Vulnerabilities & CVEs

Threat actors are actively exploiting a critical authentication bypass vulnerability in JFrog Artifactory, just days after it was publicly disclosed. Security researchers at [watchTowr] have observed the flaw being leveraged in the wild to compromise instances. The vulnerability, tracked as CVE-2026-82329 with a CVSS score of 9.8, stems from an authentication weakness in the software's default configuration. Successful exploitation allows an unauthenticated attacker to bypass security checks entirely, granting them administrative access to the Artifactory instance. Once an attacker gains admin privileges, they can perform a range of high-impact actions, including: Generating persistent admin tokens for long-term, stealthy access. Modifying repository configurations or injecting malicious code into artifacts. Potentially exfiltrating sensitive binaries and metadata stored within the registry. Given the high CVSS score and the speed at which exploitation was observed, immediate action is critical for any organization running Artifactory. Prioritize patching your JFrog Artifactory instances to the latest available version immediately. Audit existing admin accounts and generated tokens for any signs of unauthorized creation or modification. Review access logs for suspicious activity, particularly from unknown IP addresses, occurring around or after the disclosure date. If you are unable to patch immediately, consider restricting network access to the Artifactory admin interface as a temporary mitigation. Source: The Hacker News Is your team patching this directly, or are you relying on cloud-managed updates for your Artifactory instances?

Nearly 22,000 internet-exposed Microsoft Exchange servers are still running unpatched builds, leaving them open to a high-severity authentication bypass that can let an attacker take over every mailbox on the system. The flaw allows remote exploitation without valid credentials, effectively granting full control over user accounts and mail data. The vulnerable versions remain exposed despite patches being available for some time. Administrators are urged to check their Exchange Server builds against the latest cumulative updates, as the attack vector does not require any user interaction. Successful exploitation can lead to data theft, mailbox hijacking, and further lateral movement inside a corporate network. Affected component: Exchange Server authentication mechanism Impact: Full mailbox takeover, unauthorized access to emails and attachments Attack vector: Remote, unauthenticated Mitigation steps include: Apply the latest Exchange Server cumulative updates immediately Verify no unknown or rogue accounts have been added since exposure Review IIS logs for suspicious authentication entries or anomaly patterns Restrict remote access to Exchange endpoints where possible If patching is not immediately feasible, administrators should consider placing Exchange servers behind a VPN or additional access controls to reduce exposure. Source: Unknown Is your organization among the exposed instances, and are you prioritizing the patch rollout or adding temporary access restrictions first?

Threat actors are actively exploiting two critical vulnerabilities in Langflow and Ruby on Rails, according to new findings from VulnCheck. The attacks are being used for credential probing and command-and-control (C2) operations, signaling a shift from simple exploitation to active, multi-stage campaigns. CVE-2026-0768 (CVSS score: 9.8): A flaw in Langflow caused by improper validation of user-supplied input, allowing attackers to execute arbitrary Python code in the context of the root user. CVE-2026-66066: A critical vulnerability in Ruby on Rails that is also being leveraged in the wild, though specific technical details regarding the exploitation vector were not disclosed in the report. The exploitation of these flaws highlights the urgency for administrators to patch affected systems immediately. For Langflow, the arbitrary code execution risk is particularly severe given the root-level privileges. For Ruby on Rails, the C2 activity suggests the flaw is being used to establish persistent access, likely targeting web-facing applications. If you are running vulnerable versions, consider the following immediate actions: Apply vendor-provided patches or updates as soon as they are available. Monitor logs for unusual outbound network connections tied to C2 behavior. Restrict access to management interfaces for Langflow and related services. Audit user accounts for signs of credential harvesting. Source: The Hacker News Given the root-level execution risk in Langflow, has your team already prioritized patching these instances, or are you relying on network segmentation to mitigate exposure?

