Another week, another parade of internet-facing regret. The bugs are critical, the exploits are live, and somewhere a vendor is still calling this an “edge case” with a straight face.
This Week's Hall of Shame: Top CVEs
CVE-2026-76461 — Your email gateway now delivers root shells
The Gist: Cisco Secure Email Gateway running AsyncOS has a critical 9.8 SQL injection flaw in email parsing that lets unauthenticated attackers send a crafted email and end up executing commands as root. It’s being exploited in the wild, there’s public proof-of-concept activity, and patches are available.
Why It Should Keep You Up at Night: This is the kind of bug that turns your mail filter into the attacker’s favorite coworker. If your email gateway can be owned by receiving an email, that’s less “defense in depth” and more “welcome mat with administrative privileges.” The root-level impact means this can go from inbox-adjacent to infrastructure problem very quickly.
Your Playbook:
- Patch Cisco AsyncOS for Secure Email Gateway immediately using the fixed release from Cisco’s advisory.
- Hunt for signs of suspicious crafted email activity and unexpected command execution on the appliance, especially anything indicating abuse of SQL statements in parsing workflows.
Sources: Rapid Risk Radar | VulnCheck KEV | CVE Organization | CISA Known Exploited
CVE-2026-85706 — GitLab hands out server files for free
The Gist: GitLab CE/EE has a max-severity 10.0 path traversal issue affecting 18.7 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2, where an unauthenticated user can read arbitrary files via the repository commits API. It’s actively exploited, proof-of-concept details are out, and the bug stems from bad path confinement plus missing auth enforcement.
Why It Should Keep You Up at Night: Unauthenticated arbitrary file read on a DevOps platform is basically an engraved invitation to loot secrets, tokens, configs, and whatever else was left lying around in the server filesystem. And because it’s GitLab, the blast radius can include source code, pipelines, credentials, and your team’s last remaining shred of composure. A CVSS 10 is rare; earning it with path traversal in 2026 is almost performance art.
Your Playbook:
- Upgrade GitLab immediately to 19.1.8, 19.2.6, 19.3.2, or later, depending on your release track.
- Review API access logs and server-side file access patterns for suspicious unauthenticated requests to repository commits endpoints, then rotate any credentials or tokens stored on affected systems.
Sources: Rapid Risk Radar | Bleeping Computer | VulnCheck KEV | The Hacker News
CVE-2026-78006 — WordPress events plugin, now featuring RCE
The Gist: The Events Calendar plugin for WordPress from stellarwp is vulnerable to unauthenticated remote code execution in all versions through 6.17.4 via unsafe deserialization behavior in is_safe_widget_instance. Exploitation is happening in the wild, public technical details exist, and attacks require comments to be enabled and visible on events.
Why It Should Keep You Up at Night: This is the classic WordPress two-step: a massively deployed plugin plus unserialize weirdness plus “surely no one would chain that.” Turns out they would, and they did. If event comments are enabled, an attacker can go from random internet person to code execution on your server without ever needing an account, which is a pretty rude way to RSVP.
Your Playbook:
- Update The Events Calendar to a version newer than 6.17.4 as soon as a fixed release is available in your environment.
- If you can’t patch immediately, disable comments on events and review for suspicious pending-comment activity, unexpected widget rendering behavior, and signs of PHP object injection or webshell deployment.
Sources: Rapid Risk Radar | CVE Organization | VulnCheck KEV | The Hacker News
Industry Intel: What Else is On Fire This Week
-
Google Patches Pixel Modem Flaw Amid Signs of Limited Targeted Exploitation — “Limited targeted exploitation” is security PR-speak for “congrats, it’s bad, just not for everyone yet.” Read more
-
Threat Intelligence Alone Won't Close the Exploitation Gap — Shocking twist: buying more dashboards does not, in fact, cause patching and asset management to do themselves. Read more
-
Acronis cPanel Backup Plugin Vulnerability Exploited in Targeted Attacks — Because apparently even your backups need backups when plugins keep auditioning for the role of initial access broker. Read more
Stay ahead of the threat landscape at Rapid Risk Radar — where CVEs get scored and prioritized so you don't have to panic-Google "is this bad" at 2am. Check out the platform and stop flying blind.