CVE-2026-93485 was fixed on September 17 in WordPress 7.1.1. An anonymous comment plants a script, an administrator opens the page, and the script uploads a plugin carrying a web shell. Affected versions go back to 4.7.
Perspective Coverage
7 publishers
- Builder
- Builder 35%
- Operator
- Operator 62%
- Investor
- Investor 3%
Reality
- Evidence79
- Adoption42
- Hype gap+14
- Incentives67
- Confidence70
CISA has rewired the Known Exploited Vulnerabilities catalog to a binding directive issued June 10, 2026. The inclusion criteria are unchanged; the deadlines and the paperwork copying them are not.
Reality
- Evidence70
- Adoption40
- Hype gap+10
- Incentives40
- Confidence65
CVE-2026-32475 carries a CVSS of 9.0 and needs nothing more than a published form with a file upload field. Patchstack says version 4.2.2 fixes it.
Perspective Coverage
4 publishers
- Builder
- Builder 34%
- Operator
- Operator 59%
- Investor
- Investor 7%
Reality
- Evidence70
- Adoption
- Insufficient
- Hype gap+25
- Incentives55
- Confidence68
CrowdSec kept a leaver's GitHub access open so he could finish some work, his laptop was hit by the TanStack npm compromise on May 11, and the repositories were copied on May 22 and posted to a forum on September 16.
Perspective Coverage
7 publishers
- Builder
- Builder 39%
- Operator
- Operator 52%
- Investor
- Investor 9%
Reality
- Evidence55
- Adoption
- Insufficient
- Hype gap+15
- Incentives65
- Confidence60
Orca Security found four abuse paths in one of the biggest AI agent skills marketplaces. The install counter accepts unauthenticated requests, and the security audit only reruns once a skill gets popular.
Reality
- Evidence48
- Adoption22
- Hype gap+18
- Incentives65
- Confidence55
A security scanner now owns the create, update and retire lifecycle for cloud configuration items. That moves the accuracy of IT's record of record onto whatever the scanner can reach.
Reality
- Evidence30
- Adoption15
- Hype gap+40
- Incentives85
- Confidence55
Claudia Buch's 7 July letter gives supervised institutions 116 days to produce named owners, resourcing and timelines, on the ECB's stated view that AI has changed the speed of cyber risk rather than its substance.
Reality
- Evidence58
- Adoption
- Insufficient
- Hype gap+20
- Incentives82
- Confidence55
Version 1.1 of the Agentic Security Initiative's guide enumerates T1 through T17, up from fifteen. Cite the version, and stop reviewing agents one tool call at a time.
Reality
- Evidence52
- Adoption
- Insufficient
- Hype gap+12
- Incentives74
- Confidence48