Two security flaws in PaperCut NG and PaperCut MF — patched last week after being exploited in the wild — are now being leveraged in active data theft campaigns. The vulnerabilities, which were previously used as zero-days, allow attackers to gain unauthorized access to affected print management servers. The attacks reportedly follow a pattern where threat actors exploit the flaws to bypass authentication and execute arbitrary code. Once access is obtained, the attackers move laterally within the network to locate and exfiltrate sensitive documents, often targeting print queues and stored files. The print management software is widely deployed in enterprise environments, making these attacks particularly concerning for organizations that have not yet applied the updates. Affected software: PaperCut NG and PaperCut MF Patches: Released last week by the vendor Attack vector: Exploitation of the zero-day flaws leads to remote code execution and unauthorized data access Observed activity: Post-exploitation actions include data theft, with no ransomware or destructive behavior confirmed so far Administrators are strongly advised to verify that the latest patched versions are installed across all servers. In addition, monitoring print server logs for unusual login attempts or unexpected file access patterns is recommended. Network segmentation and restricting access to management interfaces can also reduce exposure. Source: Unknown Has your organization already applied the latest PaperCut patches, or are you still assessing exposure to these zero-day exploits?

The Cronos blockchain has resumed normal operations after being temporarily halted to contain a price-manipulation attack that drained approximately $74 million from the Tectonic lending protocol. The attacker exploited a vulnerability in the platform's pricing mechanics, allowing them to borrow large sums against artificially inflated collateral. The incident forced validators to pause the network to prevent further losses and stabilize the ecosystem. The attack targeted Tectonic’s use of price oracles, which are critical for determining asset values in lending markets. By manipulating the reported price of a token, the attacker was able to over-collateralize loans and walk away with funds far exceeding their actual deposit. Affected platform: Tectonic (tToken markets) Attack vector: Price manipulation via oracle data Estimated loss: ~$74 million Response: Temporary network halt, followed by a coordinated restart The Cronos team has since restarted the chain, and trading activity has resumed. Users are advised to check the status of their positions on Tectonic and stay alert for any further announcements from the protocol team regarding reimbursement or recovery plans. While the immediate threat appears contained, this incident highlights how dependent DeFi lending platforms are on reliable oracle feeds. Source: Unknown Have any of you been affected by this exploit, and what steps are you taking to assess your exposure on Tectonic?

Two unpatched vulnerabilities have been disclosed in Kaltura's HTML5 video player library, potentially allowing a remote, unauthenticated attacker to read arbitrary files from a server and execute code on it. The issues were reported by the CERT Coordination Center (CERT/CC) and both stem from the same unsafe deserialization flaw located in the mwEmbedLoader.php endpoint of the mwEmbed player. Because the flaws remain unpatched, there is currently no official fix available for affected deployments. CVE-2026-19913 – Allows arbitrary file read on the server. CVE-2026-19912 – Allows remote code execution via the same vulnerable deserialization path. Both vulnerabilities share a root cause, meaning a single successful exploit chain could potentially escalate from file disclosure to full code execution, depending on server configuration and the attacker's ability to reach the endpoint. The lack of a patch means administrators need to consider temporary mitigations, such as restricting access to the mwEmbedLoader.php endpoint via web application firewall rules or network-level controls, until an official update is released. The disclosure highlights a broader concern: third-party media libraries often run with elevated privileges on web servers, and a single unpatched component can undermine the entire hosting environment. It is advisable to audit any Kaltura-integrated systems for exposure to this endpoint and monitor for unusual requests targeting it. Source: The Hacker News Is your organization currently running Kaltura's mwEmbed player, and if so, what temporary controls are you putting in place while waiting for an official patch?

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has expanded its Known Exploited Vulnerabilities (KEV) catalog with six newly confirmed flaws, citing verified evidence of active exploitation in the wild. Among the additions is a high-severity vulnerability affecting Citrix NetScaler ADC and NetScaler Gateway, which has been flagged as an active attack vector. The newly added entries include a remote code execution flaw tracked as CVE-2019-1068, which impacts Microsoft Windows systems. This vulnerability is part of a broader batch that spans multiple vendors and platforms, including Linux-based products and Microsoft SQL Server. Citrix NetScaler ADC and NetScaler Gateway — high-severity flaw with confirmed exploitation. Microsoft SQL Server — vulnerability included in the KEV update. Linux kernel — security bug added due to observed malicious activity. Four additional vulnerabilities were also listed, though specific identifiers for all entries were not fully detailed in the advisory. CISA's KEV catalog serves as a critical resource for federal agencies and private organizations, mandating remediation within established deadlines under Binding Operational Directive (BOD) 22-01. While the exact patch timelines vary by severity, all listed flaws require immediate attention to mitigate risk. Organizations using affected products are strongly urged to review their exposure, apply vendor-provided updates, and monitor for indicators of compromise tied to these exploits. Source: The Hacker News Does your organization track the KEV catalog closely, and how are you prioritizing the NetScaler and SQL Server patches given the active exploitation evidence?

