{"uuid": "47fb435d-e03d-4352-b57c-d606553f40e7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-100382", "type": "seen", "source": "https://gist.github.com/ichintu/6ea92f5d3523919a824d2395951afa6c", "content": "This daily cyber threat intelligence digest highlights three critical software vulnerabilities, a major legal sentencing, and one non-security community post. Key takeaways:\n\n\u2022 **MediaWiki (CVE-2026-100382):** Critical (CVSS 10.0) unauthenticated RCE via OS command injection in the ExternalData extension (v<3.7).  \n\u2022 **WordPress (AV26-952):** Critical path traversal in page-template resolution enabling conditional RCE in versions <7.1.2. The flaw is actively exploited in the wild and has been added to CISA\u2019s KEV database; immediate patching is required.  \n\u2022 **CliInvoke.Specializations (CVE-2026-100368):** High (CVSS 8.4) command injection in PowerShell/Cmd wrappers caused by improper handling of untrusted arguments containing double quotes. Patched versions and mitigation workarounds are available.  \n\u2022 **Legal/Incident:** A U.S. Army soldier received a 70-month prison sentence and ~$300K in restitution for hacking AT&T and Verizon to steal mobile metadata, impacting over 100 million customers.  \n\u2022 **Non-Technical:** The digest also includes a community event recommendation for a family squid dissection in Tennessee.  \n\n**Overall:** Organizations should prioritize patching MediaWiki, WordPress, and CliInvoke components, while the sentencing underscores ongoing insider threats targeting critical telecom infrastructure.", "creation_timestamp": "2026-09-26T00:00:32.000000Z"}