All Articles

Additional Ivanti Connect Secure zero-days exploited in the wild (CVE-2026-111357, CVE-2026-118527)

Rapid7 Analysis: Unauthenticated File Upload to RCE in BeyondTrust Remote Support (CVE-2026-102764)

How Rapid7 InsightGovCloud Supports BOD 22-01 Compliance

Simplify User Access Management with SCIM on Rapid7 Command Platform

Michael Chroney

CVE-2026-111497: Critical out-of-bounds write in the Node.js Brotli decoder

Metasploit Wrap Up: Langflow, MongoDB, and More

Alan David Foster

CVE-2026-109618 and CVE-2026-109619: Critical Unauthenticated Remote Code Execution in PHP

Q3 2026 Threat Update: Attackers Are Exploiting Vulnerabilities Within 3 Days

Rapid7 Intelligence

Your Next Insider Threat Won’t be Human: Securing AI Agents From the Outside in

Authentication Bypass, Remote Code Execution, and Database Read in Eptura Archibus (FIXED)

Rapid7 Analysis: NetScaler intrusions chaining CVE-2026-88771 and CVE-2026-88779

Davide Massini, Kuky Pham, Edoardo Giuggioloni, Jose Romero

CVE-2026-102764: Critical BeyondTrust Remote Support Authentication Bypass Exploited in the Wild

Rapid7 Analysis: GitLab CI/CD Regex Integer Overflow (CVE-2026-97229)

Rapid7 Intelligence Wins the 2026 Péter Szőr Award for Outstanding Research

Christiaan Beek

How Multi-Campus Universities can Build a more Connected Security Program

From One Account to Every Mailbox: Breaking Zimbra's Identity Boundaries (Part 1)

Unauthenticated SQL Injection In Channel Software WebAlliance eCommerce

Patch Tuesday - October 2026

Ivanti Connect Secure zero-day exploited in the wild (CVE-2026-104935)

CVE-2026-97229: Critical Unauthenticated Remote Code Execution in GitLab

Metasploit Wrap Up: A Collection of What Can Only Be Called Eclectic Modules

The Metasploit Team