{ "site": "https://erroneo.us", "name": "erroneo.us", "publisher": "erroneo.us Editors", "generated": "2026-10-22", "count": 234, "feeds": { "rss": "https://erroneo.us/feed.xml", "daily": "https://erroneo.us/api/daily.json", "llms": "https://erroneo.us/llms.txt", "llms_full": "https://erroneo.us/llms-full.txt", "sitemap": "https://erroneo.us/sitemap.xml", "security_rss": "https://erroneo.us/security/feed.xml", "security_today": "https://erroneo.us/api/security/today.json", "security_index": "https://erroneo.us/api/security/index.json" }, "items": [ { "url": "https://erroneo.us/", "path": "/", "title": "erroneo.us", "description": "A researched reference to common errors: confused words, grammar mistakes, HTTP status codes, JavaScript and Python errors, cognitive biases and popular myths.", "type": "home", "section": "erroneo.us", "date_modified": "2026-10-22", "markdown_url": "https://erroneo.us/index.md" }, { "url": "https://erroneo.us/about/", "path": "/about/", "title": "About erroneo.us", "description": "What erroneo.us is, who publishes it, how pages are researched and updated, and how to report an error on a site that is literally about errors.", "type": "page", "section": "erroneo.us", "date_modified": "2026-10-20", "markdown_url": "https://erroneo.us/about/index.md" }, { "url": "https://erroneo.us/bias-or-fallacy-quiz/", "path": "/bias-or-fallacy-quiz/", "title": "Bias or Fallacy?", "description": "A free quiz of 24 everyday scenarios. Can you name the cognitive bias or logical fallacy in each? Instant feedback with links to sourced explanations.", "type": "interactive-tool", "section": "Play", "date_modified": "2026-10-20", "markdown_url": "https://erroneo.us/bias-or-fallacy-quiz/index.md", "source_count": 6 }, { "url": "https://erroneo.us/daily/", "path": "/daily/", "title": "Error of the Day", "description": "One common error a day, explained and sourced: confused words, myths, cognitive biases, developer errors and money mistakes. New at midnight Pacific.", "type": "series-index", "section": "Error of the Day", "date_modified": "2026-10-22", "markdown_url": "https://erroneo.us/daily/index.md" }, { "url": "https://erroneo.us/daily/comprised-of/", "path": "/daily/comprised-of/", "title": "Comprised of: the phrase editors keep circling", "description": "'Is comprised of' is common but many editors still flag it. The whole comprises the parts; the parts compose the whole. Use 'comprises' or 'consists of'.", "type": "daily-entry", "section": "Language", "date_modified": "2026-10-21", "markdown_url": "https://erroneo.us/daily/comprised-of/index.md", "date_published": "2026-10-21", "source_count": 4 }, { "url": "https://erroneo.us/daily/cors-error/", "path": "/daily/cors-error/", "title": "CORS errors: the server answered, the browser said no", "description": "A CORS error means the browser refused to hand your script the response. The server often answered fine. Fix it with server headers, not frontend hacks.", "type": "daily-entry", "section": "Developers", "date_modified": "2026-10-22", "markdown_url": "https://erroneo.us/daily/cors-error/index.md", "date_published": "2026-10-22", "source_count": 5 }, { "url": "https://erroneo.us/developers/", "path": "/developers/", "title": "Developer errors", "description": "Plain-English references for HTTP status codes, common JavaScript and Python error messages, and the famous software bugs that changed engineering.", "type": "section", "section": "Developers", "date_modified": "2026-10-20", "markdown_url": "https://erroneo.us/developers/index.md" }, { "url": "https://erroneo.us/developers/famous-software-bugs/", "path": "/developers/famous-software-bugs/", "title": "Famous software bugs in history", "description": "Ariane 5, Mars Climate Orbiter, Therac-25, Knight Capital, the Patriot clock, Y2K and CrowdStrike: what went wrong, per official reports, and the lessons.", "type": "guide", "section": "Developers", "date_modified": "2026-10-20", "markdown_url": "https://erroneo.us/developers/famous-software-bugs/index.md", "source_count": 14 }, { "url": "https://erroneo.us/developers/http-401-vs-403/", "path": "/developers/http-401-vs-403/", "title": "401 Unauthorized vs 403 Forbidden", "description": "401 means authenticate and try again; 403 means credentials will not help. The RFC 9110 rules, OAuth bearer-token cases, and when 404 is the safer answer.", "type": "guide", "section": "Developers", "date_modified": "2026-10-22", "markdown_url": "https://erroneo.us/developers/http-401-vs-403/index.md", "source_count": 10 }, { "url": "https://erroneo.us/developers/http-404-not-found/", "path": "/developers/http-404-not-found/", "title": "404 Not Found", "description": "What HTTP 404 Not Found really means under RFC 9110, how it differs from 410 Gone, why soft 404s hurt SEO, and how to find and fix broken URLs on your site.", "type": "guide", "section": "Developers", "date_modified": "2026-10-20", "markdown_url": "https://erroneo.us/developers/http-404-not-found/index.md", "source_count": 8 }, { "url": "https://erroneo.us/developers/http-418-im-a-teapot/", "path": "/developers/http-418-im-a-teapot/", "title": "418 I’m a teapot, explained", "description": "Where HTTP 418 I'm a teapot came from (RFC 2324, April 1998), why RFC 9110 reserves it as (Unused), and whether you should ever send it from a real API.", "type": "guide", "section": "Developers", "date_modified": "2026-10-20", "markdown_url": "https://erroneo.us/developers/http-418-im-a-teapot/index.md", "source_count": 5 }, { "url": "https://erroneo.us/developers/http-429-too-many-requests/", "path": "/developers/http-429-too-many-requests/", "title": "429 Too Many Requests", "description": "HTTP 429 means you hit a rate limit. What RFC 6585 says, how to honor Retry-After, exponential backoff with jitter in code, and the new RateLimit headers draft.", "type": "guide", "section": "Developers", "date_modified": "2026-10-20", "markdown_url": "https://erroneo.us/developers/http-429-too-many-requests/index.md", "source_count": 10 }, { "url": "https://erroneo.us/developers/http-500-internal-server-error/", "path": "/developers/http-500-internal-server-error/", "title": "500 Internal Server Error", "description": "HTTP 500 means the server hit an unexpected condition. How to find the real cause in logs, the usual culprits, and why stack traces must never reach users.", "type": "guide", "section": "Developers", "date_modified": "2026-10-20", "markdown_url": "https://erroneo.us/developers/http-500-internal-server-error/index.md", "source_count": 8 }, { "url": "https://erroneo.us/developers/http-502-vs-504/", "path": "/developers/http-502-vs-504/", "title": "502 Bad Gateway vs 504 Gateway Timeout (and 503)", "description": "502, 503 and 504 all mean something behind the proxy failed. How to tell them apart, read nginx, Caddy and load balancer logs, and fix the usual causes.", "type": "guide", "section": "Developers", "date_modified": "2026-10-20", "markdown_url": "https://erroneo.us/developers/http-502-vs-504/index.md", "source_count": 12 }, { "url": "https://erroneo.us/developers/http-status-codes/", "path": "/developers/http-status-codes/", "title": "HTTP status codes, explained properly", "description": "Every HTTP status code from 100 to 511 in plain English: what each means per RFC 9110, the usual cause, and the common mistakes with 401, 404, 429 and 5xx.", "type": "guide", "section": "Developers", "date_modified": "2026-10-22", "markdown_url": "https://erroneo.us/developers/http-status-codes/index.md", "source_count": 13 }, { "url": "https://erroneo.us/developers/javascript-errors/", "path": "/developers/javascript-errors/", "title": "Common JavaScript errors, explained", "description": "What \"Cannot read properties of undefined\", \"x is not a function\", CORS and JSON.parse errors mean, with exact browser messages and fixes.", "type": "guide", "section": "Developers", "date_modified": "2026-10-22", "markdown_url": "https://erroneo.us/developers/javascript-errors/index.md", "source_count": 14 }, { "url": "https://erroneo.us/developers/python-errors/", "path": "/developers/python-errors/", "title": "Common Python errors, explained", "description": "IndentationError, NameError, 'NoneType' object is not subscriptable, KeyError, ModuleNotFoundError and more: what each Python error means and how to fix it.", "type": "guide", "section": "Developers", "date_modified": "2026-10-20", "markdown_url": "https://erroneo.us/developers/python-errors/index.md", "source_count": 8 }, { "url": "https://erroneo.us/error-decoder/", "path": "/error-decoder/", "title": "Error Message Decoder", "description": "Paste a JavaScript or Python error message and get what it means and how to fix it. Runs entirely in your browser: no server, no AI, nothing uploaded.", "type": "interactive-tool", "section": "Play", "date_modified": "2026-10-20", "markdown_url": "https://erroneo.us/error-decoder/index.md", "source_count": 7 }, { "url": "https://erroneo.us/language/", "path": "/language/", "title": "Language errors", "description": "Guides to the English mistakes people search for most: commonly confused words, grammar errors, misspellings, mispronunciations and misused idioms.", "type": "section", "section": "Language", "date_modified": "2026-10-20", "markdown_url": "https://erroneo.us/language/index.md" }, { "url": "https://erroneo.us/language/common-grammar-mistakes/", "path": "/language/common-grammar-mistakes/", "title": "Common grammar mistakes", "description": "The grammar mistakes that actually cost you