Drupal, Ghost, and Apex One Hit Active Exploitation. Apex One Has a June 4 Federal Deadline.
Big Picture
Three actively-exploited code-level CVEs landed at once, and CISA put a federal June 4 patch deadline on the worst of them (Trend Micro Apex One on-prem). Researchers separately showed soft-target zero-day discovery is now a $20 problem, and the Laravel Lang supply-chain attack used a tactic that quietly defeats version pinning. Worth a read even if you do not run PHP.
Action this week: If you run Trend Micro Apex One on-prem, patch by June 4 (CISA federal mandate). If you run Drupal core on PostgreSQL or Ghost CMS 3.24–6.19, patch immediately — both are under active automated exploitation. If your critical-patch SLA is 30 days, this is the week it shows up in your next quarterly review.
TL;DR
Three Live CVEs Hit at Once, and One Has a Federal Clock
Drupal SA-CORE-2026-004 (CVE-2026-9082) is an unauthenticated SQL injection in Drupal core's database abstraction API affecting PostgreSQL-backed sites; Imperva observed over 15,000 exploitation attempts across nearly 6,000 sites in 65 countries within days of disclosure. A separate SQL injection in Ghost CMS (CVE-2026-26980, CVSS 9.4), affecting versions 3.24.0 through 6.19.0, was used to compromise 700+ sites in a ClickFix campaign that stole Admin API keys to inject malicious JavaScript loaders.
The third one is on a government clock. Trend Micro Apex One (on-prem) CVE-2026-34926 is a directory-traversal flaw in the management console; CISA added it to KEV with a federal remediation deadline of June 4.
Takeaways
If your critical-patch SLA is still 30 days, that is the gap to flag for your next quarterly review.
Google Repositioned CodeMender Inside Agent Platform
Google DeepMind introduced CodeMender in October 2025 as a standalone agent that found and patched vulnerabilities, claiming 72 upstreamed fixes across codebases as large as 4.5 million lines. At I/O 2026, Google announced CodeMender is now a component of its broader Agent Platform, bundled with identity, gateway, and observability rather than offered as a standalone product. Enterprise Management Associates' Chris Steffen read the move as a strategy pivot rather than a product update.
GitLab made a parallel move the same week with native secrets management and AI merge-request workflows in 19.0, suggesting platform-bundled AppSec is the emerging vendor pattern, not the exception.
Takeaways
If you were evaluating CodeMender as a standalone remediation agent, the procurement question changed this week: it is now a platform component, not a point tool.
$20 Per WordPress Plugin Zero-Day
Researchers from TrendAI and CHT Security presented a pipeline at Ekoparty Miami that finds WordPress plugin zero-days for roughly $20 each, built in three days, pairing AI-driven static analysis with automated Docker provisioning and Chrome DevTools MCP verification. That $20 figure applies to a soft target (single-file PHP plugins with a known attack surface), not arbitrary enterprise code.
Takeaways
The throughput, not the technique, is the part to watch — the WordPress plugin marketplace is north of 60,000 extensions, and that is where discovery economics matter most.
The Laravel Lang Attack Defeats Version Pinning
The Laravel Lang compromise on Packagist did not drop a malicious new package. Attackers rewrote GitHub tags so 200+ historical releases were republished with a credential stealer targeting cloud keys, SSH credentials, and browser data through Composer installs; Aikido confirmed the payload reach across more than 200 versions. Pinning a version or trusting an SBOM assumes the bytes behind a version number do not change. Tag rewriting changes them while the number stays put. The same actor cluster (TeamPCP / Mini Shai-Hulud) also hit TanStack on npm, and Grafana confirmed codebase theft through that vector.
Takeaways
If your supply-chain control is version pinning plus an SBOM, this is the attack it does not catch.
Vulnerabilities in the Wild
This week: 50+ items tracked | 3 actively exploited | 1 zero-day | 4 supply-chain incidents
• CVE-2026-9082 — Drupal core (PostgreSQL sites) Severity: Critical | Impact: Unauthenticated SQL injection | Status: Actively exploited (15,000+ attempts, ~6,000 sites)
• CVE-2026-34926 — Trend Micro Apex One (on-premise) Severity: High (CVSS 6.7–7.8) | Impact: Directory traversal in the console | Status: Zero-day, in CISA KEV, federal fix-by June 4
• CVE-2026-26980 — Ghost CMS (3.24.0–6.19.0) Severity: Critical (CVSS 9.4) | Impact: Unauthenticated Content API SQLi, Admin API key theft | Status: Actively exploited (700+ sites, ClickFix)
• CVE-2026-27886 — Strapi (4.0.0–5.36.1) Severity: Critical | Impact: Boolean-oracle exfiltration of admin reset token, account takeover | Status: Disclosed (20,000+ exposed hosts)
• CVE-2026-0265 — Palo Alto PAN-OS (CAS-enabled) Severity: Critical | Impact: JWT forgery, authentication bypass as any trusted user | Status: Disclosed with detection tooling
• Underminr — Shared CDNs / trusted-domain routing Severity: High | Impact: Hides malicious connections behind trusted domains to bypass checks | Status: Disclosed (affects millions of sites)
• Chromium Service Worker flaw — Chromium (Chrome, Edge, Opera) Severity: High | Impact: Persistent JS execution across restarts; browser hijack for DDoS/crypto-mining | Status: Unpatched, details leaked
Curated Reading List
Six reads that earn the slot.
AI Tooling Watch
When the Scanner Starts Thinking: Mythos & GPT 5.5 Cyber in Security Testing — Why it's worth your time: Zscaler's defender-side read on frontier models that reason across attack paths rather than pattern-match. Useful if you are evaluating LLM-assisted security tooling.
Anthropic Patches a Claude Code RCE Flaw Triggered by a Crafted Deeplink — Why it's worth your time: If your developers use AI coding assistants, this is the attack-surface example to walk them through. Click a link, lose the box.
Thought-Provoking
We Hardened zizmor's GitHub Actions Static Analyzer — Why it's worth your time: Trail of Bits validated zizmor against 41,253 real workflows from 6,612 top repos to close YAML-anchor blind spots in GitHub Actions static analysis.
Navigating Lax Load Balancers: When an Intersection Gets You Inside — Why it's worth your time: A practical walk through how AWS ALB listener-rule chains become an authentication-bypass surface. The kind of misconfiguration no CVE will ever flag.
Current Events
UK Cybercrime Journal: Inside the Cl0p Attack on South Staffs Water — Why it's worth your time: Cl0p sat undetected in a UK water utility for nearly two years; the ICO fined them £963,900 and documented zero vulnerability scans over an 18-month window.
Deleted Google API Keys Keep Working for Up to 23 Minutes — Why it's worth your time: Aikido found Google API key revocation is not instant. A small, concrete fact that should change how you sequence incident response after a key leak.
AppSec Weekly is curated by the Pixee team from open-source security feeds and analyst reports. We cover what AppSec leaders, CISOs, and engineering executives need to track without reading 100 RSS feeds.
Previous AppSec Weekly editions: May 17-19 — A Windows Bug Microsoft Fixed in 2020 Is Live Again, May 11-12 — SLSA Cleared the Malware.
