Emphere

Your Dockerfile has layers. We secure every one. Keep your images. Lose the CVEs.

[Emphere @empherehq]

We dived into CVE-2026-50006 and the patch shape that addressed it, ran the vulnerable and fixed anyquery server binaries against a real MySQL client.

The server accepted real MySQL wire traffic, passed ATTACH DATABASE to SQLite with no auth, and let an unauthenticated client write bytes to disk.

https://t.co/rm9oj52fxL

[Emphere @empherehq]

Full teardown: https://t.co/sIXrHtcfuG

[Emphere @empherehq]

1/4
We did our own breakdown of #wp2shell, the WordPress chain Adam Kues of Assetnote reported.

The useful shape: public REST collection, batch routing drift, wrong schema check, raw string into WP_Query.

[Emphere @empherehq]

4/4
Most wp2shell coverage carries this through to critical RCE.

Our teardown was focused on what the Assurance reproduced: unauthenticated SQL injection reachability, red on 7.0.1 and green on 7.0.2 at focused fidelity.

[Emphere @empherehq]

3/4
CVE-2026-63030 let a crafted batch request skip that type check.

CVE-2026-60137 was the sink: WP_Query accepted the raw string as author__not_in and built it into the SQL WHERE clause through implode().

[Emphere @empherehq]

https://t.co/e1OYBycw9R

[Emphere @empherehq]

https://t.co/gZuWuL4Z0M

[Emphere @empherehq]

A 1.0% EPSS score looks comforting until the CVE is already in KEV.

CVE-2026-46817 was patched in Oracle's May CPU, exploited around June 27, and added to CISA KEV on July 15. No public PoC was needed.

That is the blind spot: proprietary enterprise software can be weaponized fast after a patch, before the public signals EPSS tends to reward ever show up.

Scoring helps. It just cannot be the whole queue.

[Emphere @empherehq]

8/8
With EOL projects, disarming the unfixables is the only viable path to keep services alive and safe until migration

[Emphere @empherehq]

1/8
CVE-2026-63087 is a live 9.8 in Grafana OnCall self-hosted.

The project was archived on June 5, 2026.

That makes this one literal: affected installs have an unauthenticated auth bypass, and no upstream patch is coming.

[Emphere @empherehq]

7/8
That is the fix: put BasePluginAuthentication on the self-hosted install view, the same guard its sibling view already has.

No URL continuity check. The URL is operator config. The token is the hostile input.

[Emphere @empherehq]

NVD status: Awaiting enrichment. Ref: https://t.co/rpx7JF1e01

[Emphere @empherehq]

https://t.co/dzstAklCaI

[Emphere @empherehq]

FortiSandbox has two command-injection CVEs in CISA KEV as of 2026-07-16: CVE-2026-39808 and CVE-2026-25089. The due date is 2026-07-19.

But exploitation was reported in mid-June. That leaves roughly a month between confirmed in-the-wild activity and the formal signal many patch SLAs use to start the clock.

The third patched FortiSandbox issue, CVE-2026-39813, is the auth-bypass piece of the chain and is not on KEV.

For systems that issue threat verdicts to the rest of the stack, KEV timing is not a proxy for risk timing.