WAF Weekly: CDN Tsunami, GitLab and WordPress RCE, Aug 17-21

This week belonged to the amplification and the unpatched. Researchers showed how HTTP/3 translation at major CDNs turns a small request stream into a 350x bandwidth bomb against origin servers, and a critical GitLab flaw slipped from disclosure to exploitation in two days. A WordPress plugin RCE and a Citrix NetScaler auth bypass rounded out a week where the firewall, the edge, and the patch cadence all pulled in the same direction: know what sits in front of your app, and update everything behind it.

CDN Tsunami Turns HTTP/3 Translation Into a 350x DoS

Researchers disclosed two denial-of-service techniques that abuse how CDNs convert HTTP/3 traffic into HTTP/1.1 requests to origin servers. Named CDN Tsunami, they were tested against Alibaba, Baidu, Cloudflare, Amazon CloudFront, Fastly, and Tencent, and all six fell to the bandwidth variant. By referencing small QPACK table indexes that a CDN expands into full headers before forwarding, an attacker spending under 500 Kbps forced more than 100 Mbps at the origin, up to 350x on providers with the dynamic table. A connection variant tied up backend connections by withholding bodies. Exposure is broad. The researchers probed 151,685 subdomains and flagged 42,330 as vulnerable, and the fix sits at the CDN edge, not the origin. Any modern WAF or CDN design must account for the protocol mismatch, because the request the browser sends is not the request your origin receives.

Original source: CDN Tsunami Attack Abuses HTTP/3 Translation

GitLab Pre-auth Code Injection Exploited in Days

Threat actors began exploiting a critical GitLab flaw about two days after disclosure. Tracked as CVE-2026-19478 with a CVSS score of 9.4, it let an unauthenticated attacker modify or delete public projects and user data through a GraphQL directive. WatchTowr reproduced it in minutes and then caught in-the-wild probes on its honeypot network. The payoff is dire. An attacker can delete repositories, forge merge records, and ban maintainers in one request with no credentials. The supply chain concern is the forge-merge angle. Malicious code can look reviewed and signed off, and your pipeline builds it downstream. The narrow advisory-to-exploit window is the new normal, and a virtual patch or WAF rule is worth having the day a product like GitLab ships a fix.

Original source: Critical GitLab Flaw Exploited Shortly After Disclosure

Critical Elementor Pro Bug Opens WordPress to RCE

Patchstack disclosed a critical file upload flaw in Elementor Pro, tracked as CVE-2026-32475. The bug sits in the File Upload module, where validation and processing loops disagree about empty filename entries. A crafted multipart upload can pass the validator while the processing loop moves a malicious PHP payload into a public directory, giving remote code execution on any site with a published Elementor form that has file upload enabled. The fix landed this week, and Patchstack notes updating does not remove files uploaded during the exposure window. For roughly 10 million installs the message is familiar: patch fast, then sweep the upload directory. This is also a reminder that WordPress WAF plugins and virtual patching are the layer between a vulnerable plugin and a web shell.

Original source: Critical Elementor Pro Bug Exposes WordPress Sites to RCE

Citrix NetScaler Auth Bypass Needs a Fast Patch

Citrix urged admins to patch two NetScaler flaws on Wednesday. The severe one, CVE-2026-19490, is an authentication bypass on NetScaler Gateway and ADC appliances configured as AAA virtual servers or Gateway when SAML Action is enabled, and a remote attacker can bypass auth without privileges. A second high severity memory overflow, CVE-2026-19489, lets unauthenticated actors cause DoS when SIP ALG is enabled. Neither is confirmed exploited yet, but the ShadowServer Foundation tracks over 22,000 exposed NetScaler ADC instances. NetScaler sits directly at the perimeter, so a bypass there hands attackers the gateway itself, the clearest case for an inline WAF or virtual patch on release day.

Original source: Citrix urges admins to patch new NetScaler flaws

Zimbra RCE Under Active Exploitation

Poland's CERT Polska warned that the Zimbra Collaboration vulnerability CVE-2026-73570 is being exploited in the wild. The flaw sits in the optional zimbra-snmp package when SNMP notifications are enabled, letting an unauthenticated attacker execute arbitrary OS commands as the Zimbra user. The usual goal is server control, email access, and lateral movement. Zimbra has been a steady target for state-sponsored groups, so the active campaign is not a surprise. If you run it, patch to 10.1.20 plus and audit for the IoCs CERT Polska published. A WAF can block the known SNMP patterns at the edge, but the real fix is disabling the unnecessary integration and patching.

Original source: Hackers Target Zimbra Servers in Active Exploitation Campaign

Also notable

• Cloudflare avoided the connection variant of CDN Tsunami by buffering the full request before opening the backend, a mitigation worth demanding from any CDN or WAF vendor.
• Every advisory in this roundup shipped inside one heavy patch week, pushing the Security News category to the front of the queue.

This week was a close-up of the modern app edge. Each story follows the same shape: a trusted tool does exactly what it is allowed to do, and the seam where translation happens is where the gap opens. The GitLab merge-forge, the Elementor upload directory, the CDN header expansion, and the NetScaler auth path all break at the boundary. That is where an inline WAF, a virtual patch, and a fast update drill earn their keep. The window between advisory and exploit is now hours or days, so the defense that wins treats the seam as untrusted by default.