Another week, another batch of “how did this ship” vulnerabilities. The threat landscape remains less “defense in depth” and more “dumpster fire with excellent branding.”
This Week's Hall of Shame: Top CVEs
CVE-2026-123218 — Aspera’s accidental admin upgrade program
The Gist: IBM Aspera Faspex 5.0.0 through 5.0.19 has a critical 9.8 flaw that lets an authorized user craft a specific message to bypass authorization and gain full administrative privileges. It’s network-accessible, requires no extra privileges beyond a valid user foothold, and it’s already being exploited in the wild with public proof-of-concept floating around.
Why It Should Keep You Up at Night: This is the kind of bug that turns “low-level account” into “congratulations, you own the file transfer platform” with all the ceremony of a trapdoor opening under your compliance program. If you use Faspex to move sensitive data, an attacker getting admin access means they’re not just in the house — they’re rearranging the furniture and reading the mail.
Your Playbook:
- Identify any IBM Aspera Faspex instances running versions 5.0.0 through 5.0.19 and prioritize emergency remediation.
- Hunt for suspicious message activity and unexpected privilege changes, especially any accounts that suddenly acquired administrative capabilities.
Sources: Rapid Risk Radar | CVE Organization| CISA Known Exploited
CVE-2026-125350 — Chrome does use-after-free, attackers say thanks
The Gist: This high-severity 8.8 Chrome flaw is a use-after-free bug in XML handling prior to version 157.0.8103.50. A remote attacker can trigger arbitrary code execution inside the sandbox via a crafted HTML page, and yes, it’s being exploited in the wild and yes, there’s a patch, because apparently we all needed one more browser fire drill.
Why It Should Keep You Up at Night: Browser bugs remain the cybersecurity equivalent of stepping on a Lego in the dark: common, painful, and somehow still surprising every single time. If users can be lured to a malicious page, attackers get code execution without needing your help beyond the timeless corporate tradition of clicking things.
Your Playbook:
- Update Google Chrome immediately to version 157.0.8103.50 or later across all managed endpoints.
- Verify auto-update is actually working and use EDR or browser telemetry to flag suspicious child processes or anomalous browser behavior tied to untrusted sites.
Sources: Rapid Risk Radar | The Hacker News | VulnCheck KEV | Bleeping Computer
CVE-2026-116779 — FreeSWITCH, but make it command execution
The Gist: FreeSWITCH before 1.11.3 contains a critical 9.8 command injection issue in SIP MESSAGE handling that can let an authenticated peer execute FreeSWITCH API commands, including operating-system command sinks, with the daemon’s privileges. Exploitation has been observed in the wild, public exploit details exist, and the flaw can expose configs, credentials, and call control along the way.
Why It Should Keep You Up at Night: Telecom stack bugs are extra spicy because they don’t just risk data — they can hand over the keys to voice infrastructure, call routing, and whatever else your “digital transformation” deck promised would be seamless. Stock configurations reportedly leave inbound chat enabled, which is a fun reminder that defaults are often just pre-installed regret.
Your Playbook:
- Upgrade FreeSWITCH to version 1.11.3 immediately anywhere it’s deployed.
- Review SIP MESSAGE acceptance settings, disable inbound chat where it is not required, and audit profile accounts for weak or missing password material.
Sources: Rapid Risk Radar | CVE Organization | VulnCheck KEV | CISA Known Exploited
Industry Intel: What Else is On Fire This Week
-
We Built An Agent That Broke All of Our Security Rules. Here's What We Learned. — In a shocking twist to absolutely no one who has met an overconfident automation demo, the agent immediately face-planted into guardrails and policy. Read more
-
eMudhra Revokes 8 More CAs It Previously Declared Unaffected by Key Compromise — Nothing inspires confidence in the PKI ecosystem like “actually, there were eight more,” which is the certificate authority version of finding extra termites after the inspection. Read more
-
Microsoft Patches 1,259 Flaws, Including Exploited Outlook Bug That May Expose NTLMv2 Hashes — A patch Tuesday body count north of twelve hundred is less a release cycle and more a cry for help, with Outlook once again auditioning for Worst Coworker of the Year. Read more
Stay ahead of the threat landscape at Rapid Risk Radar — where CVEs get scored and prioritized so you don't have to panic-Google "is this bad" at 2am. Check out the platform and stop flying blind.