Daily Threat Briefing
← All briefings

Invoice Generator plugin for WordPress · libssh2 · Gitea act_runner with Docker backend

DAILY THREAT INTELLIGENCE BRIEFING Date: 2026-06-28 Prepared for: SOC Analysts | Incident Responders | Vulnerability Management | Security Leadership

EXECUTIVE SUMMARY

Today’s most notable new items are two libssh2 memory-safety vulnerabilities (CVE-2026-58050 and CVE-2026-58051) affecting all deployments through version 1.11.1, a critical privilege escalation in the WordPress Invoice Generator plugin (CVE-2026-12415, EPSS 0.66), and a container escape risk in Gitea act_runner (CVE-2026-58053). Russian intelligence’s fake-SMS credential theft campaign targeting European and Ukrainian officials has received additional public reporting. No new CISA KEV additions or BSI advisories were published in the last 24 hours.

CRITICAL VULNERABILITIES

NEW

CVE-2026-12415 (WordPress Invoice Generator plugin)

  • Affected products: Invoice Generator plugin for WordPress, versions up to and including 1.0.0
  • Severity: CVSS 9.8
  • EPSS: 0.66 — high exploitation probability
  • Technical detail: A missing capability check on the pravel_invoice_edit_account() AJAX action allows any authenticated user, regardless of role, to escalate privileges. Because WordPress AJAX endpoints are accessible to any logged-in user by default, exploitation requires only a low-privilege account such as a subscriber. The flaw is unauthenticated in practice on sites with open registration. EPSS of 0.66 indicates a high likelihood of active exploitation in the near term given the large WordPress attack surface.
  • Exploitation status: No confirmed in-the-wild exploitation reported; EPSS score warrants urgent treatment.
  • Remediation: Update the Invoice Generator plugin to a patched version when available. If no patch is yet released, disable the plugin immediately. Audit WordPress user roles for unexpected privilege changes.

CVE-2026-58050 and CVE-2026-58051 (libssh2)

  • Affected products: libssh2 through version 1.11.1 (all platforms)
  • Severity: CVSS 8.3 (both)
  • EPSS: 0.0 (newly published; no exploitation observed yet)
  • Technical detail: CVE-2026-58050 allows an attacker-controlled 32-bit attribute count read from a publickey-subsystem response to drive an unbounded heap allocation (num_attrs * sizeof(libssh2_publickey_attribute)), enabling heap overflow or memory exhaustion against any client using the publickey subsystem. CVE-2026-58051 is a related flaw where SSH2_REALLOC grows the publickey list without zero-initializing new entries; a parse failure in the cleanup path can expose uninitialized heap memory to the remote peer. Both flaws are exploitable by a malicious SSH server responding to a connecting client. libssh2 is embedded in a wide range of applications including PHP, curl, and numerous DevOps tools, broadening the attack surface significantly.
  • Exploitation status: No exploitation confirmed.
  • Remediation: Update libssh2 to a patched release when available. Audit applications and libraries that bundle libssh2 (PHP, curl, Filezilla, etc.) and apply vendor updates. Restrict SSH client connections to trusted servers where operationally feasible.

CVE-2026-58053 (Gitea act_runner — Docker backend)

  • Affected products: Gitea act_runner with Docker backend, through act version 0.262.0
  • Severity: CVSS 9.4
  • EPSS: 0.0 (newly published)
  • Technical detail: The act_runner passes a workflow’s container.options string directly to the Docker job container’s HostConfig without sanitization. Even when the runner is configured with privileged: false, a crafted workflow can inject Docker flags that re-enable privileged mode or mount host paths, effectively achieving a container escape. Any user with write access to a Gitea repository whose CI/CD pipelines run on a self-hosted act_runner with the Docker backend is a potential attacker. This is particularly relevant for organizations running shared Gitea CI infrastructure.
  • Exploitation status: No exploitation confirmed.
  • Remediation: Upgrade act_runner beyond version 0.262.0 when a patched release is available. In the interim, restrict repository write access to trusted users, disable the Docker backend on shared runners, or run act_runner in isolated environments with no access to sensitive host resources.

CVE-2026-58049 (FFmpeg — RASC video decoder)

  • Affected products: FFmpeg through commit bcd2c69e087a09b07cf45c6bd2428ee1ccb2925c
  • Severity: CVSS 8.8
  • EPSS: 0.0 (newly published)
  • Technical detail: The RASC video decoder’s decode_dlta function performs 32-bit reads and writes at the row cursor before the NEXT_LINE row-boundary check, and validates the DLTA region in pixel rather than byte units. A crafted video file can trigger out-of-bounds writes in the decoder heap. FFmpeg is widely used in media processing pipelines, transcoding services, and applications that accept user-supplied video content. Exploitation requires processing a malicious video file.
  • Exploitation status: No exploitation confirmed.
  • Remediation: Update FFmpeg to a commit beyond the affected revision. Organizations running automated media ingestion or transcoding pipelines should prioritize patching and consider sandboxing FFmpeg processes.

