BeyondTrust Remote Support flaw yields unauthenticated RCE
Rapid7’s Metasploit module writes a PHP file via a forged local router ID and runs it as the site user.
74
- Mentions · 7d7
- Mentions · 30d55
- All mentions93
- First seenAug 11, 2026
- Last mentioned8h ago
Timeline
93 articles · newest firstMetasploit adds authenticated Portainer Docker API root RCE
The new module targets an authenticated Docker API path; the commit names no CVE or affected versions.
28
Attacker probed Alpine GitLab via CVSS 10 flaw (CVE-2026-97229)
Alpine rebuilt gitlab.alpinelinux.org and reset passwords after probes; GitLab upgrades alone miss installs on stock Ruby.
82
Metasploit lands Flowise authentication-bypass module (CVE-2025-58434)
The auxiliary module targets CVE-2025-58434; the commit gives no affected versions, fix, or exploitation status.
46
Brotli decoder bug allows remote code execution (CVE-2026-111497)
ELLIO says sensors saw public exploit traffic; Node.js branches and other bundled decoders need patched builds.
86
Rapid7 says 71% of tracked exploitation starts within a week
Across 43 newly exploited high- and critical-severity flaws, disclosure-to-exploitation averaged three days.
54
Brotli flaw CVE-2026-111497 can crash systems or run code; no attacks seen
OpenAI Codex Security found the Google library bug, Node.js disclosed it on October 21, and dependents shipped emergency patches.
72
Metasploit adds Langflow, OpenCTI, Grafana and MongoDB modules
Six Langflow modules cover an auth bypass and remote code execution from 1.0.0 through 1.11.4.
66
Security Teams Urged to Focus on Remote Unauthenticated Exploits
Attackers exploit new high-severity vulnerabilities within three days of disclosure, favoring remote unauthenticated zero-click flaws.
50
PHP patches two critical unauthenticated RCE flaws
Both score CVSS 9.2; researchers built RCE exploits, and a public exploit is expected soon.
86
Rapid7: high-severity flaws exploited within three days in Q3
The Gentlemen and Qilin led claimed ransomware incidents, the US accounted for 60% of attacks, and AI was operational in 8%.
56
Ransomware groups exploit Palo Alto GlobalProtect flaw CVE-2026-0257
Unit 42 has investigated intrusions since early June; Qilin, Inc, and Settra are among the operators named.
84
Ransomware groups exploit Palo Alto PAN-OS bug CVE-2026-0257
Unit 42 says Qilin, Inc and others use the GlobalProtect flaw for unauthorized VPN access, then ransomware, across many industries.
84
Rapid7 says AI agent controls must sit outside the model
The post treats injected content as a command channel and says evidence must come from logs the agent cannot change.
32
Eptura Archibus flaws allow auth bypass, database reads, and RCE
Rapid7 says a pre-auth DWR call chain reaches database reads and file upload that runs as Local Service.
64
NetScaler intrusions chain CVE-2026-88771 and CVE-2026-88779
On an affected 14.1 appliance, attackers gained root, planted PHP web shells, and took configuration and key material.
84
Rapid7 Analysis: GitLab CI/CD Regex Integer Overflow (CVE-2026-97229)
Rapid7 shows a reliable RCE proof of concept for GitLab's CVSS 10 regex flaw CVE-2026-97229.
68
Addresses some false positives in several modules
Metasploit commit reduces false positives across several modules.
18
How Multi-Campus Universities can Build a more Connected Security Program
Rapid7 says multi-campus universities should share security visibility and response while keeping campus data separate.
22
From One Account to Every Mailbox: Breaking Zimbra's Identity Boundaries (Part 1)
Rapid7 details dozens of Zimbra flaws, including mailbox impersonation and cross-user access, with some fixes still missing.
71
Unauthenticated SQL Injection In Channel Software WebAlliance eCommerce
Rapid7 disclosed critical unauthenticated SQL injection CVE-2026-108065 in Channel Software WebAlliance eCommerce.
54
Clarify Grafana CVE-2024-9264 version handling
A Metasploit commit clarifies version handling for the Grafana CVE-2024-9264 module.
18
Microsoft Patches Record 1,413 Flaws, Including Exploited Windows Shell Bug
Microsoft patched a record 1,413 flaws, including exploited Windows Shell bug CVE-2026-96951 now on CISA’s KEV list.
84
Patch Tuesday - October 2026
Microsoft's October 2026 Patch Tuesday fixes dozens of Windows flaws, including AD FS spoofing and Desktop Window Manager privilege bugs.
58
Ivanti Connect Secure zero-day exploited in the wild (CVE-2026-104935)
Ivanti Connect Secure zero-day CVE-2026-104935 is exploited for unauthenticated remote command execution.