Security teams have spent years trying to shave seconds off their detection times, but AI is now shifting the battlefield to a more uncomfortable question: how much time do defenders actually have left to react? Modern AI models are being leveraged by attackers to automate vulnerability discovery, generate exploit code on the fly, and chain weaknesses together at a speed that traditional security operations simply weren't designed to match. The problem isn't just identifying another flaw anymore—it's that the window between an initial compromise and full lateral movement is collapsing. Attackers can now use AI to obfuscate payloads, mutate malware signatures, and adapt their tactics in real time based on the defenses they encounter. This fundamentally changes the economics of offense: what once took a skilled human analyst days can now be done in minutes. For defenders, this means the old "detect and respond" model is no longer sufficient. The focus needs to shift toward predictive readiness—building security operations that assume AI will be used against them and prepare automated responses accordingly. That involves integrating AI into your own defensive stack, not just as a faster SIEM, but as a proactive layer that can simulate attacker behavior, prioritize vulnerabilities by exploitability, and pre-stage threat hunting playbooks before an alert even fires. Building a security operations center ready for AI-powered attacks requires a few key shifts: Moving from reactive threat hunting to continuous AI-assisted red teaming that tests your environment against known AI-generated attack patterns Automating the triage process so human analysts are only pulled in for high-confidence, high-impact incidents rather than drowning in low-level alerts Ensuring your detection rules are updated against AI-generated variations of common exploits, not just static signatures Investing in behavioural analytics that can spot the subtle anomalies AI-driven intrusions often leave behind, rather than relying on known indicators of compromise Source: The Hacker News Has your team already integrated AI into your defensive workflows, or are you still relying on traditional detection methods to keep up with AI-driven attackers?

PaperCut has issued an urgent security advisory after confirming that threat actors are actively exploiting a vulnerability in its print management software. The flaw impacts all versions of both PaperCut NG and PaperCut MF, and the company has acknowledged verified customer incidents, stating it is treating the matter with the highest priority. The zero-day is being leveraged in live attacks, prompting the vendor to release an emergency patch targeting versions v25 and v26. Customers running any prior version are strongly advised to upgrade immediately to a patched release to mitigate exposure. Affected products: PaperCut NG (all versions prior to the emergency patch) PaperCut MF (all versions prior to the emergency patch) Mitigation steps: Apply the latest emergency patch provided by PaperCut for v25 and v26. If you are running an older version, upgrade to a supported, patched build without delay. Monitor your print server logs for suspicious activity or unauthorized access attempts. Restrict network access to PaperCut servers where possible. At this time, the vendor has not released detailed technical specifics about the vulnerability, but the active exploitation indicates a serious risk for organizations that rely on PaperCut for print management. Administrators should treat this as a priority and not delay patching. Source: The Hacker News Are any of you running PaperCut in your environment, and how quickly are you able to roll out the emergency patch?

Patches are now available for a critical vulnerability in cPanel and WebHost Manager (WHM) that could allow a single hosting customer to execute code as the root user. The flaw resides in the domain parking and addon domain functionality, potentially enabling a full server takeover. Tracked as CVE-2026-65643, this issue affects all supported versions of cPanel & WHM. The vendor has classified the severity as critical, urging administrators to apply the necessary updates immediately. Given that this requires no prior authentication beyond a standard hosting account, the risk of exploitation is significant for shared hosting environments. Key takeaways: Vulnerability in domain parking and addon domain functions leads to root-level code execution. Impacts all supported versions of cPanel & WHM. Patches are released; immediate updating is strongly advised. While specific technical details of the exploit chain are not yet public, the potential impact is severe. If you manage a server running cPanel, prioritizing this update is essential to prevent unauthorized root access. Administrators should verify their current version and ensure it is patched without delay. Source: The Hacker News Are you running a supported version of cPanel, and how quickly do you plan to roll out these patches to mitigate the risk of exploitation?

