Company
Cybersecurity company that makes vulnerability management and threat detection tools like InsightVM and InsightIDR, and researches security flaws.
Rapid7 built a working command-execution exploit for GitLab's CVSS 10.0 CI/CD regex overflow, CVE-2026-97229. Rapid7 says its route needs a malicious CI config pushed to a public project first, a prerequisite that conflicts with GitLab's PR:N rating.
Reality
Volexity says UTA0576 used a zero-day chain to get unauthenticated root on a fully patched Ivanti Connect Secure 22.8R2.4 VPN. Ivanti's Integrity Checker Tool does not flag it, so the check for lateral movement from the VPN device falls to forensics.
Perspective Coverage
10 publishersReality
Rapid7 reported more than 80 vulnerabilities in Zimbra Collaboration Suite and is releasing them in stages while fixes land on different schedules. The first five include a login-limit bypass and flaws that work from one ordinary compromised account.
Reality
Rapid7 disclosed CVE-2026-108065, a CVSS 9.8 SQL injection in Channel Software WebAlliance that lets an unauthenticated attacker read user PII and passwords. With admin database rights, the same request runs system commands on the server.
Reality
GitLab fixed CVE-2026-97229, a maximum-severity flaw that could let remote attackers run code, in releases 19.2.8, 19.3.4 and 19.4.2. GitLab.com already runs the fix and Dedicated customers need do nothing, so the work falls on self-managed operators.
Perspective Coverage
7 publishersReality
Cohesity data puts Qilin and The Gentlemen behind 32% of UK ransomware attacks. UK volume rose 60% on the quarter, and a watchlist of two names covers a third of it, leaving 68% with other actors.
Reality
ReliaQuest says Qilin and Settra ransomware groups are exploiting CVE-2026-0257, a PAN-OS GlobalProtect auth bypass disclosed May 13. Upgrading closes the entry point, but sessions opened before the upgrade may survive it.
Reality
F5 published CVE-2026-94127, a CVSS 9.8 heap overflow in BIG-IP APM that lets an attacker run code without credentials. Only virtual servers that pair an access policy with an OAuth Authorization Server profile are exposed, so the configuration check comes first.
Reality
Atlassian disclosed a 9.3-rated flaw, CVE-2026-21589, that lets attackers with no login read known files in 8 self-hosted Data Center products. It wants internet-facing instances taken offline or cut off from outside access until they are upgraded or behind a blocking rule.
Perspective Coverage
15 publishersReality
SonicWall patched four flaws in its SMA 1000 VPN gateways, led by CVE-2026-102255, a server-side request forgery open to remote attackers without credentials. The company reports no exploitation, though attackers used two similar SMA 1000 flaws as zero-days this year.
Perspective Coverage
4 publishersReality
Rapid7 tracked Linux implants on South Korean and Taiwanese edge appliances that erase their files ten seconds after launch but keep running. File scans miss them, so defenders have to hunt processes with no image on disk.
Perspective Coverage
4 publishersReality
SonicWall's CVSS 10.0 SSRF chains into command execution on remote access appliances, and JFrog Artifactory hands unauthenticated attackers admin under default configuration. Reverse shells and miners are already landing.
Perspective Coverage
4 publishersReality
Syed Anas Mohiuddin found the same SSRF flaw in MCP servers from five unrelated organisations, including Google, JPMorgan and two governments. Each server turned an address supplied through an agent into an outbound request without checking where it resolved, and any team running its own tool servers can check for the same gap.
Reality
Eurojust says a 16-year-old is the suspected main operator of KillSec, a group it blames for almost 1,000 data-theft extortion attacks since 2024. Both published accounts say its favoured way in was poorly secured access to victims' cloud storage.
Perspective Coverage
14 publishersReality
Cisco says attackers are exploiting CVE-2026-76504, a 9.8-rated flaw that gives unauthenticated requests admin access to the Catalyst SD-WAN Manager API. Every configuration is affected, leaving exposed on-premises Managers needing an out-of-cycle upgrade and a check for earlier intrusion.
Perspective Coverage
12 publishersReality
Investigators say KillSec, tied to about 1,000 suspected attacks, got in through software flaws, weak cloud storage and logins bought on the dark web. Those gaps sit in victims' own systems, beyond the reach of any server seizure.
Reality
Disclosures doubled year over year while actually-exploited vulnerabilities rose 8%. The arithmetic retires patch-everything SLAs and leaves exploitability triage as the defensible option.
Perspective Coverage
3 publishersReality
CVE-2026-19490 lets an unauthenticated attacker past NetScaler gateway and AAA virtual servers. Rapid7 has seen no exploitation yet and expects it shortly.
Perspective Coverage
5 publishersReality
A third party published CVE-2026-63520 before the planned date, and two public gadget chains now reach the same flaw by different routes. One signature will not cover both.
Reality
Rapid7 scored it 9.9 and Gogs shipped 0.14.3 on June 7, 2026. The reason it rates that high is configuration: open registration and unlimited repository creation let a stranger own the repo they attack from.
Reality
Security · August 28, 2026 · Confirmed10 publishers
Security · September 4, 2026 · Confirmed5 publishers
Security · September 7, 2026 · Confirmed7 publishers
Security · September 10, 2026 · Confirmed4 publishers
Security · September 23, 2026 · Confirmed6 publishers
Security · September 11, 2026 · One report1 publisher
Security · September 1, 2026 · One report1 publisher