GitLab has patched a critical GraphQL bug (CVE-2026-19478, CVSS 9.4) that could let an unauthenticated attacker remotely modify or delete public projects and user data in GitLab CE and EE, under certain conditions. If you host GitLab, prioritise updating to the latest fixed release and review your backup and recovery plan for public repos in case of future abuse of similar flaws, as described in the GitLab advisory.
A serious issue in Snowflake’s public GitHub repository for the .NET connector allowed crafted GitHub issues to trigger command injection in a workflow that contained internal Jira credentials. If your team uses GitHub Actions, audit workflows that react to issues or pull requests and strip secrets from any automation that can be touched by untrusted input, as highlighted in the Snowflake GitHub Actions report.
The Forminator Forms WordPress plugin, which has more than 600,000 active installs, has a critical flaw (CVE-2026-15748, CVSS 9.8) that could let attackers upload malicious PHP and get code execution on affected sites. If you run WordPress, check for Forminator, apply the vendor fix, and review whether you really need high risk plugins on internet facing sites, as detailed in the Forminator vulnerability write up.
Kaspersky has tracked the Cavern (also called Cav3rn) command and control framework used by Iranian state hackers, which now uses DNS and Google Apps Script to blend in with normal traffic in attacks on entities in Israel. If you manage networks with high risk profiles, work with your SOC or provider to tune DNS and cloud app monitoring so that unusual script and DNS behaviour gets flagged, based on the Cavern C2 research.
Researchers warn that MCP servers, which let AI agents call tools and data, can expose enterprise secrets through plain text configs, over-permissioned access, and prompt injection before security teams even know the servers exist. If your developers are trialling AI agents, treat MCP like any other app stack with change control, secret scanning, and access reviews, as set out in the MCP server security analysis.
Need IT support that just works? Email hello@icthero.co.uk or talk to us.