Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

CVE-2026-54159 is a PHP object injection vulnerability in ps_facetedsearch, the layered navigation module bundled with PrestaShop, that lets an unauthenticated attacker run arbitrary code on the storefront. The vulnerability carries a CVSS v3.1 base score of 10.0 (Critical).

wp2shell is the name given to an unauthenticated remote code execution attack against WordPress core. It is not a single bug. It is a chain of two separately tracked flaws that, combined, let an anonymous attacker run code on a default WordPress installation with no plugins, no valid account, and no user interaction. The first flaw, CVE-2026-63030, is a REST API batch-route confusion issue in WP_REST_Server::serve_batch_request_v1().

CVE-2026-56164 is a privilege escalation vulnerability in on-premises Microsoft SharePoint Server, caused by a missing authentication check on a critical function (CWE-306). An unauthenticated attacker can exploit it over a network, with no credentials and no user interaction required. The vulnerability carries a CVSS v3.1 base score of 5.3 (Medium), and Microsoft rates it Moderate.

CVE-2026-56291 is an unauthenticated arbitrary file upload vulnerability in Balbooa Forms, a commercial drag-and-drop form builder for Joomla installed as the com_baforms component. The flaw is classified as CWE-434, unrestricted upload of a file with a dangerous type. The vulnerability carries a CVSS v3.1 base score of 9.8 (Critical). It has also been assigned a CVSS v4.0 base score of 10.0 (Critical), with an exploitation maturity of “attacked.”

CVE-2026-40138 and CVE-2026-40139 are two pre-authentication vulnerabilities in the authentication subsystem of BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA), stemming from improper validation and processing of authentication data. Both carry a CVSS v3.1 base score of 9.2 (Critical).

CVE-2026-57517 is a blind SQL injection vulnerability in Control Web Panel (CWP), caused by insufficient sanitization of the userRes POST parameter submitted to the panel’s user endpoint before the value is used to build a SQL query. The vulnerability carries a CVSS v3.1 base score of 9.8 (Critical).

Static application security testing (SAST) tools are intentionally conservative. Traditional scanners identify code that appears exploitable and flag the snippet for review, even when protections elsewhere in the application prevent exploitation. Although that approach helps teams catch vulnerabilities, it also creates false positives that consume developer time, slow remediation efforts, and make future alerts easier to dismiss.

CVE-2026-55957 is a missing critical step in authentication in Apache Tomcat, present when the JNDIRealm is configured to authenticate binds using GSSAPI. The vulnerability carries a CVSS v3.1 base score of 9.8 (Critical), based on network attack vector, low attack complexity, no privileges required, and no user interaction.

Scaling application security and attack surface monitoring inside a single enterprise is a massive headache. In June 2026, the Department for Science, Innovation and Technology (DSIT) of the UK Government joined us on stage at Infosecurity Europe to share the reality of a challenge that puts even the largest corporate hurdles into perspective.

Over the past months, I’ve noticed a shift in customer conversations. Coverage, prioritization, emerging threats — those questions have given way to exposed MCP servers, unmanaged AI chatbots, and risks that don’t show up as CVEs. Mythos comes up in every other call. The calculus changed. AI now writes a quarter of production code, with twice as many vulnerabilities. The exploitation window collapsed from days to hours.