Rapid7 Updates Metasploit Templates Without New Exploits

On 5 October 2026 Rapid7 updated Metasploit Framework templates and docs for placeholders, ordering, architecture checks, encoders, and NOP generators, with no CVE or exploit.

On 5 October 2026, Rapid7 landed a set of Metasploit Framework commits that update module templates and documentation rather than release exploits. The changes add DisclosureDate and SessionTypes placeholders, force the AutoCheck prepend to run last, enforce platform placeholders, standardize mixin ordering, and update architecture handling. Documentation now links explanations for Rank, CheckCode, and Notes, expands encoder and exploit guidance, and clarifies encoder and NOP-generator usage. A commit timestamped later the same day makes encoder and exploit templates fail loudly when incomplete and adds rank placeholders. The six reports describe complementary maintenance work and do not disagree; none cites a CVE, a new exploit module, or observed exploitation.

• On 5 October 2026 Rapid7 committed several Metasploit Framework module-template and documentation updates.
• Templates gained DisclosureDate and SessionTypes placeholders, and encoder and exploit module documentation was expanded.
• The AutoCheck prepend is forced last in module templates, and architecture handling was updated.
• Documentation links were added for the Rank, CheckCode, and Notes placeholders.
• Templates now enforce platform placeholders and standardize mixin ordering.
• Usage instructions for encoder modules and NOP generators were clarified.
• A later same-day commit makes encoder and exploit templates fail loudly when incomplete and adds rank placeholders.
• None of the reports describes a CVE, a new exploit module, or in-the-wild exploitation.