Rapid7 Intelligence

Additional Ivanti Connect Secure zero-days exploited in the wild (CVE-2026-111357, CVE-2026-118527)

Rapid7 Analysis: Unauthenticated File Upload to RCE in BeyondTrust Remote Support (CVE-2026-102764)

CVE-2026-111497: Critical out-of-bounds write in the Node.js Brotli decoder

CVE-2026-109618 and CVE-2026-109619: Critical Unauthenticated Remote Code Execution in PHP

Q3 2026 Threat Update: Attackers Are Exploiting Vulnerabilities Within 3 Days

Rapid7 Intelligence

Rapid7 Analysis: NetScaler intrusions chaining CVE-2026-88771 and CVE-2026-88779

Davide Massini, Kuky Pham, Edoardo Giuggioloni, Jose Romero

CVE-2026-102764: Critical BeyondTrust Remote Support Authentication Bypass Exploited in the Wild

Rapid7 Analysis: GitLab CI/CD Regex Integer Overflow (CVE-2026-97229)

Rapid7 Intelligence Wins the 2026 Péter Szőr Award for Outstanding Research

Christiaan Beek

Ivanti Connect Secure zero-day exploited in the wild (CVE-2026-104935)

CVE-2026-21589: Critical unauthenticated arbitrary file access in Atlassian products

Critical Cisco Catalyst SD-WAN Manager API authentication bypass exploited in the wild (CVE-2026-76504)

CVE-2026-94127: Critical Unauthenticated RCE in F5 BIG-IP APM

CVE-2026-76461: Critical Cisco Secure Email Gateway Vulnerability Exploited in the Wild

CVE-2026-86206, CVE-2026-86207: N-able N-central Authentication Bypass (FIXED)

DPRK APTs: Ted backdoor and curlRAT target South Korean media and automotive sectors

Rapid7 Intelligence

Rapid7 Analysis: Microsoft SharePoint Remote Code Execution (CVE-2026-63520)

CVE-2026-19490: Critical Vulnerability Affecting Citrix NetScaler ADC and NetScaler Gateway

Rapid7 Analysis: Unauthenticated Remote Code Execution in JetBrains TeamCity (CVE-2026-63077)

CVE-2026-18577: N-able N-central Authentication Bypass Exploited in the Wild

Rapid7 Analysis: KindaRails2Shell (CVE-2026-66066)