{"vulnerability": "CVE-2026-100382", "sightings": [{"uuid": "30f06ba1-d6ea-4932-9890-d2e83adfdfb5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-100382", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/117334398532334299", "content": "CVE-2026-100382 (CRITICAL, CVSS 10): Wikimedia Mediawiki ExternalData Extension (<3.7) suffers OS Command Injection. Remote, unauthenticated code execution is possible. Restrict access & monitor systems. Details: https://radar.offseq.com/threat/cve-2026-100382-cwe-78-improper-neutralization-of-special-elements-used-in-an-os-command-os-command-75689d73ee2acd97 #OffSeq #CVE2026100382 #infosec #Mediawiki", "creation_timestamp": "2026-09-26T00:00:37.958876Z"}, {"uuid": "0ba067de-79b1-4d5f-9721-64e7a1dadb80", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-100382", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mwey4y6xt62q", "content": "CVE-2026-100382: CRITICAL OS Command Injection in Mediawiki ExternalData Extension (<3.7). Remote attackers can run arbitrary commands. Restrict access & monitor for signs of compromise. https://radar.offseq.com/threat/cve-2026-100382-cwe-78-improper-neutralization-of-special-elements-used-in-an-...", "creation_timestamp": "2026-09-26T00:00:39.841304Z"}, {"uuid": "47fb435d-e03d-4352-b57c-d606553f40e7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-100382", "type": "seen", "source": "https://gist.github.com/ichintu/6ea92f5d3523919a824d2395951afa6c", "content": "This daily cyber threat intelligence digest highlights three critical software vulnerabilities, a major legal sentencing, and one non-security community post. Key takeaways:\n\n\u2022 **MediaWiki (CVE-2026-100382):** Critical (CVSS 10.0) unauthenticated RCE via OS command injection in the ExternalData extension (v<3.7).  \n\u2022 **WordPress (AV26-952):** Critical path traversal in page-template resolution enabling conditional RCE in versions <7.1.2. The flaw is actively exploited in the wild and has been added to CISA\u2019s KEV database; immediate patching is required.  \n\u2022 **CliInvoke.Specializations (CVE-2026-100368):** High (CVSS 8.4) command injection in PowerShell/Cmd wrappers caused by improper handling of untrusted arguments containing double quotes. Patched versions and mitigation workarounds are available.  \n\u2022 **Legal/Incident:** A U.S. Army soldier received a 70-month prison sentence and ~$300K in restitution for hacking AT&T and Verizon to steal mobile metadata, impacting over 100 million customers.  \n\u2022 **Non-Technical:** The digest also includes a community event recommendation for a family squid dissection in Tennessee.  \n\n**Overall:** Organizations should prioritize patching MediaWiki, WordPress, and CliInvoke components, while the sentencing underscores ongoing insider threats targeting critical telecom infrastructure.", "creation_timestamp": "2026-09-26T00:00:32.000000Z"}, {"uuid": "a286ba8e-6a19-4c7c-8e60-06122fee3ae5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-100382", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mweyjccx4n2q", "content": "\ud83d\udea8 CVE-2026-100382 \u2014 CVSS 10 CRITICAL\n\nImproper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-100382\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-09-26T00:07:32.256525Z"}, {"uuid": "72d0d078-c8dd-4197-9542-e72605358212", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-100382", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/117336521016931097", "content": "Mediawiki ExternalData Extension <3.7 has a CRITICAL OS Command Injection vuln (CVE-2026-100382). Unauthenticated attackers could run arbitrary OS commands. No exploits yet. Restrict access, monitor activity. https://radar.offseq.com/threat/improper-neutralization-of-special-elements-used-in-an-os-command-os-command-injection-vulnerability-b27f1e4f9d070501 #OffSeq #CVE2026100382 #Mediawiki #Security", "creation_timestamp": "2026-09-26T09:00:24.231763Z"}, {"uuid": "bb638bde-8e40-4165-9681-65dfb86b074b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-100382", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mwgnqkqw3k26", "content": "CVE-2026-100382 - mediawiki - externaldata extension\nThe ExternalData add\u2011on for Mediawiki can be tricked into executing system commands without any authentication. This means an attacker could run\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#wikimediafoundation #CVE #infosec", "creation_timestamp": "2026-09-26T16:00:04.700078Z"}]}