SURIQ
More than 5,200 vulnerabilities reached a logged decision on our threat desk this week. They spanned dozens of products, every severity band, and the full spread of the self-hosted stack, from mail servers to backup controllers to code editors. When we sort that pile not by vendor or by score but by what the flaw actually lets an attacker do, one category is larger than any other. It is not the exotic one the headlines chase. It is command execution: 370 advisories whose payoff is running a command or a shell on the server. That is more than the next two categories, cross-site scripting and account takeover, put together.
The most common bug is the oldest one
Here is the week's distribution, classified from the advisory titles. Read it as the leading categories rather than a complete taxonomy, since a single flaw can wear two labels.
Command injection and remote code execution sat at 370. Cross-site scripting followed at 193, then account takeover at 151, SQL injection at 145, path traversal around 140, and server-side request forgery at 94. Around 75 of the week's total carried a sign of active exploitation by our tracking, and 26 were worth publishing across our desks.
None of this is a new class. Command injection has been near the top of every application-security list for two decades. The interesting part is not that it exists; it is that in a week full of AI connector scares and clever authentication bypasses, the plainest, oldest failure mode is still the one that shows up most. The severity scores pull the eye toward the CVSS 9s and 10s. The volume points somewhere quieter and more consistent: attacker gets to run a command.
Self-hosted software is glue that shells out
Look at what produced the command-execution advisories this week and a pattern shows up that no single CVE writeup can: the affected products are, overwhelmingly, management software whose whole job is to drive other tools.
The clearest example is Roundcube's markasjunk plugin (CVE-2026-74997). Its spam-training feature works by calling a command-line learning tool, so the plugin assembles a shell command out of message data. A logged-in user can bend that command to run arbitrary code on the mail server. The webmail app is not doing anything unusual here; shelling out to an external spam trainer is exactly what the feature is for. The command line is the feature, and the injection rides in on it.
The same shape repeats across the week. Commvault patched an allowlist bypass in its CommServe backup controller (CVE-2026-13737): the product exists to run commands across your estate, so its security boundary is a list of which commands are permitted, and the bug is that boundary leaking. An editor built on Eclipse Theia would run attacker commands the moment you opened a malicious repository (CVE-2026-19884), because the editor is glue over git and a crafted git config told it what to run. And Joomla's Fabrik add-on carried an unauthenticated, CVSS 10 code-execution flaw (CVE-2026-67282) in a form builder that generates and evaluates logic on the fly.
Put them side by side and the common thread is structural, not accidental. Self-hosted infrastructure software is largely glue: thin management layers that translate a web request or a config file into an action performed by some other binary, a shell, an interpreter, a mail utility, a backup agent, git. Every one of those hand-offs is a place where untrusted input can become a command. That is why command execution keeps topping the list. It is not that these teams are careless; it is that the native motion of the software is to run things, and running things safely on behalf of a stranger is genuinely hard.
And when one of these lands, the endgame is often the same file on disk. This week's reported hidden admin webshell, found in a set of WordPress theme add-ons (our writeup), is what command execution looks like after it succeeds and decides to stay: a small script that turns every later request into another command. The injection is the door; the webshell is the attacker moving in.
One tell fits all of them
You cannot patch your way to the front of a class that produces 370 advisories in a week, across products you may not even know you run. Chasing each CVE one by one is the losing half of the game.
The command-execution class has one gift for defenders, though, and it is worth more than any single patch: at the host, every instance ends the same way. A process that has no business launching a shell launches one. The PHP worker behind your CMS spawns a shell. The mail daemon spawns a scripting interpreter. The backup service reaches for a network tool it never normally touches. You do not need the CVE number, the vendor advisory, or even to know the bug exists to see that. The signature is the anomaly in the process tree, and it looks the same whether the entry point was Roundcube, Fabrik, or something with no advisory yet.
This is the part self-hosting changes. On a managed platform, the boundary between an app and the operating system belongs to the vendor, and you never see it. When you run the box, the process tree is yours, and it is the one signal that generalizes across the entire class. Patching removes a named bug from one product. A baseline of what each service is supposed to spawn catches the whole category, including the instances no one has named yet, which is precisely the set a patch cannot help you with.
What to do with the glue you run
Three moves, in order of how long they keep paying off.
First, inventory your command-execution surface. It is not every app; it is specifically the ones that shell out. Webmail with spam or antivirus plugins, CMS form and import extensions, backup and orchestration control planes, CI runners, and editor or language servers are the usual suspects. Write down which of those are reachable from the internet, because that is your real exposure map.
Second, patch this week's named ones if you run them: Roundcube 1.6.18 or 1.7.3, Fabrik 4.6.8, the fixed Commvault CommServe maintenance release, and editors built on Eclipse Theia at 1.70. Prioritize the unauthenticated ones, since they need no foothold first. Fabrik is the one to move on today; it takes no login at all, so patch it and then check the webroot for stray PHP files.
Third, and this is the control that outlives the patch cycle, baseline what each internet-facing service normally spawns, then alert when it spawns something else: a shell, an interpreter, a network client, a compiler. Most web and mail daemons have a small, boring set of children in normal operation, which is what makes the outliers loud. That alert does not care which CVE opened the door, which is exactly why it is worth building once and keeping.
The headline bugs next week will have different names and different vendors. If enough of them are self-hosted management software, and the last two decades say they will be, most will still end in the same place: your server running a command it was talked into. Watch that spot.
Methodology: figures are drawn from the Suriq threat desk's own intelligence and news ledgers over the stated window. "Triaged" counts events we logged a decision on, not raw signal volume; exploitation figures are best-effort and labelled approximate.