Attackers exploit CVE-2026-100382, a CVSS 10 unauthenticated MediaWiki RCE in External Data. PoC is public. Upgrade to 3.7 now.

#MediaWiki #ExternalData #CVE2026100382 #RCE #CommandInjection #ExploitedInTheWild #PoC