Emerging Threats

Additional Ivanti Connect Secure zero-days exploited in the wild (CVE-2026-111357, CVE-2026-118527)

CVE-2026-111497: Critical out-of-bounds write in the Node.js Brotli decoder

CVE-2026-109618 and CVE-2026-109619: Critical Unauthenticated Remote Code Execution in PHP

Your Next Insider Threat Won’t be Human: Securing AI Agents From the Outside in

Rapid7 Analysis: NetScaler intrusions chaining CVE-2026-88771 and CVE-2026-88779

Davide Massini, Kuky Pham, Edoardo Giuggioloni, Jose Romero

CVE-2026-102764: Critical BeyondTrust Remote Support Authentication Bypass Exploited in the Wild

Ivanti Connect Secure zero-day exploited in the wild (CVE-2026-104935)

CVE-2026-97229: Critical Unauthenticated Remote Code Execution in GitLab

Zero-Day Exploitation of Citrix NetScaler ADC and Gateway: CVE-2026-88771 and CVE-2026-88772

CVE-2026-85706: Critical GitLab Path Traversal Exploited in the Wild

CVE-2026-63030: wp2shell a Critical Remote Code Execution Vulnerability in WordPress Core

Rapid7 Intelligence

CVE-2026-55040: Microsoft SharePoint JWT Token Authentication Bypass (FIXED)

CVE-2026-41940: cPanel & WHM Authentication Bypass

CVE-2026-33032: Nginx UI Missing MCP Authentication

FortiGate CVE-2025-59718 Exploitation: Incident Response Findings

Eric Carey, Olivia Henderson, Noah Hemker

The Attack Cycle is Accelerating: Announcing the Rapid7 2026 Global Threat Landscape Report

Rapid7 Intelligence

Introducing Hacktics and Telemetry, a Podcast from Rapid7 Labs

Douglas McKee, Director, Vulnerability Intelligence

Critical Cisco Catalyst Vulnerability Exploited in the wild (CVE-2026-20127)

Rapid7 Intelligence

CVE-2026-1731: Critical Unauthenticated Remote Code Execution in BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA)

Chrysalis, Notepad++, and Supply Chain Risk: What it Means, and What to Do Next

Critical Ivanti Endpoint Manager Mobile (EPMM) zero-day exploited in the wild (CVE-2026-1281 & CVE-2026-1340)