Another week, another parade of vendors acting surprised that unsafe file handling, appliance RCEs, and malicious documents are bad for business. Somewhere, a security team is updating change tickets and stress-eating trail mix.
This Week's Hall of Shame: Top CVEs
CVE-2026-86950 — Apple’s booby-trapped file problem
The Gist: Apple patched an out-of-bounds write flaw in CoreGraphics with a CVSS score of 8.8. A maliciously crafted file can trigger arbitrary code execution, and Apple says it may have been exploited in the wild in highly targeted attacks against iOS users.
Why It Should Keep You Up at Night: This is the kind of bug that turns “just open this file” into “congratulations, you now have an incident bridge.” The exploit chain may be “extremely sophisticated,” but the victim action is painfully ordinary, which is usually how these things become everyone’s problem five minutes after a targeted campaign goes public.
Your Playbook:
- Patch to iOS 26.7.1, iPadOS 26.7.1, macOS Sequoia 15.8.1, or macOS Tahoe 26.7.1 immediately.
- Hunt for suspicious file delivery vectors in email, messaging, and mobile device logs, especially on high-risk or executive devices.
Sources: Rapid Risk Radar | CVE Organization | VulnCheck KEV | The Hacker News
CVE-2026-88772 — NetScaler says “edge device,” attackers hear “front door”
The Gist: Citrix NetScaler ADC and Gateway are affected by a critical flaw rated CVSS 9.5 that can lead to remote code execution or denial of service. It is being exploited in the wild, has public proof-of-concept activity, and impacts unpatched versions before 14.1-73.37 and 13.1-64.23, including affected FIPS and NDcPP builds.
Why It Should Keep You Up at Night: Internet-facing appliances are the gift that keeps on giving to threat actors and the migraine that keeps on throbbing for defenders. If your NetScaler is lagging behind on patches, you are essentially running a welcome mat with “root access this way” stitched into it.
Your Playbook:
- Upgrade NetScaler ADC and Gateway to 14.1-73.37, 13.1-64.23, or the corresponding fixed FIPS/NDcPP releases without delay.
- Audit appliance logs and downstream authentication activity for signs of exploitation, lateral movement, or suspicious configuration changes.
Sources: Rapid Risk Radar | The Hacker News | CVE Organization | VulnCheck KEV
CVE-2026-18143 — WooCommerce plugin, meet arbitrary file upload
The Gist: Addify’s Request a Quote for WooCommerce plugin is vulnerable to unauthenticated arbitrary file upload in all versions up to and including 2.9.2, earning a CVSS 9.8. The flaw stems from missing file extension and MIME validation, allowing attackers to upload executable files like PHP into a web-accessible directory when the public quote popup flow is enabled.
Why It Should Keep You Up at Night: This is the classic WordPress side quest where a business plugin quietly becomes a shell delivery service for attackers. “We let user-supplied files land in a web-accessible folder with weak validation” is less a bug and more a confession written in PHP.
Your Playbook:
- Update the plugin beyond version 2.9.2 as soon as a fixed release is available, or disable/remove it immediately if you expose the quote popup flow publicly.
- Check the RFQ upload directory and web server logs for unexpected PHP or executable uploads, then rotate credentials if compromise is suspected.
Sources: Rapid Risk Radar | CVE Organization | VulnCheck KEV
Industry Intel: What Else is On Fire This Week
-
AI Coding Agents Exposed 13,000 Internal Images, Including Billing Records, on GitHub — Nothing says “future of productivity” like automating your way into a data leak and posting it on GitHub for the whole class to see. Read more
-
US-Focused CSuite Phishing Steals Microsoft 365 Sessions and Deploys RMM Tools for Remote Access — Yet again, executives are being lovingly escorted from phishing lure to session theft to remote access tooling, because apparently MFA fatigue needed a sequel. Read more
-
Attackers Exploit NetScaler Flaw for Root Access, Deploy WHIPSHOT and SLAPSHOT — If the malware names sound like rejected energy drinks, the outcome is less fun: root access on edge infrastructure and a very bad day for defenders. Read more
Stay ahead of the threat landscape at Rapid Risk Radar — where CVEs get scored and prioritized so you don't have to panic-Google "is this bad" at 2am. Check out the platform and stop flying blind.