credibility, from comma splices to 'between you and I', plus the fake rules you can safely ignore. With fixes.", "type": "guide", "section": "Language", "date_modified": "2026-10-21", "markdown_url": "https://erroneo.us/language/common-grammar-mistakes/index.md", "source_count": 17 }, { "url": "https://erroneo.us/language/commonly-confused-words/", "path": "/language/commonly-confused-words/", "title": "Commonly confused words", "description": "Affect or effect? Then or than? A skimmable table of 45 commonly confused English words with meanings, examples and memory tricks that actually stick.", "type": "guide", "section": "Language", "date_modified": "2026-10-21", "markdown_url": "https://erroneo.us/language/commonly-confused-words/index.md", "source_count": 17 }, { "url": "https://erroneo.us/language/commonly-mispronounced-words/", "path": "/language/commonly-mispronounced-words/", "title": "Commonly mispronounced words", "description": "Nuclear, espresso, February, often, GIF: which pronunciations dictionaries call nonstandard, which are fine, and the linguistics behind each one.", "type": "guide", "section": "Language", "date_modified": "2026-10-20", "markdown_url": "https://erroneo.us/language/commonly-mispronounced-words/index.md", "source_count": 16 }, { "url": "https://erroneo.us/language/commonly-misspelled-words/", "path": "/language/commonly-misspelled-words/", "title": "Commonly misspelled words", "description": "Separate, definitely, accommodate, embarrass: a table of 50 commonly misspelled English words with the usual wrong spelling, why it happens and a memory trick.", "type": "guide", "section": "Language", "date_modified": "2026-10-20", "markdown_url": "https://erroneo.us/language/commonly-misspelled-words/index.md", "source_count": 6 }, { "url": "https://erroneo.us/language/misused-idioms-and-phrases/", "path": "/language/misused-idioms-and-phrases/", "title": "Misused idioms and phrases", "description": "For all intents and purposes, couldn't care less, begs the question, irregardless, literally: the real forms, their origins and what dictionaries say.", "type": "guide", "section": "Language", "date_modified": "2026-10-20", "markdown_url": "https://erroneo.us/language/misused-idioms-and-phrases/index.md", "source_count": 19 }, { "url": "https://erroneo.us/myths/", "path": "/myths/", "title": "Myths & misconceptions", "description": "Popular myths about science, history, nutrition and money checked against primary sources: NASA, the FDA, the USDA, the CFPB and peer-reviewed research.", "type": "section", "section": "Myths", "date_modified": "2026-10-20", "markdown_url": "https://erroneo.us/myths/index.md" }, { "url": "https://erroneo.us/myths/history-myths/", "path": "/myths/history-myths/", "title": "History myths: what really happened", "description": "Was Napoleon short? Did Vikings wear horned helmets? Did Marie Antoinette say 'let them eat cake'? 11 popular history myths and what the record shows.", "type": "guide", "section": "Myths", "date_modified": "2026-10-20", "markdown_url": "https://erroneo.us/myths/history-myths/index.md", "source_count": 16 }, { "url": "https://erroneo.us/myths/money-mistakes/", "path": "/myths/money-mistakes/", "title": "Money mistakes and personal-finance myths", "description": "Minimum payments, credit-check myths, skipped 401(k) matches, fee drag, market timing, forgotten subscriptions and scams: 13 money mistakes, with sources.", "type": "guide", "section": "Myths", "date_modified": "2026-10-20", "markdown_url": "https://erroneo.us/myths/money-mistakes/index.md", "source_count": 12 }, { "url": "https://erroneo.us/myths/nutrition-myths/", "path": "/myths/nutrition-myths/", "title": "Nutrition myths: what the evidence actually says", "description": "Eggs and cholesterol, MSG, detoxes, eight glasses of water, the five-second rule, best-by dates: 13 food myths, checked against FDA, USDA and research.", "type": "guide", "section": "Myths", "date_modified": "2026-10-20", "markdown_url": "https://erroneo.us/myths/nutrition-myths/index.md", "source_count": 19 }, { "url": "https://erroneo.us/myths/science-myths/", "path": "/myths/science-myths/", "title": "Science myths that refuse to die", "description": "Do we use 10% of our brains? Is the Great Wall visible from space? Is glass a liquid? 13 common science myths, the real answers, and the studies behind them.", "type": "guide", "section": "Myths", "date_modified": "2026-10-20", "markdown_url": "https://erroneo.us/myths/science-myths/index.md", "source_count": 19 }, { "url": "https://erroneo.us/sources/", "path": "/sources/", "title": "Sources & methodology", "description": "How erroneo.us researches, cites and checks every page, plus the complete bibliography of specifications, reports, dictionaries and studies we cite.", "type": "page", "section": "erroneo.us", "date_modified": "2026-10-20", "markdown_url": "https://erroneo.us/sources/index.md" }, { "url": "https://erroneo.us/spot-the-error/", "path": "/spot-the-error/", "title": "Spot the Error", "description": "A free, timed proofreading game: find the one wrong word in each sentence. Confused words, grammar, idioms and spelling, each round linked to the rule.", "type": "interactive-tool", "section": "Play", "date_modified": "2026-10-20", "markdown_url": "https://erroneo.us/spot-the-error/index.md", "source_count": 8 }, { "url": "https://erroneo.us/thinking/", "path": "/thinking/", "title": "Thinking errors", "description": "Cognitive biases and logical fallacies explained with everyday examples, the research behind them, and practical ways to catch them in yourself.", "type": "section", "section": "Thinking", "date_modified": "2026-10-20", "markdown_url": "https://erroneo.us/thinking/index.md" }, { "url": "https://erroneo.us/thinking/cognitive-biases/", "path": "/thinking/cognitive-biases/", "title": "Cognitive biases: the predictable ways good minds go wrong", "description": "A sourced guide to 20 common cognitive biases: anchoring, confirmation bias, sunk cost, Dunning-Kruger and more, with examples, fixes and replication caveats.", "type": "guide", "section": "Thinking", "date_modified": "2026-10-20", "markdown_url": "https://erroneo.us/thinking/cognitive-biases/index.md", "source_count": 26 }, { "url": "https://erroneo.us/thinking/logical-fallacies/", "path": "/thinking/logical-fallacies/", "title": "Logical fallacies: how arguments break, with examples", "description": "Straw man, ad hominem, false dilemma, slippery slope, post hoc and more: 20 logical fallacies explained with plain examples, Latin names and how to respond.", "type": "guide", "section": "Thinking", "date_modified": "2026-10-20", "markdown_url": "https://erroneo.us/thinking/logical-fallacies/index.md", "source_count": 4 }, { "url": "https://erroneo.us/tools/", "path": "/tools/", "title": "Play with your errors", "description": "Free interactive tools: a proofreading game, a bias-or-fallacy quiz, a JS and Python error decoder, an HTTP status code explorer and myth-or-fact cards.", "type": "tool-index", "section": "Play", "date_modified": "2026-10-20", "markdown_url": "https://erroneo.us/tools/index.md" }, { "url": "https://erroneo.us/security/briefs/php2shell-php-rce/", "path": "/security/briefs/php2shell-php-rce/", "title": "PHP2Shell: Critical Unauthenticated RCE in PHP", "description": "If PHP answers HTTP requests anywhere you run it, patch or apply a vendor fix today; this is pre-application, unauthenticated, and attack traffic started before the patch shipped.", "type": "security-brief", "section": "Security Digest", "date_published": "2026-10-21", "date_modified": "2026-10-21", "markdown_url": "https://erroneo.us/security/briefs/php2shell-php-rce/index.md", "verdict": "act-now" }, { "url": "https://erroneo.us/security/briefs/nodejs-october-2026-security-releases/", "path": "/security/briefs/nodejs-october-2026-security-releases/", "title": "Node.js October 2026 Security Releases: 10 CVEs Fixed", "description": "Four high-severity fixes, including a Brotli decoder memory-corruption bug the project says permits remote code execution, make this a routine-but-real upgrade: roll every supported line forward this week.", "type": "security-brief", "section": "Security Digest", "date_published": "2026-10-21", "date_modified": "2026-10-21", "markdown_url": "https://erroneo.us/security/briefs/nodejs-october-2026-security-releases/index.md", "verdict": "patch-this-week" }, { "url": "https://erroneo.us/security/briefs/litellm-1-107-0-supply-chain-compromise/", "path": "/security/briefs/litellm-1-107-0-supply-chain-compromise/", "title": "LiteLLM 1.107.0: Malicious PyPI and Docker Release", "description": "Check right now whether anything installed litellm 1.107.0 or pulled a LiteLLM image by a floating tag on October 21; if it did, assume every secret that host could read is stolen.", "type": "security-brief", "section": "Security Digest", "date_published": "2026-10-21", "date_modified": "2026-10-21", "markdown_url": "https://erroneo.us/security/briefs/litellm-1-107-0-supply-chain-compromise/index.md", "verdict": "act-now" }, { "url": "https://erroneo.us/security/briefs/plex2shell-plex-media-server-rce-chain/", "path": "/security/briefs/plex2shell-plex-media-server-rce-chain/", "title": "Plex2Shell: Exploited RCE Chain in Plex Media Server", "description": "A public proof of concept chains four Plex bugs into code execution without credentials, and attackers have used it since October 17: update any internet-reachable server now, then check it for a