Wing FTP Server before 8.1.3 contains an authenticated remote code execution vulnerability in the session serialization mechanism that allows authenticated administrators to inject arbitrary Lua code through the domain admin mydirectory field. Attackers can exploit unsafe serialization of session values into Lua source code without proper escaping of closing delimiters, causing the injected code to be executed when the poisoned session is loaded via loadfile().

Most of today's newly disclosed CVEs will never become operationally relevant.

These are the signals that stood out to me from today's vulnerability activity.

1. Palo Alto PAN-OS is now on KEV

CVE-2026-0257

Added to the CISA KEV catalog Confirmed in-the-wild exploitation Authentication bypass vulnerability

For most enterprises, a KEV-listed vulnerability on an internet-facing security appliance deserves immediate attention. Attackers consistently prioritize edge infrastructure because it often provides privileged network access and visibility.

2. Langflow now has public exploit activity

CVE-2026-0770

Public exploit / PoC available Remote Code Execution Exploit activity linked

What caught my attention here isn't just the RCE itself, but the continued trend of vulnerabilities emerging around AI workflow tooling and self-hosted LLM infrastructure.

Once public exploit code appears, opportunistic scanning typically follows.

3. Windows privilege escalation vulnerability saw a major EPSS increase

CVE-2019-0543

EPSS moved:

25% → 43% (+18%)

That's one of the largest EPSS increases observed today.

EPSS isn't proof of exploitation, but large upward moves often indicate growing attacker interest before broader exploitation becomes visible.

Other signals worth watching

Wing FTP Server

CVE-2026-44403

Public exploit / PoC linked Authenticated RCE Organizations exposing FTP infrastructure should review patch status.

WordPress ecosystem

Two vulnerabilities showed exploit activity today, including:

CVE-2026-1830 (Quick Playground Plugin RCE)

WordPress remains one of the most consistently targeted attack surfaces due to deployment volume and plugin fragmentation.

Apache ActiveMQ

CVE-2026-34197

EPSS increased:

70% → 84% (+14%)

A high EPSS score getting even higher is usually more interesting than a low-score vulnerability moving a few points.

My patching priority order today

1. PAN-OS (KEV) 2. Langflow RCE 3. Wing FTP Server 4. Apache ActiveMQ 5. Windows privilege escalation cases with rising EPSS

Curious how others prioritize vulnerabilities internally.

Do you treat KEV as the primary signal, or are EPSS changes becoming part of your patch prioritization process?