VulnCheck has identified two previously undocumented factory implants in firmware for routers manufactured by Shenzhen Zhibotong Electronics (ZBT). Each implant grants an unauthenticated remote attacker the ability to execute commands as root on affected devices, according to the firm's zero-day research team. The two implants, dubbed SPEAKINGSTONE and DARKLANTERN, are being tracked as CVE-2026-74232 and CVE-2026-74233, respectively. These are not post-exploitation backdoors added after the fact; they are present in the factory firmware itself, meaning devices ship with the vulnerabilities already in place. The implications are significant for any organization using ZBT hardware in their network infrastructure: Both implants allow remote code execution with root privileges, bypassing authentication entirely. Because the flaws are embedded in the firmware at the manufacturing stage, standard patching or reimaging may not remove them unless a vendor-supplied update specifically addresses the issue. Attackers exploiting these flaws would gain full control over the router, enabling traffic interception, persistent access, or use of the device as a pivot point into the broader network. At the time of writing, no vendor response or patching timeline has been mentioned in the report. Organizations using ZBT routers should treat them as untrusted and consider isolating them from sensitive network segments until a fix is confirmed. Source: The Hacker News Is your organization currently running any ZBT-based hardware, and if so, what steps are you taking to mitigate exposure while awaiting an official fix?

Multiple critical security flaws have been disclosed in popular WordPress plugins and themes, including WPMU DEV Dashboard, Avada, TranslatePress, Pods, and GiveWP. These vulnerabilities could allow attackers to achieve authentication bypass, account takeover, and arbitrary code execution, potentially leading to full site takeover. The issues were identified by security researchers at Wordfence and Patchstack, with the most severe being an authentication bypass flaw tracked as CVE-2026-76581 (CVSS score: 9.8). This particular vulnerability affects the WPMU DEV Dashboard plugin and could allow an unauthenticated attacker to log in as an administrator if certain conditions are met. Additional critical flaws were found in the other components: Avada (theme): A flaw that could allow authenticated attackers with subscriber-level access to execute arbitrary PHP code. TranslatePress (plugin): A vulnerability enabling account takeover via insufficient validation of user-supplied data. Pods (plugin): An issue that could lead to privilege escalation, allowing lower-privileged users to escalate their access. GiveWP (plugin): A flaw that could permit authenticated attackers to upload malicious files, leading to remote code execution. Given the severity of these vulnerabilities, administrators are strongly advised to update all affected plugins and themes to their latest patched versions immediately. Additionally, it is recommended to: Review user roles and permissions to ensure no unauthorized privilege escalation has occurred. Audit site logs for any suspicious login activity or file uploads. Enable a Web Application Firewall (WAF) to help mitigate exploitation attempts. These vulnerabilities are particularly dangerous because WordPress powers a substantial portion of the web, making it a prime target for automated attacks. Source: The Hacker News Are any of you currently running WPMU DEV Dashboard or Avada, and if so, what steps are you taking to verify your sites haven't been compromised before patching?

ServiceNow has shipped patches for four security vulnerabilities affecting its AI Platform, with three of them carrying a perfect CVSS 10.0 severity rating. Under specific conditions, these flaws could be exploited by an unauthenticated attacker, potentially leading to arbitrary code execution or SQL injection. The vendor has already deployed a security update to its hosted instances and provided the corresponding fixes to partners and self-hosted customers. Organizations running their own instances are urged to apply the updates immediately, as the risk of exploitation remains high given the maximum severity score. Three of the four flaws are rated 10.0 on the CVSS scale. The vulnerabilities affect the ServiceNow AI Platform. Exploitation may allow unauthenticated code execution or SQL injection. Patches are available for hosted, partner-managed, and self-hosted environments. Given the critical nature of these issues, administrators should prioritize verifying their patch status and confirming that no unauthorized access has occurred within their environments. Source: The Hacker News Has your organization completed the patching process for these ServiceNow vulnerabilities, and are you monitoring for any signs of exploitation?

