tag: Rce · 177 items
- Engineer — Plan: Severity is high (unauthenticated remote root), but enrichment signals are absent — no KEV, no confirmed public PoC, no active exploitation. Audit whether MPTCP listeners are running on exposed servers and schedule kernel patching as soon as a fix is available; consider disabling MPTCP if it is not operationally required.
- SOC/IR — Learn: No IOCs, no confirmed in-the-wild exploitation, and no ATT&CK-mappable TTPs are published yet; there is nothing to hunt or detect at this stage. Watch for follow-on reporting with exploitation evidence before writing detections.
- Leader — Skip
- Engineer — Plan: One-interaction RCE requiring only an attacker Telegram account is a high-severity mobile risk; verify corporate or BYOD devices are running Telegram ≥ 12.10.4 via MDM policy or device-compliance checks. No exploitation signals yet, so this is a patch-window item rather than emergency.
- SOC/IR — Learn: No active exploitation, IOCs, or ATT&CK-mappable TTPs have been published; the voice-call RCE vector is worth logging for context when triaging future mobile-related incidents, but there is nothing actionable to detect or hunt today.
- Leader — Skip
- Engineer — Act: Remote unauthenticated root RCE in the Linux kernel TCP stack with a public GitHub PoC is a patch-now event regardless of the low EPSS snapshot — check Ubuntu/RHEL kernel errata and patch all internet-exposed Linux hosts this sprint.
- SOC/IR — Plan: No confirmed wild exploitation yet, but the public PoC for unauthenticated root RCE means weaponization is imminent — build detections for anomalous TCP session patterns and unexpected root-child process spawning on Linux servers before active campaigns emerge.
- Leader — Plan: A CVSS 9.8 kernel-level RCE spanning Ubuntu and RHEL has board-question potential if exploitation begins; confirm with engineering that Linux patch cycles are accelerated and prepare a brief so leadership isn’t caught off-guard when it escalates.
- Signals: CVE-2026-98432 — CISA KEV: not listed, EPSS 0.00, public PoC on GitHub
- Engineer — Act: CVSS 10.0 RCE via crafted CI regex with a public PoC and a confirmed exploitation attempt against a live GitLab server; patch your GitLab instance to the latest fixed release immediately and audit CI configuration pipelines for unexpected regex patterns.
- SOC/IR — Act: An exploitation attempt against Alpine Linux’s GitLab server confirms active targeting; sweep GitLab server access and CI pipeline execution logs for anomalous regex patterns in CI configs since roughly October 21 and tune detections for RCE attempts via GitLab’s CI parsing endpoint.
- Leader — Plan: A CVSS 10.0 GitLab RCE with a public PoC and active exploitation attempts poses supply-chain risk if your engineering teams self-host GitLab; confirm with engineering that all instances are patched this week and assess whether any CI/CD outputs or secrets could have been exposed.
- Signals: CVE-2026-97229 — CISA KEV: not listed, EPSS 0.18, public PoC on GitHub, reported by 2 collected sources
- Engineer — Act: Public PoC on GitHub combined with confirmed active probing makes this Act despite low EPSS; apply Oracle’s Critical Patch Update to Oracle E-Business Suite immediately and verify no external exposure of EBS endpoints.
- SOC/IR — Act: Threat actors are already scanning for this RCE; hunt for exploitation attempts against Oracle EBS Application Object Library endpoints dating back to last week’s patch release, and tune WAF/IDS rules for CVE-2026-101767 probe patterns.
- Leader — Plan: Oracle EBS hosts sensitive financial and HR data — confirm whether the organization runs EBS, verify the Critical Patch Update is applied this sprint, and track escalation to Act if CISA KEV listing or confirmed exploitation follows.
- Signals: CVE-2026-101767 — CISA KEV: not listed, EPSS 0.01, public PoC on GitHub
- Engineer — Act: Active internet-wide scanning signals exploitation is imminent; if you run Oracle E-Business Suite, apply the October critical patch update now and confirm no public-facing EBS endpoints remain exposed until patching is complete.
- SOC/IR — Act: Scanning campaigns targeting Oracle EBS create detectable noise — hunt for exploitation attempts against EBS endpoints in web and firewall logs since the patch disclosure date, and tune rules for Oracle EBS attack patterns if EBS is in your estate.
- Leader — Plan: Confirm with engineering whether Oracle E-Business Suite is in use and verify its patch status this week; active attacker scanning compresses the remediation window significantly and may warrant expedited change control approval.
- Engineer — Act: A public PoC on GitHub for a CVSS 9.9 code injection flaw (CVE-2026-104351) makes exploitation pressure real despite the low EPSS; patch Adobe Campaign Classic to the latest released version immediately.
- SOC/IR — Plan: With a public PoC available, build or tune detections for exploitation attempts against Campaign Classic endpoints — look for anomalous process spawning or outbound connections from the Campaign Classic application process.
- Leader — Skip
- Signals: CVE-2026-104351 — CISA KEV: not listed, EPSS 0.01, public PoC on GitHub
- Engineer — Act: EPSS 0.55 plus a public GitHub PoC make this Act: update Windows PHP packages to the latest 8.2–8.5 builds immediately, and audit any application that enables cURL’s CURLOPT_ENCODING (automatic Brotli decompression), since that is the exploitable path.
- SOC/IR — Plan: No active exploitation or KEV listing yet, but a public PoC and high EPSS warrant building a detection for anomalous PHP-CGI/FastCGI process behavior on Windows hosts; queue a hunt for known PoC signatures once they stabilize.
- Leader — Skip
- Signals: CVE-2026-111497 — CISA KEV: not listed, EPSS 0.55, public PoC on GitHub
- Engineer — Act: CISA KEV listing plus EPSS 1.00 and a public GitHub PoC confirm imminent exploitation risk. Audit all deployments for PHP2Shell and apply the vendor patch immediately; treat any unpatched instance as potentially compromised.
- SOC/IR — Act: Active exploitation is confirmed and a public PoC is available, meaning intrusions may already be in progress. Hunt for signs of unauthenticated RCE against PHP-based services since early October 2026 and tune WAF/EDR rules to flag PHP2Shell-related web-shell activity.
- Leader — Plan: CISA KEV classification signals an organization-wide exposure check is warranted. Confirm with engineering whether PHP2Shell is in use, and if so, verify emergency patching is tracked as a priority-one item this week.
- Signals: CVE-2026-109618 — CISA KEV: listed, EPSS 1.00, public PoC on GitHub, reported by 2 collected sources
- Engineer — Act: Both CVEs carry EPSS 1.00 with public PoCs and confirmed in-the-wild exploitation; patch any PHP2Shell-dependent installations immediately and audit web server logs for indicators of post-exploitation activity such as newly written shells.
- SOC/IR — Act: Public PoCs and confirmed exploitation mean attack tooling is freely available; hunt for exploitation attempts against PHP2Shell endpoints and sweep for web shell artifacts or unexpected outbound connections since the PoC release date.
- Leader — Act: EPSS 1.00 plus confirmed exploitation warrants same-week action — confirm whether your organization runs PHP2Shell or any software dependent on it, and verify engineering has this on emergency patching priority.
- Signals: CVE-2026-109618 — CISA KEV: not listed, EPSS 1.00, public PoC on GitHub, reported by 2 collected sources · CVE-2026-109619 — CISA KEV: not listed, EPSS 1.00, public PoC on GitHub, reported by 2 collected sources
- Engineer — Act: Microsoft’s out-of-band release for a critical RCE-class flaw (HTTP2Shell/Broccoli2Shell) in the .NET Brotli stack signals high urgency; update all .NET runtimes and SDK versions to the emergency-patched release across every workload and pipeline image this patch window.
- SOC/IR — Plan: No published IOCs or active exploitation campaigns in the enrichment signals yet, but the ‘Shell’ naming and emergency severity make this a prime candidate to build exploitation-detection rules before in-the-wild activity emerges — prepare Sigma/KQL queries targeting anomalous .NET HTTP2 processing behavior.
- Leader — Plan: A critical emergency patch for the .NET runtime touches most enterprise application stacks; confirm patch deployment timeline with engineering and ensure any customer-facing .NET services are covered before this becomes a named exploitation event.
- Engineer — Act: A pre-authentication RCE (ZDI-CAN-33774) in the Linux kernel’s built-in SMB server is publicly disclosed with no mainline fix yet. Audit all Linux servers for ksmbd running (
lsmod | grep ksmbd), disable the service where SMB is not required, and firewall SMB ports (445/TCP) at the network edge until a kernel patch is available. - SOC/IR — Plan: No active exploitation or IOCs reported yet, but public mailing-list disclosure of a pre-auth RCE raises the PoC timeline. Identify estate assets running ksmbd, and build detections for anomalous inbound SMB traffic to Linux hosts before a working exploit emerges.
- Leader — Skip
- Engineer — Plan: Upgrade Ruby to 4.0.9 / 3.4.12 / 3.3.13 on all services that process user-supplied input; the Onigmo memory-corruption bugs are critical RCE class but no KEV listing or public PoC is present yet, so this is urgent-queue rather than emergency patch.
- SOC/IR — Skip
- Leader — Plan: Confirm your GitLab instances (widely used DevOps platform) are running the patched versions that resolved these four critical RCEs; flag any Ruby-based internal services to your engineering team for expedited patching this quarter.
- Engineer — Act: A public PoC exists for this buffer-overflow RCE in the Brotli decoder, and the affected surface is wide: update Python brotli and brotlicffi packages to patched versions and audit any Envoy proxy configuration that enables Brotli decompression, since attacker-controlled compressed payloads are the trigger.
- SOC/IR — Learn: No active exploitation campaign, no published IOCs, and EPSS sits at effectively zero — there is no hunt or detection to run today, but analysts should understand that Brotli-decompressing endpoints (Envoy, Python services) represent an emerging RCE surface to watch if exploitation picks up.
- Leader — Skip
- Signals: CVE-2026-111497 — CISA KEV: not listed, EPSS 0.00, public PoC on GitHub
- Engineer — Act: A turnkey scanner for the handler-mismatch + LFI → shell chain is now trending on GitHub, lowering the bar for mass exploitation; any PHP deployment should be patched to fixed versions for CVE-2026-109618 and CVE-2026-109619 and audited for handler misconfigurations immediately, even though EPSS is low and KEV is not yet triggered.
- SOC/IR — Plan: A no-dependency scanner trending on GitHub means opportunistic exploitation attempts against PHP hosts are likely soon; build or tune detections for LFI probe patterns and php2shell session-chain anomalies (unusual session handler requests followed by file-read behavior) in web server and WAF logs before active campaigns emerge.
- Leader — Skip
- Signals: CVE-2026-109618 — CISA KEV: not listed, EPSS 0.12, public PoC on GitHub, reported by 5 collected sources · CVE-2026-109619 — CISA KEV: not listed, EPSS 0.06, public PoC on GitHub, reported by 5 collected sources
- Engineer — Learn: The item signals a possible third critical PHP vulnerability in an already-active exploitation cluster, but provides no CVE identifier, affected versions, or patch status — monitor PHP security advisories closely and be ready to act once details are confirmed.
- SOC/IR — Skip
- Leader — Skip
- Engineer — Plan: Both CVEs have public PoCs on GitHub and AWS issued a bulletin, but neither is KEV-listed and EPSS scores (0.12/0.06) indicate limited active exploitation so far. Audit PHP runtime versions across Lambda functions and EC2 workloads, then schedule patching against the AWS bulletin guidance this sprint.
- SOC/IR — Learn: Public PoCs exist but there are no reported IOCs, mapped TTPs, or confirmed in-the-wild exploitation campaigns to hunt or detect against; monitor threat feeds for escalation before building detections.
- Leader — Skip
- Signals: CVE-2026-109618 — CISA KEV: not listed, EPSS 0.12, public PoC on GitHub, reported by 5 collected sources · CVE-2026-109619 — CISA KEV: not listed, EPSS 0.06, public PoC on GitHub, reported by 5 collected sources
- Engineer — Plan: PHP RCE with no patch warrants near-term action: verify whether your PHP deployments use the affected non-default configuration and apply the PHP team’s published mitigation steps immediately; revisit once a patch is released.
- SOC/IR — Skip
- Leader — Skip
- Engineer — Act: A public PoC on GitHub raises exploitation probability despite PHP’s ‘unlikely’ framing; audit your PHP application configurations for the affected feature and disable it per PHP’s mitigation guidance before a patch ships.
- SOC/IR — Plan: The public PoC makes opportunistic exploitation attempts plausible; build or tune detections for anomalous process spawning from web server processes and new webshell activity on PHP-serving hosts this sprint.
- Leader — Skip
- Signals: CVE-2026-115560 — CISA KEV: not listed, EPSS n/a, public PoC on GitHub
- Engineer — Plan: Public PoCs exist for two RCE flaws in EOL PHP affecting WordPress, OpenCart, and similar stacks, but EPSS scores (0.12 / 0.06) and no KEV listing mean immediate emergency patching isn’t warranted. Audit your fleet for EOL PHP 5.4–8.1; prioritize upgrading to a supported PHP release, or apply these community backport patches as a temporary stopgap for systems that can’t migrate quickly.
- SOC/IR — Learn: No active exploitation campaign or IOCs are reported, so there’s no hunt to run today. The published PoCs document how PHP file-upload progress-bar handling can be abused for RCE, which is worth reviewing to inform or validate any existing detection rules for web shell drops via file upload on PHP applications.
- Leader — Skip
- Signals: CVE-2026-109618 — CISA KEV: not listed, EPSS 0.12, public PoC on GitHub, reported by 5 collected sources · CVE-2026-109619 — CISA KEV: not listed, EPSS 0.06, public PoC on GitHub, reported by 5 collected sources
- Engineer — Act: A public PoC on GitHub demonstrates unauthenticated RCE against Node.js 24.22.0 on Linux arm64 — a plausible production target in cloud environments. Verify whether your Node.js 24.x deployments run on arm64, apply the Node.js project patch as soon as it is released, and consider blocking or sanitizing untrusted Brotli input at the application boundary in the interim.
- SOC/IR — Plan: No active exploitation is reported (EPSS 0.00, not in KEV), but a public PoC raises the chance of in-the-wild attempts. Build or tune detections for anomalous child process spawning from Node.js worker processes, which is the expected exploitation footprint for a runtime RCE of this class.
- Leader — Plan: Node.js is pervasive across modern application stacks; a confirmed RCE with a public exploit warrants a near-term inventory check. Ask engineering to confirm which Node.js 24.x arm64 deployments exist and to track the upstream patch — escalate to Act if CISA adds this to KEV or exploitation is reported in the wild.
- Signals: CVE-2026-111497 — CISA KEV: not listed, EPSS 0.00, public PoC on GitHub
- Engineer — Plan: If your organization runs Aruba switches or wireless gear, schedule patching of ArubaOS to address eight CVSS 10 auth bypass and RCE issues; no active exploitation or public PoC is confirmed yet, so this fits a near-term patch window rather than emergency response.
