Thirteen New Metasploit Modules, One Old Pattern

Rapid7 published its summer Metasploit wrap-up this week, and the headline is thirteen new exploit modules landing in a single batch. The targets span enough product categories to make a useful point all on their own: Ghost CMS, Joomla JCE, WordPress WP2Shell, Langflow, OpenCATS, Pterodactyl Panel, Ray Dashboard, Pix-for-WooCommerce, SonicWall SMA1000, and a Linux kernel local privilege escalation. That list has something in it for almost every environment.

Which is, more or less, the point.

What the batch covers

The web application modules are the straightforward part. Three CMS platforms — Ghost, Joomla (via the JCE editor extension), and WordPress — plus a WooCommerce payment plugin getting exploit modules in the same batch is the kind of thing that reads as noise if you’re not running any of them, and reads as a to-do list if you are. OpenCATS (an open-source applicant tracking system) and Pterodactyl Panel (game server management) round out the small-to-mid-market web application coverage.

The more interesting additions are in AI and distributed computing infrastructure. Langflow — an open-source workflow orchestration tool for building AI pipelines — receives another module, following advisories earlier in the year. Ray Dashboard, the management interface for the Ray distributed computing framework used heavily in ML training workloads, joins it. [Analysis: both tools are frequently deployed in environments that prioritize build velocity over security hardening, often without authentication configured on the management interface and with more network access than the team assumes. The concentration of exploit module development around AI tooling likely reflects how quickly these products spread into production without accompanying security review.]

On the network perimeter side, SonicWall SMA1000 gets a module. SonicWall’s remote access appliances have appeared in Metasploit before, and SMA-series devices have made the CISA KEV catalog more than once. If you have one, the current firmware version is worth checking before the week ends.

The Linux kernel local privilege escalation — useful for post-exploitation on a host compromised via one of the other RCE modules — completes the package. It doesn’t need internet exposure to matter; it just needs a foothold.

The framework itself

Beyond the modules, Rapid7 notes two infrastructure additions. HTTP malleable C2 profiles allow Metasploit traffic to pattern-match against known commercial frameworks, which affects detection fidelity for teams relying on traffic signatures. And MCP (Model Context Protocol) integration has been added to the framework itself, which is a notable signal: the same protocol now appearing in both attack tooling and the AI tooling it’s targeting.

What to do with this

A Metasploit wrap-up isn’t a threat report; it’s a capability inventory. The presence of a module doesn’t mean attacks are actively happening, and it doesn’t mean they aren’t. It means reliable exploit code now exists in a framework that is straightforward to use.

For any of the web-facing platforms on this list — Ghost, Joomla, WordPress, Pterodactyl, Langflow, Ray Dashboard — the question is simple: is it patched, and is it accessible from the internet? If either answer is no or unknown, that’s the task.

For SonicWall SMA1000: firmware current, access logs reviewed, no anomalies.

Thirteen modules. Different product names every time, same answer every time.

Patch the internet-facing ones first.