Loki Intelligence — Security Briefs · Published
Daily Security Brief: Ivanti KEV Additions, WordPress RCE, Drupal Commerce
Active exploitation dominates today's reports, spanning edge access gear, CMS platforms, DevOps tooling and network infrastructure, with several flaws targeted soon after fixes shipped. Teams should prioritize patching internet-facing systems listed as exploited, verify exposure of CMS, commerce and GitLab instances, and review authentication flows.
Signal 01 · CISA
CISA Adds Two Known Exploited Vulnerabilities to Catalog
CISA added two Ivanti Connect Secure vulnerabilities, CVE-2026-111357 and CVE-2026-118527, to its Known Exploited Vulnerabilities Catalog based on evidence of active exploitation. They involve missing authentication for a critical function and generation of predictable numbers or identifiers.
Why it matters: Remote access appliances are high-value edge targets, so confirm affected versions, apply vendor fixes and review access logs for anomalies.
Source: CISA
Signal 02 · The Hacker News
WordPress RCE Flaw Draws Nearly 63,000 Attack Attempts in Just 24 Hours
Attackers were seen attempting to exploit a high-severity remote code execution flaw in WordPress Core shortly after patches were released. The issue has no CVE identifier.
Why it matters: Sites that lag on core updates face rapid exploitation attempts, so enable or verify automatic updates and confirm patched versions are deployed.
Source: The Hacker News
Signal 03 · The Hacker News
Hackers Actively Exploit Highly Critical Drupal Commerce Core Authorization Bypass Flaw
Drupal warned that attackers are exploiting a highly critical missing authorization flaw, CVE-2026-118539, in its Commerce Core component. Affected versions are listed as 0.0.0 to 2.41.
Why it matters: Web shops running Drupal Commerce should update to a fixed release promptly and review order and admin activity for unexpected changes.
Source: The Hacker News
Signal 04 · BleepingComputer
Hackers exploit Cisco SD-WAN flaw to deploy custom KeyDrift malware
A newly identified threat group tracked as UAT-11473 was observed exploiting CVE-2026-20127, an authentication bypass in Cisco Catalyst SD-WAN Controllers, to deploy a custom malware framework called KeyDrift.
Why it matters: Network management controllers hold privileged positions, so patch them, restrict management exposure and monitor for unexpected changes.
Source: BleepingComputer
Signal 05 · The Hacker News
Attacker Tried to Exploit Alpine Linux’s GitLab via CVSS 10.0 Flaw Its Ruby Left Open
Alpine Linux said an attacker tried to exploit a critical GitLab flaw, CVE-2026-97229 (CVSS 10.0), on its own GitLab server a week after GitLab released a fix. The flaw can let an attacker run code on the server.
Why it matters: Self-hosted GitLab instances should be updated quickly after security releases, since attackers act within days of a fix appearing.
Source: The Hacker News
Signal 06 · BleepingComputer
Critical Linux kernel flaw allows remote root attacks on MPTCP servers
Researchers at Anthropic developed an exploit for a critical Linux kernel vulnerability that lets unauthenticated attackers remotely run commands as root on servers with Multipath TCP listeners.
Why it matters: Identify hosts with MPTCP enabled, apply kernel updates when available and disable the feature where it is not needed.
Source: BleepingComputer
Signal 07 · CISA
Siemens Mendix SAML Module
A CISA advisory describes an authentication bypass in the Siemens Mendix SAML module, where an unauthenticated remote attacker could gain access by replaying a valid SAML assertion in IdP-initiated flows. Siemens has released new versions for affected products.
Why it matters: Teams using Mendix SAML should update and review whether IdP-initiated sign-in is needed, a flow worth including in authorized authentication testing.
Source: CISA
Brief sources
Related briefs
- Hardware Hacking for Embedded Security
- How to Evaluate an AI Security Testing Provider
- What Is AI Agent Security Testing?
Relevant Loki services: Orvyn — AI agent security private preview and SKYEN web & API pentesting.