- SOC/IR — Skip
- Leader — Skip
- Engineer — Act: Pillow is ubiquitous in Python web apps that accept image uploads; a public PoC exists on GitHub making exploitation straightforward. Patch Pillow to the fixed release immediately, or disable EPS/Ghostscript support via environment variable if a patch window is unavailable.
- SOC/IR — Plan: No active exploitation yet (EPSS 0.00, not in KEV), but the public PoC lowers the bar. Build or tune a detection for web-tier processes (Python/Gunicorn) spawning Ghostscript, which should not normally invoke child shells — flag any unexpected child process tree from gs/gswin.
- Leader — Skip
- Signals: CVE-2026-112900 — CISA KEV: not listed, EPSS 0.00, public PoC on GitHub
- Engineer — Plan: A critical PHP patch is imminent with no public details yet; engineers running PHP should monitor php.net, stage a fast-track patch window, and be ready to deploy the moment the release drops.
- SOC/IR — Learn: No IOCs or TTPs are available yet; flag this as an inbound watch item so detection work can begin promptly once the vulnerability class is disclosed.
- Leader — Skip
- Engineer — Act: If you run VeloCloud Orchestrator On-Prem, apply Arista’s security update immediately — active exploitation means this is not wait-and-see. Verify your VCO version and patch to the fixed release named in Arista’s advisory.
- SOC/IR — Act: Active exploitation of a network orchestration platform warrants an assume-breach posture for any org running VCO On-Prem; hunt for anomalous access or config changes on VCO instances since before the patch date and check Arista’s advisory for any published IOCs.
- Leader — Plan: If VeloCloud Orchestrator is in your environment, confirm your team has patched and assess whether exploitation occurred before the patch window; no broader board-level event unless your org was targeted.
- Engineer — Plan: PHP core RCE with public PoC and now a trending mass-scanner lowers the bar for attackers to identify unpatched targets; neither CVE is in KEV and EPSS is low (0.05/0.06), but patch PHP to the fixed version this sprint before exploitation pressure rises.
- SOC/IR — Plan: The scanner performs subdomain recon and banner grabbing to fingerprint PHP versions — build or tune detections for high-rate HTTP requests probing PHP version banners or /phpinfo endpoints originating from external IPs.
- Leader — Skip
- Signals: CVE-2026-109618 — CISA KEV: not listed, EPSS 0.05, public PoC on GitHub, reported by 4 collected sources · CVE-2026-109619 — CISA KEV: not listed, EPSS 0.06, public PoC on GitHub, reported by 4 collected sources
- Engineer — Plan: Node.js is a near-universal runtime in cloud/app stacks; the bundled Brotli decompressor carries an RCE-severity flaw across 22.x, 24.x, and 26.x. No public PoC or KEV listing yet, so schedule patching to the respective fixed versions this sprint rather than treating it as an emergency.
- SOC/IR — Skip
- Leader — Skip
- Engineer — Plan: Max-severity remote code execution via the regex compiler affects GitLab instances you may self-host; patches are released so prioritize upgrading to the fixed version within your next patch window — no confirmed exploitation or public PoC yet, but attack surface is high-value CI/CD infrastructure.
- SOC/IR — Skip
- Leader — Learn: A max-severity RCE in GitLab warrants awareness if your organization self-hosts it; engineering teams should be patching, but no active breach or sector-wide incident elevates this to leadership action today.
- Engineer — Plan: If you run self-managed GitLab, apply the October 21 release immediately — the October 12 patch only covered 19.2+ and left older versions fully exposed to unauthenticated RCE. No KEV or public PoC is confirmed yet, but CVSS 10.0 with universal version coverage warrants patching ahead of your normal window.
- SOC/IR — Skip
- Leader — Plan: Confirm your engineering team has applied the October 21 GitLab patch, not just the October 12 one — a widespread false sense of being patched exists for self-managed deployments, and unauthenticated RCE on source-code infrastructure would be a material incident if exploited.
- Engineer — Act: CISA confirmation of active exploitation chains across four Plex Media Server vulnerabilities makes this urgent for any team hosting Plex. Patch Plex Media Server to the latest available version immediately and audit exposed instances for signs of compromise.
- SOC/IR — Plan: Active exploitation is confirmed but the summary lacks published IOCs or ATT&CK-mapped TTPs to hunt with now. Inventory any Plex Media Server instances in your estate and plan a sweep for post-compromise indicators (unexpected outbound connections, new scheduled tasks) once public technical analysis emerges.
- Leader — Skip
- Engineer — Act: Working exploits are in use against a pair of PHP flaws enabling full server takeover, affecting the majority of PHP deployments. Patch PHP to the latest stable release immediately and verify no web shells or unauthorized processes exist on PHP-backed servers.
- SOC/IR — Act: Active in-the-wild exploitation of a widespread PHP RCE means assume-breach posture is warranted for any PHP-backed systems. Hunt for anomalous child processes spawned from web server processes and audit PHP server logs for signs of exploitation since today.
- Leader — Act: A pair of actively exploited PHP flaws affecting roughly 70% of websites is a systemic event likely to generate board and customer questions. Confirm whether company-operated PHP properties and key SaaS vendors are exposed, and be prepared to brief leadership this week.
- Engineer — Act: An out-of-cycle 9.2 CVSS RCE pair in PHP demands same-day response: apply the emergency PHP release (due 14:00 UTC Oct 21) to all PHP installations and container base images immediately; hold deployments on unpatched versions until confirmed fixed.
- SOC/IR — Plan: No IOCs or exploitation confirmed yet, but once technical analysis drops post-patch, build detections for PHP webshell creation and anomalous PHP process spawning; queue a hunt back 24 hours after details are public.
- Leader — Plan: Confirm the organization’s PHP exposure across self-hosted apps and vendor SaaS, and ensure engineering teams are patching today; if PHP underpins customer-facing services, prepare a brief for leadership in case exploitation emerges before patching is complete.
- Engineer — Act: PHP2Shell (CVE-2026-109618/109619) are CVSS 9.2 RCE flaws with no sufficient pre-patch workaround; apply the PHP fix the moment it ships at 14:00 UTC today and do not rely on the configuration setting being circulated as a mitigation.
- SOC/IR — Plan: No IOCs or confirmed exploitation are provided, so no immediate hunt is warranted; prepare PHP-targeted RCE detection rules (webshell drops, anomalous child processes from web server workers) to deploy alongside or shortly after today’s patch release.
- Leader — Plan: Confirm with engineering that PHP instances in your environment are on the patch list for today; absent evidence of active exploitation there is no board or customer communication needed yet, but track this if exploitation emerges post-disclosure.
- Engineer — Act: PHP is near-universal in web stacks; leaked pre-disclosure details raise exploitation risk before patches land. Stage PHP upgrade in your pipeline now and apply the emergency release the moment it publishes tomorrow.
- SOC/IR — Plan: No IOCs or TTPs are available yet, but leaked vulnerability details make exploitation attempts likely shortly after disclosure. Queue a hunt for unusual PHP process execution and web-shell artifacts to run once patch details confirm the attack surface.
- Leader — Plan: Two critical PHP flaws with an out-of-cycle emergency release cycle warrant confirming your PHP inventory and ensuring engineering teams have an expedited patch window ready for tomorrow’s release.
- Engineer — Act: Two critical RCE flaws with public PoCs on GitHub mean exploitation is practical now; patch all PHP installations to the emergency-release version immediately and audit web server logs for signs of pre-patch exploitation.
- SOC/IR — Act: Public PoCs for both CVEs make exploitation attempts imminent if not already occurring; hunt for web shell creation events and anomalous PHP process execution since PoC publication, and tune WAF/EDR rules for PHP shell upload patterns.
- Leader — Plan: Critical RCE in a widely deployed runtime with public PoCs warrants confirming your PHP inventory and ensuring engineering prioritizes the emergency patch this week; not yet at board-briefing threshold absent confirmed mass exploitation.
- Signals: CVE-2026-109618 — CISA KEV: not listed, EPSS n/a, public PoC on GitHub, reported by 4 collected sources · CVE-2026-109619 — CISA KEV: not listed, EPSS n/a, public PoC on GitHub, reported by 3 collected sources
- Engineer — Act: Critical unauthenticated RCE in the PHP runtime itself affects all sites regardless of application code; exploit attempts are already being observed. Patch to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35 immediately and verify no webshells were dropped on exposed servers.
- SOC/IR — Act: Active exploit attempts against web servers running PHP create an assume-breach window before patching completes. Hunt for anomalous child processes or file-write activity from web server PHP processes since patch release, and scan for newly created webshells in document roots.
- Leader — Plan: PHP2Shell affects any organization running PHP-based web services and active exploit attempts narrow the patching window significantly. Confirm engineering has inventoried PHP versions in production and is treating this as an emergency patch cycle this week; escalate to leadership briefing only if exploitation is confirmed in your environment.
- Engineer — Act: PHP carries a CVSS 9.4 RCE pair with public PoC already circulating before today’s emergency patch drop — update all PHP installations to the patched release as soon as it publishes and restrict external access to PHP services in the interim.
- SOC/IR — Act: PoC availability ahead of the patch means exploitation attempts are likely imminent; hunt for anomalous web-shell activity and suspicious PHP process spawning across web-facing servers since today, and tune WAF/EDR rules for PHP exploitation patterns.
- Leader — Plan: CVSS 9.4 with pre-patch PoC in wide-use infrastructure warrants confirming PHP exposure across your environment this week and ensuring engineering teams treat today’s emergency patch as P1 — not yet board-level but could escalate if exploitation becomes widespread.
- Signals: CVE-2026-109618 — CISA KEV: not listed, EPSS n/a, public PoC on GitHub, reported by 4 collected sources · CVE-2026-109619 — CISA KEV: not listed, EPSS n/a, public PoC on GitHub, reported by 3 collected sources
- Engineer — Act: Public PoC already circulating before the patch ships — any PHP deployment is at immediate risk of remote code execution. Patch PHP to the fixed release as soon as it drops and monitor the php.net announce list; treat this as an emergency change window.
- SOC/IR — Act: A public PoC against a critical PHP RCE means in-the-wild exploitation attempts are likely imminent or already underway; sweep web server and WAF logs for anomalous POST patterns targeting PHP session/upload endpoints and tune IDS rules to catch PHP shell drop attempts.
- Leader — Plan: PHP underpins a large fraction of web infrastructure — confirm whether your org or key SaaS vendors run PHP-based apps, and ensure engineering has this on an emergency patch track this week before KEV listing and broader exploitation force a reactive posture.
- Signals: CVE-2026-109618 — CISA KEV: not listed, EPSS n/a, public PoC on GitHub, reported by 4 collected sources
- Engineer — Act: Public PoCs exist on GitHub for both critical RCE flaws in PHP, which is widely deployed across web servers and CMS stacks; patch PHP to the latest patched release immediately and check whether PHP-FPM or CGI mode configurations are specifically exposed.
- SOC/IR — Act: With public PoCs live and multi-source corroboration, active exploitation of these PHP RCE flaws is likely imminent; hunt for anomalous web server child-process spawning and web shell artifacts in document roots since at least the PoC publication date.
- Leader — Plan: Critical PHP RCEs with public PoCs in a language powering a large share of web infrastructure warrant confirming organisational PHP exposure and verifying engineering has the patch cycle underway this week; not yet KEV-listed or at Log4Shell-scale, but monitor in case it escalates to a board-question event.
- Signals: CVE-2026-109618 — CISA KEV: not listed, EPSS n/a, public PoC on GitHub, reported by 4 collected sources · CVE-2026-109619 — CISA KEV: not listed, EPSS n/a, public PoC on GitHub, reported by 3 collected sources
- Engineer — Learn: Broadcom Wi-Fi chipsets appear in enterprise access points and edge devices beyond these Belgian ISP gateways, so engineers should note this unauthenticated proximity-RCE vector and track Broadcom’s advisory channel for a patch before scheduling remediation.
- SOC/IR — Skip
- Leader — Skip
- Engineer — Plan: NGINX is near-ubiquitous in cloud environments and critical RCE flaws with out-of-band patches warrant prompt action; no KEV listing or public PoC yet, so schedule patching this sprint — identify your NGINX versions and apply F5’s out-of-band releases to all instances.
- SOC/IR — Skip
- Leader — Skip
- Engineer — Plan: Two critical RCE flaws affect all supported Drupal versions with no PoC or KEV yet, but the project itself warns exploitation is imminent — update Drupal core to the patched release this sprint rather than waiting for the next maintenance window.
- SOC/IR — Skip
- Leader — Skip
- Engineer — Act: A public PoC on GitHub makes exploitation practical despite the low EPSS; RCE on an e-commerce server likely handling payment data warrants immediate action. Update or remove the BlockStrap plugin on all Magento/Adobe Commerce instances and verify no post-exploitation artifacts exist.
- SOC/IR — Plan: No confirmed active exploitation yet, but a public PoC means attacks could begin soon. Build or tune detections for anomalous PHP execution and unexpected outbound connections from Magento web server processes in preparation for exploitation attempts.
- Leader — Skip
- Signals: CVE-2026-103849 — CISA KEV: not listed, EPSS 0.01, public PoC on GitHub
- Engineer — Act: Active exploitation of CVE-2026-110447 in the richdocumentscode Nextcloud app with a public PoC means any self-hosted Nextcloud instance running the built-in CODE Server is at immediate risk of RCE and backdoor implantation; patch the richdocumentscode app to the latest fixed version now and audit server filesystem and process history for signs of post-exploitation activity.
- SOC/IR — Act: With confirmed active exploitation leading to backdoor deployment, assume any Nextcloud server running richdocumentscode may already be compromised; sweep Nextcloud hosts for anomalous child processes from the CODE Server, unexpected outbound connections, and persistence mechanisms (cron, systemd units, webshells) established since this CVE’s disclosure window.
- Leader — Skip
- Signals: CVE-2026-110447 — CISA KEV: not listed, EPSS 0.01, public PoC on GitHub
- Engineer — Act: CISA KEV listed plus a public PoC and confirmed active exploitation make this urgent — apply the PAN-OS patch immediately and restrict management interface access to trusted IP ranges only.
- SOC/IR — Act: Active exploitation of a perimeter security appliance warrants an assume-breach posture — hunt for anomalous management-plane activity and lateral movement from PAN-OS devices dating back to initial disclosure.
- Leader — Act: PAN-OS is perimeter infrastructure for many enterprises; confirm whether it is in use, verify engineering has an emergency patch window in progress, and be ready to respond to customer or board questions given the CISA KEV designation and confirmed active exploitation.
