Another week, another parade of critical bugs that somehow made it out the door wearing a fake mustache labeled “secure by default.” If your patch queue looks like a hostage note, congratulations: you’re doing cybersecurity in 2026.
This Week's Hall of Shame: Top CVEs
CVE-2026-60004 — Gitea hands over the keys
The Gist: Gitea before 1.27.1 is vulnerable to remote code execution via the diffpatch API through Git hook installation. It carries a 9.8 CVSS, is network reachable with no auth and no user interaction, and it’s already being exploited in the wild with public proof-of-concept details available.
Why It Should Keep You Up at Night: This is the kind of bug attackers adore: low effort, high reward, and sitting in code hosting infrastructure that often has a lovely view of your development pipeline. If someone can turn your Git service into their personal command runner, that’s not “technical debt” anymore — that’s a full-blown repo exorcism.
Your Playbook:
- Upgrade Gitea to version 1.27.1 or later immediately anywhere the diffpatch API is exposed.
- Review Git hook activity and server-side command execution logs for unexpected installations or changes, and isolate affected instances if you spot anything weird.
Sources: Rapid Risk Radar | CISA Known Exploited | HelpNetSecurity | VulnCheck KEV
CVE-2026-82329 — Artifactory, now with bonus admin
The Gist: JFrog Artifactory contains an authentication weakness that, under default configuration, may let an unauthenticated network attacker obtain administrative privileges. The flaw is rated 9.8 CVSS, has public proof-of-concept coverage, and is being actively exploited in the wild.
Why It Should Keep You Up at Night: Artifact repositories are basically the snack pantry of the software supply chain, except the snacks are binaries and secrets. Handing out admin access to unauthenticated attackers under “default configuration” is the sort of phrase that makes defenders stare into the middle distance and reconsider all life choices.
Your Playbook:
- Patch Artifactory to the vendor-fixed release as soon as possible and prioritize internet-exposed instances first.
- Audit for suspicious token creation, admin account activity, and repository changes, then rotate credentials and access tokens if compromise is even remotely plausible.
Sources: Rapid Risk Radar | CISA Known Exploited | Bleeping Computer | VulnCheck KEV
CVE-2026-83548 — SonicWall’s pre-auth surprise party
The Gist: The SMA1000 Appliance Work Place interface is affected by a pre-authentication SSRF flaw caused by an unintended alternate access path. It carries a perfect 10.0 CVSS score, requires no authentication, and is already under active exploitation.
Why It Should Keep You Up at Night: Pre-auth SSRF on remote access gear is the security equivalent of leaving a side door open with a neon sign that says “definitely not important.” When the target is sensitive appliance functionality, “unauthorized operations” is doing a lot of polite corporate work to describe what could become a very bad week.
Your Playbook:
- Apply SonicWall’s fix or mitigation guidance immediately for all SMA1000 appliances, especially externally reachable systems.
- Restrict management exposure, monitor for unusual requests hitting the Work Place interface, and review appliance logs for signs of unexpected access paths or admin actions.
Sources: Rapid Risk Radar | CISA Known Exploited | CVE Organization | Bleeping Computer
Industry Intel: What Else is On Fire This Week
-
Google, Anthropic, and OpenAI Unveil Cyber AI Models, Safeguards, and Access Programs — The AI giants have arrived to save security, which definitely won’t create any new attack surface, no sir, nothing to see here. Read more
-
Fake Software Installers Disable Windows Update and Weaken Microsoft Defender — Because apparently regular malware wasn’t rude enough, now it shows up disguised as an installer and immediately unplugs the smoke alarms. Read more
-
Malicious .git Configs Can Make Claude, Codex, Cursor, and Other AI Agents Run Attacker Code — We taught coding assistants to be helpful, and naturally attackers responded by stuffing evil into Git config files like it’s the world’s nerdiest jump scare. Read more
Stay ahead of the threat landscape at Rapid Risk Radar — where CVEs get scored and prioritized so you don't have to panic-Google "is this bad" at 2am. Check out the platform and stop flying blind.