86
CVE-2026-97229: Critical Unauthenticated Remote Code Execution in GitLab
Rapid7 reproduced unauthenticated GitLab RCE CVE-2026-97229 (CVSS 10) and urges immediate patching.
84
Critical SonicWall SMA 1000 Flaw Targeted in 135 Exploitation Attempts After Patch
Attackers made 135 attempts to exploit critical pre-auth SSRF CVE-2026-102255 in SonicWall SMA 1000 days after patching.
84
Months-Old Palo Alto VPN Vulnerability Remains a Target for Ransomware Groups
Qilin and Settra are still exploiting Palo Alto CVE-2026-0257 to open unauthorized VPN sessions.
78
Metasploit Wrap Up: A Collection of What Can Only Be Called Eclectic Modules
Rapid7's Metasploit wrap-up adds 12 modules, including unauthenticated RCE for N-central, Langflow, LiteLLM, and dizqueTV.
52
What the BPFDoor backdoor tells us about attacks on the network edge
Rapid7 says BPFDoor stays silent on Linux edge devices until a magic packet arrives.
60
Update modules/exploits/multi/http/langflow_unauth_rce_cve_2026_0769.rb
Metasploit updated its Langflow unauthenticated RCE module for CVE-2026-0769.
48
Update modules/exploits/multi/http/langflow_auth_rce_cve_2026_7873.rb
Metasploit updated its authenticated RCE module for Langflow flaw CVE-2026-7873.
48
SonicWall Patches CVSS 10.0 Pre-Authentication SSRF Flaw in SMA1000 Appliances
SonicWall patched a CVSS 10.0 pre-auth SSRF in SMA1000 WorkPlace plus three authenticated flaws.
74
Update modules/auxiliary/scanner/postgres/postgres_login.rb
Rapid7 updated Metasploit's PostgreSQL login scanner module, with no vulnerability details disclosed.
14
CVE-2026-21589: Critical unauthenticated arbitrary file access in Atlassian products
Atlassian patched CVE-2026-21589, an unauthenticated file-read flaw in eight products, with public proof-of-concept code available.
82
The ASOS incident: When attackers use the channels customers trust
ASOS confirmed an unauthorized app push and possible exposure of customer names and contacts.
64
Linux Backdoors Impersonate Email Security Tools to Evade Detection in Korea and Taiwan
Linux backdoors impersonating SpamSniper and ShareTech target telecom appliances in South Korea and Taiwan.
76
Securing Agent-to-Agent Communication: The Next Identity Frontier
Rapid7 urges identity, least-privilege, and telemetry controls for autonomous AI agent-to-agent communication.
36
MCP for agent-to-agent comms may the the riskiest protocol you've never heard of
Researcher finds MCP trust gaps that let prompt injection pivot between agents at Google, Rapid7, and others.
74
New Stealthy Linux Backdoors Target Telecoms, Masquerade as Email Traffic
Rapid7 documents stealthy Linux backdoors—BPFDoor, Rekoobe, and new AVERAT implant—targeting telecom and network-edge appliances in South Korea and Taiwan.
68
Related CVEs
by mentions- CVE-2026-5504070%9.1Authentication Bypass in Microsoft SharePoint Server
- CVE-2026-9722918%10.0Unauthenticated RCE in GitLab CE/EE via CI/CD regex
- CVE-2026-154097%10.0Unauthenticated SSRF in SonicWall SMA1000 Appliances
- CVE-2026-025795%7.8Authentication Bypass in Palo Alto Networks PAN-OS GlobalProtect Portal and Gateway
- CVE-2026-635203%8.1Unauthenticated RCE in Microsoft SharePoint Server
- CVE-2026-8570697%10.0Unauthenticated Path Traversal Arbitrary File Read in GitLab CE/EE
- CVE-2026-8621815%10.0Pre-Auth Static Code Injection RCE in N-able N-central (Exploited in the Wild)
- CVE-2026-7650439%9.8Unauthenticated admin API auth bypass in Cisco Catalyst SD-WAN Manager
- CVE-2026-8354910%7.8Authenticated OS Command Injection RCE in SonicWall SMA1000 Appliance Console
- CVE-2026-1541012%7.2Authenticated OS Command Injection in SonicWall SMA 1000 Appliance Management Console
Appears with
- Rapid7vendor · 48
- Metasploit Frameworkproduct · 27
- CISAorganization · 12
- Microsoftvendor · 11
- Microsoftorganization · 7
- Metasploitproduct · 7
- Kateproduct · 6
- Langflowproduct · 6
- Qilinthreat actor · 5
- Windowsproduct · 5
- SonicWallvendor · 5
- GitLabvendor · 4
- Palo Alto Networksvendor · 3
- N-centralproduct · 3
- SonicWallorganization · 3
- BPFDoormalware · 3
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.