Security researcher Olivier Laflamme has disclosed two independent root remote code execution (RCE) chains affecting the Unitree G1 EDU humanoid robot, with one attack vector requiring only Bluetooth proximity to fully compromise the system. The first flaw, tracked as CVE-2026-76639, involves a network-adjacent exploitation path that chains through the chat_go service and bashrunner component. This route allows an attacker on the same network to escalate privileges to root on the robot's Locomotion PC without authentication. The second vulnerability, CVE-2026-76640, is notably more severe in terms of attack scope. It enables a remote attacker to trigger the same root-level compromise over Bluetooth Low Energy (BLE), meaning an adversary within wireless range of the robot can achieve full system control without any prior network access. Affected product: Unitree G1 EDU humanoid robot Impact: Root-level remote code execution Attack vectors: Network-adjacent (via chat_go/bashrunner) and BLE proximity Both chains ultimately lead to complete control of the Locomotion PC, which handles critical locomotion and navigation functions. Laflamme's disclosure highlights the growing attack surface in consumer-grade robotics, where embedded systems often prioritize functionality over security hardening. Source: The Hacker News Are you or your team deploying Unitree robots, and if so, how are you isolating the BLE and network interfaces from untrusted environments?

CISA has added a critical ownCloud vulnerability to its Known Exploited Vulnerabilities (KEV) catalog after reports emerged of active exploitation targeting a nuclear research organization in the Philippines. The flaw, tracked as CVE-2023-49105 with a CVSS score of 9.8, is being leveraged by a Chinese-speaking threat actor according to available reporting. The vulnerability is a case of improper authentication handling within ownCloud, allowing an attacker to bypass authentication mechanisms and gain unauthorized access to sensitive files. In this particular campaign, the threat actor used the flaw to steal nuclear-related records from the Philippine research body. Affected component: ownCloud core (specific versions were not disclosed in the initial advisory) Impact: Authentication bypass leading to full file disclosure and potential data exfiltration CVSS v3.1 score: 9.8 (Critical) Given the addition to the KEV catalog, federal agencies and organizations running ownCloud are strongly advised to prioritize patching immediately. Even if your organization is not in the nuclear or energy sector, adversaries often reuse infrastructure and TTPs across industries, so this should be treated as an active threat. Mitigation steps to consider: Apply the official ownCloud security patch for CVE-2023-49105 without delay. Audit access logs for unusual authentication patterns or large data exports. Review any exposed ownCloud instances for signs of compromise, especially if internet-facing. Monitor for secondary payloads or credential harvesting activity. Organizations that cannot patch immediately should consider taking ownCloud instances offline or restricting access to trusted networks only. If you suspect exposure, incident responders should treat this as a potential data breach and conduct a thorough forensic review of file access history. Source: The Hacker News Has your team already patched CVE-2023-49105, or are you still assessing your exposure to this authentication bypass?

Malicious actors are actively exploiting a newly patched vulnerability in PaperCut NG and PaperCut MF to execute arbitrary code on susceptible instances, prompting the vendor to release an emergency security update with additional hardening measures. The flaw stems from a configuration issue that allows an unauthenticated attacker to gain remote control over PaperCut's trusted configuration settings. By chaining this weakness with another flaw, attackers can execute arbitrary Java code within the application's environment without requiring any user credentials. This effectively grants full remote control over the print management server, a critical asset in many enterprise networks. The vendor has since pushed out an emergency fix. Administrators are strongly urged to apply the patch immediately, as the vulnerability is confirmed to be under active exploitation in the wild. Given the unauthenticated nature of the attack chain, any internet-exposed PaperCut server is at high risk. For security teams, the key takeaways are: Immediately update PaperCut NG and PaperCut MF to the latest patched version. Audit server logs for any unusual Java process executions or unexpected configuration changes. Restrict access to the PaperCut admin interface and application ports where possible. Monitor the vendor's advisory page for any follow-up hardening guidance. This latest incident underscores a troubling trend: attackers are increasingly chaining multiple logic flaws to bypass authentication entirely, making prompt patch management more critical than ever. Source: The Hacker News Given the active exploitation, how is your organization handling the rollout and verification of this emergency patch for your print infrastructure?

Cosmos Labs has disclosed that a critical balance-handling flaw in the shared Cosmos EVM module was actively exploited to drain funds from six different blockchains between August 20 and August 25, 2026. The issue, tracked as GHSA-7g4w-cg88-2cq2, has been rated Critical by the team, though the advisory was published without a CVE identifier, a weakness classification, or a CVSS score. The vulnerability impacts versions < 0.6.2 and >= 0.6.2 (with the patch applied in a later release). According to the advisory, the flaw resides in how the module handles balance adjustments, allowing an attacker to manipulate accounting logic under specific conditions. Affected versions: All releases prior to the patched 0.6.2 update. Exploitation window: August 20–25, 2026, across six unnamed chains. Impact: Unauthorized draining of funds due to incorrect balance state transitions. Cosmos Labs has urged all operators running the EVM module to upgrade immediately, as the issue is known to be exploitable in the wild. No further technical specifics or indicators of compromise were shared in the public notice. Source: The Hacker News Is your team already running the patched 0.6.2 build, or are you still assessing exposure across your chain's validators?