miner or proxy.", "type": "security-brief", "section": "Security Digest", "date_published": "2026-10-20", "date_modified": "2026-10-20", "markdown_url": "https://erroneo.us/security/briefs/plex2shell-plex-media-server-rce-chain/index.md", "verdict": "act-now" }, { "url": "https://erroneo.us/security/briefs/emudhra-emsign-intermediate-ca-key-compromise/", "path": "/security/briefs/emudhra-emsign-intermediate-ca-key-compromise/", "title": "eMudhra CA Key Compromise: Update Non-Browser TLS Clients", "description": "Anyone can mint certificates from these broken CA keys, but only clients that skip Certificate Transparency and still trust the emSign root are exposed, and only to an on-path attacker: update those trust bundles this week, build machines first.", "type": "security-brief", "section": "Security Digest", "date_published": "2026-10-20", "date_modified": "2026-10-20", "markdown_url": "https://erroneo.us/security/briefs/emudhra-emsign-intermediate-ca-key-compromise/index.md", "verdict": "patch-this-week" }, { "url": "https://erroneo.us/security/briefs/connectwise-cloud-backup-skykick-m365-oauth-compromise/", "path": "/security/briefs/connectwise-cloud-backup-skykick-m365-oauth-compromise/", "title": "ConnectWise Cloud Backup: App Credential Abused in M365", "description": "If any tenant you run or manage ever consented to a ConnectWise or SkyKick app, disable those apps and audit the tenant today; attackers used the vendor's own credential to sign in as the app, so MFA did not stop them.", "type": "security-brief", "section": "Security Digest", "date_published": "2026-10-16", "date_modified": "2026-10-16", "markdown_url": "https://erroneo.us/security/briefs/connectwise-cloud-backup-skykick-m365-oauth-compromise/index.md", "verdict": "act-now" }, { "url": "https://erroneo.us/security/briefs/pillow-13-0-0-security-release-image-parsing-rce/", "path": "/security/briefs/pillow-13-0-0-security-release-image-parsing-rce/", "title": "Pillow 13.0.0: Critical Image-Parsing Memory Bugs Fixed", "description": "If your service opens images that users or the internet supply, move to Pillow 13.0.0 this week; the worst bugs are memory corruption reachable from a crafted file, and reproducers are in the published advisories.", "type": "security-brief", "section": "Security Digest", "date_published": "2026-10-16", "date_modified": "2026-10-16", "markdown_url": "https://erroneo.us/security/briefs/pillow-13-0-0-security-release-image-parsing-rce/index.md", "verdict": "patch-this-week" }, { "url": "https://erroneo.us/security/briefs/beyondtrust-remote-support-cve-2026-102764-zero-day/", "path": "/security/briefs/beyondtrust-remote-support-cve-2026-102764-zero-day/", "title": "BeyondTrust Remote Support CVE-2026-102764 Zero-Day", "description": "If you run a self-hosted BeyondTrust Remote Support appliance, patch it today and assume it may already be compromised; an espionage group used this as a zero-day for about seven weeks.", "type": "security-brief", "section": "Security Digest", "date_published": "2026-10-15", "date_modified": "2026-10-15", "markdown_url": "https://erroneo.us/security/briefs/beyondtrust-remote-support-cve-2026-102764-zero-day/index.md", "verdict": "act-now" }, { "url": "https://erroneo.us/security/briefs/siemens-software-center-dll-sideloading-cve-2026-110936/", "path": "/security/briefs/siemens-software-center-dll-sideloading-cve-2026-110936/", "title": "Siemens Software Center DLL Flaw Abused in ClickFix Attacks", "description": "Siemens users get the fix automatically, but the real threat is attackers shipping their own signed, older copy as a malware loader, so Windows defenders should block the indicators and hunt rather than rely on patching.", "type": "security-brief", "section": "Security Digest", "date_published": "2026-10-15", "date_modified": "2026-10-15", "markdown_url": "https://erroneo.us/security/briefs/siemens-software-center-dll-sideloading-cve-2026-110936/index.md", "verdict": "check-exposure" }, { "url": "https://erroneo.us/security/briefs/nextjs-use-cache-image-optimizer-rce/", "path": "/security/briefs/nextjs-use-cache-image-optimizer-rce/", "title": "Next.js: Two Critical Unauthenticated RCEs (Oct 14)", "description": "Self-hosted Next.js apps should move to 16.4.1 or 15.5.28 this week; both RCEs have preconditions and no exploitation is reported, but the fix is a routine minor upgrade.", "type": "security-brief", "section": "Security Digest", "date_published": "2026-10-14", "date_modified": "2026-10-14", "markdown_url": "https://erroneo.us/security/briefs/nextjs-use-cache-image-optimizer-rce/index.md", "verdict": "patch-this-week" }, { "url": "https://erroneo.us/security/briefs/pan-os-cve-2026-0322-management-interface-rce/", "path": "/security/briefs/pan-os-cve-2026-0322-management-interface-rce/", "title": "PAN-OS CVE-2026-0322: Exploited Management-Interface RCE", "description": "Patch every PAN-OS firewall and Panorama this week, and today if the management interface is reachable from the internet; the bug needs an admin login but is already being exploited.", "type": "security-brief", "section": "Security Digest", "date_published": "2026-10-14", "date_modified": "2026-10-14", "markdown_url": "https://erroneo.us/security/briefs/pan-os-cve-2026-0322-management-interface-rce/index.md", "verdict": "patch-this-week" }, { "url": "https://erroneo.us/security/briefs/siteguard-server-edition-cve-2026-106931-zero-day/", "path": "/security/briefs/siteguard-server-edition-cve-2026-106931-zero-day/", "title": "SiteGuard WAF CVE-2026-106931: Exploited Command Injection", "description": "If you run SiteGuard Server Edition, save its diagnostic data and patch this week, sooner on public web servers; the bug is exploited, but its local rating means attackers need a foothold first.", "type": "security-brief", "section": "Security Digest", "date_published": "2026-10-14", "date_modified": "2026-10-14", "markdown_url": "https://erroneo.us/security/briefs/siteguard-server-edition-cve-2026-106931-zero-day/index.md", "verdict": "patch-this-week" }, { "url": "https://erroneo.us/security/briefs/ivanti-connect-secure-cve-2026-104935-zero-day/", "path": "/security/briefs/ivanti-connect-secure-cve-2026-104935-zero-day/", "title": "Ivanti Connect Secure CVE-2026-104935: Exploited Zero-Day", "description": "Upgrade Connect Secure today and investigate with memory and network forensics, because the Integrity Checker missed this compromise and part of the attack chain still has no fix.", "type": "security-brief", "section": "Security Digest", "date_published": "2026-10-13", "date_modified": "2026-10-13", "markdown_url": "https://erroneo.us/security/briefs/ivanti-connect-secure-cve-2026-104935-zero-day/index.md", "verdict": "act-now" }, { "url": "https://erroneo.us/security/briefs/visual-studio-copilot-cve-2026-103572-rce/", "path": "/security/briefs/visual-studio-copilot-cve-2026-103572-rce/", "title": "Visual Studio Copilot CVE-2026-103572: Trailing-Dot RCE", "description": "If your developers use Copilot in Visual Studio or SSMS, update this week: exploitation needs only text the agent reads, and the researcher's write-up spells out the chain.", "type": "security-brief", "section": "Security Digest", "date_published": "2026-10-13", "date_modified": "2026-10-13", "markdown_url": "https://erroneo.us/security/briefs/visual-studio-copilot-cve-2026-103572-rce/index.md", "verdict": "patch-this-week" }, { "url": "https://erroneo.us/security/briefs/windows-shell-motw-bypass-cve-2026-96951/", "path": "/security/briefs/windows-shell-motw-bypass-cve-2026-96951/", "title": "Windows Shell CVE-2026-96951: Exploited MOTW Bypass", "description": "Roll the October 2026 Windows update out to every desktop this week; attackers are using this to make malicious attachments and downloads skip the warnings that would stop them.", "type": "security-brief", "section": "Security Digest", "date_published": "2026-10-13", "date_modified": "2026-10-13", "markdown_url": "https://erroneo.us/security/briefs/windows-shell-motw-bypass-cve-2026-96951/index.md", "verdict": "patch-this-week" }, { "url": "https://erroneo.us/security/briefs/podman-checkpoint-image-sandbox-bypass-cve-2026-94603/", "path": "/security/briefs/podman-checkpoint-image-sandbox-bypass-cve-2026-94603/", "title": "Podman CVE-2026-94603: Images Can Disable the Sandbox", "description": "If you run third-party images with rootful Podman, upgrade to 5.8.8 or 6.1.3 now, because an image can switch off the sandbox you asked for; rootless Podman and trusted-image-only hosts can patch on a normal cycle.", "type": "security-brief", "section": "Security Digest", "date_published": "2026-10-13", "date_modified": "2026-10-13", "markdown_url": "https://erroneo.us/security/briefs/podman-checkpoint-image-sandbox-bypass-cve-2026-94603/index.md", "verdict": "check-exposure" }, { "url": "https://erroneo.us/security/briefs/slugfest-npm-trusted-publishing-slug-hijack/", "path": "/security/briefs/slugfest-npm-trusted-publishing-slug-hijack/", "title": "SlugFest: npm Trusted Publishing Repo-Name Hijack", "description": "The hole was closed on npm's side on October 2, 2026 and no abuse has been reported, so most teams have nothing to patch; maintainers should still spend five minutes auditing trusted publisher bindings and recent publishes.", "type": "security-brief", "section": "Security