Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

CVE-2026-58048 is a privilege escalation vulnerability in the database management functionality of cPanel & WHM, the hosting control panel developed by WebPros. An authenticated cPanel account holder with access to the MySQL/MariaDB database feature can execute arbitrary database commands with full administrative privileges, rather than being confined to the databases and grants tied to their own account. The CVE record carries a CVSS v4.0 base score of 9.4 (Critical).

Two weeks ago I sat in on a webinar where CyCognito’s founders walked through continuous AI pentesting. The framing stayed with me: the pentest itself has not changed, only who runs each part of it. AI has reached nearly every corner of cybersecurity, and pentesting is no exception. The promise is an agent that probes applications, uncovers flaws scanners miss, and delivers a report before a human tester has finished scoping the engagement.

The July 2026 Apache Traffic Server security release addresses a large batch of vulnerabilities across the proxy core and its plugin ecosystem, disclosed on July 29, 2026 and fixed in versions 9.2.15 and 10.1.4. Published counts of the batch differ. The Apache Traffic Server project describes the release as addressing 34 CVEs, while Belgium’s Centre for Cybersecurity puts the figure at 38 vulnerabilities.

CVE-2026-10818 is an arbitrary file upload vulnerability in WPForms Pro, the paid edition of a widely deployed WordPress form builder plugin. It was published on July 25, 2026, with Wordfence as the assigning CNA. The flaw sits in the ajax_chunk_upload_finalize function, which handles the final step of a chunked file upload. File type validation runs after the chunk metadata and the file contents have already been written to disk, and the assembled file is not deleted when that validation fails.

CVE-2026-54159 is a PHP object injection vulnerability in ps_facetedsearch, the layered navigation module bundled with PrestaShop, that lets an unauthenticated attacker run arbitrary code on the storefront. The vulnerability carries a CVSS v3.1 base score of 10.0 (Critical).

wp2shell is the name given to an unauthenticated remote code execution attack against WordPress core. It is not a single bug. It is a chain of two separately tracked flaws that, combined, let an anonymous attacker run code on a default WordPress installation with no plugins, no valid account, and no user interaction. The first flaw, CVE-2026-63030, is a REST API batch-route confusion issue in WP_REST_Server::serve_batch_request_v1().

CVE-2026-56164 is a privilege escalation vulnerability in on-premises Microsoft SharePoint Server, caused by a missing authentication check on a critical function (CWE-306). An unauthenticated attacker can exploit it over a network, with no credentials and no user interaction required. The vulnerability carries a CVSS v3.1 base score of 5.3 (Medium), and Microsoft rates it Moderate.

CVE-2026-56291 is an unauthenticated arbitrary file upload vulnerability in Balbooa Forms, a commercial drag-and-drop form builder for Joomla installed as the com_baforms component. The flaw is classified as CWE-434, unrestricted upload of a file with a dangerous type. The vulnerability carries a CVSS v3.1 base score of 9.8 (Critical). It has also been assigned a CVSS v4.0 base score of 10.0 (Critical), with an exploitation maturity of “attacked.”

CVE-2026-40138 and CVE-2026-40139 are two pre-authentication vulnerabilities in the authentication subsystem of BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA), stemming from improper validation and processing of authentication data. Both carry a CVSS v3.1 base score of 9.2 (Critical).

CVE-2026-57517 is a blind SQL injection vulnerability in Control Web Panel (CWP), caused by insufficient sanitization of the userRes POST parameter submitted to the panel’s user endpoint before the value is used to build a SQL query. The vulnerability carries a CVSS v3.1 base score of 9.8 (Critical).