PaperCut has shipped a second emergency security update for its PaperCut NG and PaperCut MF print management platforms, addressing two vulnerabilities that are being actively exploited in the wild. The move comes after security researchers identified several methods to bypass the patches issued in the previous emergency release. The initial fixes were found to be insufficient, as attackers could still reach the vulnerable code paths through alternate means. This prompted the vendor to issue another out-of-band update to close the remaining loopholes. The flaws are being leveraged in real-world attacks, making immediate deployment critical for administrators running affected versions. Affected products: PaperCut NG and PaperCut MF Priority: Apply the latest emergency patch immediately Action required: Update all internet-facing and internal print servers without delay The new patches are available through the standard PaperCut update mechanism. Organizations that have not yet applied the first emergency update should install this latest version directly, as it supersedes the previous one. Administrators are also advised to review their print server logs for any signs of unauthorized access or suspicious activity linked to these exploits. Source: Unknown Is your team planning to fast-track this second patch, or are you waiting to see if further bypasses emerge before updating your print servers?

A maximum-severity flaw has been disclosed in GiveWP, a popular WordPress donation and fundraising plugin, which could allow unauthenticated attackers to execute arbitrary commands directly on the hosting server. The vulnerability stems from a PHP Object Injection issue within the plugin’s handling of user-supplied input, leading to remote code execution. Given the plugin’s widespread use by non-profits and fundraising sites, the risk of exploitation is considered critical. The security issue affects GiveWP versions prior to 3.19.3. The flaw is triggered through a specific chain that , when combined with a separate gadget in the WordPress core, allows the attacker to achieve full server-side command execution without requiring any authentication. Because no login or special permissions are needed, any visitor to a vulnerable site could potentially compromise the entire server, including other hosted sites or data. The vulnerability was discovered by security researcher villu164, who reported it through the WPScan initiative. The patch was quietly included in the stable release, and administrators are strongly advised to update immediately. Failure to do so could expose donation records, personal donor information, and server credentials. In addition to upgrading, site owners should audit their logs for suspicious activity and review file integrity for signs of backdoors. Affected: GiveWP versions prior to 3.19.3 Action required: Update to version 3.19.3 or later Impact: Unauthenticated remote code execution via PHP Object Injection Source: Unknown Given how many donation and non-profit sites rely on GiveWP, has your organization already applied the latest update, and what steps are you taking to verify whether any suspicious server-side activity occurred before the patch was released?

More than 8,300 internet-exposed Gitea instances remain unpatched against a critical remote code execution flaw that is now being actively exploited in the wild, according to the cybersecurity watchdog Shadowserver. These vulnerable servers are thought to be running older versions of the self-hosted Git service that lack fixes for the underlying issue, leaving them open to attacks that can lead to full system compromise. Shadowserver’s telemetry indicates the exposure is widespread, with many administrators yet to apply the necessary updates despite the public availability of patches. The vulnerability, which allows unauthenticated attackers to execute arbitrary code on affected installations, is especially dangerous because Gitea is often deployed on internal networks or used to manage sensitive source code. Successful exploitation can give attackers a foothold to steal credentials, tamper with repositories, or move laterally within an organisation. Security researchers urge administrators to treat this as an urgent priority rather than a routine update, given the confirmed exploitation activity. For those responsible for Gitea deployments, the immediate steps are straightforward: Identify all instances of Gitea running in your environment, including those on less obvious hosts or containers. Check the version number of each instance against the patched releases listed in the official Gitea security advisories. Upgrade to the latest stable version as soon as possible, as older branches may not receive backported fixes. If immediate patching is not feasible, restrict network access to the Gitea web interface and API until updates can be applied. Review access logs for unusual requests or unexpected administrative actions that may indicate prior compromise. Given the active exploitation and the scale of exposure, delaying the update is a significant risk. Even smaller deployments that are not directly internet-facing should be patched, as attackers often pivot through adjacent systems. Source: BleepingComputer Is your organisation running any public-facing Git services, and have you already verified which version you are on?