Another week, another batch of internet-facing regret. Vendors keep treating secure coding like an optional side quest, and somehow we're all supposed to act surprised.
This Week's Hall of Shame: Top CVEs
CVE-2026-95675 — D-Link hands out root like Halloween candy
The Gist: D-Link DAP-1360 firmware 6.14 and earlier has an unauthenticated remote code execution bug with a CVSS 9.3. Attackers can hit the web management interface over the network, run arbitrary commands as root, and yes, it is already being exploited with public proof-of-concept code available.
Why It Should Keep You Up at Night: This is the part where your humble access point stops being a boring piece of networking gear and becomes an attacker beachhead inside your LAN. Unauthenticated RCE as root on edge hardware is the cybersecurity equivalent of leaving your house key under a doormat labeled "key."
Your Playbook:
- Identify any DAP-1360 devices and immediately upgrade beyond firmware 6.14 if a fixed release is available from your support channel.
- Restrict or disable the web management interface from untrusted networks and hunt for unexpected config changes or outbound traffic from affected devices.
Sources: Rapid Risk Radar | CVE Organization | VulnCheck KEV
CVE-2026-21589 — Atlassian's file cabinet with the lock half-open
The Gist: Atlassian disclosed a CVSS 9.3 arbitrary file access flaw affecting multiple Data Center products including Bitbucket, Confluence, Jira, Bamboo, Crowd, Crucible, and Fisheye. It is unauthenticated and remotely exploitable, though attackers need to know the exact file path and name; public proof-of-concept details are available, but active exploitation has not been reported here.
Why It Should Keep You Up at Night: "You need to know the file path first" is not the comforting limitation some people think it is, especially in environments where default paths, app structure, and juicy filenames are hardly state secrets. If your crown jewels are sitting in the web root, this becomes less "theoretical edge case" and more "surprise compliance meeting."
Your Playbook:
- Patch the affected Atlassian products to the listed fixed versions: Bitbucket 9.4.26/10.2.8/10.5.1, Confluence 9.2.26/10.2.19, Crowd 6.3.7/7.0.3/7.1.7/7.2.4, Jira Software 9.12.40/10.3.26/11.3.12, Jira Service Management 5.12.40/10.3.26/11.3.12, Bamboo 10.2.24/12.1.12, Crucible 4.9.15, and Fisheye 4.9.15.
- Review web application root directories for sensitive files, remove anything that does not belong there, and monitor access logs for unusual requests targeting known paths.
Sources: Rapid Risk Radar | CVE Organization | The Hacker News | HelpNetSecurity
CVE-2026-51886 — Langflow executes first, regrets never
The Gist: Langflow v1.9.3 contains a code injection vulnerability in the /api/v1/validate/code path that can lead to remote code execution, with a CVSS 9.8. The flaw stems from executing user-supplied Python without sandboxing, and it is already seeing in-the-wild exploitation.
Why It Should Keep You Up at Night: Any product that takes raw Python from users and tosses it into exec is basically speedrunning a postmortem. If you've exposed this service or granted access too broadly, an attacker can turn your AI workflow tooling into their own remote shell with embarrassingly little effort.
Your Playbook:
- Upgrade Langflow beyond v1.9.3 as soon as a patched release is available and pull any public-facing instances behind strong access controls immediately.
- Audit authenticated access to the application, review server logs for suspicious calls to
/api/v1/validate/code, and isolate compromised hosts if arbitrary code execution is suspected.
Sources: Rapid Risk Radar | CVE Organization | GitHub Security Advisories | VulnCheck KEV
Industry Intel: What Else is On Fire This Week
-
Anthropic Expands Claude Access for Vetted Cyber Teams as Glasswing Finds 129,000 Flaws — AI for defenders is great, but "129,000 flaws" is one of those numbers that really says the quiet part out loud about modern software quality. Read more
-
100+ Compromised Websites Use Fake Cloudflare Checks to Deliver LunexStealer — Because apparently even fake bot checks now come with complimentary malware, like the worst loyalty program on earth. Read more
-
Fake ChatGPT, Gemini, and Claude Ad Portals Capture Credentials and MFA Codes — Threat actors have discovered that if people will click sponsored AI links without blinking, phishing basically writes itself. Read more
Stay ahead of the threat landscape at Rapid Risk Radar — where CVEs get scored and prioritized so you don't have to panic-Google "is this bad" at 2am. Check out the platform and stop flying blind.