Total CMS Takeover: Movable Type Patches Critical 9.8 CVSS Perl RCE

Six Apart published an urgent advisory for Movable Type describing two critical flaws in the Listing Framework: an RCE (CVE-2026-25776, CVSS 9.8) that can execute arbitrary Perl code and an SQL injection (CVE-2026-33088, CVSS 7.3) allowing arbitrary SQL commands. The issues affect Movable Type 6.0 and later; patches are available (9.0.7, 8.8.3, 8.0.10) and temporary mitigations include restricting access to mt.cgi and mt-data-api.cgi or disabling the Data API if unused.