A critical, unpatched Remote Code Execution (RCE) vulnerability in the popular self-hosted Git service Gogs, coupled with severe flaws in the WeGIA charity platform, represents today’s most pressing and actionable threats. These vulnerabilities, actively exploitable by authenticated attackers, put source code and sensitive donor data at immediate risk.

Unpatched Gogs RCE Puts Source Code Hosts in Peril

A critical argument injection vulnerability in Gogs, scored at CVSSv4 9.4, allows any authenticated user to execute arbitrary code on the server. This flaw, detailed by Rapid7 Labs, stems from improper neutralization of argument delimiters in a command (CWE-88). With no CVE assigned and no official patch available as of May 28, 2026, administrators must rely on stringent workarounds. The vulnerability can be triggered through the “Rebase before merging” pull request feature, enabling attackers to inject malicious arguments into underlying Git commands.

WeGIA Platform Flaws Enable Complete Takeover

Two critical vulnerabilities in the WeGIA web manager for charitable institutions, CVE-2026-28411 and CVE-2026-28409, create a dangerous attack chain. The first is an authentication bypass via unsafe use of PHP’s extract() function on the $_REQUEST superglobal, allowing an unauthenticated attacker to overwrite local variables and gain administrative access. This access can then be leveraged to exploit the second flaw: a Remote Code Execution vulnerability in the database restoration functionality. An attacker can upload a malicious backup file containing shell metacharacters to achieve full system compromise. Both are fixed in WeGIA version 3.6.5.

FortiClient EMS Exploits and Ransomware Evolution

Threat actors continue to exploit a now-patched critical flaw in FortiClient Endpoint Management Server (EMS) to deploy credential stealers, abusing trusted management infrastructure. Organizations must ensure they have patched against CVE-2023-48788 or similar critical RCE flaws. Meanwhile, the analysis of “The Gentlemen” ransomware by Microsoft Threat Intelligence highlights the evolving threat landscape. This Go-based encryptor uses per-file ephemeral key encryption and features an aggressive self-propagation module, enabling it to rapidly deploy across an entire network through simultaneous exploitation attempts.

Shifting from Panic to Precision in Patching

Amid these critical flaws, the industry is moving away from sole reliance on CVSS scores for prioritization. As discussed in recent analysis, integrating the Exploit Prediction Scoring System (EPSS) and Ground-Truth Common Vulnerability Enumeration (GCVE) into vulnerability management workflows allows teams to focus patching efforts on threats most likely to be exploited and most relevant to their specific environment. This data-driven approach is crucial for efficiently allocating resources against vulnerabilities like the Gogs RCE and WeGIA flaws, which have clear exploit paths and high impact.

Proactive Defense Against Fraud and Compliance Shifts

Beyond software flaws, the FBI warns of a surge in fake FIFA websites running World Cup 2026 fraud schemes designed to steal personal and financial information. This threat requires technical controls like DNS filtering and user education on purchasing tickets only from authorized vendors. Concurrently, the compliance landscape is shifting towards continuous monitoring. Teams are rethinking readiness and reporting, leveraging tools to automate asset discovery and vulnerability assessment against evolving frameworks like NIS2, turning compliance from a periodic audit into an integrated security function.

Administrators of self-hosted Gogs instances must immediately disable the “Rebase before merging” feature and restrict instance access to trusted networks. All WeGIA installations should be upgraded to version 3.6.5 without delay to address CVE-2026-28411 and CVE-2026-28409. Finally, integrate EPSS scores into vulnerability management to prioritize patching for flaws with high exploit likelihood, ensuring defenses are aligned with actual threat actor behavior.