Another week, another stack of “how did this ship” moments from the software industry. Grab your coffee, your patch calendar, and maybe a small stress ball for the part where unauthenticated RCE shows up again like it pays rent.
This Week's Hall of Shame: Top CVEs
CVE-2026-97229 — GitLab’s regex grenade
The Gist: GitLab CE/EE fixed a CVSS 10.0 remote code execution flaw affecting 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2. An unauthenticated attacker can trigger arbitrary code execution on the GitLab server through a specially crafted regular expression in CI/CD config, and yes, it is being exploited in the wild with a public POC floating around for extra seasoning.
Why It Should Keep You Up at Night: This is the nightmare combo meal: internet-reachable, no auth required, and sitting in the middle of a platform that often has source code, secrets, runners, and production deployment logic under one roof. If your SDLC backbone can be popped by a regex, that’s less “edge case” and more “security review conducted via coin flip.”
Your Playbook:
- Upgrade GitLab immediately to 19.2.8, 19.3.5, 19.4.2, or a newer fixed release.
- Review CI/CD configuration changes and GitLab server logs for suspicious regex-heavy pipeline activity or unexpected code execution on the host.
Sources: Rapid Risk Radar | Bleeping Computer | CVE Organization | The Hacker News
CVE-2026-107441 — Zyxel switch, surprise shell
The Gist: Zyxel GS1900-24E firmware through 2.90(AAHK.2)C0 contains an out-of-bounds write in a CGI program, scored CVSS 8.8. An unauthenticated adjacent attacker can send a crafted HTTP request and potentially execute OS commands, and exploitation has already been observed.
Why It Should Keep You Up at Night: “Adjacent” sounds comforting until you remember flat networks are still a beloved tradition in far too many environments. A switch management interface turning into an attacker launchpad is exactly the kind of infrastructure own-goal that makes incident response teams develop thousand-yard stares.
Your Playbook:
- Update affected GS1900-24E devices to a vendor-fixed firmware release as soon as one is available in your environment’s support channel.
- Restrict management plane access to dedicated admin networks only, and block HTTP access from user and guest segments immediately.
Sources: Rapid Risk Radar | CVE Organization | VulnCheck KEV
CVE-2026-86596 — WordPress plugin meets code injection chaos
The Gist: The s2Member WordPress plugin is vulnerable to remote code execution in all versions up to and including 260927, with a CVSS score of 9.8. The bug stems from insufficient sanitization in strip_php_tags_deep() and template cleanup logic that effectively rebuilds a valid <?php opener, enabling code execution by authenticated attackers with custom-level access or above; it is exploited in the wild and has a public POC.
Why It Should Keep You Up at Night: WordPress plugin security remains the cinematic universe that never stops producing sequels nobody asked for. If a membership plugin can be tricked into stitching PHP back together like some cursed arts-and-crafts project, your server is one bad account permission away from becoming someone else’s infrastructure.
Your Playbook:
- Update s2Member to a patched version beyond 260927 immediately, or disable/remove the plugin if no fixed release is available in your deployment window.
- Audit user roles with custom-level access and review web server, plugin, and email-template-related logs for suspicious payloads in the
item_nameparameter.
Sources: Rapid Risk Radar | VulnCheck KEV | CVE Organization
Industry Intel: What Else is On Fire This Week
-
Critical Rails Flaw Lets Attackers Write Server Files via Crafted ImageMagick Uploads — Because letting user-supplied files tango with server-side processing has never once gone weird, said no one who’s worked AppSec. Read more
-
Xen Hypervisor Flaws Let One Malicious VM Read and Write Any Other VM's Memory — Multitenancy is great right up until one tenant decides the neighbor’s memory also belongs to them. Read more
-
Radio With No Radar: Why Agent Runtime Security Fails Without the Layers Beneath It — A nice reality check for anyone who thought one shiny agent could somehow substitute for actual layered defense. Read more
Stay ahead of the threat landscape at Rapid Risk Radar — where CVEs get scored and prioritized so you don't have to panic-Google "is this bad" at 2am. Check out the platform and stop flying blind.