Gitea Authentication Bypass 🔴, CISA Adds ColdFusion to KEV 🔴, Cavern Manticore Iran C2 🎯, Accenture Confirms 35 GB Breach 🎯, Ubiquiti 7 Critical Patches ⚠️

The defining story is the Gitea authentication bypass under active exploitation. CVE-2026-20896: Gitea Docker Images Under Active Exploitation, Authentication Bypass via Single HTTP Header is a CVSS 9.8 flaw from the official Docker image shipping with REVERSE_PROXY_TRUSTED_PROXIES set to a wildcard, so any source IP is trusted. With reverse-proxy authentication enabled, anyone reaching the HTTP port sends one X-WEBAUTH-USER header and impersonates any user, including an administrator. Roughly 6,200 Gitea instances are internet-exposed, and the first in-the-wild hit came 13 days after disclosure. Update to 1.26.3 or later, where the setting is opt-in.

The most consequential new campaign is Cavern Manticore: Iran MOIS Deploys Modular Cavern C2 Framework Against Israeli IT Providers. The cluster abuses SysAid's software update mechanism for DLL side-loading, then fetches five post-exploitation modules covering file operations, database enumeration, Active Directory reconnaissance, network scanning, and SOCKS5 tunneling. It deliberately chains trusted IT provider relationships, pivoting through one managed-service firm to reach the next target, making RMM access logs a primary hunting surface.

Two supply-chain threads matter. Cordyceps, a class of GitHub Actions weaknesses spanning pull_request_target and workflow_run triggers, is exploitable in more than 300 major repositories, and every affected pipeline passed standard scanners. The Tenda backdoor CVE-2026-11405 ships hardcoded in firmware with no patch, and Accenture confirmed a breach in which roughly 35 GB of source code were reportedly stolen.

Watchlist: patch Gitea and audit reverse-proxy auth configs, hunt SysAid DLL side-loading and RMM lateral movement, prefer pull_request over pull_request_target, and disable remote management on Tenda devices.