Continue reading the full briefing.
CVE-2026-61609: Pterodactyl's shared global rate-limit key on login and 2FA checkpoint enables unauthenticated panel-wide authentication lockout (DoS)
### Summary The `authentication` rate limiter used for the login and two-factor checkpoint endpoints applies a single global bucket shared by every client, instead of keying per IP or per account. An unauthenticated attacker sending ~10 requests per minute from one IP exhausts the shared bucket and causes HTTP 429 for every user on every IP attempting to…
Why it matters: GitHub Advisory Database pterodactyl/panel participates in the path from source code to production. A weakness can inherit runner permissions, build secrets, trusted artifacts, or deployment access.
What to verify: Trace untrusted input through pull requests and jobs, review token scope, isolate runners, pin trusted dependencies, and rebuild affected artifacts after remediation.
Operational focus: Confirm whether the vulnerable route, plugin, framework, or API behavior is enabled and public.
CVE-2026-50569: Fission: HTTPTrigger admission omits RelativeURL / Prefix validation; kubectl apply bypasses CLI checks
`HTTPTriggerSpec.Validate()` validated `Methods`, `FunctionReference`, `Host`, `IngressConfig`, and `CorsConfig`, but silently skipped `RelativeURL` and `Prefix`. Those two fields were validated at the CLI level only (`pkg/fission-cli/cmd/httptrigger/create.go:83`). The post-CRD-modernization webhook for HTTPTrigger was retired in favor of API-server CEL — and CEL had no rules on those fields either — so an HTTPTrigger created via `kubectl apply` or a direct…
Why it matters: GitHub Advisory Database github.com/fission/fission participates in the path from source code to production. A weakness can inherit runner permissions, build secrets, trusted artifacts, or deployment access.
What to verify: Trace untrusted input through pull requests and jobs, review token scope, isolate runners, pin trusted dependencies, and rebuild affected artifacts after remediation.
Operational focus: Patch the component, test authentication and authorization boundaries, and review suspicious requests.
USN-8618-1: Linux kernel vulnerabilities
It was discovered that some AMD Zen 2 processors did not properly isolate shared resources in the operation cache. A local attacker could possibly use this issue to corrupt instructions executed at a higher privilege level, resulting in privilege escalation. (CVE-2025-54518) Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise…
Why it matters: Ubuntu Security Notices may be embedded across servers, containers, appliances, and administration hosts. Package installation alone does not prove that the corrected code is running.
What to verify: Compare distribution package versions, identify the loaded kernel or library, plan required service restarts or reboots, and validate workload health after the change.
Operational focus: Use a WAF as temporary risk reduction where appropriate, but keep the permanent software fix owned.
CVE-2026-55971: Heap-based Buffer Overflow vulnerability in Apache Thrift C++ bindings. This issue affects…
Heap-based Buffer Overflow vulnerability in Apache Thrift C++ bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue.
Why it matters: CVE-2026-55971 is a memory-safety issue whose practical impact depends on the reachable parser, process privileges, platform protections, and reliability of attacker-controlled input.
What to verify: Confirm the exact affected build and component exposure, update from the vendor channel, review crash and restart telemetry, and keep network containment in place until the fixed process is running.
Operational focus: Confirm whether the vulnerable route, plugin, framework, or API behavior is enabled and public.
Open the original NIST National Vulnerability Database record
CVE-2026-58023: Out-of-bounds Read vulnerability in Apache Thrift c_glib bindings. This issue affects Apache…
Out-of-bounds Read vulnerability in Apache Thrift c_glib bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue.
Why it matters: CVE-2026-58023 is a memory-safety issue whose practical impact depends on the reachable parser, process privileges, platform protections, and reliability of attacker-controlled input.
What to verify: Confirm the exact affected build and component exposure, update from the vendor channel, review crash and restart telemetry, and keep network containment in place until the fixed process is running.
Operational focus: Patch the component, test authentication and authorization boundaries, and review suspicious requests.
Open the original NIST National Vulnerability Database record
Application response plan
Confirm that the affected route or component is actually enabled, then patch the permanent cause. Use temporary filtering only as a bridge and review requests for evidence of attempted abuse.
- Inventory WordPress core, plugins, themes, frameworks, and public API versions.
- Prioritize unauthenticated injection, authorization bypass, file access, and remote execution paths.
- Patch affected components and remove unused or abandoned extensions.
- Review web, application, authentication, and administrative change logs for abuse.
- Validate security headers, least-privilege roles, backups, and recovery after remediation.
Requests and control signals
Check route reachability, authentication state, roles, request patterns, component versions, and recovery readiness.
- Confirm whether the vulnerable route, plugin, framework, or API behavior is enabled and public.
- Patch the component, test authentication and authorization boundaries, and review suspicious requests.
- Use a WAF as temporary risk reduction where appropriate, but keep the permanent software fix owned.
Web security takeaway
Permanent web risk reduction comes from fixing the vulnerable component or authorization path, then validating the result with request evidence and recovery checks.
References used in this briefing
- CISA Known Exploited Vulnerabilities: CVE-2026-60137: WordPress Core SQL Injection Vulnerability
- CISA Known Exploited Vulnerabilities: CVE-2026-63030: WordPress Core Interpretation Conflict Vulnerability
- NIST National Vulnerability Database: CVE-2026-66745: Artica Proxy before 4.50.000000 Service Pack 7 (fixed in hotfix 20260724-02) contains…
- GitHub Advisory Database: CVE-2026-61609: Pterodactyl's shared global rate-limit key on login and 2FA checkpoint enables unauthenticated panel-wide authentication lockout (DoS)
- GitHub Advisory Database: CVE-2026-50569: Fission: HTTPTrigger admission omits RelativeURL / Prefix validation; kubectl apply bypasses CLI checks
- Ubuntu Security Notices: USN-8618-1: Linux kernel vulnerabilities
- NIST National Vulnerability Database: CVE-2026-55971: Heap-based Buffer Overflow vulnerability in Apache Thrift C++ bindings. This issue affects…
- NIST National Vulnerability Database: CVE-2026-58023: Out-of-bounds Read vulnerability in Apache Thrift c_glib bindings. This issue affects Apache…
Related briefings
Live Web Security Brief for July 28, 2026: APIs, WordPress, and Application Risk
Live web application intelligence for WordPress, APIs, authentication, authorization, injection flaws, dependencies, and browser-facing controls. Updated for July…
Read More
Live Web Security Brief for July 27, 2026: APIs, WordPress, and Application Risk
Live Web Security intelligence for July 27, 2026, verified from current public advisories and official security feeds. Top…
Read More
Web Security Brief for July 23, 2026: APIs, Headers, and WordPress Attack Surface
A web security review for API authentication, browser security headers, WordPress updates, and public attack surface.
Read MoreNeed to add context to this briefing?
Send corrections, security tips, source updates, or collaboration notes through the contact page so the editorial team can review them properly.