Five Things we Took Away from Gartner SRM Sydney 2026

This Rapid7 collection highlights a critical cPanel & WHM authentication bypass (CVE-2026-41940, CVSS 9.8) disclosed April 28–29, 2026 that enables unauthenticated remote attackers to gain administrative access, plus Metasploit updates including a Camaleon CMS directory traversal (CVE-2024-46987). Broad themes across the posts: the 2026 threat landscape is accelerating (disclosure-to-exploitation windows have narrowed to days), attackers exploit weak identity controls (missing MFA, weak credentials), exposed services, and unpatched systems, and access is increasingly commoditized. Operational/