Digest", "date_published": "2026-10-13", "date_modified": "2026-10-13", "markdown_url": "https://erroneo.us/security/briefs/slugfest-npm-trusted-publishing-slug-hijack/index.md", "verdict": "most-can-relax" }, { "url": "https://erroneo.us/security/briefs/go-october-2026-security-releases/", "path": "/security/briefs/go-october-2026-security-releases/", "title": "Go October 2026 Security Releases: 16 Stdlib Fixes", "description": "Rebuild and redeploy Go services with Go 1.27.3 or 1.26.10 this week, starting with internet-facing HTTP/2 servers and reverse proxies; none of these bugs is known to be exploited.", "type": "security-brief", "section": "Security Digest", "date_published": "2026-10-08", "date_modified": "2026-10-08", "markdown_url": "https://erroneo.us/security/briefs/go-october-2026-security-releases/index.md", "verdict": "patch-this-week" }, { "url": "https://erroneo.us/security/briefs/proftpd-mod-copy-cve-2015-3306-kev/", "path": "/security/briefs/proftpd-mod-copy-cve-2015-3306-kev/", "title": "ProFTPD mod_copy CVE-2015-3306: 2015 Bug Added to KEV", "description": "Nearly everyone fixed this a decade ago; the real job is finding any ProFTPD 1.3.5-era build with mod_copy still answering on port 21, usually inside old appliances, and replacing or removing it.", "type": "security-brief", "section": "Security Digest", "date_published": "2026-10-08", "date_modified": "2026-10-08", "markdown_url": "https://erroneo.us/security/briefs/proftpd-mod-copy-cve-2015-3306-kev/index.md", "verdict": "check-exposure" }, { "url": "https://erroneo.us/security/briefs/argo-cd-october-2026-repo-server-rce-appproject-bypass/", "path": "/security/briefs/argo-cd-october-2026-repo-server-rce-appproject-bypass/", "title": "Argo CD: Repo-Server RCE and AppProject Bypass (Oct 2026)", "description": "Upgrade Argo CD to a patched 3.3, 3.4 or 3.5 release this week, and today on shared instances where people you do not fully trust can push to tracked repos or merely view an Application.", "type": "security-brief", "section": "Security Digest", "date_published": "2026-10-07", "date_modified": "2026-10-07", "markdown_url": "https://erroneo.us/security/briefs/argo-cd-october-2026-repo-server-rce-appproject-bypass/index.md", "verdict": "patch-this-week" }, { "url": "https://erroneo.us/security/briefs/ghostaction-github-workflow-credential-theft/", "path": "/security/briefs/ghostaction-github-workflow-credential-theft/", "title": "GhostAction: Fake Security Workflows Steal GitHub Secrets", "description": "If any repository you own or contribute to gained a security-audit.yml or github_actions_security.yml workflow you did not write, treat its Actions secrets, every credential ever committed to it, and the pushing account as compromised.", "type": "security-brief", "section": "Security Digest", "date_published": "2026-10-07", "date_modified": "2026-10-07", "markdown_url": "https://erroneo.us/security/briefs/ghostaction-github-workflow-credential-theft/index.md", "verdict": "check-exposure" }, { "url": "https://erroneo.us/security/briefs/atlassian-data-center-file-read-cve-2026-21589/", "path": "/security/briefs/atlassian-data-center-file-read-cve-2026-21589/", "title": "Atlassian Data Center File Read CVE-2026-21589 Exploited", "description": "Every self-managed Atlassian Data Center product is affected, a public detection script exists and CISA confirms exploitation; patch to a fixed LTS or block traversal patterns at the edge today.", "type": "security-brief", "section": "Security Digest", "date_published": "2026-10-05", "date_modified": "2026-10-05", "markdown_url": "https://erroneo.us/security/briefs/atlassian-data-center-file-read-cve-2026-21589/index.md", "verdict": "act-now" }, { "url": "https://erroneo.us/security/briefs/ahsaycbs-cve-2026-105133-105134-backup-server-rce/", "path": "/security/briefs/ahsaycbs-cve-2026-105133-105134-backup-server-rce/", "title": "AhsayCBS: Exploited Pre-Auth RCE Chain in Backup Server", "description": "If you or your MSP run an AhsayCBS backup server, install the October 12 hotfix today and hunt for webshells: the chain is unauthenticated, runs as SYSTEM, is being exploited by several actors, and the August patch did not fix it.", "type": "security-brief", "section": "Security Digest", "date_published": "2026-10-04", "date_modified": "2026-10-04", "markdown_url": "https://erroneo.us/security/briefs/ahsaycbs-cve-2026-105133-105134-backup-server-rce/index.md", "verdict": "act-now" }, { "url": "https://erroneo.us/security/briefs/fortimail-ibe-path-traversal-cve-2026-104286/", "path": "/security/briefs/fortimail-ibe-path-traversal-cve-2026-104286/", "title": "FortiMail CVE-2026-104286: Exploited Pre-Auth File Write", "description": "If you run a self-managed FortiMail, upgrade today and check Fortinet's indicators; this is an unauthenticated file-write zero-day on an internet-facing mail gateway.", "type": "security-brief", "section": "Security Digest", "date_published": "2026-10-01", "date_modified": "2026-10-01", "markdown_url": "https://erroneo.us/security/briefs/fortimail-ibe-path-traversal-cve-2026-104286/index.md", "verdict": "act-now" }, { "url": "https://erroneo.us/security/briefs/cisco-sd-wan-manager-cve-2026-76504-api-auth-bypass/", "path": "/security/briefs/cisco-sd-wan-manager-cve-2026-76504-api-auth-bypass/", "title": "Cisco SD-WAN Manager CVE-2026-76504: Exploited Auth Bypass", "description": "If you run SD-WAN Manager on-prem, upgrade now and check the logs Cisco names; one crafted HTTP request gives an unauthenticated attacker admin over the controller for your whole WAN.", "type": "security-brief", "section": "Security Digest", "date_published": "2026-09-30", "date_modified": "2026-09-30", "markdown_url": "https://erroneo.us/security/briefs/cisco-sd-wan-manager-cve-2026-76504-api-auth-bypass/index.md", "verdict": "act-now" }, { "url": "https://erroneo.us/security/briefs/zammad-cve-2026-102489-102490-rce-root-chain/", "path": "/security/briefs/zammad-cve-2026-102489-102490-rce-root-chain/", "title": "Zammad CVE-2026-102489/102490: Exploited RCE-to-Root Chain", "description": "Self-hosted Zammad on 6.x is remotely exploitable and was used in a real breach: upgrade to 7.2.2 today (6.5.5 only as a stopgap), and patch DEB/RPM installs of any version to close the root escalation.", "type": "security-brief", "section": "Security Digest", "date_published": "2026-09-30", "date_modified": "2026-09-30", "markdown_url": "https://erroneo.us/security/briefs/zammad-cve-2026-102489-102490-rce-root-chain/index.md", "verdict": "act-now" }, { "url": "https://erroneo.us/security/briefs/apple-coregraphics-cve-2026-86950-exploited-zero-day/", "path": "/security/briefs/apple-coregraphics-cve-2026-86950-exploited-zero-day/", "title": "Apple CoreGraphics CVE-2026-86950: Exploited Zero-Day", "description": "A targeted file-parsing zero-day with a fix out since September 28: confirm every iPhone, iPad and Mac is on 26.7.1, 15.8.1 or a 27.x release this week, and today for high-risk users.", "type": "security-brief", "section": "Security Digest", "date_published": "2026-09-28", "date_modified": "2026-09-28", "markdown_url": "https://erroneo.us/security/briefs/apple-coregraphics-cve-2026-86950-exploited-zero-day/index.md", "verdict": "patch-this-week" }, { "url": "https://erroneo.us/security/briefs/citrix-netscaler-cve-2026-88771-88772-zero-days/", "path": "/security/briefs/citrix-netscaler-cve-2026-88771-88772-zero-days/", "title": "NetScaler CVE-2026-88771/88772: Exploited Pre-Auth RCE", "description": "Every customer-managed NetScaler ADC or Gateway needs the latest build today, and any appliance that was unpatched in September should be investigated as compromised, because patching does not evict attackers.", "type": "security-brief", "section": "Security Digest", "date_published": "2026-09-27", "date_modified": "2026-09-27", "markdown_url": "https://erroneo.us/security/briefs/citrix-netscaler-cve-2026-88771-88772-zero-days/index.md", "verdict": "act-now" }, { "url": "https://erroneo.us/security/briefs/actions-cool-mini-shai-hulud-reactivation/", "path": "/security/briefs/actions-cool-mini-shai-hulud-reactivation/", "title": "actions-cool Actions Re-Enabled With Mini Shai-Hulud Payload", "description": "If any workflow referenced either actions-cool action by tag and ran between September 16 and 25, 2026, assume its secrets and repository were compromised; everyone else can confirm with one grep.", "type": "security-brief", "section": "Security Digest", "date_published": "2026-09-24", "date_modified": "2026-09-24", "markdown_url": "https://erroneo.us/security/briefs/actions-cool-mini-shai-hulud-reactivation/index.md", "verdict": "check-exposure" }, { "url": "https://erroneo.us/security/briefs/wordpress-core-page-template-lfi-cve-2026-87902/", "path": "/security/briefs/wordpress-core-page-template-lfi-cve-2026-87902/", "title": "WordPress Core: Page-Template File Inclusion to RCE", "description": "Every WordPress branch back to 4.7 was affected, no login is needed, public scanning tooling exists and attackers are already writing files through pearcmd.php, so confirm you are on a fixed release today.", "type": "security-brief", "section": "Security Digest", "date_published": "2026-09-22", "date_modified": "2026-09-22", "markdown_url": "https://erroneo.us/security/briefs/wordpress-core-page-template-lfi-cve-2026-87902/index.md", "verdict": "act-now" }, { "url": "https://erroneo.us/security/briefs/linux-af-unix-gc-container-escape-cve-2026-80521/", "path": "/security/briefs/linux-af-unix-gc-container-escape-cve-2026-80521/", "title": "Linux AF_UNIX CVE-2026-80521: Public Container Escape", "description": "If you run untrusted or third-party