- Signals: CVE-2026-0322 — CISA KEV: listed, EPSS 0.01, public PoC on GitHub, reported by 2 collected sources
- Engineer — Act: CISA KEV-listed, public PoC on GitHub, and confirmed active exploitation against PAN-OS firewalls — apply Palo Alto’s security updates immediately and verify no unauthorized access occurred pre-patch.
- SOC/IR — Act: Active exploitation of a perimeter firewall device warrants an assume-breach sweep — hunt for lateral movement or unusual outbound traffic from PAN-OS management IPs since the disclosure date, and tune detections for post-exploitation behavior on adjacent segments.
- Leader — Act: Actively exploited RCE on a widely deployed perimeter control warrants same-week action — confirm which sites run PAN-OS, verify patching is underway, and be ready to brief leadership if any firewall shows signs of compromise.
- Signals: CVE-2026-0322 — CISA KEV: listed, EPSS 0.01, public PoC on GitHub, reported by 2 collected sources
- Engineer — Plan: NGINX is ubiquitous reverse proxy/edge infrastructure; the TLS flaw that may allow forging sessions is high-impact for any mTLS deployment. No KEV, PoC, or active exploitation reported, but patches are available now — schedule upgrade to 1.30.6 (stable) or 1.31.7 (mainline) this cycle and audit configs that use client-certificate authentication.
- SOC/IR — Skip
- Leader — Skip
- Engineer — Plan: Two critical RCE flaws in a ubiquitous framework warrant priority patching, but with no KEV listing, public PoC, or active exploitation confirmed, this is urgent-but-scheduled rather than drop-everything. Upgrade Next.js to the patched release and audit any transitive use of the sharp/librsvg stack for SVG processing in other services.
- SOC/IR — Learn: No IOCs, no confirmed exploitation, and no TTPs to map yet — nothing to hunt or detect today. File awareness of React Server Components and librsvg/SVG processing as future attack surface if exploitation emerges.
- Leader — Skip
- Engineer — Act: Public PoC and 1,423 honeypot exploitation attempts confirm active in-the-wild attacks against Langflow (CVSS 9.9); if you run Langflow for AI workflow development, patch immediately or restrict access to authenticated users on trusted networks.
- SOC/IR — Act: Active exploitation campaign with over 1,400 observed attempts warrants an immediate sweep of internal and exposed Langflow instances for compromise indicators; hunt for unusual outbound connections or code execution from Langflow processes since the PoC became public.
- Leader — Plan: If your organization has AI/ML engineering teams building agentic workflows, confirm whether Langflow is in use and verify patching status — active exploitation is confirmed but the blast radius is limited to teams that have deployed this platform.
- Signals: CVE-2026-105740 — CISA KEV: not listed, EPSS 0.01, public PoC on GitHub
- Engineer — Act: If you run Drupal with contributed modules, patch immediately to 11.4.10, 11.3.19, or 10.6.19; at least one unauthenticated exploit path is known. Audit which contributed modules are enabled and prioritize sites with public-facing Field UI exposure.
- SOC/IR — Learn: No published IOCs or ATT&CK-mapped TTPs in this advisory; monitor for exploitation reports against Drupal-hosted assets and be ready to hunt for web shell drops on CMS servers if active exploitation is confirmed.
- Leader — Skip
- Engineer — Act: Unauthenticated root RCE on a perimeter email appliance under active exploitation demands emergency patching outside normal windows; upgrade Cisco SEG to the fixed release immediately and audit appliance integrity post-patch.
- SOC/IR — Act: Active exploitation of a perimeter device warrants an assume-breach sweep: review Cisco SEG logs for anomalous process execution, unexpected admin accounts, or unusual outbound connections since before the patch advisory date.
- Leader — Act: Confirm this week whether the organization runs Cisco SEG and verify that engineering has initiated emergency patching; an actively exploited unauthenticated RCE on the email gateway is a plausible breach vector requiring same-week tracking.
- Engineer — Act: Unauthenticated file write via crafted email attachment yielding root code execution on a common perimeter appliance is being actively exploited — patch Cisco Secure Email Gateway to Cisco’s fixed version immediately, and if patching cannot happen today, consider restricting inbound attachment processing or isolating the appliance.
- SOC/IR — Act: Active exploitation of an edge email appliance means assume-breach posture: sweep Cisco SEG devices for unexpected OS file writes and anomalous root-level process execution since the advisory date, and check email logs for unusual attachments that passed through the gateway.
- Leader — Act: Cisco Secure Email Gateway is widely deployed across enterprise environments; active exploitation of a perimeter email device handling sensitive communications warrants confirming whether your organization runs it and directing engineering to apply the emergency patch before end of day.
- Engineer — Act: Both CVEs are CISA KEV-listed with public PoCs and confirmed active exploitation deploying web shells and XMRig miners; update AhsayCBS to the latest patched release immediately and audit backup servers for existing web shell artifacts in the application directories.
- SOC/IR — Act: Active exploitation is dropping web shells and XMRig miners on AhsayCBS hosts — hunt for unexpected files in backup application directories, anomalous outbound connections to mining pools, and lateral movement from backup server accounts since the initial disclosure date.
- Leader — Skip
- Signals: CVE-2026-105133 — CISA KEV: listed, EPSS 0.01, public PoC on GitHub · CVE-2026-105134 — CISA KEV: listed, EPSS 0.03, public PoC on GitHub
- Engineer — Plan: GitLab CE/EE is a common CI/CD platform in enterprise environments; update to the patched release immediately — no public PoC or active exploitation is confirmed yet, but unauthenticated RCE via CI/CD regex warrants treating your patch window as days, not weeks.
- SOC/IR — Skip
- Leader — Learn: A maximum-severity unauthenticated RCE in a widely deployed CI/CD platform is worth tracking — if exploitation emerges at scale, this could escalate to a board-level supply-chain risk; confirm your engineering team has patched and monitor for exploitation news.
- Engineer — Act: Active exploitation plus a public PoC on GitHub means any WordPress instance running Bricksforge is at immediate risk; update the plugin to the patched version now or disable it entirely while you assess impact.
- SOC/IR — Act: Assume-breach sweep is warranted for any WordPress infrastructure: hunt for newly written PHP files under wp-content/plugins/bricksforge/, review web server logs for unauthenticated POST requests to plugin endpoints, and search EDR/SIEM for web shell execution patterns since the PoC dropped.
- Leader — Skip
- Signals: CVE-2026-85097 — CISA KEV: not listed, EPSS 0.00, public PoC on GitHub
- Engineer — Learn: A concrete real-world example of pickle deserialization RCE via Flask session cookies — audit any internal Flask apps using custom pickle-backed session stores and prefer signed, non-pickle serialization formats instead.
- SOC/IR — Learn: No active exploitation or IOCs to act on; the writeup is useful background on pickle deserialization as an RCE vector for future detection engineering, but yields no immediate hunt or rule work.
- Leader — Skip
- Engineer — Plan: GitLab instances running CI/CD are in scope; the RCE in the regex compiler engine is CVSS max, but no KEV listing, PoC, or active exploitation is reported yet. Identify your GitLab version and schedule patching to the fixed release within your critical-patch SLA — don’t wait for routine cycle given the CI/CD blast radius.
- SOC/IR — Skip
- Leader — Plan: Confirm whether self-managed GitLab is in your environment and verify engineering has it in the patching queue; a compromised CI/CD pipeline is a supply-chain event that could trigger customer disclosure obligations, so track remediation ETA this week.
- Engineer — Plan: Public PoC exists for this RCE but EPSS is 0.02 and no KEV listing — patch GitHub Enterprise to the latest release this sprint before exploitation interest picks up; GitHub.com is already patched by GitHub.
- SOC/IR — Plan: Public PoC lowers the bar for opportunistic exploitation; build or tune detections for anomalous GitHub API calls and unexpected Actions runner behavior as an exploitation precursor before active campaign activity emerges.
- Leader — Learn: RCE in a widely-used developer platform is worth noting for the risk register, but no active exploitation and a very low EPSS score mean this does not yet warrant leadership escalation or customer communication.
- Signals: CVE-2026-3854 — CISA KEV: not listed, EPSS 0.02, public PoC on GitHub
- Engineer — Act: Unauthenticated RCE on Exim with a public PoC on GitHub means active exploitation could begin at any time — patch Exim to the fixed version and confirm no internet-exposed instances are running the vulnerable release.
- SOC/IR — Plan: No active exploitation confirmed yet, but the public PoC makes this an imminent detection priority — build or tune rules to flag anomalous child-process spawning and unexpected outbound connections from your Exim instances before exploitation begins.
- Leader — Skip
- Signals: CVE-2026-45185 — CISA KEV: not listed, EPSS 0.01, public PoC on GitHub
- Engineer — Act: A public working exploit for a pre-auth root RCE means active exploitation risk is immediate; upgrade AnyDesk Linux to version 8.0.3 on all hosts and audit for any instances still running older versions.
- SOC/IR — Plan: No IOCs or active campaign reported yet, but working exploit publication typically precedes mass exploitation; build or tune detections for anomalous process spawning from the AnyDesk daemon on Linux endpoints and queue a hunt for lateral movement from remote-access tools.
- Leader — Plan: Confirm whether AnyDesk Linux is deployed in the environment and verify the patch is applied; the vendor’s deliberately vague changelog — no CVE, no security advisory — is a vendor-transparency red flag worth raising in your next vendor risk review.
- Engineer — Act: A public PoC is on GitHub for a critical memory-overflow RCE in NetScaler ADC/Gateway affecting SAML configurations — apply Citrix’s patch immediately and confirm whether your deployment uses SAML to assess exposure scope.
- SOC/IR — Plan: No active exploitation or published IOCs yet, but a public PoC raises the likelihood of imminent attempts; build or tune a detection for anomalous HTTP traffic to NetScaler SAML endpoints as a pre-emptive measure.
- Leader — Skip
- Signals: CVE-2026-107406 — CISA KEV: not listed, EPSS 0.00, public PoC on GitHub
- Engineer — Plan: NetScaler ADC and Gateway are common enterprise edge appliances and historically high-value targets; no CISA KEV, EPSS, or public PoC yet, but Citrix rates this critical and is urging immediate action — schedule patching within days and verify your NetScaler versions against the advisory.
- SOC/IR — Plan: No published IOCs or confirmed exploitation yet, but NetScaler appliances have a strong history of rapid post-disclosure weaponization; prepare hunt queries for post-exploitation behavior on NetScaler hosts and set a watch for KEV listing or PoC release this week.
- Leader — Learn: A critical RCE in a remote-access gateway is worth noting on the risk register, but with no active exploitation confirmed this is squarely in the engineering team’s patch queue — escalate to Act if exploitation is confirmed or if NetScaler Gateway is your primary remote-access solution.
- Engineer — Plan: Five critical RCE-to-root flaws in NX-OS affect data center Nexus switches; no KEV listing or public PoC yet. Confirm whether Nexus switches are in scope, then schedule patching against Cisco’s advisory within the next maintenance window.
- SOC/IR — Skip
- Leader — Skip
- Engineer — Act: Unpatched critical unauthenticated RCE in LMCache multiprocess mode with no fix available; if running vLLM or any LMCache deployment, immediately disable multiprocess mode or network-isolate the cache server (firewall ZeroMQ port) until a patched release ships.
- SOC/IR — Plan: No IOCs or confirmed active exploitation reported, but organizations running LLM inference infrastructure should create detections for anomalous process spawning or unexpected inbound connections on LMCache/vLLM nodes; start collecting relevant host and network logs from AI compute clusters now.
- Leader — Learn: Highlights emerging attack surface in enterprise AI infrastructure; no immediate leadership action required, but useful context for AI security posture reviews and vendor risk assessments if LLM serving software is in scope.
- Engineer — Act: Active scanning for CVE-2026-61500 with a public PoC means exploitation is imminent for any exposed Rejetto HFS instance; identify and patch or take offline any internet-facing HFS servers immediately.
- SOC/IR — Act: Active scanning is underway — hunt for anomalous authentication or session-related traffic against HFS servers and sweep for signs of session forgery or RCE activity since the scanning began.
- Leader — Skip
- Signals: CVE-2026-61500 — CISA KEV: not listed, EPSS 0.01, public PoC on GitHub, reported by 2 collected sources
- Engineer — Plan: If you self-host the GitLab AI Gateway with Duo Agent Platform enabled, this is a real code-execution risk — upgrade to 19.2.4, 19.3.2, or 19.4.1. No public PoC or active exploitation reported, so this fits a near-term sprint rather than an emergency rollout.
- SOC/IR — Skip
- Leader — Skip
- Engineer — Plan: GitLab AI Gateway RCE is vendor-rated critical and affects a widely deployed DevOps component, but no KEV, public PoC, or active exploitation is confirmed. Schedule patching to the latest fixed GitLab version this sprint and verify AI Gateway is not exposed to untrusted networks until patched.
- SOC/IR — Skip
- Leader — Skip
- Engineer — Act: CISA KEV listed, public PoC available, and active exploitation confirmed — patch FortiMail to Fortinet’s recommended fixed version immediately; treat any unpatched internet-facing FortiMail instance as potentially compromised.
- SOC/IR — Act: Active zero-day exploitation of a network-edge email gateway warrants an assume-breach posture — sweep FortiMail logs for anomalous command execution or outbound connections since the first reported exploitation date, and tune detections for post-compromise activity on devices in that network segment.
- Leader — Act: Confirm whether your organization runs FortiMail and verify emergency patching is underway; CISA KEV listing on an actively exploited edge appliance may warrant a brief to leadership given potential for email interception and lateral movement.
- Signals: CVE-2026-104286 — CISA KEV: listed, EPSS 0.02, public PoC on GitHub, reported by 2 collected sources
- Engineer — Learn: Themes here — model-file inspection triggering RCE, cache-confusion request mixing, and long-lived public secrets — are worth internalizing for design reviews, but the summary names no specific software or CVEs to patch and carries no enrichment signals.
- SOC/IR — Learn: The digest surfaces interesting attack primitives (AI-powered zero-day chaining, model inspection as code execution) but provides no IOCs, ATT&CK mappings, or specific campaigns to hunt for this week.
- Leader — Learn: 543K live exposed secrets is a meaningful scale signal worth referencing when reviewing secrets-management program maturity, but no named vendor breach or deadline is present that would require immediate leadership action.
- Engineer — Act: CISA KEV listing plus a public GitHub PoC confirms active exploitation of this unauthenticated RCE on Zimbra mail servers. Apply the available Zimbra patch immediately; if the instance is internet-facing and patching will be delayed, consider taking it offline or blocking external access as a temporary control.
- SOC/IR — Act: Microsoft’s analysis includes attack paths and detection opportunities for an actively exploited, unauthenticated command injection on a common enterprise mail platform. Run a targeted hunt across Zimbra hosts for compromise indicators using the TTPs outlined in the post, and tune SIEM/EDR detections against the described exploitation behavior — assume any unpatched internet-facing Zimbra instance may already be compromised.
