Morning Review in IT Security — August 18, 2026

The cybersecurity landscape continues to face significant threats as critical vulnerabilities emerge across multiple platforms and infrastructure components. Today's security briefing highlights urgent issues affecting widely deployed software, command-and-control infrastructure used by nation-state actors, and foundational identity systems that require immediate attention from organizations worldwide.

Critical GitLab GraphQL Flaw Could Let Unauthenticated Attackers Delete Public Projects

GitLab has released security updates addressing a critical vulnerability affecting both Community Edition and Enterprise Edition installations. The flaw, tracked as CVE-2026-19478 with a CVSS score of 9.4, could allow unauthenticated attackers to remotely modify or delete public projects and associated user data under certain conditions. The vulnerability represents a significant risk to organizations relying on GitLab for version control and project management. Source: Critical GitLab GraphQL Flaw Could Let Unauthenticated Attackers Delete Public Projects

Forminator WordPress Flaw Can Enable Unauthenticated RCE via Malicious PHP Uploads

A critical vulnerability has been discovered in the Forminator Forms WordPress plugin, which maintains over 600,000 active installations across the web. Tracked as CVE-2026-15748 with a CVSS rating of 9.8, this flaw enables unauthenticated attackers to achieve arbitrary code execution on vulnerable sites through malicious PHP file uploads. The severity of this vulnerability is compounded by the plugin's widespread adoption, creating substantial risk exposure for a large portion of the WordPress ecosystem. Source: Forminator WordPress Flaw Can Enable Unauthenticated RCE via Malicious PHP Uploads

Cavern C2 Uses DNS and Google Apps Script to Blend Into Legitimate Traffic

Kaspersky researchers have documented the continued evolution of the Cavern command-and-control framework, which is employed by Iranian nation-state threat actors targeting Israeli entities. Ongoing monitoring since December 2025 has revealed previously unreported components that expand the framework's capabilities, including the use of DNS and Google Apps Script to disguise malicious traffic as legitimate communications. The discovery demonstrates sophisticated techniques employed by state-sponsored actors to evade detection while maintaining persistent command and control over compromised systems. Source: Cavern C2 Uses DNS and Google Apps Script to Blend Into Legitimate Traffic

Certighost and the Privilege Hiding in Your Certificate Authority

A critical vulnerability designated CVE-2026-54121 has been identified in Active Directory Certificate Services, enabling standard domain users to escalate privileges and transform an Enterprise Certificate Authority into a Domain Controller. Beyond the technical patch, this vulnerability underscores the broader security implications of standing privileges and implicit trust within public key infrastructure systems. Organizations must recognize that certificate authorities function as Tier 0 identity infrastructure and require corresponding security controls and monitoring. Source: Certighost and the Privilege Hiding in Your Certificate Authority

Organizations should prioritize patching these vulnerabilities immediately, particularly those affecting widely deployed platforms. The combination of unauthenticated remote code execution flaws and privilege escalation vulnerabilities in critical infrastructure components presents a compounding risk that requires urgent remediation across enterprise environments.