code in containers on a 6.10+ kernel, install fixed kernels as they ship and move that code behind stronger isolation now; a public exploit turns an unprivileged container process into a host compromise.", "type": "security-brief", "section": "Security Digest", "date_published": "2026-09-22", "date_modified": "2026-09-22", "markdown_url": "https://erroneo.us/security/briefs/linux-af-unix-gc-container-escape-cve-2026-80521/index.md", "verdict": "patch-this-week" }, { "url": "https://erroneo.us/security/briefs/graphalgo-go-modules-terraform-provider-typosquats/", "path": "/security/briefs/graphalgo-go-modules-terraform-provider-typosquats/", "title": "Graphalgo Malware in Go Modules and Terraform Providers", "description": "Grep your go.mod, go.sum and Terraform files for four names; if none match you are done, and if one does, treat the machine as compromised.", "type": "security-brief", "section": "Security Digest", "date_published": "2026-09-22", "date_modified": "2026-09-22", "markdown_url": "https://erroneo.us/security/briefs/graphalgo-go-modules-terraform-provider-typosquats/index.md", "verdict": "check-exposure" }, { "url": "https://erroneo.us/security/briefs/linux-kernel-five-exploited-lpe-bugs-kev/", "path": "/security/briefs/linux-kernel-five-exploited-lpe-bugs-kev/", "title": "Linux Kernel: Five Exploited Root Bugs Added to CISA KEV", "description": "Five local root bugs, all with fixes and most with public exploits, are now confirmed exploited; get every Linux host onto a current kernel and reboot this week, container hosts, CI runners and shared servers first.", "type": "security-brief", "section": "Security Digest", "date_published": "2026-09-18", "date_modified": "2026-09-18", "markdown_url": "https://erroneo.us/security/briefs/linux-kernel-five-exploited-lpe-bugs-kev/index.md", "verdict": "patch-this-week" }, { "url": "https://erroneo.us/security/briefs/plugin4shell-ai-agent-plugin-sha-pin-bypass/", "path": "/security/briefs/plugin4shell-ai-agent-plugin-sha-pin-bypass/", "title": "Plugin4Shell: Plugin Pin Bypass in AI Coding Agents", "description": "Claude Code and Codex users on current versions are fixed; the real exposure is Copilot or Gemini CLI plugins that auto-update from repositories hosted outside GitHub.", "type": "security-brief", "section": "Security Digest", "date_published": "2026-09-17", "date_modified": "2026-09-17", "markdown_url": "https://erroneo.us/security/briefs/plugin4shell-ai-agent-plugin-sha-pin-bypass/index.md", "verdict": "check-exposure" }, { "url": "https://erroneo.us/security/briefs/cisco-ise-cve-2026-76460-api-auth-bypass/", "path": "/security/briefs/cisco-ise-cve-2026-76460-api-auth-bypass/", "title": "Cisco ISE CVE-2026-76460: Exploited CVSS 10 Auth Bypass", "description": "If you run Cisco ISE or ISE-PIC on any release before the fixed patches, patch now and hunt every node; the bug needs no login, is exploited, and Cisco warns attackers may get root and erase their tracks.", "type": "security-brief", "section": "Security Digest", "date_published": "2026-09-16", "date_modified": "2026-09-16", "markdown_url": "https://erroneo.us/security/briefs/cisco-ise-cve-2026-76460-api-auth-bypass/index.md", "verdict": "act-now" }, { "url": "https://erroneo.us/security/briefs/google-pixel-modem-cve-2026-58704-zero-day/", "path": "/security/briefs/google-pixel-modem-cve-2026-58704-zero-day/", "title": "Google Pixel Modem CVE-2026-58704: Exploited Zero-Day", "description": "A targeted, no-interaction modem bug on Pixel phones with a fix already out: make 2026-09-05 the minimum patch level for every managed Pixel this week, and sooner for high-risk users.", "type": "security-brief", "section": "Security Digest", "date_published": "2026-09-15", "date_modified": "2026-09-15", "markdown_url": "https://erroneo.us/security/briefs/google-pixel-modem-cve-2026-58704-zero-day/index.md", "verdict": "patch-this-week" }, { "url": "https://erroneo.us/security/briefs/acronis-backup-cpanel-plesk-lpe-cve-2026-87886/", "path": "/security/briefs/acronis-backup-cpanel-plesk-lpe-cve-2026-87886/", "title": "Acronis Backup cPanel Plugin CVE-2026-87886: Exploited LPE", "description": "Only hosting servers running the Acronis Backup plugin for cPanel & WHM, Plesk or DirectAdmin are affected; on those, especially multi-tenant cPanel boxes, update the plugin now because it is being exploited.", "type": "security-brief", "section": "Security Digest", "date_published": "2026-09-15", "date_modified": "2026-09-15", "markdown_url": "https://erroneo.us/security/briefs/acronis-backup-cpanel-plesk-lpe-cve-2026-87886/index.md", "verdict": "check-exposure" }, { "url": "https://erroneo.us/security/briefs/cisco-secure-email-gateway-cve-2026-76461-76519-root-rce/", "path": "/security/briefs/cisco-secure-email-gateway-cve-2026-76461-76519-root-rce/", "title": "Cisco Secure Email Gateway: Two Exploited Root RCE Bugs", "description": "Every on-premises Secure Email Gateway below 15.5.5-014 or 16.5.0-780 can be rooted by an email and both bugs are exploited: upgrade now, and check for compromise before and after, because attackers can wipe local evidence.", "type": "security-brief", "section": "Security Digest", "date_published": "2026-09-14", "date_modified": "2026-09-14", "markdown_url": "https://erroneo.us/security/briefs/cisco-secure-email-gateway-cve-2026-76461-76519-root-rce/index.md", "verdict": "act-now" }, { "url": "https://erroneo.us/security/briefs/gitlab-commits-api-file-read-cve-2026-85706/", "path": "/security/briefs/gitlab-commits-api-file-read-cve-2026-85706/", "title": "GitLab CVE-2026-85706: Unauthenticated File Read, Exploited", "description": "Any unpatched self-managed GitLab 18.7 or later can have its configuration and secret keys read by anyone on the network, and CISA says it is being exploited; upgrade today and rotate secrets if you were exposed.", "type": "security-brief", "section": "Security Digest", "date_published": "2026-09-10", "date_modified": "2026-09-10", "markdown_url": "https://erroneo.us/security/briefs/gitlab-commits-api-file-read-cve-2026-85706/index.md", "verdict": "act-now" }, { "url": "https://erroneo.us/security/briefs/check-point-vpn-and-management-cve-2026-85102-93616/", "path": "/security/briefs/check-point-vpn-and-management-cve-2026-85102-93616/", "title": "Check Point: Exploited VPN Gateway and Management RCEs", "description": "Check Point shops should patch both gateways and management servers now: each flaw is unauthenticated RCE, both are exploited, and fixing one tier does not fix the other.", "type": "security-brief", "section": "Security Digest", "date_published": "2026-09-09", "date_modified": "2026-09-09", "markdown_url": "https://erroneo.us/security/briefs/check-point-vpn-and-management-cve-2026-85102-93616/index.md", "verdict": "act-now" }, { "url": "https://erroneo.us/security/briefs/windows-update-stack-alpc-zero-days-cve-2026-81963-85880/", "path": "/security/briefs/windows-update-stack-alpc-zero-days-cve-2026-81963-85880/", "title": "Windows Zero-Days: Update Stack and ALPC EoP (Sep 2026)", "description": "Make sure every Windows machine has the September 2026 or a later cumulative update; both bugs are exploited, but an attacker needs code running on the box first.", "type": "security-brief", "section": "Security Digest", "date_published": "2026-09-08", "date_modified": "2026-09-08", "markdown_url": "https://erroneo.us/security/briefs/windows-update-stack-alpc-zero-days-cve-2026-81963-85880/index.md", "verdict": "patch-this-week" }, { "url": "https://erroneo.us/security/briefs/magento-stylesmuggler-cve-2026-75650-zero-day-rce/", "path": "/security/briefs/magento-stylesmuggler-cve-2026-75650-zero-day-rce/", "title": "Magento StyleSmuggler CVE-2026-75650: Exploited Pre-Auth RCE", "description": "Any self-run Magento or Adobe Commerce store without the September hotfix should be presumed compromised: patch, then scan, then rotate the encryption key and every credential it protects, and add the October fix for the follow-on BlockStrap bug.", "type": "security-brief", "section": "Security Digest", "date_published": "2026-09-07", "date_modified": "2026-09-07", "markdown_url": "https://erroneo.us/security/briefs/magento-stylesmuggler-cve-2026-75650-zero-day-rce/index.md", "verdict": "act-now" }, { "url": "https://erroneo.us/security/briefs/connectwise-screenconnect-cve-2026-84869-guest-file-execution/", "path": "/security/briefs/connectwise-screenconnect-cve-2026-84869-guest-file-execution/", "title": "ScreenConnect CVE-2026-84869: Guest-to-Host File Execution", "description": "If your technicians use a ScreenConnect client older than 26.6.5, a compromised machine they connect to can run code on theirs; upgrade on-premises servers and reinstall host clients now.", "type": "security-brief", "section": "Security Digest", "date_published": "2026-09-03", "date_modified": "2026-09-03", "markdown_url": "https://erroneo.us/security/briefs/connectwise-screenconnect-cve-2026-84869-guest-file-execution/index.md", "verdict": "act-now" }, { "url": "https://erroneo.us/security/briefs/mikrotik-routeros-mikrotrick-ssh-cve-2026-86060/", "path": "/security/briefs/mikrotik-routeros-mikrotrick-ssh-cve-2026-86060/", "title": "MikroTrick: Exploited MikroTik RouterOS SSH Takeover Chain", "description": "If you run MikroTik routers, upgrade them now and check for an 'ops' admin account; an unauthenticated SSH chain to full admin was exploited a day before patches shipped.", "type": "security-brief", "section": "Security