- Leader — Plan: This is a KEV-listed RCE on internet-facing mail servers, meaning exploitation is confirmed in the wild; confirm whether Zimbra is in your inventory and verify the engineering team has an emergency patch timeline in place this week. Not yet at Log4Shell systemic scope, but email server compromise carries credential and data-exfiltration risk worth validating before it becomes an incident.
- Signals: CVE-2026-73570 — CISA KEV: listed, EPSS 0.12, public PoC on GitHub
- Engineer — Act: CISA KEV-listed pre-auth memory overflow in NetScaler ADC/Gateway (CVSS 9.5) with public PoC and confirmed active exploitation — patch all NetScaler ADC and Gateway appliances to the vendor-fixed version immediately, prioritizing internet-facing instances.
- SOC/IR — Act: Active exploitation of a pre-auth edge-device RCE means assume-breach posture is warranted — sweep NetScaler ADC/Gateway logs for anomalous DTLS traffic, unexpected shell processes, or lateral movement originating from the appliance since initial disclosure date.
- Leader — Act: Citrix NetScaler is pervasive in enterprise environments and this actively exploited critical RCE is CISA KEV-listed — confirm whether NetScaler ADC/Gateway is deployed, direct immediate patching, and brief leadership if it is internet-facing or handles sensitive authentication flows.
- Signals: CVE-2026-88772 — CISA KEV: listed, EPSS 0.01, public PoC on GitHub, reported by 3 collected sources
- Engineer — Act: Both CVEs are CISA KEV-listed with public PoCs and confirmed active exploitation — patch NetScaler to Citrix’s latest fixed builds immediately; if patching cannot be completed within hours, follow Citrix’s guidance to shut down exposed appliances until patched.
- SOC/IR — Act: Active exploitation of NetScaler edge devices means assume compromise is possible before patching — hunt for anomalous outbound connections, unexpected processes, or lateral movement originating from NetScaler appliances since the disclosure date, and tune detections for post-RCE behavior on these hosts.
- Leader — Act: Dual CISA KEV-listed RCEs on widely deployed enterprise edge infrastructure warrant same-week leadership action — confirm whether your environment runs NetScaler, verify engineering has begun emergency patching, and prepare to brief leadership given the likelihood of board or customer questions.
- Signals: CVE-2026-88771 — CISA KEV: listed, EPSS n/a, public PoC on GitHub, reported by 3 collected sources · CVE-2026-88772 — CISA KEV: listed, EPSS n/a, public PoC on GitHub, reported by 2 collected sources
- Engineer — Act: Actively exploited RCE on NetScaler ADC/Gateway with no patch available; take appliances offline or restrict management-plane access immediately, monitor watchTowr’s advisory for IOCs and check Citrix for any interim mitigations.
- SOC/IR — Act: Active exploitation of internet-facing edge appliances means possible pre-patch compromise; assume-breach posture — hunt for anomalous activity from NetScaler IPs, review watchTowr’s analysis for TTPs, and prepare runbooks for NetScaler IR.
- Leader — Act: Unpatched RCE on a widely deployed network edge product with confirmed active exploitation is a board-level event; confirm whether NetScaler ADC or Gateway is in your estate, assess exposure, and brief leadership this week in case it escalates before a patch ships.
- Engineer — Act: Active exploitation confirmed — attackers are writing PHP webshells to disk via CVE-2026-87902; patch WordPress immediately and audit wp-content directories and recently modified PHP files for unauthorized shells.
- SOC/IR — Act: Assume-breach posture for any WordPress hosts; hunt for newly created or modified PHP files in web roots, anomalous HTTP requests reaching previously non-existent paths, and OS command execution spawning from web server processes.
- Leader — Plan: Confirm whether the organization runs WordPress and direct engineering to prioritize patching this quarter; active exploitation is under way but this has not yet reached Log4Shell-scale board visibility.
- Signals: CVE-2026-87902 — CISA KEV: not listed, EPSS 0.03, public PoC on GitHub, reported by 2 collected sources
- Engineer — Act: Public PoC exists for a CVSS 9.8 unauthenticated RCE affecting all Bifrost HTTP transport versions before 2.1.0 — if you run this AI gateway in any environment, patch to 2.1.0 immediately and audit for signs of exploitation in management endpoint logs.
- SOC/IR — Plan: No active exploitation signals yet (EPSS 0.01, not KEV-listed), but a public PoC raises near-term risk — if Bifrost appears in your estate, write a detection for unauthenticated HTTP requests to its management interface before campaigns emerge.
- Leader — Skip
- Signals: CVE-2026-90898 — CISA KEV: not listed, EPSS 0.01, public PoC on GitHub
- Engineer — Act: Pre-auth RCE on a widely deployed VPN gateway with CISA KEV listing, active exploitation, and a public PoC demands immediate action: apply Check Point’s patch for CVE-2026-85102, then audit gateway logs for signs of pre-patch compromise.
- SOC/IR — Act: Active exploitation of an edge VPN device requires an assume-breach posture: hunt for unusual outbound connections or lateral movement originating from or through Check Point Security Gateway hosts since the earliest known exploitation date, and check threat intel feeds for published IOCs tied to this campaign.
- Leader — Act: CISA KEV listing and confirmed active exploitation of a perimeter VPN appliance are board-question-level conditions: confirm whether Check Point Security Gateway is in your environment, verify your team has an emergency patch plan, and be ready to brief leadership on exposure before this surfaces in the news.
- Signals: CVE-2026-85102 — CISA KEV: listed, EPSS 0.01, public PoC on GitHub
- Engineer — Plan: Unauthenticated PHP file inclusion enabling potential code execution is severe and affects all WordPress branches back to 4.7; no KEV listing or public PoC in signals, but the attack surface is enormous — patch to WordPress 7.1.2 across all managed sites within your normal critical-patch window.
- SOC/IR — Skip
- Leader — Skip
- Engineer — Act: BIG-IP APM is a common enterprise edge/access device; active RCE exploitation with a patch now available means immediate upgrade is warranted — apply F5’s security updates to BIG-IP APM without waiting for your normal patch window.
- SOC/IR — Act: Active exploitation of an edge access device requires an assume-breach posture — sweep BIG-IP APM logs for anomalous sessions, unauthorized admin activity, or unusual outbound connections dating back before the patch was issued.
- Leader — Act: Confirm within the week whether BIG-IP APM is in your estate; if so, direct engineering to treat this as emergency patching and brief incident response, as actively exploited perimeter RCE zero-days carry real breach risk before patching completes.
- Engineer — Act: CISA KEV-listed, public PoC, and confirmed active exploitation on F5 BIG-IP APM systems configured as OAuth authorization servers — apply F5’s engineering hotfix for CVE-2026-94127 immediately and verify whether any BIG-IP instances serve that OAuth role.
- SOC/IR — Act: Active exploitation of an edge device that precedes patching means assume-breach posture — sweep BIG-IP APM logs for anomalous unauthenticated requests to OAuth endpoints and hunt for post-compromise lateral movement since at least September 22.
- Leader — Act: Actively exploited unauthenticated RCE on a widely-deployed enterprise network appliance warrants same-week action — confirm whether BIG-IP APM is in use as an OAuth server, verify engineering has the hotfix on track, and be ready to brief leadership if it is.
- Signals: CVE-2026-94127 — CISA KEV: listed, EPSS 0.01, public PoC on GitHub
- Engineer — Plan: Patch Next.js to the version released 2026-09-22 that fixes the ImageResponse RCE; audit any app that passes user-controlled input (e.g. URL parameters) into ImageResponse calls. No KEV listing or public PoC in signals, so patching this sprint is prudent but not emergency-level.
- SOC/IR — Skip
- Leader — Skip
- Engineer — Plan: Root code execution reachable by any cPanel account holder is a severe privilege-escalation path, but no KEV listing, public PoC, or active-exploitation signals are present. Upgrade cPanel to the vendor-released fixed versions for both the CalDAV/CardDAV service and the WP Toolkit plugin before the quarter ends.
- SOC/IR — Skip
- Leader — Skip
- Engineer — Act: CISA KEV-listed with a public GitHub PoC and confirmed exploitation — patch Check Point Security Management Server to the September 22 fix immediately; the flaw allows unauthenticated script execution on the server that controls your firewall policies.
- SOC/IR — Act: Exploitation dates to July 23, so sweep Check Point management server access logs for anomalous unauthenticated web service calls and unexpected script executions from that date forward; assume-breach posture is warranted given KEV listing.
- Leader — Act: If Check Point is in the environment, confirm the management server has been patched to the September 22 release and request a compromise assessment covering activity since July 23 — attacker access here means potential modification of firewall policies across the estate.
- Signals: CVE-2026-93616 — CISA KEV: listed, EPSS 0.02, public PoC on GitHub
- Engineer — Act: A public PoC now lowers the exploitation bar for this CSRF-to-PHP-execution flaw in WordPress Core; patch WordPress to the latest patched release and verify that admin-facing endpoints require nonce validation.
- SOC/IR — Plan: No confirmed active exploitation yet, but a public PoC means campaigns are likely imminent; build or tune detections for anomalous PHP execution originating from WordPress admin paths and unexpected file-write activity on web roots.
- Leader — Learn: A meaningful WordPress Core vulnerability with a published exploit — not yet at systemic scale, but worth confirming your engineering team has patched any WordPress instances; no board-level action required unless exploitation becomes widespread.
- Engineer — Plan: The CVSS 6.5 spoofing label may have caused teams to deprioritize this patch; full technical details are now public, raising PoC risk. Patch SharePoint Server 2016, 2019, and Subscription Edition to the vendor-supplied fix before a PoC materializes.
- SOC/IR — Plan: With detailed exploit mechanics now public, exploitation attempts are more likely in coming weeks. Build or stage SharePoint-targeted authenticated RCE hunt queries now so you can sweep quickly if active exploitation is reported.
- Leader — Skip
- Signals: CVE-2026-65660 — CISA KEV: not listed, EPSS 0.01, no public PoC found
- Engineer — Plan: WordPress is near-universal in web estates; this CSRF-style flaw lets a crafted link trigger theme installation on behalf of a logged-in admin, which can chain to code execution. No KEV or public PoC signals exploitation pressure yet, so patch WordPress core to the latest patched release this sprint and enforce admin MFA to raise the social-engineering bar.
- SOC/IR — Learn: The Click2Shell chain (crafted link → silent theme install → code execution) is a useful mental model for triage, but with no active exploitation, no IOCs, and no published TTPs, there is no immediate detection or hunt work to act on today.
- Leader — Skip
- Engineer — Plan: CVSS 8.8 unauthenticated RCE via hard-coded key is a serious class of flaw, but EPSS is 0.01 with no KEV listing and no public PoC — patch ARM beyond version 2026.2 on your next patch cycle rather than treating it as emergency.
- SOC/IR — Skip
- Leader — Skip
- Signals: CVE-2026-28326 — CISA KEV: not listed, EPSS 0.01, no public PoC found
- Engineer — Act: Actively exploited pre-auth RCE with a public PoC on GitHub overrides the low EPSS; patch Orkes Conductor to 3.30.2 or later immediately if running any version before that.
- SOC/IR — Act: Active exploitation confirmed by Fortinet means assume-breach posture for any environment running Orkes Conductor — sweep for anomalous process spawns from the Conductor service and pull Fortinet’s report for available IOCs to hunt against SIEM data.
- Leader — Plan: Verify whether Orkes Conductor is in your tech stack; if confirmed, escalate to engineering as urgent given active exploitation of a 9.8 CVSS pre-auth RCE — this is not yet a board-level systemic event unless your org is exposed.
- Signals: CVE-2026-58138 — CISA KEV: not listed, EPSS 0.09, public PoC on GitHub
- Engineer — Plan: Unauthenticated root RCE on the management plane that controls all firewall policy is extremely high impact, but no KEV listing, PoC, or active exploitation is confirmed; apply Check Point’s LivePatch update to all Security Management and Log Servers within your next patch window, prioritizing internet-accessible instances.
- SOC/IR — Plan: No IOCs or confirmed exploitation yet, but compromise of the Check Point management server would let an attacker silently rewrite firewall policy — establish a baseline of expected connections to your management server ports now and prepare a hunt query to surface anomalous pre-auth traffic if exploitation activity is reported.
- Leader — Plan: If Check Point Security Management is in your environment, confirm with your engineering team this quarter that the LivePatch update has been applied; unauthenticated control-plane RCE would hand attackers the keys to your entire perimeter policy, but no active exploitation has been reported yet.
- Engineer — Plan: If you run Check Point management servers, this critical RCE is directly relevant — update to the patched release as soon as your window allows; no active exploitation or public PoC is confirmed yet, so Act urgency isn’t warranted but routine-cycle treatment is insufficient for a root-level management plane flaw.
- SOC/IR — Skip
- Leader — Plan: If Check Point is in your environment, confirm with the team that patching of management infrastructure is prioritized this sprint; a critical RCE on a security management plane is the kind of exposure auditors and customers will ask about if it later appears on KEV.
- Engineer — Act: Active exploitation of an unauthenticated OS command execution flaw (CVSS 9.8) in Issabel PBX — if you run Issabel, patch immediately or isolate the management interface from public network access and audit for indicators of prior compromise.
- SOC/IR — Act: Active exploitation reported; hunt for anomalous command execution or outbound connections from Issabel/PBX systems since this vulnerability became public, and check whether any internet-exposed PBX management interfaces exist in the estate.
- Leader — Skip
- Signals: CVE-2026-89026 — CISA KEV: not listed, EPSS 0.01, public PoC on GitHub
- Engineer — Act: A public PoC exists for this critical heap overflow enabling RCE against any Unbound resolver that validates DNSSEC; patch to Unbound 1.26.1 immediately and verify all resolver deployments (containers, host-based, service mesh sidecars) are updated.
- SOC/IR — Learn: No active exploitation or IOCs reported, and EPSS is 0.01; the attack path (attacker-controlled zone triggers RCE in resolver) is worth noting for future hunt hypotheses, but no detection work is warranted until exploitation evidence emerges.
- Leader — Skip
- Signals: CVE-2026-81642 — CISA KEV: not listed, EPSS 0.01, public PoC on GitHub
- Engineer — Act: Unauthenticated file upload enabling PHP web shell deployment is being actively exploited against this WooCommerce plugin (~6,000 installs). Check all WordPress sites for this plugin, update to the patched version immediately, and audit the uploads directory for unexpected PHP files.
- SOC/IR — Act: Active exploitation is planting PHP backdoors on WordPress sites; sweep web servers for anomalous PHP files in WooCommerce plugin upload paths and hunt for POST requests to the plugin’s file-upload endpoint since exploitation began.
