Rapid7 Cybersecurity Blog the company blog of Rapid7: latest posts and feed

Nov 6

Metasploit Wrapup: Unauth RCE modules in Network Perimeter Devices and much more

Nov 5

Gartner Report: The Attack Path is Closing Faster than Most Teams Can Patch

Security teams have never lacked vulnerability data. The harder problem is deciding which issues create a credible path to business impact, then acting before that path can be used.

Nov 4

The Race Against the 3-Day Clock: How Rapid7 Helps Meet BOD 26-04 Compliance

Introduction to BOD 26-04 On June 10, 2026, CISA issued Binding Operational Directive 26-04, "Prioritizing Security Updates Based on Risk." Strip away the regulatory language and it reads like a single operational fact: for a vulnerability...

Nov 4

Rapid7 Achieves ISO/IEC 42001 Certification for its AI Management System

Exciting news for AI governance! Rapid7 has achieved ISO/IEC 42001:2023 certification for our Artificial Intelligence Management System (AIMS).

Nov 2

Additional Ivanti Connect Secure zero-days exploited in the wild (CVE-2026-111357, CVE-2026-118527)

Overview On October 29, 2026, Ivanti updated its security advisory for Ivanti Connect Secure (ICS) to include two additional vulnerabilities and released fixes for both.

Oct 30

Rapid7 Analysis: Unauthenticated File Upload to RCE in BeyondTrust Remote Support (CVE-2026-102764)

Overview An origin-validation flaw in BeyondTrust Remote Support lets an unauthenticated attacker write files on the appliance and execute code as the site's operating-system user.

Oct 28

How Rapid7 InsightGovCloud Supports BOD 22-01 Compliance

An introduction to CISA’s BOD 22-01 Issued nearly four years ago, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) Binding Operational Directive 22-01 (BOD 22-01) has been adopted across both public and private sector...

Oct 27

Simplify User Access Management with SCIM on Rapid7 Command Platform

Managing access to security tools shouldn't require another manual process. As organizations grow, keeping user accounts and permissions up to date becomes increasingly complex.

Oct 26

CVE-2026-111497: Critical out-of-bounds write in the Node.js Brotli decoder

Overview On October 21, 2026, the Node.js Project published a security advisory for CVE-2026-111497, an out-of-bounds write in the Brotli decoder bundled with Node.js.

Oct 23

Metasploit Wrap Up: Langflow, MongoDB, and More

This release adds multiple new modules, and 6 of those modules point at a single target: Langflow, the open-source LLM workflow builder.

Oct 21

Q3 2026 Threat Update: Attackers Are Exploiting Vulnerabilities Within 3 Days

Three days is the average time between a high-severity vulnerability becoming public and its exploitation, according to the latest Quarterly Threat Landscape Report from Rapid7.

Oct 21

CVE-2026-109618 and CVE-2026-109619: Critical Unauthenticated Remote Code Execution in PHP

Overview On October 21, 2026, the PHP project announced security releases for two critical vulnerabilities in PHP. CVE-2026-109618 can corrupt memory during out-of-memory (OOM) handling, while CVE-2026-109619 is a use-after-free flaw...

Oct 19

CVE-2026-102764: Critical BeyondTrust Remote Support Authentication Bypass Exploited in the Wild

Overview On October 15, 2026, BeyondTrust disclosed a critical authentication bypass in Remote Support (RS), its platform for remotely troubleshooting and administering endpoints.

Oct 19

Rapid7 Analysis: NetScaler intrusions chaining CVE-2026-88771 and CVE-2026-88779

Overview In early October 2026, Rapid7 analysts investigated a compromise of a Citrix NetScaler ADC appliance. The appliance was running an affected 14.1 build and was exposed to active exploitation targeting NetScaler authentication and...

Oct 19

Authentication Bypass, Remote Code Execution, and Database Read in Eptura Archibus (FIXED)

Overview While performing continuous red teaming exercises through Rapid7’s Vector Command service, Rapid7 discovered three new vulnerabilities in Eptura Archibus.

Oct 19

Your Next Insider Threat Won’t be Human: Securing AI Agents From the Outside in

Why the controls on an AI agent have to live outside of it, and what a security operations team can implement and maintain those controls.

Oct 16

Rapid7 Intelligence Wins the 2026 Péter Szőr Award for Outstanding Research

Some awards you're happy to receive, while others make you stop for a moment. Receiving the 2026 Péter Szőr Award this week at Virus Bulletin in Seville for our research, BPFdoor in Telecom Networks: Sleeper Cells in the Backbone, was of...

Oct 16

Rapid7 Analysis: GitLab CI/CD Regex Integer Overflow (CVE-2026-97229)

Overview On October 12, 2026, GitLab released 19.4.2, 19.3.5, and 19.2.8 to fix CVE-2026-97229, an integer overflow in its CI/CD regular-expression handling. The issue was reported through HackerOne by joaxcar.

Oct 15

How Multi-Campus Universities can Build a more Connected Security Program

Parts 1 and 2 of this series looked at two pressures facing higher education security teams. First, the threat landscape: universities are dealing with more frequent attacks across complex, distributed environments, while campus-by-campus...

Oct 14

Unauthenticated SQL Injection In Channel Software WebAlliance eCommerce

Overview While performing continuous red teaming exercises through Rapid7’s Vector Command service, Rapid7 discovered CVE-2026-108065, an SQL Injection vulnerability (CWE-89) in Channel Software WebAlliance eCommerce.The exploit allows a...

Oct 14

From One Account to Every Mailbox: Breaking Zimbra's Identity Boundaries (Part 1)

An enterprise mail server authenticates users, stores private communications, delivers recovery links, runs calendars, and sends mail that employees and other systems trust.

Oct 13

CVE-2026-97229: Critical Unauthenticated Remote Code Execution in GitLab

Overview On October 12, 2026, GitLab published a critical patch release for CVE-2026-97229, an integer overflow or wraparound ( CWE-190 ) in the CI/CD regular expression compiler affecting GitLab Community Edition (CE) and Enterprise...

Oct 13

Ivanti Connect Secure zero-day exploited in the wild (CVE-2026-104935)

Overview On October 13, 2026, Ivanti published a security advisory for CVE-2026-104935, a high-severity authentication bypass by spoofing ( CWE-290 ) affecting Ivanti Connect Secure (ICS).

Oct 13

Patch Tuesday - October 2026

Microsoft is publishing 1,413 own-product vulnerabilities on October 2026 Patch Tuesday, including 1,102 vulnerabilities in Windows.

Oct 9

Metasploit Wrap Up: A Collection of What Can Only Be Called Eclectic Modules