Loki Intelligence — Security Briefs · Published
Daily Security Brief: Webmail, WordPress, and API Platforms Under Attack
Today's risk picture centers on actively exploited flaws in webmail, WordPress core, SharePoint, MikroTik routers, and e-commerce and API platforms, several of them attacked within hours or days of disclosure. Teams should prioritize patching internet-facing web applications, verifying that automatic updates actually landed, and checking exposed systems for web shells or unexpected files.
Signal 01 · GitHub Security
AI-powered fuzzing with the GitHub Security Lab Taskflow Agent
GitHub Security Lab released a Fuzzing Taskflow on its Taskflow Agent framework that automates C/C++ fuzzing end to end: selecting entry points, writing AFL++ harnesses, chasing coverage gaps, and triaging crashes into per-bug reports. The author stresses that verdicts and suggested patches remain starting points that need human review.
Why it matters: Maintainers can use agent-driven fuzzing to extend coverage, but should run it only in disposable, unprivileged environments because the agent executes build commands directly on the host.
Source: GitHub Security
Signal 02 · The Hacker News
Roundcube Pre-Auth SQL Injection Flaw Actively Exploited in the Wild
The Canadian Centre for Cyber Security warned that CVE-2026-48842, a pre-authentication SQL injection in Roundcube Webmail's virtuser_query plugin, is being exploited in the wild. Fixed in May 2026 in versions 1.6.16 and 1.7.1, the flaw could expose mail account credentials and stored messages.
Why it matters: Confirm Roundcube instances run 1.6.16, 1.7.1 or later, check whether the virtuser_query plugin is enabled, and review mail databases for unexpected access.
Source: The Hacker News
Signal 03 · Cloudflare Security
Agents can now set up your website’s security with Turnstile Spin
Cloudflare introduced Turnstile Spin, an agent-guided workflow that embeds its Turnstile challenge on the frontend and wires server-side Siteverify validation into the backend after the developer approves a plan. It can also repair widgets serving traffic without backend validation and migrate sites from other CAPTCHA providers.
Why it matters: A bot challenge without server-side token verification offers little protection, so confirm every widget's tokens are validated in the backend, regardless of who wrote the integration.
Source: Cloudflare Security
Signal 04 · CISA
CISA Adds Two Known Exploited Vulnerabilities to Catalog
CISA added two actively exploited flaws to its KEV catalog: CVE-2026-65660, a Microsoft SharePoint code injection issue that can let an authorized attacker execute code over a network, and CVE-2026-67279, a MikroTik RouterOS workflow enforcement weakness that can let an unauthenticated client open a session channel.
Why it matters: Patch on-premises SharePoint servers and MikroTik routers promptly, keep router management off the internet, and review both for unexpected sessions or code execution.
Source: CISA
Signal 05 · CISA
CISA Adds One Known Exploited Vulnerability to Catalog
CISA listed CVE-2026-87902, a WordPress Core remote file inclusion vulnerability, in its KEV catalog based on evidence of active exploitation. According to the catalog entry, the flaw can make page-template resolution include a readable local PHP file outside the active theme directories, leading to remote code execution.
Why it matters: Verify that WordPress updates actually applied across all sites, including staging and forgotten installs, and treat any unpatched instance as a priority remediation item.
Source: CISA
Signal 06 · The Hacker News
Attackers Exploit WordPress CVE-2026-87902 Within Hours of Disclosure
Attackers began exploiting CVE-2026-87902, a CVSS 9.2 WordPress core flaw fixed in versions including 7.1.2, 7.0.6, 6.9.9 and 6.8.10, within hours of its September 22 disclosure, according to Previdian and Patchstack. Exploitation depends on specific theme and server preconditions, but observed attempts wrote attacker-controlled PHP files to temporary directories.
Why it matters: Update to a fixed WordPress release, then look for unexpected PHP files in temporary directories and review web server logs for suspicious template-inclusion requests.
Source: The Hacker News
Signal 07 · CISA
CISA Adds Two Known Exploited Vulnerabilities to Catalog
CISA added two exploited vulnerabilities to the KEV catalog: CVE-2026-5430, a path traversal in several WSO2 API management products that can enable unrestricted file upload and remote code execution, and CVE-2026-71362, an incorrect authorization flaw in Adobe Commerce and Magento that can grant elevated access to sensitive resources.
Why it matters: Teams running WSO2 gateways or Magento storefronts should apply vendor fixes quickly, limit exposed admin paths, and check for unexpected uploaded files or privilege changes.
Source: CISA
Brief sources
Related briefs
- Cloud Pentest Checklist for SaaS Teams
- Automated Vulnerability Assessment vs Manual Pentest
- Hardware Hacking for Embedded Security
Relevant Loki service: SKYEN web & API pentesting.