes Sightseeing Internally
The Gist: MLflow before 3.15.0 contains a critical SSRF flaw, CVSS 9.3, in the unauthenticated webhook test endpoint. The bug validates the original URL but then happily follows redirects and re-resolves hostnames, which can let attackers poke internal services or cloud metadata endpoints; it’s exploited in the wild and a PoC exists.
Why It Should Keep You Up at Night: This is the AI tooling version of checking one ID at the door and then letting the guest wander into the server room through a side entrance. If MLflow is reachable, attackers may be able to extract sensitive internal responses, which is especially fun when those “internal responses” involve cloud credentials or service metadata.
Your Playbook:
- Upgrade MLflow to version 3.15.0 immediately.
- Block or tightly restrict access to webhook-related endpoints and monitor for outbound requests to internal IP space or cloud metadata addresses triggered by MLflow.
Sources: Rapid Risk Radar | CVE Organization | VulnCheck KEV | GitHub Security Advisories
Industry Intel: What Else is On Fire This Week
-
StopAndProtect Uses Nearly 2,000 Hacked WordPress Sites to Spread Malware and Steal Data — Because apparently compromised WordPress sites are still the internet’s favorite free CDN for bad decisions. Read more
-
Microsoft Links 30+ Rotating Domains to MacSync Stealer Infrastructure — Rotating domains remain the threat actor equivalent of changing hoodies and insisting nobody can recognize you. Read more
-
Critical macOS, SharePoint, vCenter, and Microsoft IKE Flaws Under Active Exploitation — In case your patch queue looked too manageable, here’s the industry’s latest group project in operational panic. Read more
Stay ahead of the threat landscape at Rapid Risk Radar — where CVEs get scored and prioritized so you don't have to panic-Google "is this bad" at 2am. Check out the platform and stop flying blind.