- Leader — Skip
- Engineer — Act: Active exploitation of a Gitea RCE by a suspected Chinese actor with 13 confirmed compromises makes this urgent for anyone running an internet-facing Gitea instance. Patch Gitea to the latest version immediately and audit access logs for unauthorized RCE attempts.
- SOC/IR — Act: Red Heron scanned over 1,300 Gitea instances as part of this campaign, suggesting systematic targeting; hunt for exploitation attempts against any Gitea instances in your environment and check for post-compromise lateral movement patterns consistent with Chinese espionage actors since the campaign began.
- Leader — Learn: A confirmed multi-national espionage campaign exploiting a self-hosted developer tool is worth awareness for context on Chinese threat actor tempo, but Gitea is niche enough that this does not rise to board-level action unless your organization specifically runs it.
- Engineer — Act: CISA KEV-listed, public PoC live, and actively exploited — patch AsyncOS for Cisco Secure Email Gateway to Cisco’s fixed release immediately; if patching is delayed, apply any available workaround and isolate the appliance from untrusted networks.
- SOC/IR — Act: Active exploitation of an edge mail appliance means assume-breach posture is warranted — sweep email gateway logs for anomalous process execution or unexpected outbound connections since the vulnerability was disclosed, and tune EDR/SIEM for unauthenticated root-level process spawns from the AsyncOS process tree.
- Leader — Act: Cisco Secure Email Gateway is a widely deployed enterprise appliance; active exploitation with a CVSS 9.8 and KEV listing warrants confirming whether your environment uses it this week and verifying your team has applied Cisco’s patch — brief leadership if the appliance handles regulated data or sits on a compliance boundary.
- Signals: CVE-2026-76461 — CISA KEV: listed, EPSS 0.02, public PoC on GitHub
- Engineer — Act: VMware vCenter is core enterprise infrastructure and this RCE is under active ransomware exploitation per CISA — patch vCenter to the July-released fix immediately if not already done, and verify patch status across all vCenter instances in your environment.
- SOC/IR — Act: Ransomware actors are exploiting vCenter in the wild — run a retrospective hunt across vCenter logs since July for signs of exploitation or lateral movement, and verify EDR coverage on vCenter hosts where possible.
- Leader — Act: CISA-confirmed ransomware exploitation of a widely deployed infrastructure component warrants same-week action — confirm with your engineering team that vCenter instances are patched and brief leadership given the ransomware-as-operational-risk angle.
- Engineer — Act: Netlogon RCE with EPSS 0.80 and a public PoC is a critical, imminent-exploitation risk for any Active Directory environment. Apply the Microsoft patch for CVE-2026-41089 to all domain controllers immediately, prioritizing before the weekend.
- SOC/IR — Act: With a public PoC and EPSS 0.80, exploitation attempts are likely already occurring; initiate a hunt for anomalous Netlogon traffic and failed authentication spikes (Windows Event IDs 5805, 4625) against domain controllers since the PoC publication date.
- Leader — Act: A Netlogon RCE with public exploit code represents a domain-wide compromise scenario comparable to ZeroLogon — confirm with your team that emergency DC patching is underway and brief leadership now, before this surfaces in the news.
- Signals: CVE-2026-41089 — CISA KEV: not listed, EPSS 0.80, public PoC on GitHub
- Engineer — Act: CVSS 10.0 pre-auth RCE on N-central is CISA KEV-listed with active exploitation and a public GitHub PoC — patch N-central immediately and audit your N-central server logs for signs of compromise before the patch is applied.
- SOC/IR — Act: Active exploitation of an RMM platform is a high-priority assume-breach scenario; hunt for anomalous commands or lateral movement originating from N-central agents across managed endpoints since exploitation requires no credentials and leaves a narrow pre-auth detection window.
- Leader — Act: Compromised RMM tools give attackers keys to every managed endpoint — confirm whether your organization or any MSP you rely on runs N-central, and request written patch confirmation or an attestation of remediation given the September 11 CISA deadline.
- Signals: CVE-2026-86218 — CISA KEV: listed, EPSS 0.01, public PoC on GitHub
- Engineer — Act: CISA KEV-listed RCE in WatchGuard Firebox is now confirmed ransomware-leveraged; patch Firebox to the latest available version immediately and audit edge-device logs for signs of pre-patch compromise.
- SOC/IR — Act: Ransomware actors exploiting an RCE in a perimeter firewall is an assume-breach scenario — sweep for lateral movement originating from WatchGuard appliances and hunt for IOCs tied to this campaign since CISA’s December KEV addition.
- Leader — Act: Ransomware exploitation of a perimeter firewall is board-level risk; confirm this week whether WatchGuard Firebox is in your estate, verify emergency patching is underway, and brief leadership before an incident forces the conversation.
- Engineer — Act: Two vulnerabilities are confirmed exploited in the wild, including a Windows privilege escalation; prioritize patching those plus the critical RCEs in Skype for Business, MSMQ, and RRAS within your emergency patch window — review the full advisory to identify the two KEV-grade CVEs by number and verify patch deployment within 48–72 hours.
- SOC/IR — Plan: With two actively exploited vulns (including a Windows privesc) but no IOCs provided here, queue detection work this week: pull the specific CVE IDs from Microsoft’s release, map the exploited privesc to relevant ATT&CK techniques, and tune alerts for anomalous privilege elevation on unpatched Windows hosts.
- Leader — Learn: The 973-CVE release is the largest Patch Tuesday on record and may surface in board or customer conversations; useful context for communicating why patch velocity investment matters, but the two actively exploited issues are not yet a named systemic event requiring leadership escalation.
- Engineer — Act: Actively exploited in the wild plus a public PoC makes this urgent despite the low EPSS; update Chrome to the latest release across all managed endpoints and browser fleets immediately.
- SOC/IR — Plan: No IOCs or TTPs are published yet, but active exploitation warrants tuning EDR rules to flag anomalous child processes spawned from Chrome renderer processes as an exploitation indicator.
- Leader — Skip
- Signals: CVE-2026-87491 — CISA KEV: not listed, EPSS 0.00, public PoC on GitHub
- Engineer — Act: A working unauthenticated RCE exploit chain against Telerik UI for ASP.NET AJAX is now public; apply the July Progress patch immediately and audit whether any deployments use the affected non-default AES-CBC configuration that enables the oracle.
- SOC/IR — Plan: No confirmed wild exploitation or published IOCs yet, but the public PoC warrants building detections for anomalous HTTP requests targeting Telerik AJAX endpoints — prepare Sigma/SPL rules now so you’re ready if exploitation picks up.
- Leader — Skip
- Engineer — Act: If you run N-central, apply the emergency hotfix immediately — max-severity RCE with reported ongoing attacks on an RMM platform is a critical-priority patch with no waiting window.
- SOC/IR — Act: Active exploitation of an RMM platform is an assume-breach trigger: hunt for unauthorized lateral movement or remote execution originating from N-central agents across managed endpoints since before the patch window.
- Leader — Act: Confirm whether your organization or any MSP you rely on runs N-central, and request attestation that the emergency hotfix has been applied — RMM compromise has cascading supply-chain risk to all managed systems.
- Engineer — Act: Unauthenticated RCE with active exploitation since September 4 and no patch yet — apply Sansec’s recommended WAF/mitigation rules immediately, audit Magento/Adobe Commerce file systems and web roots for newly dropped backdoors, and consider restricting public access to admin paths until a patch is released.
- SOC/IR — Act: Active exploitation campaign targeting Magento/Adobe Commerce via StyleSmuggler began September 4 — hunt for anomalous POST requests to layout/XML-related endpoints and for new or modified PHP files in web roots on those servers since that date, and tune file-integrity and web-shell detection rules accordingly.
- Leader — Act: An actively exploited zero-day with unauthenticated RCE on e-commerce servers puts payment card and customer data at immediate risk — confirm whether your organization or key vendors run Magento/Adobe Commerce, assess PCI DSS breach-notification obligations, and brief leadership given the likelihood of press coverage.
- Engineer — Act: A public PoC on GitHub for this CVSS 9.3 integer-overflow VM escape (CVE-2026-59346) makes exploitation practical even without a KEV listing; patch VMware Workstation and Fusion to the latest Broadcom-released versions immediately, prioritizing developer and security-lab machines where Workstation is commonly deployed.
- SOC/IR — Plan: With a public PoC available, build host-side detections for anomalous process spawning from VMware Workstation parent processes, which would indicate a VM-to-host breakout attempt; the local elevated-privilege prerequisite means exploitation is a post-compromise step worth hunting for in dev-heavy environments.
- Leader — Learn: A VM escape in desktop virtualization software (Workstation/Fusion, not ESXi) is a meaningful but not board-level event; note the risk for developer workstation fleets and confirm engineering is tracking the patch rollout.
- Signals: CVE-2026-59346 — CISA KEV: not listed, EPSS n/a, public PoC on GitHub
- Engineer — Plan: Patch ArubaOS-CX to the fixed version HPE released; no KEV listing or public PoC signals active exploitation, but a critical RCE on network OS warrants scheduled patching this quarter.
- SOC/IR — Skip
- Leader — Skip
- Engineer — Act: Public PoC on GitHub for an unauthenticated root RCE on widely deployed data-center switches raises exploitation risk even with low EPSS; apply Cisco’s Nexus 9000 patch now and separately assess IOS XR exposure for the two 9.8-rated CVEs that have no available workaround.
- SOC/IR — Plan: No active exploitation confirmed yet, but the public PoC means attempts are likely imminent; build detections for anomalous access to Nexus 9000 management interfaces and prepare a hunt query baseline now before KEV listing forces a reactive response.
- Leader — Plan: Unauthenticated root RCE on core network switches with a public PoC is a meaningful risk-register item; confirm your network team has the Nexus 9000 patch cycle scheduled and note the IOS XR exposure for environments running that platform.
- Signals: CVE-2026-20212 — CISA KEV: not listed, EPSS 0.01, public PoC on GitHub
- Engineer — Act: Active campaign with public PoC and 440k observed attempts makes this urgent despite low EPSS — if you run Super Forms or Elementor Pro on any WordPress site, update both plugins immediately and audit web-accessible upload directories for dropped files.
- SOC/IR — Act: The scale of this campaign (440k attempts) warrants sweeping web server logs for unauthenticated POST requests to Super Forms and Elementor Pro upload endpoints, and hunting for newly created PHP files in WordPress upload paths since the PoC became public.
- Leader — Plan: Confirm whether WordPress with these plugins exists in any customer-facing or internal properties; if so, ensure the patch-and-audit cycle is assigned and tracked — the exploitation volume makes this a realistic exposure risk worth validating this week.
- Signals: CVE-2026-14894 — CISA KEV: not listed, EPSS 0.05, public PoC on GitHub
- Engineer — Plan: If you run WordPress with All-in-One WP Migration and Backup installed, update the plugin to the patched version immediately; no KEV listing or public PoC confirmed yet, so this is urgent-but-not-emergency patching.
- SOC/IR — Skip
- Leader — Skip
- Engineer — Act: If you run Sangoma Switchvox SMB Edition 8.3, patch immediately — a public PoC exists and active exploitation is reported. Restrict network access to the Switchvox admin interface as an interim control while a patch is applied.
- SOC/IR — Act: Active exploitation is deploying reverse shells from VoIP infrastructure; hunt for anomalous outbound connections originating from Switchvox hosts and sweep network logs for unexpected C2 traffic since the PoC went public.
- Leader — Skip
- Signals: CVE-2026-9586 — CISA KEV: not listed, EPSS 0.01, public PoC on GitHub
- Engineer — Act: Actively exploited RCE zero-days on an edge appliance demand immediate response: apply SonicWall’s emergency mitigations or patches as soon as available, and treat any internet-exposed SMA1000 as potentially compromised pending confirmation.
- SOC/IR — Act: Active exploitation of an edge SSL VPN device means compromise may predate any patch; sweep SMA1000 appliances for anomalous outbound connections and lateral movement indicators from the appliance’s IP, and initiate assume-breach review of adjacent segments.
- Leader — Act: If SonicWall SMA1000 is in the estate, confirm remediation is underway this week and request a vendor statement on exposure scope; actively exploited RCE on a remote-access gateway is the kind of incident that surfaces in board and customer conversations.
- Engineer — Plan: If you run GeoNetwork, upgrade to 4.4.12 (4.x branch) or 4.2.17 (4.2 branch) — the chained unauthenticated RCE is severe but no KEV listing, public PoC, or active exploitation is reported, so patch this sprint rather than emergency-tonight.
- SOC/IR — Skip
- Leader — Skip
- Engineer — Act: Active exploitation of an unauthenticated RCE in Langflow (public PoC available) is being used to exfiltrate API keys and cloud credentials. Patch Langflow to the latest fixed release immediately, rotate any OpenAI and AWS keys accessible from Langflow instances, and review Langflow access logs for signs of unauthorized execution.
- SOC/IR — Act: Confirmed active exploitation with credential theft as the objective creates a detection and hunt opportunity now. Identify any Langflow instances in the environment, hunt for anomalous outbound requests or process spawning from those hosts, and monitor for unusual OpenAI or AWS API activity that could indicate stolen key use.
- Leader — Plan: If AI application development is underway internally, Langflow may be present in engineer pipelines — AWS key theft from a development tool is a material cloud-spend and data-exposure risk. Direct engineering teams this week to audit Langflow deployments and confirm no keys were exposed.
- Signals: CVE-2026-0768 — CISA KEV: not listed, EPSS 0.02, public PoC on GitHub, reported by 2 collected sources
- Engineer — Learn: CVE-2021-31886 is a 2021 vulnerability with EPSS 0.03 and no KEV listing — exploitation pressure is low. WAGO PLCs are niche OT hardware outside most cloud/AppSec stacks, but the research technique (AI-accelerated exploit porting to embedded ARM targets) is worth understanding if you maintain any OT/ICS-adjacent environments.
- SOC/IR — Learn: No IOCs, no active campaign, and no new detection surface are introduced by this research. The demonstrated method of using LLMs to port PLC exploits is context worth knowing for OT-adjacent threat hunting, but there is nothing actionable to write rules or run sweeps against today.
- Leader — Learn: This research is a concrete signal that AI tooling is meaningfully lowering the barrier for porting ICS/OT exploits — relevant if you have OT exposure on your risk register or are shaping a position on AI in offensive security for a board or customer briefing.
- Signals: CVE-2021-31886 — CISA KEV: not listed, EPSS 0.03, public PoC on GitHub
- Engineer — Act: CVE-2026-0768 in Langflow is a CVSS 9.8 RCE running as root with a public PoC and confirmed active exploitation — patch or take Langflow offline immediately; also audit Rails deployments for CVE-2026-66066 exposure and apply the latest Rails patch given the 0.28 EPSS and available PoC.
