.jpg&w=828&q=75)
Gartner says AI is closing attack paths faster than patching
Rapid7 is offering free access to the May 28, 2026 Gartner report and tying it to its own exposure-management pitch.
1
Stories per day · 30 days
7 RSS
Relatedmetasploit6ransomware3vulnerability-management3ci-cd2cve-2026-972292gitlab2onigmo2qilin2rce2ai-assisted-attacks1apache-solr1apt1attack-path1averat1award1bod-22-011bpfdoor1channel-software1
69 stories, newest first · one card per story
Stories tagged #rapid7
Rapid7 achieves ISO/IEC 42001 certification for AI governance
Rapid7 has obtained ISO/IEC 42001 certification for its Artificial Intelligence Management System following independent audit.
Rapid7 says InsightGovCloud supports CISA BOD 22-01 compliance
The FedRAMP-authorized suite advertises KEV alerts, asset discovery and CyberScope XML exports for agencies and contractors.
Metasploit Framework commit updates a module and its docs
The public commit message names neither the module nor any target or vulnerability.
Rapid7 Command Platform adds SCIM user provisioning
SCIM is off by default and lets an existing identity provider create, update, and deactivate Command Platform accounts.
Rapid7 says 71% of tracked exploitation starts within a week
Across 43 newly exploited high- and critical-severity flaws, disclosure-to-exploitation averaged three days.
1
Rapid7: high-severity flaws exploited within three days in Q3
The Gentlemen and Qilin led claimed ransomware incidents, the US accounted for 60% of attacks, and AI was operational in 8%.
4
Rapid7: high-severity flaws exploited three days after disclosure
Of 43 newly exploited high- and critical-severity bugs in Q3, 34 needed no authentication or user interaction.
1
Metasploit updates Apache Solr version scanner documentation
The commit only refreshes module documentation and does not add an exploit or a new module.
Metasploit commit removes agent module examples, updates AGENTS.md
The change is documentation and example cleanup, not a new exploit or module release.
Rapid7 Analysis: GitLab CI/CD Regex Integer Overflow (CVE-2026-97229)
Rapid7 shows a reliable RCE proof of concept for GitLab's CVSS 10 regex flaw CVE-2026-97229.
9
Rapid7 Intelligence Wins the 2026 Péter Szőr Award for Outstanding Research
Rapid7 Intelligence won Virus Bulletin's 2026 Péter Szőr Award for BPFDoor telecom research.
Addresses some false positives in several modules
Metasploit commit reduces false positives across several modules.
How Multi-Campus Universities can Build a more Connected Security Program
Rapid7 says multi-campus universities should share security visibility and response while keeping campus data separate.
2
From One Account to Every Mailbox: Breaking Zimbra's Identity Boundaries (Part 1)
Rapid7 details dozens of Zimbra flaws, including mailbox impersonation and cross-user access, with some fixes still missing.
Unauthenticated SQL Injection In Channel Software WebAlliance eCommerce
Rapid7 disclosed critical unauthenticated SQL injection CVE-2026-108065 in Channel Software WebAlliance eCommerce.
2
Clarify Grafana CVE-2024-9264 version handling
A Metasploit commit clarifies version handling for the Grafana CVE-2024-9264 module.
CVE-2026-97229: Critical Unauthenticated Remote Code Execution in GitLab
Rapid7 reproduced unauthenticated GitLab RCE CVE-2026-97229 (CVSS 10) and urges immediate patching.
2
Metasploit Wrap Up: A Collection of What Can Only Be Called Eclectic Modules
Rapid7's Metasploit wrap-up adds 12 modules, including unauthenticated RCE for N-central, Langflow, LiteLLM, and dizqueTV.
12
What the BPFDoor backdoor tells us about attacks on the network edge
Rapid7 says BPFDoor stays silent on Linux edge devices until a magic packet arrives.
Update modules/exploits/multi/http/langflow_unauth_rce_cve_2026_0769.rb
Metasploit updated its Langflow unauthenticated RCE module for CVE-2026-0769.
Update modules/exploits/multi/http/langflow_auth_rce_cve_2026_7873.rb
Metasploit updated its authenticated RCE module for Langflow flaw CVE-2026-7873.
Update modules/auxiliary/scanner/postgres/postgres_login.rb
Rapid7 updated Metasploit's PostgreSQL login scanner module, with no vulnerability details disclosed.
Rapid7 security advisory (AV26-1004)
Canada's Cyber Centre warns Rapid7 Velociraptor before 0.77.3 has insufficient permission checks (CVE-2026-78411).