Tuesday, August 18, 2026 · 1 of 5

1. CISA adds an actively exploited Ray RCE to the KEV catalog

   — CVSS 9.4, browser-reachable via DNS rebinding, already in a GPU-cryptomining botnet; federal fix deadline is Aug 20 (Aug 17)

   SecurityInfra