- SOC/IR — Act: Active exploitation includes credential-probing and C2 callback activity — hunt for anomalous outbound connections and lateral movement originating from Langflow or Rails app servers since these flaws became public, and build detections for post-exploitation behavior on those hosts.
- Leader — Skip
- Signals: CVE-2026-0768 — CISA KEV: not listed, EPSS 0.02, public PoC on GitHub · CVE-2026-66066 — CISA KEV: not listed, EPSS 0.28, public PoC on GitHub
- Engineer — Act: CVSS 9.8 authentication bypass and RCE affecting commonly deployed plugins (Avada, GiveWP, TranslatePress, Pods, WPMU DEV Dashboard), with a public PoC already on GitHub; patch all five to their latest patched releases before the PoC accelerates exploitation.
- SOC/IR — Plan: No active exploitation confirmed (EPSS 0.00, not on KEV), but the public PoC shortens the window; build or tune detections for anomalous WordPress admin account creation and unauthenticated POST requests targeting these plugin endpoints this sprint.
- Leader — Skip
- Signals: CVE-2026-76581 — CISA KEV: not listed, EPSS 0.00, public PoC on GitHub
- Engineer — Plan: If your environment uses Unitree G1 EDU robots, review network segmentation and disable unnecessary BLE/network services; no KEV listing and near-zero EPSS suggest limited active exploitation pressure, but public PoCs exist so schedule patching.
- SOC/IR — Skip
- Leader — Skip
- Signals: CVE-2026-76639 — CISA KEV: not listed, EPSS 0.01, public PoC on GitHub · CVE-2026-76640 — CISA KEV: not listed, EPSS 0.00, public PoC on GitHub
- Engineer — Plan: Three unauthenticated RCE/SQLi flaws at maximum severity demand prompt action, but no KEV listing or public PoC elevates this to Act yet. If running self-hosted ServiceNow, apply the patch this week and verify hosted instances received the automated update.
- SOC/IR — Skip
- Leader — Plan: Three CVSS 10.0 flaws in a widely deployed ITSM platform warrant confirming whether your organization runs self-hosted ServiceNow and ensuring the patch was applied; hosted tenants should receive confirmation from ServiceNow that their instances were updated.
- Engineer — Plan: Maximum-severity unauthenticated RCE in GiveWP is serious, but no KEV listing, public PoC, or active exploitation is confirmed in the signals; update GiveWP to the patched version this sprint and audit any WordPress instances running it.
- SOC/IR — Skip
- Leader — Skip
- Engineer — Act: A public PoC exists for a root-level RCE in cPanel and WHM affecting all supported versions — update cPanel/WHM to the patched release immediately and verify no unauthorized access occurred on any exposed panels.
- SOC/IR — Plan: With a public PoC now available, write or enable detections for anomalous root-process spawning from cPanel/WHM processes and unusual web requests to the cPanel/WHM management interfaces before exploitation campaigns begin.
- Leader — Skip
- Signals: CVE-2026-65643 — CISA KEV: not listed, EPSS n/a, public PoC on GitHub
- Engineer — Act: Public PoC on GitHub for unauthenticated RCE in a ubiquitous web framework clears the bar for immediate action — upgrade Next.js to the patched release now, prioritizing any Windows-hosted deployments and any apps accepting untrusted image uploads.
- SOC/IR — Plan: With a public PoC and no KEV listing yet, build detections for suspicious AVIF uploads and Windows-style path traversal sequences (e.g. ..) in HTTP requests targeting Next.js routes before active exploitation begins.
- Leader — Plan: Two critical unauthenticated RCE flaws with public PoC in a widely-deployed framework warrant confirming this quarter that your engineering teams have inventoried Next.js usage and applied patches — flag for a status check if any customer-facing apps are affected.
- Signals: CVE-2026-75604 — CISA KEV: not listed, EPSS n/a, public PoC on GitHub
- Engineer — Plan: Avada is among the most widely deployed commercial WordPress themes, and unauthenticated PHP code execution is a maximum-severity primitive — update Avada to the patched release this sprint. No KEV listing or public PoC is confirmed yet, so this is urgent but not emergency-weekend work.
- SOC/IR — Skip
- Leader — Skip
- Engineer — Act: CISA KEV listing with active exploitation across NetScaler ADC/Gateway, Linux, and SQL Server — all plausible in enterprise environments; patch affected NetScaler and SQL Server instances immediately and verify Linux kernel versions against the KEV entries.
- SOC/IR — Act: NetScaler edge devices are a prime assume-breach target when exploitation precedes patching; hunt for post-exploitation activity on NetScaler appliances and any lateral movement from SQL Server hosts since these vulnerabilities entered active exploitation.
- Leader — Plan: Six KEV additions spanning widely-deployed infrastructure signal a broad active-exploitation wave; confirm your engineering teams are tracking patch timelines for NetScaler, Linux, and SQL Server against CISA’s binding operational directive deadlines.
- Signals: CVE-2019-1068 — CISA KEV: listed, EPSS 0.53, public PoC on GitHub
- Engineer — Act: Citrix NetScaler is a common edge appliance; active exploitation of an RCE with a CISA KEV order makes this immediate. Identify all NetScaler instances in your environment and apply the vendor patch now — Saturday deadline applies to federal agencies but exploitation is not sector-limited.
- SOC/IR — Act: Active exploitation of an edge RCE means attackers may already be inside before patching occurs; initiate an assume-breach sweep on NetScaler appliances, reviewing management-plane logs and lateral movement indicators since the vulnerability became public.
- Leader — Act: CISA’s mandatory patch order with a Saturday deadline signals systemic exploitation — confirm whether your organization runs Citrix NetScaler, verify remediation is in progress, and brief leadership if you operate federal systems or customer-facing NetScaler infrastructure.
- Engineer — Act: Over 270 confirmed compromises signals mass exploitation of this Zimbra Collaboration Suite RCE flaw — immediately determine if you run ZCS and apply the available patch; treat any internet-exposed Zimbra instance as potentially compromised pending verification.
- SOC/IR — Act: Widespread active exploitation means assume-breach posture for any Zimbra environment: audit Zimbra server logs and web directories for web shells or anomalous POST requests since the campaign began, even without specific published IOCs.
- Leader — Act: Confirmed mass compromise of enterprise email infrastructure warrants same-week action — verify whether your organization or key SaaS/hosting vendors run on-premises Zimbra and direct your security team to assess exposure immediately before this surfaces as a board-level question.
- Engineer — Act: CISA KEV-listed RCE (CVSS 9.8) with public PoC requires only repository write access to execute arbitrary shell commands — patch Gitea immediately and audit server process trees and outbound connections for miner-related IOCs.
- SOC/IR — Act: Active exploitation with miner-like payload delivery gives a clear detection angle — hunt for anomalous child processes spawned by the Gitea process, unusual outbound connections from CI/Git infrastructure, and unexpected CPU spikes on self-hosted Git servers since the CVE was published.
- Leader — Plan: If your organization runs self-hosted Gitea, confirm with engineering teams this week whether the patch has been applied; a compromised source code host is a supply-chain risk that may warrant customer notification depending on your disclosure obligations.
- Signals: CVE-2026-60004 — CISA KEV: listed, EPSS n/a, public PoC on GitHub
- Engineer — Act: Active exploitation confirmed by CERT Polska plus a public PoC on GitHub makes this urgent regardless of the low EPSS score. Patch Zimbra Collaboration (ZCS) to the fixed release immediately; prioritize any internet-facing Zimbra instances.
- SOC/IR — Act: Active in-the-wild exploitation of an email server RCE creates an assume-breach exposure window. Hunt Zimbra SNMP and application logs for anomalous command execution patterns since the PoC publication date, and pull any IOCs published by CERT Polska for sweeping.
- Leader — Skip
- Signals: CVE-2026-73570 — CISA KEV: not listed, EPSS 0.01, public PoC on GitHub
- Engineer — Learn: Gogs 10.0 RCE and n8n workflow-to-RCE are worth tracking if you run either tool, but no enrichment signals (no KEV, PoC, or EPSS) are present and the summary is too thin to drive patching prioritization; read the underlying advisories directly for specifics.
- SOC/IR — Learn: The roundup references signed-driver abuse against defenses (BYOVD pattern) and legitimate-app blending techniques, but supplies no IOCs, ATT&CK mappings, or detection guidance — useful for threat-landscape awareness only.
- Leader — Skip
- Engineer — Act: Microsoft has applied a server-side fix requiring no customer patch, but active exploitation occurred before remediation — audit Entra ID sign-in and audit logs for anomalous authentication, new service principals, or privilege escalation events from the period prior to the fix, and verify no credential or token abuse persists.
- SOC/IR — Act: Confirmed in-the-wild exploitation of an identity provider with a public PoC warrants an immediate hunt — query Entra ID audit and sign-in logs for suspicious app registrations, delegated permission grants, and admin role assignments occurring in the exploitation window, and tune detections for anomalous OAuth consent flows.
- Leader — Act: A CVSS 10.0 actively exploited RCE on the organization’s cloud identity plane is a board-level event analogous to Log4Shell in blast radius — brief leadership this week on the pre-patch exposure window and confirm with the security team that no evidence of compromise was found in Entra ID logs before Microsoft’s server-side fix landed.
- Signals: CVE-2026-69836 — CISA KEV: not listed, EPSS n/a, public PoC on GitHub
- Engineer — Plan: Any Node.js service using isolated-vm to run untrusted code (plugins, user-submitted scripts, multi-tenant eval) is exposed to host RCE; no public PoC or KEV listing yet, but the impact ceiling is high — audit your dependency tree and upgrade isolated-vm to a version above 7.0.0 this sprint.
- SOC/IR — Skip
- Leader — Skip
- Engineer — Plan: Update Elementor Pro to the patched version immediately; no active exploitation or PoC confirmed in signals, but RCE via file upload on a widely-deployed WordPress plugin warrants prompt patching within your normal critical window.
- SOC/IR — Skip
- Leader — Skip
- Engineer — Act: Zimbra Collaboration Suite is common enterprise mail infrastructure; active exploitation confirmed by a national CERT means patch immediately — update ZCS to the vendor’s latest patched release and audit web-accessible Zimbra instances for signs of prior compromise.
- SOC/IR — Act: Active exploitation of a Zimbra RCE means assume-breach posture for orgs running it — sweep Zimbra servers for web shells, anomalous child processes from the mail service, and unusual outbound connections; pull CERT Polska’s advisory for any published IOCs to run against SIEM.
- Leader — Act: Zimbra hosts enterprise email, so a critical RCE under active attack is a data-exposure risk — confirm whether Zimbra is in your environment, and if so direct teams to treat patching as priority-one this week and assess whether any compromise warrants customer or regulatory notification.
- Engineer — Act: CISA confirmed active exploitation of this critical Windows IKE RCE — patch all Windows systems running IPsec/VPN services immediately; treat as emergency patch given KEV-level signal from CISA warning.
- SOC/IR — Act: Active exploitation confirmed by CISA — hunt for anomalous IKE/IPsec traffic and suspicious activity originating from VPN-adjacent or edge Windows systems since the campaign began; assume-breach sweep warranted for internet-exposed IKE endpoints.
- Leader — Plan: Confirm with infrastructure teams that Windows IPsec/VPN systems are prioritized in the current patch cycle; active exploitation elevates this above routine cadence but it falls short of board-level disclosure unless a breach is discovered.
- Engineer — Act: A public PoC exists for this unauthenticated file upload RCE (CVSS 9.8) affecting 600,000+ WordPress installs; update Forminator Forms to the patched version immediately and verify no malicious PHP files were uploaded to wp-content directories.
- SOC/IR — Plan: With a public PoC available, exploitation attempts are likely imminent; build or tune WAF/SIEM rules to detect unauthenticated multipart file upload requests to Forminator endpoints and alert on unexpected PHP file creation under wp-content.
- Leader — Skip
- Signals: CVE-2026-15748 — CISA KEV: not listed, EPSS n/a, public PoC on GitHub
- Engineer — Act: CISA KEV listing confirms active exploitation of a critical RCE in Ray, a widely-used Python distributed computing framework for AI/ML workloads; patch Ray immediately and, if patching is delayed, restrict external access to Ray dashboard and cluster endpoints.
- SOC/IR — Act: Active exploitation confirmed via KEV; hunt for unauthorized code execution originating from Ray cluster nodes and sweep for internet-exposed Ray dashboards in your environment, prioritizing ML infrastructure that may not be covered by standard EDR.
- Leader — Plan: If your organization runs AI/ML workloads, ask engineering to confirm whether Ray is deployed and to report patch status; KEV listing makes this likely to surface in auditor or customer questionnaires about your ML infrastructure security posture.
- Engineer — Act: A max-severity RCE in SAP Commerce Cloud is under active attack just days after patching — apply the SAP patch immediately and audit Commerce Cloud logs for signs of pre-patch compromise.
- SOC/IR — Act: Active exploitation is confirmed by threat intelligence, so sweep SAP Commerce Cloud application and access logs for anomalous activity indicative of RCE or post-exploitation behavior since the patch release date.
- Leader — Act: Confirm whether your organization runs SAP Commerce Cloud and verify the emergency patch has been applied; if patching is delayed, request an incident status from the team given active exploitation is already underway.
- Engineer — Act: vCenter is core infrastructure for most enterprise estates and active exploitation is deploying persistent reverse SSH tunnels — patch CVE-2026-59310 immediately and audit vCenter hosts for unexpected outbound SSH connections or new SSH tunnel processes.
- SOC/IR — Act: The campaign’s TTP is specific and huntable: sweep for outbound SSH sessions originating from vCenter server hosts, flag any reverse tunnel tools (socat, plink, autossh) running on hypervisor management nodes since the vulnerability’s disclosure date.
- Leader — Plan: Active exploitation of a critical vCenter RCE means full-estate exposure for organizations running VMware — confirm with engineering this sprint that patching is complete and request a status update before this surfaces in a customer security questionnaire.
- Signals: CVE-2026-59310 — CISA KEV: not listed, EPSS 0.01, public PoC on GitHub
- Engineer — Act: Public PoC on GitHub for a CVSS 10.0 unauthenticated RCE in SAP Commerce Cloud Data Hub Adapter makes exploitation practical now; apply SAP’s patch for CVE-2026-58231 immediately and verify no unauthorized access to the Data Hub Adapter endpoint prior to patching.
- SOC/IR — Act: With a public PoC available for unauthenticated RCE, sweep web access logs for anomalous requests to SAP Commerce Cloud Data Hub Adapter endpoints and hunt for post-exploitation activity (unusual process spawns, lateral movement) on Commerce Cloud hosts since the disclosure date.
- Leader — Act: Confirm whether your organization runs SAP Commerce Cloud and, if so, verify the engineering team has emergency-patched CVE-2026-58231; a public PoC for a max-severity unauthenticated RCE on an e-commerce platform warrants a same-week status check and potential customer notification if the platform handles transaction data.