Digest", "date_published": "2026-09-03", "date_modified": "2026-09-03", "markdown_url": "https://erroneo.us/security/briefs/mikrotik-routeros-mikrotrick-ssh-cve-2026-86060/index.md", "verdict": "act-now" }, { "url": "https://erroneo.us/security/briefs/chrome-v8-cve-2026-85046-87491-exploited-zero-days/", "path": "/security/briefs/chrome-v8-cve-2026-85046-87491-exploited-zero-days/", "title": "Chrome V8 Zero-Days CVE-2026-85046 and CVE-2026-87491", "description": "Both were exploited zero-days, but Chrome and Edge fixed them in early September and auto-update has had six weeks to deliver the fix; the job now is finding browsers that did not update, not a scramble.", "type": "security-brief", "section": "Security Digest", "date_published": "2026-09-03", "date_modified": "2026-09-03", "markdown_url": "https://erroneo.us/security/briefs/chrome-v8-cve-2026-85046-87491-exploited-zero-days/index.md", "verdict": "check-exposure" }, { "url": "https://erroneo.us/security/briefs/litellm-proxy-mcp-auth-bypass-kev/", "path": "/security/briefs/litellm-proxy-mcp-auth-bypass-kev/", "title": "LiteLLM Proxy: Three Exploited Flaws in CISA KEV", "description": "If you run a self-hosted LiteLLM Proxy older than 1.84.0, upgrade now and treat the provider keys it holds as possibly exposed; SDK-only users are not affected.", "type": "security-brief", "section": "Security Digest", "date_published": "2026-09-02", "date_modified": "2026-09-02", "markdown_url": "https://erroneo.us/security/briefs/litellm-proxy-mcp-auth-bypass-kev/index.md", "verdict": "patch-this-week" }, { "url": "https://erroneo.us/security/briefs/gitspawn-git-fsmonitor-ai-coding-agents/", "path": "/security/briefs/gitspawn-git-fsmonitor-ai-coding-agents/", "title": "GitSpawn: Repo Git Config Runs Code in AI Coding Agents", "description": "Update your coding agents this week and never point one at a repository that arrived as files until you have read its .git/config; ordinary clones are not affected, and no attacks have been reported.", "type": "security-brief", "section": "Security Digest", "date_published": "2026-09-01", "date_modified": "2026-09-01", "markdown_url": "https://erroneo.us/security/briefs/gitspawn-git-fsmonitor-ai-coding-agents/index.md", "verdict": "patch-this-week" }, { "url": "https://erroneo.us/security/briefs/jfrog-artifactory-cve-2026-82329-auth-bypass-kev/", "path": "/security/briefs/jfrog-artifactory-cve-2026-82329-auth-bypass-kev/", "title": "JFrog Artifactory: Exploited Auth Bypass to Admin (KEV)", "description": "If you run self-hosted Artifactory below the fixed builds, treat it as exploited until shown otherwise: upgrade, then hunt for rogue admins, Groovy plugins and stolen signing keys, because patching does not remove them.", "type": "security-brief", "section": "Security Digest", "date_published": "2026-08-28", "date_modified": "2026-08-28", "markdown_url": "https://erroneo.us/security/briefs/jfrog-artifactory-cve-2026-82329-auth-bypass-kev/index.md", "verdict": "act-now" }, { "url": "https://erroneo.us/security/briefs/papercut-ng-mf-cve-2026-81578-82078-auth-bypass-rce/", "path": "/security/briefs/papercut-ng-mf-cve-2026-81578-82078-auth-bypass-rce/", "title": "PaperCut NG/MF: Mass-Exploited Pre-Auth RCE Chain (KEV)", "description": "If a PaperCut NG/MF server below 24.1.10, 25.0.13 or 26.0.5 was reachable from the internet after late August, assume it was compromised: upgrade, then hunt and rebuild, because this chain gave unauthenticated attackers SYSTEM and was mass-exploited.", "type": "security-brief", "section": "Security Digest", "date_published": "2026-08-27", "date_modified": "2026-08-27", "markdown_url": "https://erroneo.us/security/briefs/papercut-ng-mf-cve-2026-81578-82078-auth-bypass-rce/index.md", "verdict": "act-now" }, { "url": "https://erroneo.us/security/briefs/owncloud-cve-2023-49105-webdav-presigned-url-bypass-kev/", "path": "/security/briefs/owncloud-cve-2023-49105-webdav-presigned-url-bypass-kev/", "title": "ownCloud CVE-2023-49105: 2023 WebDAV Bypass Now in KEV", "description": "Up-to-date ownCloud servers are fine; any ownCloud core 10.6.0 to 10.13.0 still online should be upgraded today and treated as breached, because attackers are using this bug to empty file shares.", "type": "security-brief", "section": "Security Digest", "date_published": "2026-08-27", "date_modified": "2026-08-27", "markdown_url": "https://erroneo.us/security/briefs/owncloud-cve-2023-49105-webdav-presigned-url-bypass-kev/index.md", "verdict": "check-exposure" }, { "url": "https://erroneo.us/security/briefs/nextjs-windows-avif-next-og-rce/", "path": "/security/briefs/nextjs-windows-avif-next-og-rce/", "title": "Next.js: Windows, AVIF and next/og RCEs (Aug-Sep 2026)", "description": "Self-hosted Next.js apps still below 15.5.24 or 16.3.3 should upgrade now, ideally straight to the October releases; Windows hosts and apps optimizing untrusted AVIF images are the urgent cases.", "type": "security-brief", "section": "Security Digest", "date_published": "2026-08-25", "date_modified": "2026-08-25", "markdown_url": "https://erroneo.us/security/briefs/nextjs-windows-avif-next-og-rce/index.md", "verdict": "patch-this-week" }, { "url": "https://erroneo.us/security/briefs/apache-tomcat-august-2026-security-constraint-bypasses/", "path": "/security/briefs/apache-tomcat-august-2026-security-constraint-bypasses/", "title": "Apache Tomcat August 2026: Security Constraint Bypasses", "description": "Upgrade Tomcat, including the copy embedded in Spring Boot apps, this week; the access-control bypasses matter wherever you rely on web.xml security constraints or container authentication, and none is known to be exploited.", "type": "security-brief", "section": "Security Digest", "date_published": "2026-08-25", "date_modified": "2026-08-25", "markdown_url": "https://erroneo.us/security/briefs/apache-tomcat-august-2026-security-constraint-bypasses/index.md", "verdict": "patch-this-week" }, { "url": "https://erroneo.us/security/briefs/spring-for-graphql-cve-2026-59285-deserialization/", "path": "/security/briefs/spring-for-graphql-cve-2026-59285-deserialization/", "title": "Spring for GraphQL CVE-2026-59285: Pagination RCE Risk", "description": "Only Spring Boot 4 apps on Spring for GraphQL 2.0.0-2.0.4 that use Jackson 2.x and expose paginated Connection fields are at risk; if that is you, take the 2.0.5 upgrade now.", "type": "security-brief", "section": "Security Digest", "date_published": "2026-08-20", "date_modified": "2026-08-20", "markdown_url": "https://erroneo.us/security/briefs/spring-for-graphql-cve-2026-59285-deserialization/index.md", "verdict": "check-exposure" }, { "url": "https://erroneo.us/security/briefs/arrayref-crates-io-proc-macro1-build-script-malware/", "path": "/security/briefs/arrayref-crates-io-proc-macro1-build-script-malware/", "title": "arrayref, internment, append-only-vec: Rust Crates Hijacked", "description": "Only builds that resolved the three poisoned releases during a roughly two-hour window on August 20, 2026 ran the payload, but any machine that did should be treated as compromised.", "type": "security-brief", "section": "Security Digest", "date_published": "2026-08-20", "date_modified": "2026-08-20", "markdown_url": "https://erroneo.us/security/briefs/arrayref-crates-io-proc-macro1-build-script-malware/index.md", "verdict": "check-exposure" }, { "url": "https://erroneo.us/security/briefs/citrix-netscaler-cve-2026-19490-gateway-aaa-auth-bypass/", "path": "/security/briefs/citrix-netscaler-cve-2026-19490-gateway-aaa-auth-bypass/", "title": "NetScaler CVE-2026-19490: Exploited Gateway Auth Bypass", "description": "Any customer-managed NetScaler with a Gateway or AAA virtual server on an August-or-older build should be upgraded today, straight to the current builds, because this bypass is being tried in the wild and later exploited NetScaler bugs are fixed in the same upgrade.", "type": "security-brief", "section": "Security Digest", "date_published": "2026-08-19", "date_modified": "2026-08-19", "markdown_url": "https://erroneo.us/security/briefs/citrix-netscaler-cve-2026-19490-gateway-aaa-auth-bypass/index.md", "verdict": "act-now" }, { "url": "https://erroneo.us/security/briefs/vm2-sandbox-escape-wave-3-12-2/", "path": "/security/briefs/vm2-sandbox-escape-wave-3-12-2/", "title": "vm2: 22 Critical Sandbox Escapes, Fixed in 3.12.2", "description": "If anything outside your trust boundary can get code into vm2, upgrade to 3.12.2 today and plan to move that code out of process; if vm2 only runs your own code, upgrade on a normal cycle.", "type": "security-brief", "section": "Security Digest", "date_published": "2026-08-17", "date_modified": "2026-08-17", "markdown_url": "https://erroneo.us/security/briefs/vm2-sandbox-escape-wave-3-12-2/index.md", "verdict": "check-exposure" }, { "url": "https://erroneo.us/security/briefs/adobe-commerce-magento-cve-2026-71362-account-takeover/", "path": "/security/briefs/adobe-commerce-magento-cve-2026-71362-account-takeover/", "title": "Adobe Commerce CVE-2026-71362: Exploited Account Takeover", "description": "Any Magento or Adobe Commerce store without the August 2026 isolated patch is exposed to an exploited, login-free takeover of customer accounts; apply it today.", "type": "security-brief", "section": "Security Digest", "date_published": "2026-08-11", "date_modified": "2026-08-11", "markdown_url": "https://erroneo.us/security/briefs/adobe-commerce-magento-cve-2026-71362-account-takeover/index.md", "verdict": "act-now" }, { "url": "https://erroneo.us/security/briefs/cisco-asa-ftd-vpn-dos-cve-2026-20349/", "path": "/security/briefs/cisco-asa-ftd-vpn-dos-cve-2026-20349/", "title": "Cisco