This week’s cybersecurity alarm bells include critical remote code execution vulnerabilities found in the open-source platforms Gogs and n8n, the release of a powerful new AI model (GLM-5.3) that’s supercharged for exploit discovery, and other significant threats that demand urgent attention.
Gogs CVE-2026-52813: Path Traversal Opens the Hooks
Gogs—an open-source self-hosted Git service—was found to contain a severe vulnerability allowing any user (including unauthenticated or minimally privileged) to achieve remote code execution (RCE). The flaw involves accepting organization names with “../” path traversal sequences, which are then used to create directories via unsanitized filesystem paths. A malicious actor can nest repositories such that Git hooks in other repositories can be overwritten and triggered, executing arbitrary code as the git user. ([thehackernews.com](https://thehackernews.com/2026/08/threatsday-gogs-100-rce-n8n-workflow-to.html))
This issue, tracked as CVE-2026-52813 (CVSS 10.0), affects all Gogs versions prior to 0.14.3. The vulnerability was patched in version 0.14.3 with incoming changes in commit f6acd467305943aae8403cbac81f0118dd1235d7. If you can’t upgrade immediately, putting a stop to self-registration by setting DISABLE_REGISTRATION = true and restricting which users may create organizations are temporary mitigations. ([advisories.gitlab.com](https://advisories.gitlab.com/golang/gogs.io/gogs/CVE-2026-52813/?utm_source=openai))
n8n CVE-2026-33696: Exploitable Prototype Pollution + Workflow Nodes
The automation platform n8n has also been hit by a critical RCE vulnerability, identified as CVE-2026-33696. In versions before 2.14.1, 2.13.3 and 1.123.27, users with permissions to create or modify workflows can exploit prototype pollution in specific nodes (namely XML and GSuiteAdmin), writing attacker-controlled data into Object.prototype. Combined with other node permissions or functions, this can lead to full remote code execution under the account running n8n. ([thehackernews.com](https://thehackernews.com/2026/08/threatsday-gogs-100-rce-n8n-workflow-to.html))
Security teams should immediately update affected instances to n8n version 2.14.1 or later (or at least 2.13.3 / 1.123.27). When updates aren’t yet possible, restrict workflow creation/edit permissions to trusted users and disable the XML node via the NODES_EXCLUDE environment variable, though these are stopgaps, not long-term solutions. ([nvd.nist.gov](https://nvd.nist.gov/vuln/detail/CVE-2026-33696?utm_source=openai))
GLM-5.3 AI Model: Exploit Discovery at Scale
Chinese AI startup Z.ai has launched GLM-5.3, which demonstrates major advances in long-horizon reasoning and exploitation chain discovery. In “real-world” codebases, the model identified 2,436 vulnerabilities across 269 projects—more than 1,000 of them rated medium-to-high severity. Many of these bugs had been overlooked for years, some dating back four decades. ([thehackernews.com](https://thehackernews.com/2026/08/threatsday-gogs-100-rce-n8n-workflow-to.html))
Although GLM-5.3 excels at identifying vulnerabilities and planning multi-step exploit strategies, it still trails behind Anthropic Mythos 5 when it comes to converting those discoveries into functional attacks. ([thehackernews.com](https://thehackernews.com/2026/08/threatsday-gogs-100-rce-n8n-workflow-to.html))
Other Notable Threats & Fixes
- Signed driver abuse: Microsoft’s Defender remediation driver (
BTR.sys), which is signed and trusted, has been repurposed to bypass endpoint defenses during system startup in a technique known as BYOVD. ([thehackernews.com](https://thehackernews.com/2026/08/threatsday-gogs-100-rce-n8n-workflow-to.html)) - DLL sideloading malware campaign: The Grandoreiro group has been abusing the “Duplicate Files Finder” utility to deliver malware through DLL sideloading, especially in Latin America and Spain. ([thehackernews.com](https://thehackernews.com/2026/08/threatsday-gogs-100-rce-n8n-workflow-to.html))
- Privacy & App-Tracking changes: In Germany, Apple has agreed to adjust its App Tracking Transparency (ATT) consent UI after regulators found that its own apps’ prompts were more favorable than those required of third-party apps. The changes will roll out across the European Union. ([thehackernews.com](https://thehackernews.com/2026/08/threatsday-gogs-100-rce-n8n-workflow-to.html))
- Exposed refrigeration controller flaws: Critical bugs in refrigeration controllers from Copeland XWEB and Danfoss AK-SM 800A have been patched. Issues include root-level RCE possibilities, bypassable authentication, arbitrary Nginx directive injection, and more. ([thehackernews.com](https://thehackernews.com/2026/08/threatsday-gogs-100-rce-n8n-workflow-to.html))
- Backdoor hiding in whitespace: A 12 KB Windows backdoor disguised as Realtek software hides its command-and-control (C2) server address encoded in trailing whitespace characters of a desktop.ini file, evading standard pattern detection. ([thehackernews.com](https://thehackernews.com/2026/08/threatsday-gogs-100-rce-n8n-workflow-to.html))
Even reliable infrastructure components and low-visibility edge functionality are proving to be prime vectors for compromise. In many of these cases—including the Gogs and n8n issues—it wasn’t thousands of lines of code but overlooked assumptions around input handling, default permissions, and trusted paths. Attackers are finding that what’s not forbidden is effectively allowed.
For organizations using Gogs or n8n, these vulnerabilities highlight a stark risk: any self-hosted or lightly secured deployment is exposed. Upgrading, tightening permissions, disabling risky nodes, and auditing organization names or workflows are immediate priorities. Keep a close eye on AI-driven tools like GLM-5.3—they’re reshaping both offense and defense, reducing the window for patching. The game has changed; the smallest misconfiguration now has the potential for the largest breach.