- Signals: CVE-2026-58231 — CISA KEV: not listed, EPSS n/a, public PoC on GitHub
- Engineer — Act: Public PoC on GitHub for a CVSS 9.1 unauthenticated RCE across SharePoint Server Subscription Edition, 2019, and 2016 means exploitation risk is immediate even without KEV listing; apply Microsoft’s patch for CVE-2026-55040 across all affected on-prem SharePoint instances this week.
- SOC/IR — Plan: No confirmed in-the-wild exploitation yet (EPSS 0.02, no KEV), but a public PoC for unauthenticated RCE warrants building SharePoint-specific detections now — hunt for anomalous unauthenticated requests to SharePoint REST/SOAP endpoints and tune alerts on privilege escalation patterns in SharePoint audit logs before active campaigns emerge.
- Leader — Plan: A CVSS 9.1 unauthenticated RCE with public PoC against widely deployed SharePoint Server warrants confirming on-prem SharePoint scope with your team and ensuring patch prioritization this sprint — escalate to Act if exploitation is observed in the wild.
- Signals: CVE-2026-55040 — CISA KEV: not listed, EPSS 0.02, public PoC on GitHub
- Engineer — Act: vCenter is core infrastructure and a CVSS 9.8 directory-traversal-to-RCE with reported active exploitation warrants immediate patching despite weak enrichment signals (not KEV, EPSS 0.01). Apply Broadcom’s patch for CVE-2026-59310 and audit vCenter network access controls to reduce exposure while rolling out.
- SOC/IR — Plan: Active exploitation is reported by a single vendor (QUIRSO) but no IOCs or ATT&CK-mapped TTPs are published yet, leaving no sweep surface today. Build or tune detections for post-exploitation behavior originating from vCenter hosts (unusual process spawning, outbound connections from vCenter management IPs) in anticipation of broader disclosure.
- Leader — Plan: A 9.8-severity RCE in widely deployed VMware vCenter with reported exploitation is worth a prompt check-in with the engineering team to confirm patch status, but the single-source report and absence of a KEV listing mean this does not yet require board escalation or a customer-facing statement.
- Signals: CVE-2026-59310 — CISA KEV: not listed, EPSS 0.01, no public PoC found
- Engineer — Act: Public PoC exists on GitHub for a flaw affecting every WordPress version; update WordPress core to the patched release immediately, as the chain to server-side PHP execution is demonstrated even though it requires an admin to visit an attacker page.
- SOC/IR — Plan: With a public PoC but EPSS of 0.01 and no KEV listing, active exploitation is not yet confirmed; build or tune a detection for anomalous reflected XSS patterns hitting the WordPress login endpoint and alert on unexpected admin-session activity following external link clicks.
- Leader — Skip
- Signals: CVE-2026-64638 — CISA KEV: not listed, EPSS 0.01, public PoC on GitHub
- Engineer — Plan: If your team runs Paperclip for AI agent orchestration, two unpatched RCE paths via malicious agent imports are real exposure; check for a patched release and restrict which agent sources are trusted in your control plane.
- SOC/IR — Learn: The malicious-agent-import-to-RCE attack pattern is an emerging TTP as AI orchestration tooling spreads in dev environments — no IOCs or active exploitation to hunt for now, but worth building familiarity with the attack surface.
- Leader — Skip
- Engineer — Act: Patch on-premise JetBrains TeamCity to the fixed version immediately — CISA KEV listing confirms active exploitation, a public PoC is on GitHub, and the unauthenticated deserialization flaw carries a 9.8 CVSS score. Also audit TeamCity for unauthorized admin accounts or altered build configurations.
- SOC/IR — Act: TeamCity servers are pre-authentication targets; assume-breach sweep is warranted — hunt for anomalous build jobs, new admin accounts, or outbound connections from CI/CD hosts since patch disclosure. Map exploitation behavior to ATT&CK T1190 (Exploit Public-Facing Application) and tune EDR/SIEM rules for post-exploitation on build agents.
- Leader — Act: On-premise TeamCity RCE under active exploitation carries supply-chain risk comparable to prior CI/CD incidents — confirm this quarter whether your organization runs on-premise TeamCity instances and verify patch status with engineering before end of week.
- Signals: CVE-2026-63077 — CISA KEV: listed, EPSS 0.01, public PoC on GitHub
- Engineer — Plan: If you run TP-Link Omada for network management, schedule patching of the ZTP component this sprint — 15 chainable vulns with RCE potential are high severity, though no KEV listing or public PoC currently raises the urgency to emergency status.
- SOC/IR — Skip
- Leader — Skip
- Engineer — Act: All three CVEs are CISA KEV-listed with confirmed active exploitation; CVE-2026-9198 in Langflow is a CVSS 9.8 unauthenticated RCE with a public PoC — patch Langflow, Apache Tomcat, and N-central to current vendor-recommended versions immediately, prioritizing any internet-exposed instances.
- SOC/IR — Act: Active exploitation of Langflow (unauthenticated RCE) and Tomcat creates immediate hunt obligations — sweep logs for exploitation attempts against these services since August 5, check for post-exploitation indicators (new processes, outbound connections) on hosts running any of the three products.
- Leader — Plan: Three simultaneous KEV additions including a critical AI-workflow tool (Langflow) warrant confirming your team’s KEV remediation SLA is on track and verifying whether N-central (an RMM platform) is in scope — RMM compromise can enable broad lateral movement across managed endpoints.
- Signals: CVE-2026-9198 — CISA KEV: listed, EPSS 0.02, public PoC on GitHub
- Engineer — Plan: Active Storage is a core Rails component widely used for file handling, so any Rails-backed app is likely exposed; no public PoC or KEV listing yet, but the critical severity and unauthenticated file-read-to-RCE path make this a patch-this-sprint priority — update Rails to the fixed version.
- SOC/IR — Skip
- Leader — Skip
- Engineer — Plan: If your pipelines load Hugging Face Diffusers models, audit which model repos are consumed and pin to reviewed/trusted sources; check whether you are on the patched Diffusers version once fixes land, as these flaws bypass the trust_remote_code safeguard.
- SOC/IR — Learn: No active exploitation or IOCs reported; understand that model-loading in ML pipelines can be a code-execution vector and begin thinking about detection coverage for anomalous process spawning from Python ML workloads.
- Leader — Learn: Illustrates that AI/ML supply chain risk is not theoretical — if your teams consume external model repositories, ask whether a policy governing approved model sources exists before a control is needed.
- Engineer — Act: Pre-auth RCE with a public exploit in vBulletin’s template renderer is actively exploitable right now — patch vBulletin to the vendor-released fixed version immediately if you run any internet-facing vBulletin instance.
- SOC/IR — Act: A public exploit for pre-auth PHP code execution means exploitation is likely in progress — sweep vBulletin access logs for anomalous template-rendering requests and hunt for web shells or unexpected PHP processes on any vBulletin host since the disclosure date.
- Leader — Skip
- Engineer — Act: Any authenticated repo contributor can plant a malicious Git hook and execute arbitrary commands as the Gitea service account — a very low exploitation bar with a public PoC already on GitHub. Upgrade all Gitea instances from 1.17–1.27.0 to 1.27.1 immediately.
- SOC/IR — Plan: No KEV listing or confirmed in-the-wild exploitation yet, but the public PoC makes opportunistic attacks likely soon. Build a detection for unexpected process spawning from the Gitea service account and audit recent git hook creation events on any self-hosted Gitea instances.
- Leader — Plan: Self-hosted Gitea instances are common in engineering orgs and often sit inside CI/CD pipelines where a service-account RCE could enable supply-chain compromise. Confirm whether internal Gitea deployments exist and verify they are on the patching roadmap before the public PoC drives active exploitation.
- Signals: CVE-2026-60004 — CISA KEV: not listed, EPSS n/a, public PoC on GitHub
- Engineer — Act: A public PoC exists for this CVSS 9.8 unauthenticated stack overflow in odhcpd, which is enabled by default. Upgrade all OpenWrt devices to 24.10.8 immediately, or disable DHCPv6/odhcpd on devices that don’t need it.
- SOC/IR — Plan: With a public PoC now available, exploitation of internet- or LAN-exposed OpenWrt edge devices is imminent. Build detections for anomalous DHCPv6 traffic volumes and unexpected child processes from odhcpd, and queue a sweep of managed OpenWrt-based appliances for signs of prior compromise.
- Leader — Skip
- Signals: CVE-2026-53921 — CISA KEV: not listed, EPSS n/a, public PoC on GitHub
- Engineer — Act: A public PoC on GitHub combined with a CVSS 9.8 unauthenticated RCE makes exploitation imminent — patch all on-premises TeamCity instances to 2025.11.7 or 2026.1.3 immediately; Cloud instances are already remediated.
- SOC/IR — Act: With a public PoC now available, begin hunting for unauthenticated requests to TeamCity build/run endpoints and review build agent logs for unexpected OS command execution patterns since the PoC publication date.
- Leader — Plan: Confirm whether your organization runs TeamCity On-Premises and verify the engineering team has prioritized emergency patching this week — a compromise of CI/CD pipelines carries supply-chain risk that could generate customer or board questions if exploitation is later confirmed.
- Signals: CVE-2026-63077 — CISA KEV: not listed, EPSS n/a, public PoC on GitHub
- Engineer — Act: A public exploit now makes unauthenticated code execution against vBulletin 6.2.1 and earlier trivially accessible to any attacker. Patch to the fixed release immediately; if no patch is available for your branch, take the instance offline or block external access until patched.
- SOC/IR — Plan: With a public exploit in the wild, opportunistic scanning and exploitation attempts are likely imminent. Build or tune web application attack detections for anomalous unauthenticated POST requests to vBulletin PHP endpoints and PHP child-process spawning indicative of eval() abuse.
- Leader — Skip
- Engineer — Act: FastJson is widely used in Java applications; if your codebase or dependencies include it, audit immediately and apply any available patch or mitigations — if no patch exists, consider disabling unsafe deserialization features or replacing the library.
- SOC/IR — Act: Active exploitation is underway against US firms; hunt for anomalous outbound connections or process spawning from Java application servers since this week, and tune detections for RCE post-exploitation behavior (e.g., web shells, unexpected child processes).
- Leader — Plan: Active zero-day targeting US organizations warrants asking your engineering team this week whether FastJson is in use and what the mitigation timeline is — this may generate customer questions if it widens.
- Engineer — Act: CVE-2026-16812 (CVSS 10.0) is CISA KEV-listed with a public PoC and confirmed active exploitation — patch on-premises VeloCloud Orchestrator to the vendor-fixed version immediately and treat any unpatched instance as potentially compromised.
- SOC/IR — Act: Active exploitation of this RCE means on-prem VCO hosts should be treated as assume-breach candidates; hunt for anomalous process execution or outbound connections originating from VeloCloud Orchestrator nodes and sweep for IOCs since the date public PoC became available.
- Leader — Act: Confirm whether the organization runs on-premises VeloCloud Orchestrator and if so escalate to an emergency patch cycle this week; a CVSS 10.0 SD-WAN orchestration flaw on the CISA KEV list under active exploitation is a board-question-level event for enterprises relying on it for network management.
- Signals: CVE-2026-16812 — CISA KEV: listed, EPSS n/a, public PoC on GitHub
- Engineer — Act: Public PoC is on GitHub and this is a bypass of a prior February patch, indicating active research interest; if you self-host n8n, upgrade to 2.31.5 or 2.32.1 immediately to close authenticated RCE exposure.
- SOC/IR — Plan: No KEV listing and EPSS is low (0.09), but the public PoC raises the practical risk; build a detection for unexpected child processes or OS command execution spawned by the n8n service account to cover in-estate exposure.
- Leader — Skip
- Signals: CVE-2026-27577 — CISA KEV: not listed, EPSS 0.09, public PoC on GitHub
- Engineer — Act: Fastjson 1.x is embedded in many Spring Boot applications; unauthenticated RCE with a public PoC and confirmed active attacks means immediate action is required — audit all services for Fastjson 1.x dependencies, apply WAF rules to block the malicious JSON chain, and isolate or rate-limit exposed endpoints until a patch is available.
- SOC/IR — Act: Multi-source confirmation of active exploitation gives a detection mandate now — hunt for anomalous JSON deserialization patterns in HTTP request logs to Spring Boot services and monitor for unexpected outbound connections or process spawning from Java app servers since the earliest confirmed attack date.
- Leader — Plan: A critical, unpatched RCE in a widely-used Java library under active attack warrants commissioning an urgent Fastjson 1.x exposure inventory across development teams this week; if use is confirmed, allocate engineering time for compensating controls and track remediation until a vendor patch is released.
- Signals: CVE-2026-16723 — CISA KEV: not listed, EPSS 0.00, public PoC on GitHub
- Engineer — Act: A working public exploit now exists for this six-week-old GitLab flaw; any authenticated user with push access on an unpatched self-managed instance can achieve RCE. Upgrade to the patched version released June 10 immediately and verify no self-managed GitLab instances remain on 18.11.3.
- SOC/IR — Act: PoC publication on July 24 makes exploitation imminent; hunt for anomalous Jupyter notebook pushes followed by commit-diff access on self-managed GitLab instances, and look for unexpected git-process child execution in EDR telemetry as of that date.
- Leader — Plan: A public exploit for GitLab RCE elevates CI/CD pipeline compromise risk this week; confirm with engineering that all self-managed GitLab instances are on the June 10 patched release before this becomes an active incident requiring notification.
- Engineer — Act: Active Cl0p data-extortion campaign exploiting internet-exposed PTC Windchill and FlexPLM via chained pre-auth flaws; immediately audit for internet-exposed instances, apply available patches, and if patching is delayed, restrict Windchill login servlet and FlexPLM WSDL endpoint from external access.
- SOC/IR — Act: Active Cl0p campaign with a concrete exploit chain (pre-auth FlexPLM WSDL disclosure chained into Windchill login servlet); hunt for anomalous pre-authenticated requests to these endpoints since campaign start and sweep for Cl0p-associated IOCs in PLM server logs and EDR telemetry.
- Leader — Plan: Cl0p affiliates are running a targeted data-extortion campaign against manufacturing and engineering organizations using PTC Windchill/FlexPLM; if your org or key suppliers use these platforms, assess exposure now and be prepared to brief leadership on potential data theft risk before it surfaces in the press.
- Engineer — Learn: The vulnerability sat in Microsoft’s own infrastructure and is already patched, but the technique — crafted SVG triggering RCE in a server-side image processing pipeline — is directly generalizable. Audit any service that accepts user-submitted SVGs and processes them server-side (ImageMagick, librsvg, Inkscape CLI, etc.) for equivalent exposure.
- SOC/IR — Skip
- Leader — Learn: A research disclosure showing critical RCE in a major cloud vendor’s production infrastructure; Microsoft has issued CVEs and presumably patched. No action required but it’s a useful data point on shared-responsibility boundaries when cloud vendors process user-submitted content.