ASA/FTD CVE-2026-20349: Exploited VPN Crash Bug", "description": "If your ASA or FTD terminates remote access VPN, SSL VPN or ZTNA, install the fixed release this week; attackers are using this to knock firewalls offline, but Cisco describes no code execution or data theft.", "type": "security-brief", "section": "Security Digest", "date_published": "2026-08-11", "date_modified": "2026-08-11", "markdown_url": "https://erroneo.us/security/briefs/cisco-asa-ftd-vpn-dos-cve-2026-20349/index.md", "verdict": "patch-this-week" }, { "url": "https://erroneo.us/security/briefs/windows-afd-sys-cve-2026-68820-zero-day-eop/", "path": "/security/briefs/windows-afd-sys-cve-2026-68820-zero-day-eop/", "title": "Windows AFD.sys CVE-2026-68820: Exploited Zero-Day EoP", "description": "A local bug, but a real zero-day: North Korea's Lazarus group used it to load a kernel rootkit, so any Windows host still missing the August 2026 or later cumulative update should be patched this week.", "type": "security-brief", "section": "Security Digest", "date_published": "2026-08-11", "date_modified": "2026-08-11", "markdown_url": "https://erroneo.us/security/briefs/windows-afd-sys-cve-2026-68820-zero-day-eop/index.md", "verdict": "patch-this-week" }, { "url": "https://erroneo.us/security/briefs/metabase-cve-2026-72898-reset-password-sqli/", "path": "/security/briefs/metabase-cve-2026-72898-reset-password-sqli/", "title": "Metabase CVE-2026-72898: Exploited Pre-Auth SQL Injection", "description": "Self-hosted Metabase 58 through 63 below the fixed point releases can be taken over without a login and was attacked as a zero-day; upgrade now, and if the reset endpoint was reachable, assume your connected database credentials are burned.", "type": "security-brief", "section": "Security Digest", "date_published": "2026-08-06", "date_modified": "2026-08-06", "markdown_url": "https://erroneo.us/security/briefs/metabase-cve-2026-72898-reset-password-sqli/index.md", "verdict": "act-now" }, { "url": "https://erroneo.us/security/briefs/macos-screen-sharing-auth-bypass-cve-2026-65400/", "path": "/security/briefs/macos-screen-sharing-auth-bypass-cve-2026-65400/", "title": "macOS Screen Sharing CVE-2026-65400: Exploited Auth Bypass", "description": "Any Mac with Screen Sharing or Remote Management reachable from an untrusted network needs the update today and a compromise check; Macs with the service off should still update, but they were not reachable by this attack.", "type": "security-brief", "section": "Security Digest", "date_published": "2026-08-06", "date_modified": "2026-08-06", "markdown_url": "https://erroneo.us/security/briefs/macos-screen-sharing-auth-bypass-cve-2026-65400/index.md", "verdict": "check-exposure" }, { "url": "https://erroneo.us/security/briefs/gemini-cli-claude-code-ci-agent-flaws/", "path": "/security/briefs/gemini-cli-claude-code-ci-agent-flaws/", "title": "Gemini CLI and Claude Code Flaws Expose CI Secrets", "description": "If an AI coding agent runs in your CI on content outsiders can write (issues, PRs, comments), check versions and workflow permissions this week; laptop users on auto-update already have the fixes.", "type": "security-brief", "section": "Security Digest", "date_published": "2026-08-05", "date_modified": "2026-08-05", "markdown_url": "https://erroneo.us/security/briefs/gemini-cli-claude-code-ci-agent-flaws/index.md", "verdict": "check-exposure" }, { "url": "https://erroneo.us/security/briefs/langflow-cve-2026-9198-kev-unauthenticated-rce/", "path": "/security/briefs/langflow-cve-2026-9198-kev-unauthenticated-rce/", "title": "Langflow CVE-2026-9198: Exploited Unauthenticated RCE", "description": "Langflow is now the most repeatedly exploited AI-agent builder on CISA's list; any network-reachable instance below 1.10.1 should be patched today and checked for compromise.", "type": "security-brief", "section": "Security Digest", "date_published": "2026-08-04", "date_modified": "2026-08-04", "markdown_url": "https://erroneo.us/security/briefs/langflow-cve-2026-9198-kev-unauthenticated-rce/index.md", "verdict": "act-now" }, { "url": "https://erroneo.us/security/briefs/chaindrop-keyv-npm-worm/", "path": "/security/briefs/chaindrop-keyv-npm-worm/", "title": "ChainDrop: npm Worm Trojanizes keyv and cacheable Packages", "description": "These are deep transitive dependencies of ESLint-style tooling and HTTP stacks, so many projects resolved them without choosing them; if a lockfile picked up a flagged version in August 2026, treat that host as compromised.", "type": "security-brief", "section": "Security Digest", "date_published": "2026-08-04", "date_modified": "2026-08-04", "markdown_url": "https://erroneo.us/security/briefs/chaindrop-keyv-npm-worm/index.md", "verdict": "check-exposure" }, { "url": "https://erroneo.us/security/briefs/open-vsx-evil-twin-extensions-mangorbit/", "path": "/security/briefs/open-vsx-evil-twin-extensions-mangorbit/", "title": "Open VSX: 77 Evil-Twin Extensions Leak Developer Data", "description": "Check whether any of the 77 extension IDs are installed or recommended in your workspaces and remove them; this was reconnaissance, not credential theft, so blanket secret rotation is not needed.", "type": "security-brief", "section": "Security Digest", "date_published": "2026-08-04", "date_modified": "2026-08-04", "markdown_url": "https://erroneo.us/security/briefs/open-vsx-evil-twin-extensions-mangorbit/index.md", "verdict": "check-exposure" }, { "url": "https://erroneo.us/security/briefs/mlflow-cve-2026-64849-webhook-ssrf-cloud-metadata/", "path": "/security/briefs/mlflow-cve-2026-64849-webhook-ssrf-cloud-metadata/", "title": "MLflow CVE-2026-64849: Exploited Unauthenticated SSRF", "description": "If an MLflow tracking server below 3.15.0 is reachable by anyone you do not fully trust, assume attackers can read your cloud instance credentials through it: upgrade today, then check webhooks and cloud audit logs.", "type": "security-brief", "section": "Security Digest", "date_published": "2026-08-02", "date_modified": "2026-08-02", "markdown_url": "https://erroneo.us/security/briefs/mlflow-cve-2026-64849-webhook-ssrf-cloud-metadata/index.md", "verdict": "act-now" }, { "url": "https://erroneo.us/security/briefs/n-able-n-central-auth-bypass-pre-auth-rce-kev/", "path": "/security/briefs/n-able-n-central-auth-bypass-pre-auth-rce-kev/", "title": "N-able N-central: Exploited Auth Bypass and Pre-Auth RCE", "description": "Any self-hosted N-central server below 2026.3.1.14 should be treated as exposed and patched today, and any server that was patched late needs a compromise review, because one stolen RMM console reaches every managed endpoint.", "type": "security-brief", "section": "Security Digest", "date_published": "2026-08-01", "date_modified": "2026-08-01", "markdown_url": "https://erroneo.us/security/briefs/n-able-n-central-auth-bypass-pre-auth-rce-kev/index.md", "verdict": "act-now" }, { "url": "https://erroneo.us/security/briefs/anthropic-claude-evals-real-systems-pypi-package/", "path": "/security/briefs/anthropic-claude-evals-real-systems-pypi-package/", "title": "Claude Evals Reached 3 Real Orgs, Published a PyPI Stealer", "description": "Unless Anthropic has contacted you, there is nothing to patch or rotate; the lesson is how one unvetted install of a brand-new package handed a security vendor's credentials to an agent.", "type": "security-brief", "section": "Security Digest", "date_published": "2026-07-30", "date_modified": "2026-07-30", "markdown_url": "https://erroneo.us/security/briefs/anthropic-claude-evals-real-systems-pypi-package/index.md", "verdict": "most-can-relax" }, { "url": "https://erroneo.us/security/briefs/vmware-vcenter-syslog-rce-cve-2026-59310/", "path": "/security/briefs/vmware-vcenter-syslog-rce-cve-2026-59310/", "title": "VMware vCenter CVE-2026-59310: Exploited Syslog RCE", "description": "If you run vCenter and have not installed Broadcom's July 29 fix, patch today and hunt for persistence; this is unauthenticated root code execution with hundreds of victims and ransomware use.", "type": "security-brief", "section": "Security Digest", "date_published": "2026-07-29", "date_modified": "2026-07-29", "markdown_url": "https://erroneo.us/security/briefs/vmware-vcenter-syslog-rce-cve-2026-59310/index.md", "verdict": "act-now" }, { "url": "https://erroneo.us/security/briefs/cisco-fmc-cve-2026-20316-hard-coded-password/", "path": "/security/briefs/cisco-fmc-cve-2026-20316-hard-coded-password/", "title": "Cisco FMC CVE-2026-20316: Exploited Hard-Coded Password", "description": "If you run on-premises Cisco FMC and have not installed the July hot fix or a September hardening release, upgrade now and check for the published indicator; the login needs no guessing and CISA ties the bug to ransomware.", "type": "security-brief", "section": "Security Digest", "date_published": "2026-07-29", "date_modified": "2026-07-29", "markdown_url": "https://erroneo.us/security/briefs/cisco-fmc-cve-2026-20316-hard-coded-password/index.md", "verdict": "act-now" }, { "url": "https://erroneo.us/security/briefs/nodejs-july-2026-security-releases/", "path": "/security/briefs/nodejs-july-2026-security-releases/", "title": "Node.js July 2026 Security Releases: HTTP/2 and 11 CVEs", "description": "Routine but real: upgrade every supported Node.js line this week, sooner if you terminate HTTP/2 in Node or rely on the Permission Model as a