ONGOING

  • CVE-2026-46331 (Linux Kernel pedit COW): public working exploit; apply distribution kernel patches immediately.
  • CVE-2026-43503 (Linux Kernel DirtyClone): public exploit walkthrough; apply distribution kernel patches.
  • CVE-2026-49869 / CVE-2026-53576 (Kestra): CVSS 10.0 unauthenticated API bypass; upgrade to 1.0.45 or 1.3.21.
  • CVE-2026-54350 (Budibase): CVSS 10.0 unauthenticated database read; upgrade to 3.39.12.
  • CVE-2026-52785 (OpenProject): SQL injection and RCE batch; upgrade to 17.3.3 or 17.4.1.
  • CVE-2026-20262 / CVE-2026-20245 (Cisco Catalyst SD-WAN Manager): actively exploited; CISA KEV deadline 2026-06-29 — patch immediately.

EUROPEAN ADVISORIES

No new BSI WID or CERT-EU advisories were published in the last 24 hours.

The following previously reported BSI advisories remain open and require action: WID-SEC-2026-2093 (Keycloak), WID-SEC-2026-2091 (PowerDNS), WID-SEC-2026-2096 (Fluentd), WID-SEC-2026-2085 (WSO2 API Manager), and WID-SEC-2026-2089 (Coolify) — apply vendor patches per yesterday’s guidance.

Note: CISA KEV deadlines for CVE-2026-12569 (PTC Windchill/FlexPLM) and CVE-2026-20230 (Cisco Unified CM) fell on 2026-06-28. Confirm remediation is complete for both.

ACTIVE THREATS AND CAMPAIGNS

STATUS CHANGE — Russian Intelligence Fake-SMS Messaging Credential Theft The SSU and FBI have jointly confirmed a long-running Russian intelligence campaign using fraudulent support text messages to steal messaging application credentials from government officials, military personnel, politicians, and activists in Ukraine, Europe, and the United States. This is a material expansion of the previously reported Signal phishing campaign: the operation now encompasses broader messaging platforms and uses SMS-based social engineering as the primary lure, not just in-app device-linking prompts. European government and diplomatic organizations should treat any unsolicited support messages referencing messaging accounts as high-confidence phishing attempts and brief staff accordingly.

ONGOING — SharkLoader / StrikeShark: Cobalt Strike loader campaign targeting government and diplomatic organizations; apply Kaspersky IOCs to EDR and SIEM. ONGOING — Turla STOCKSTAY: .NET backdoor targeting Ukrainian government and Italian foreign policy entities; apply GTIG IOCs. ONGOING — Miasma supply chain malware: targeting npm and GitHub Actions; audit CI/CD pipeline dependencies. ONGOING — Microsoft-tracked hotel phishing campaign: photo ZIP lures dropping Node.js implant targeting European hospitality sector.

SECURITY NEWS AND CONTEXT

A newly documented attack technique shows that AI coding agents can be tricked into executing malware by cloning a seemingly clean GitHub repository containing a payload invisible to security scanners and human reviewers; organizations using agentic development tools should review sandbox controls around automated code execution. The German government has disclosed, after years of silence, that use of “stealth SMS” (stille SMS) for covert location tracking has dropped significantly, following parliamentary pressure for transparency on the surveillance technique.

RECOMMENDED ACTIONS

  1. Update or disable the WordPress Invoice Generator plugin (CVE-2026-12415, EPSS 0.66) — privilege escalation exploitable by any authenticated user; audit for unexpected role changes.
  2. Update libssh2 beyond version 1.11.1 (CVE-2026-58050, CVE-2026-58051) — patch all applications bundling libssh2 including PHP, curl, and DevOps tooling.
  3. Upgrade Gitea act_runner beyond 0.262.0 (CVE-2026-58053) — restrict repository write access on shared runners pending patch availability.
  4. Update FFmpeg beyond the affected commit (CVE-2026-58049) — sandbox media processing pipelines handling untrusted video content.
  5. Confirm completion of PTC Windchill/FlexPLM (CVE-2026-12569) and Cisco Unified CM (CVE-2026-20230) remediation — CISA KEV deadline was today, 2026-06-28.
  6. Patch Cisco Catalyst SD-WAN Manager (CVE-2026-20262, CVE-2026-20245) — CISA KEV deadline 2026-06-29; treat as emergency.
  7. Brief staff on expanded Russian intelligence SMS-based messaging credential theft campaign — any unsolicited support messages referencing messaging accounts should be treated as phishing.
  8. Enforce sandbox controls around AI coding agents and agentic development tools — restrict automated code execution to isolated environments.
  9. Continue remediation of previously reported items: CVE-2026-46331 and CVE-2026-43503 (Linux kernel), Kestra CVSS 10.0 flaws, Budibase CVE-2026-54350, OpenProject patch batch, Keycloak, PowerDNS, Fluentd, WSO2 API Manager.