- Signals: CVE-2026-32194 — CISA KEV: not listed, EPSS 0.01, public PoC on GitHub
- Engineer — Act: Public authenticated-RCE PoCs exist for Redis 6.2.22, 7.4.9, 8.6.4, and 8.8.0; upgrade to Redis 6.2.23, 7.2.15, or 7.4.10 immediately, and audit whether RESTORE, EVAL, or XGROUP are accessible to untrusted clients in your environment.
- SOC/IR — Plan: No confirmed in-the-wild exploitation yet, but public PoCs accelerate that timeline; build detections for anomalous Redis command sequences involving RESTORE combined with EVAL or XGROUP, and baseline normal Redis command usage now so deviations surface quickly.
- Leader — Plan: Redis is pervasive in enterprise stacks; confirm all internal deployments and any SaaS vendors running Redis are targeting the patched versions (6.2.23/7.2.15/7.4.10), and track remediation completion — the authenticated-only attack surface limits immediate board escalation but warrants this-quarter tracking.
- Engineer — Act: Active exploitation confirmed with a public GitHub PoC; patch SharePoint immediately AND regenerate machine keys — patching alone does not evict attackers who already exfiltrated them, so key rotation is the critical second step.
- SOC/IR — Act: Stolen machine keys enable persistent, post-patch impersonation attacks — hunt SharePoint IIS logs for exploitation artifacts since the vulnerability became public, and write detections for anomalous ViewState or token-forging activity tied to mismatched machine keys.
- Leader — Plan: Confirm SharePoint is in scope, then ensure your engineering team understands that patching alone is insufficient — key rotation and a post-exploitation sweep are required; flag this as a two-step remediation so it isn’t closed prematurely in the ticket queue.
- Signals: CVE-2026-50522 — CISA KEV: not listed, EPSS 0.20, public PoC on GitHub, reported by 2 collected sources
- Engineer — Act: CVSS 9.8 deserialization RCE with public PoC and confirmed active exploitation — patch SharePoint Server to the July 2026 Patch Tuesday build immediately; do not wait for CISA KEV confirmation given exploitation is already underway.
- SOC/IR — Act: Active exploitation predating your patch window means assume-breach posture is warranted — hunt for anomalous deserialization or code execution activity on SharePoint servers back to at least the PoC publication date, and review watchTowr’s reporting for any available IOCs or behavioral signatures.
- Leader — Act: A CVSS 9.8 unauthenticated RCE in widely-deployed enterprise SharePoint under active exploitation requires a same-week exposure check — confirm whether the org runs on-premises SharePoint Server and verify the engineering team has prioritized the July Patch Tuesday update.
- Signals: CVE-2026-50522 — CISA KEV: not listed, EPSS 0.20, public PoC on GitHub, reported by 2 collected sources
- Engineer — Act: CISA KEV listing confirms active exploitation of this RCE in Langflow, a framework increasingly adopted by AI development teams. Audit all environments for Langflow deployments and patch to the fixed version immediately — days-level urgency, not weeks.
- SOC/IR — Act: Active exploitation of a Langflow RCE means any instance in your estate should be treated as potentially compromised; initiate an assume-breach sweep of Langflow hosts for post-exploitation artifacts (new processes, outbound connections, credential access) and hunt for inbound exploitation attempts in web/proxy logs since the vulnerability became public.
- Leader — Plan: Langflow is niche enough that board escalation is unlikely unless your AI engineering teams are actively using it — confirm with engineering whether Langflow is deployed anywhere in the environment and ensure it lands in the emergency patch queue this week.
- Engineer — Act: Both CVEs have public PoCs and exploitation is already underway with mass scanning — patch all WordPress instances to the fixed versions immediately and audit exposed sites for webshell artifacts, especially any unexpected PHP files or modified themes.
- SOC/IR — Act: Active exploitation confirmed since early Saturday UTC; hunt for webshell uploads and anomalous POST requests targeting WordPress endpoints across your estate, and sweep for post-compromise persistence on any internet-facing WordPress hosts.
- Leader — Plan: Active exploitation with mass scanning is in progress but hasn’t reached Log4Shell-scale board attention yet; confirm whether WordPress appears in your web portfolio and ensure it’s on your engineering team’s immediate patching queue this week.
- Signals: CVE-2026-60137 — CISA KEV: not listed, EPSS 0.04, public PoC on GitHub · CVE-2026-63030 — CISA KEV: not listed, EPSS 0.09, public PoC on GitHub, reported by 2 collected sources
- Engineer — Act: Unauthenticated RCE in WordPress Core (not a plugin) is being actively exploited with a public PoC on GitHub — patch all WordPress Core installations to the latest fixed release immediately and audit web server and DB logs for SQLi patterns.
- SOC/IR — Act: Active exploitation is confirmed; sweep any WordPress-hosting infrastructure for webshells, unexpected file writes, and anomalous database query patterns tied to wp2shell activity since last week’s disclosure.
- Leader — Plan: Confirm whether WordPress is present in the company’s web estate and verify engineering has prioritized patching this week; not yet at board-briefing scale but unauthenticated RCE with active exploitation warrants prompt follow-up with the engineering team.
- Signals: CVE-2026-63030 — CISA KEV: not listed, EPSS 0.09, public PoC on GitHub, reported by 2 collected sources
- Engineer — Act: Public PoC exists and in-the-wild exploitation is reported for this unauthenticated sandbox-escape RCE (CVSS 9.5) in the ServiceNow AI Platform. Confirm your ServiceNow instance has the available patch applied via the admin console, and audit platform logs for anomalous code execution since the disclosure date.
- SOC/IR — Act: Active exploitation of unauthenticated RCE on a widely deployed enterprise ITSM platform creates immediate detection work. Hunt for anomalous outbound connections, unusual process spawning, or lateral movement originating from ServiceNow infrastructure since the vulnerability was disclosed, and tune EDR/SIEM for post-exploitation behavior on hosts that ServiceNow agents touch.
- Leader — Act: A critical unauthenticated RCE in ServiceNow with confirmed in-the-wild exploitation could expose ITSM data and integrated systems. This week, confirm with your ServiceNow admin that the patch is applied to your instance and assess whether any sensitive data (HR, IT credentials, integrations) in the platform warrants a precautionary leadership or customer notification.
- Signals: CVE-2026-6875 — CISA KEV: not listed, EPSS 0.01, public PoC on GitHub, reported by 2 collected sources
- Engineer — Act: A public Docker lab with a working one-payload exploit now exists for fastjson 1.2.66–1.2.83; critically, autoType=OFF and parseObject binding are not effective mitigations. Audit your dependency tree for fastjson in this range and upgrade to 1.2.84+ (or fastjson2), treating autoType-disabled deployments as unprotected.
- SOC/IR — Plan: The public exploit lab lowers the bar for threat actors to weaponize this Spring Boot class-loading RCE chain. Build or tune detections for unexpected outbound SSRF from Java application hosts followed by remote class loading activity; the SSRF→defineClass pattern is a distinct behavioral signal to hunt for in proxy and EDR telemetry.
- Leader — Skip
- Engineer — Plan: ServiceNow is widely deployed in enterprise environments and a critical RCE warrants patch prioritization, but enrichment signals are very weak (EPSS 0.01, no CISA KEV, no public PoC) and exploitation is claimed by a single vendor source. If you run ServiceNow AI Platform, confirm your version and apply the available patch this sprint rather than treating it as a drop-everything emergency.
- SOC/IR — Learn: Exploitation is asserted by one threat-intel vendor (Defused) with no corroborating IOCs, ATT&CK mappings, or multi-source confirmation — there is no concrete detection surface to act on yet. Monitor for published IOCs or behavioral signatures before opening a hunt.
- Leader — Plan: ServiceNow is a core ITSM platform at many enterprises; confirm with engineering whether your organization runs the affected AI Platform version and verify patching is prioritized this sprint. The single-source exploitation claim without CISA KEV listing does not yet warrant a board-level communication, but exposure should be checked proactively.
- Signals: CVE-2026-6875 — CISA KEV: not listed, EPSS 0.01, no public PoC found
- Engineer — Act: NGINX is near-universal in cloud stacks and a public PoC already exists on GitHub, lowering the bar for exploitation despite low EPSS. Upgrade to nginx 1.30.4 (stable) or 1.31.3 (mainline), or NGINX Plus 37.0.3.1, before the PoC matures into a weaponized exploit.
- SOC/IR — Skip
- Leader — Skip
- Signals: CVE-2026-42533 — CISA KEV: not listed, EPSS 0.01, public PoC on GitHub
- Engineer — Act: Public exploits for critical WordPress Core RCE make this urgent regardless of absent KEV/EPSS data — update WordPress Core to the latest patched release immediately and verify any managed hosting environments are also updated.
- SOC/IR — Plan: No IOCs or TTPs are provided to hunt on now, but given public exploits exist for a widely-deployed web platform, build or tune detections for WordPress exploit traffic (e.g., anomalous POST patterns, webshell indicators in web access logs) before active campaigns arrive.
- Leader — Plan: This is an engineering-track issue, not board-level — confirm your team has inventoried WordPress instances across the estate and that patching is tracked to completion this week.
- Engineer — Plan: Update 7-Zip to v26.02 on any systems or pipelines that process untrusted archives; no KEV listing or public PoC confirmed yet, but RCE via user-opened files is a practical threat in build environments or developer workstations.
- SOC/IR — Skip
- Leader — Skip
- Engineer — Act: Public PoC is available for an unauthenticated RCE in WordPress core affecting 6.9 and 7.0 with no plugins required — patch every WordPress instance to the fixed version immediately and audit web server file systems for newly dropped shells or unexpected PHP files.
- SOC/IR — Act: A public PoC for unauthenticated RCE in WordPress core means active exploitation is likely underway; sweep web access logs for anomalous POST patterns against wp-admin and wp-includes endpoints, and hunt for new or modified PHP files and unexpected child processes spawned by the web server process since the disclosure date.
- Leader — Act: Unauthenticated RCE in WordPress core with a working public exploit is a systemic exposure for any org running WordPress-powered properties; confirm inventory of WordPress versions across customer-facing and internal sites, verify engineering has prioritized emergency patching, and assess whether key SaaS or media vendors in your supply chain are exposed.
- Engineer — Act: SharePoint Server CVE-2026-58644 (CVSS 9.8) is KEV-listed with active exploitation and a public GitHub PoC — patch immediately; federal deadline is July 19, 2026, so treat this as emergency priority regardless of your organization type.
- SOC/IR — Act: With active exploitation confirmed and a public PoC live, treat any on-prem SharePoint Server as potentially compromised — sweep SharePoint ULS/IIS logs for deserialization anomalies and unusual POST requests to SharePoint endpoints since the vulnerability was disclosed.
- Leader — Act: A CVSS 9.8 SharePoint RCE is actively exploited and KEV-listed with a two-day federal remediation deadline — confirm this week whether your environment runs SharePoint Server on-prem and verify the engineering team has emergency patching underway before the July 19 deadline.
- Signals: CVE-2026-58644 — CISA KEV: listed, EPSS 0.01, public PoC on GitHub
- Engineer — Act: CISA warning signals KEV-level active exploitation — update or disable the iCagenda and Balbooa Forms Joomla extensions immediately, and audit web roots for unexpectedly uploaded files that may indicate prior compromise.
- SOC/IR — Act: Active exploitation via arbitrary file upload means webshells may already be in place — hunt Joomla web directories for recently uploaded executables and review web server logs for POST requests targeting these extension upload endpoints.
- Leader — Plan: Confirm whether any company-owned or vendor-hosted web properties run Joomla with these extensions and verify engineering teams have patch SLAs in motion; this does not yet rise to board-briefing level.
- Engineer — Plan: A public PoC exists for this GitHub RCE, raising urgency even though EPSS is 0.24 and KEV is not listed. If running GitHub Enterprise Server, apply available patches now and review CI/CD pipeline logs for anomalous workflow executions.
- SOC/IR — Plan: Public PoC availability makes pre-emptive detection work worthwhile before confirmed active exploitation. Build or tune rules around anomalous GitHub API calls, unexpected workflow triggers, and unusual code execution patterns in CI/CD infrastructure.
- Leader — Plan: GitHub is core infrastructure for most engineering orgs; confirm whether your deployment is GitHub.com or self-hosted Enterprise Server, and request GitHub’s remediation status — a public PoC with no KEV listing still warrants a near-term vendor risk check.
- Signals: CVE-2026-3854 — CISA KEV: not listed, EPSS 0.24, public PoC on GitHub
- Engineer — Plan: GitHub Copilot is broadly deployed on developer workstations; a public PoC exists for this RCE-via-prompt-injection path, but EPSS is 0.03 and it is not KEV-listed. Check for an available Copilot update and audit whether your pipelines or editors process untrusted file content through Copilot without sandboxing.
- SOC/IR — Learn: Prompt injection as an RCE delivery mechanism in AI coding assistants is a novel developer-endpoint attack class worth adding to your threat model, but the summary provides no IOCs or ATT&CK-mappable TTPs to act on for detection tuning today.
- Leader — Plan: If your organization deploys GitHub Copilot to developers (very common), a demonstrated RCE path represents a developer-workstation supply-chain risk; confirm with engineering whether a patched version is available and assess exposure this quarter before exploitation pressure rises.
- Signals: CVE-2025-53773 — CISA KEV: not listed, EPSS 0.03, public PoC on GitHub
- Engineer — Act: Unauthenticated RCE on a widely-deployed internet-facing MTA with a public PoC on GitHub demands immediate action regardless of low EPSS — Exim has a history of mass exploitation. Patch Exim to the version addressing CVE-2026-45185; if no patch is yet available, restrict SMTP exposure at the network layer while tracking vendor advisory.
- SOC/IR — Plan: No active exploitation confirmed in enrichment signals, but a public PoC for pre-auth RCE on an internet-facing mail server shortens the window — build or stage Exim-specific detections (unusual child processes spawned from the Exim process, unexpected outbound connections from mail servers) before exploitation ramps up.
- Leader — Skip
- Signals: CVE-2026-45185 — CISA KEV: not listed, EPSS 0.01, public PoC on GitHub
- Engineer — Plan: If OpenClaw is deployed in your environment, verify you are running a patched version addressing all three CVEs (GHSA-hjr6-g723-hmfm and siblings); no public PoC or KEV listing present, so patch within normal cycle but prioritize given CVSS 8.8 and the RCE/privilege-escalation chain.
- SOC/IR — Learn: No published IOCs or active exploitation reported; the attack chain description (WhatsApp input → credential theft → privilege escalation → host RCE) is worth understanding to recognize behavioral indicators if OpenClaw is in scope, but no detection work is actionable today.
- Leader — Skip