30
42
Metasploit Wrap Up: This One Goes to Sixteen!
Metasploit adds 16 modules including 10 exploits, five covering CISA KEV vulnerabilities in Cisco, SonicWall, PaperCut, JetBrains and Langflow.
Rapid7's weekly Metasploit update ships 16 new modules, 10 of them exploit modules, with five targeting CISA KEV entries. New exploits cover Cisco Secure Firewall Management Center auth bypass (CVE-2026-20079), a SonicWall SMA1000 SSRF-to-root RCE chain (CVE-2026-83548/CVE-2026-83549), JetBrains TeamCity deserialization RCE (CVE-2026-63077), PaperCut NG/MF chain (CVE-2026-81578/CVE-2026-82078), and Langflow authenticated RCE (CVE-2026-19295). The SonicWall and PaperCut chains were reported as actively exploited zero-days, and a new ESC8 relay module exploits CVE-2026-20929 against AD CS Web Enrollment.
48
Update modules/auxiliary/scanner/http/elasticsearch_tika_xfa_xxe.rb
Rapid7 updated a Metasploit auxiliary scanner module that detects XML external entity injection in Elasticsearch via Apache Tika.
A commit in the Metasploit Framework updated modules/auxiliary/scanner/http/elasticsearch_tika_xfa_xxe.rb, an auxiliary scanner module. The module targets XML external entity (XXE) injection in Elasticsearch through Apache Tika, and was co-authored by jheysel-r7. The terse commit message contains no additional details, CVE references, or exploitation notes.
18
30
Hottest cybersecurity open-source tools of the month: August 2026
August's open-source security roundup highlights NVIDIA SkillSpector for AI agent skill scanning, Future AGI, Chainloop, PentestGPT, and Hazmat agent containment.
Help Net Security's August 2026 roundup covers five open-source tools: NVIDIA's SkillSpector, a scanner that assesses AI agent skills from directories, zips, SKILL.md files, or Git URLs and returns findings and risk scores; Future AGI, an Apache 2.0 platform for tracing, evaluating, simulating, and guardrailing LLM agents; Chainloop, a software supply chain evidence store that produces signed in-toto attestations in CI pipelines; PentestGPT, an agentic penetration testing framework running recon, exploit, and reporting stages; and Hazmat, which runs AI coding agents like Claude Code and Codex inside a separate machine account for containment.
25
55
55
55
30
30