Craft CMS flaw CVE-2026-79987 lets low-privilege users run OS

🕵️ RESEARCH & DEEP DIVES

• Craft CMS flaw CVE-2026-79987 lets low-privilege users run OS commands via element search
  An authenticated non-admin Craft CMS user can execute operating system commands through unsafe reflection in element-search eager loading.

  • Applies to Craft CMS 5.8.0 and later before 5.10.13.
  • A remote, authenticated, non-admin Control Panel user with only the accessCp permission can execute OS commands as the PHP web worker.
  • The flaw is unsafe reflection (CWE-470), triggered through element-search eager loading.
  • Tracked as CVE-2026-79987 with CVSS 8.7 (CVSS v4.0) and 8.8 (CVSS v3.1); reported by @CryptoCat and coordinated by Hackrate.
  Sources 📄 Source: github.com · 📎 Coverage: cve.threatint.com · 👁 via CVE ThreatInt

• AI-powered attack exploited PaperCut flaws to hack 395 organizations — BleepingComputer

• Cisco FMC flaws exploited by ransomware gang, state-sponsored hackers — BleepingComputer

• IDScan confirms breach tied to 153 million stolen driver’s licenses — BleepingComputer

• Threat groups enhance cyberattack capabilities with AI — Cybersecurity Dive

• White House sees water cybersecurity partnership in Texas as national blueprint — Cybersecurity Dive

• CISA is on the verge of filling hundreds of critical vacancies — Cybersecurity Dive

• Cybersecurity M&A Roundup: 33 Deals Announced in August 2026 — SecurityWeek

• Nightmare-Eclipse Strikes Again With 'ShieldCrash' Windows Exploit — Dark Reading

• Orthanc DICOM Server — CISA Advisories

• NextGen Healthcare Mirth Connect — CISA Advisories

• ST Engineering iDirect iQ-Series Terminals (Update A) — CISA Advisories

• AVEVA Pipeline Integrity Monitor — CISA Advisories

• FileRun before 2026.3.0 PHP Object Injection via Perms::getPerms()FileRun before 2... — CVE ThreatInt

• FileRun before 2026.3.0 Authenticated SQL Injection via Groups Add ActionFileRun b... — CVE ThreatInt

• FileRun before 2026.3.0 OS Command Injection via escapeshellcmd() No-Op Redefiniti... — CVE ThreatInt

• FileRun before 2026.3.0 OS Command Injection via PhotoProofSheet HandlerFileRun be... — CVE ThreatInt

• OS command injection in the advanced-rule parser of ConfigServer Security & F... — CVE ThreatInt

• Path traversal in Plesk's Backup Manager causes arbitrary file write as root ... — CVE ThreatInt

• Improper escaping of a request URL in ConfigServer Security & Firewall allows... — CVE ThreatInt

• A Time-of-check Time-of-use (TOCTOU) race condition leading to insecure symli... — CVE ThreatInt

• Tesseract: Out-of-bounds write in UnicharCompress via unvalidated recoder cod... — CVE ThreatInt

• Tesseract: Heap out-of-bounds write in LSTM::Forward via na_/gate-matrix dime... — CVE ThreatInt

• Tesseract: Heap out-of-bounds write/read in FullyConnected::Forward via layer... — CVE ThreatInt

• Tesseract: ReadNormProtos stack buffer overflowTesseract is an open source OC... — CVE ThreatInt

• rclone: source object names can escape the configured root on uploadrclone is... — CVE ThreatInt

• rclone: S3 multipart declared-length memory exhaustionrclone is a command-lin... — CVE ThreatInt

• rclone: RC per-server auth-proxy bypassrclone is a command-line program to sy... — CVE ThreatInt

• rclone serve s3: --auth-proxy without --auth-key authenticates nobody - full ... — CVE ThreatInt

• rclone: FTP cross-session auth-proxy backend confusionrclone is a command-lin... — CVE ThreatInt

• rclone: Directory metadata (chmod/chown/chtimes) applied through a planted sy... — CVE ThreatInt

• rclone local: crafted Range request against a translated symlink panics (DoS)... — CVE ThreatInt

• OpenMatter Network Realigns Leadership Team to Accelerate Global Commercial Growth — Cyber Security News

• At least three Turkish ministers received notifications from Apple warning that their iPhones may have been targeted by... — @campuscodi@mastodon.social

• Forgejo through 16.0.3 Critical RCE — r/netsec

• OpenPanel SQLi Bypasses Project Isolation (CVE-2026-88890) — thehackerwire.com (discovered)

• Technical Content Marketing for Cybersecurity: Writing for Buyers Who Distrust Marketing — securityboulevard.com (discovered)

• The Best AI SOC Platforms in 2026: An Honest Comparison — securityboulevard.com (discovered)

• Detection scaled. The loop did not. — securityboulevard.com (discovered)

• SloppyRAT: A New Tool For Ransomware Attacks — securityboulevard.com (discovered)