sandbox.", "type": "security-brief", "section": "Security Digest", "date_published": "2026-07-29", "date_modified": "2026-07-29", "markdown_url": "https://erroneo.us/security/briefs/nodejs-july-2026-security-releases/index.md", "verdict": "patch-this-week" }, { "url": "https://erroneo.us/security/briefs/arista-velocloud-orchestrator-cve-2026-16812-93952-exploited-rce/", "path": "/security/briefs/arista-velocloud-orchestrator-cve-2026-16812-93952-exploited-rce/", "title": "Arista VeloCloud Orchestrator: Two Exploited CVSS 10 Flaws", "description": "On-prem VCO operators should move to 5.2.3.16 or 6.4.2.8 now, lock the web interface down and hunt for the published backdoor files; both flaws are exploited, and the July fixes do not cover the September bug.", "type": "security-brief", "section": "Security Digest", "date_published": "2026-07-27", "date_modified": "2026-07-27", "markdown_url": "https://erroneo.us/security/briefs/arista-velocloud-orchestrator-cve-2026-16812-93952-exploited-rce/index.md", "verdict": "act-now" }, { "url": "https://erroneo.us/security/briefs/gitea-cve-2026-60004-diffpatch-git-hook-rce/", "path": "/security/briefs/gitea-cve-2026-60004-diffpatch-git-hook-rce/", "title": "Gitea CVE-2026-60004: Exploited RCE via diffpatch API", "description": "Upgrade every self-hosted Gitea below 1.27.1 today and close open registration; automated attacks sign up, create a repo and get a shell in seconds, and a proof of concept is public.", "type": "security-brief", "section": "Security Digest", "date_published": "2026-07-27", "date_modified": "2026-07-27", "markdown_url": "https://erroneo.us/security/briefs/gitea-cve-2026-60004-diffpatch-git-hook-rce/index.md", "verdict": "act-now" }, { "url": "https://erroneo.us/security/briefs/teamcity-cve-2026-63077-unauthenticated-rce/", "path": "/security/briefs/teamcity-cve-2026-63077-unauthenticated-rce/", "title": "TeamCity CVE-2026-63077: Unauthenticated RCE, Exploited", "description": "Any self-hosted TeamCity server below 2025.11.7 or 2026.1.3 that an attacker can reach over HTTP(S) can be taken over without credentials, and ransomware crews are using it; patch or apply the security patch plugin today, then check for intrusions.", "type": "security-brief", "section": "Security Digest", "date_published": "2026-07-27", "date_modified": "2026-07-27", "markdown_url": "https://erroneo.us/security/briefs/teamcity-cve-2026-63077-unauthenticated-rce/index.md", "verdict": "act-now" }, { "url": "https://erroneo.us/security/briefs/check-point-smartconsole-cve-2026-16232-auth-bypass/", "path": "/security/briefs/check-point-smartconsole-cve-2026-16232-auth-bypass/", "title": "Check Point CVE-2026-16232: Exploited Management Auth Bypass", "description": "Install the July 2026 Jumbo Hotfix on every Check Point management server this week, and today if the server is reachable from the internet with unrestricted Trusted Clients; that is the setup attackers used to take full admin control.", "type": "security-brief", "section": "Security Digest", "date_published": "2026-07-22", "date_modified": "2026-07-22", "markdown_url": "https://erroneo.us/security/briefs/check-point-smartconsole-cve-2026-16232-auth-bypass/index.md", "verdict": "patch-this-week" }, { "url": "https://erroneo.us/security/briefs/zimbra-snmp-command-injection-cve-2026-73570/", "path": "/security/briefs/zimbra-snmp-command-injection-cve-2026-73570/", "title": "Zimbra CVE-2026-73570: Exploited SNMP Command Injection", "description": "If you run Zimbra below 10.1.20, check today whether the optional zimbra-snmp package is installed with SNMP notifications on; if it is, patch and hunt for web shells, because hundreds of such servers have been compromised.", "type": "security-brief", "section": "Security Digest", "date_published": "2026-07-20", "date_modified": "2026-07-20", "markdown_url": "https://erroneo.us/security/briefs/zimbra-snmp-command-injection-cve-2026-73570/index.md", "verdict": "check-exposure" }, { "url": "https://erroneo.us/security/briefs/wordpress-7-0-2-rest-batch-sqli-rce-cve-2026-63030/", "path": "/security/briefs/wordpress-7-0-2-rest-batch-sqli-rce-cve-2026-63030/", "title": "WordPress 7.0.2: REST Batch + SQL Injection Chain to RCE", "description": "Core WordPress 6.9 and 7.0 sites were exposed to unauthenticated remote code execution that is now exploited; most sites got a forced update, so your job is to confirm every one actually did.", "type": "security-brief", "section": "Security Digest", "date_published": "2026-07-17", "date_modified": "2026-07-17", "markdown_url": "https://erroneo.us/security/briefs/wordpress-7-0-2-rest-batch-sqli-rce-cve-2026-63030/index.md", "verdict": "act-now" }, { "url": "https://erroneo.us/security/briefs/hugging-face-breach-openai-evaluation-agents/", "path": "/security/briefs/hugging-face-breach-openai-evaluation-agents/", "title": "Hugging Face Breached by Escaped OpenAI Evaluation Agents", "description": "Hugging Face found no tampering with public models, datasets, Spaces or packages, so most users only need the token rotation it recommended; anyone who ever exposed a write token publicly should assume it was found and used.", "type": "security-brief", "section": "Security Digest", "date_published": "2026-07-16", "date_modified": "2026-07-16", "markdown_url": "https://erroneo.us/security/briefs/hugging-face-breach-openai-evaluation-agents/index.md", "verdict": "check-exposure" }, { "url": "https://erroneo.us/security/briefs/sonicwall-sma1000-zero-days-cve-2026-15409-83548/", "path": "/security/briefs/sonicwall-sma1000-zero-days-cve-2026-15409-83548/", "title": "SonicWall SMA1000: Two Rounds of Exploited Zero-Days", "description": "If you run an SMA1000 appliance, install the September hotfix and check it for compromise today; the July fix alone does not cover the second pair of exploited bugs.", "type": "security-brief", "section": "Security Digest", "date_published": "2026-07-14", "date_modified": "2026-07-14", "markdown_url": "https://erroneo.us/security/briefs/sonicwall-sma1000-zero-days-cve-2026-15409-83548/index.md", "verdict": "act-now" }, { "url": "https://erroneo.us/security/briefs/sharepoint-cve-2026-58644-50522-55040-65660-exploited/", "path": "/security/briefs/sharepoint-cve-2026-58644-50522-55040-65660-exploited/", "title": "SharePoint: Four July-August 2026 Flaws Now Exploited", "description": "Any on-premises SharePoint farm not yet on the August 2026 builds is exposed to exploited bugs with public exploit code; patch, rotate machine keys and check for compromise now.", "type": "security-brief", "section": "Security Digest", "date_published": "2026-07-14", "date_modified": "2026-07-14", "markdown_url": "https://erroneo.us/security/briefs/sharepoint-cve-2026-58644-50522-55040-65660-exploited/index.md", "verdict": "act-now" }, { "url": "https://erroneo.us/security/briefs/sangoma-switchvox-cve-2026-9586-pre-auth-sqli-rce/", "path": "/security/briefs/sangoma-switchvox-cve-2026-9586-pre-auth-sqli-rce/", "title": "Sangoma Switchvox CVE-2026-9586: Pre-Auth SQLi to RCE", "description": "A single unauthenticated request turns an unpatched Switchvox PBX into a shell; if yours is below 8.4.0.2 and reachable from the internet, upgrade today and check it for compromise.", "type": "security-brief", "section": "Security Digest", "date_published": "2026-07-14", "date_modified": "2026-07-14", "markdown_url": "https://erroneo.us/security/briefs/sangoma-switchvox-cve-2026-9586-pre-auth-sqli-rce/index.md", "verdict": "act-now" }, { "url": "https://erroneo.us/security/briefs/sharepoint-cve-2026-56164-zero-day/", "path": "/security/briefs/sharepoint-cve-2026-56164-zero-day/", "title": "SharePoint CVE-2026-56164: Exploited Unauthenticated 0-Day", "description": "Ignore the modest vendor score: this was exploited as a zero-day against on-prem SharePoint, so internet-facing farms need the July 2026 updates, a machine-key rotation and a compromise check now.", "type": "security-brief", "section": "Security Digest", "date_published": "2026-07-14", "date_modified": "2026-07-14", "markdown_url": "https://erroneo.us/security/briefs/sharepoint-cve-2026-56164-zero-day/index.md", "verdict": "act-now" }, { "url": "https://erroneo.us/security/briefs/microsoft-ad-fs-cve-2026-56155-dkm-acl-privilege-escalation/", "path": "/security/briefs/microsoft-ad-fs-cve-2026-56155-dkm-acl-privilege-escalation/", "title": "AD FS CVE-2026-56155: Exploited EoP via Weak DKM Key ACLs", "description": "If you run AD FS, install the October 2026 or later Windows update on every farm server this week and confirm the DKM container ACL was fixed; unless you opted in, the July patch only flagged the weak permissions.", "type": "security-brief", "section": "Security Digest", "date_published": "2026-07-14", "date_modified": "2026-07-14", "markdown_url": "https://erroneo.us/security/briefs/microsoft-ad-fs-cve-2026-56155-dkm-acl-privilege-escalation/index.md", "verdict": "patch-this-week" }, { "url": "https://erroneo.us/security/briefs/asyncapi-npm-pwn-request-miasma-rat/", "path": "/security/briefs/asyncapi-npm-pwn-request-miasma-rat/", "title": "AsyncAPI npm Packages Backdoored via pull_request_target", "description": "If any build resolved @asyncapi/specs 6.11.2 or the July 14 generator releases, treat that machine as backdoored; everyone else should still fix their own pull_request_target workflows.", "type": "security-brief", "section": "Security Digest", "date_published": "2026-07-14", "date_modified": "2026-07-14", "markdown_url": "https://erroneo.us/security/briefs/asyncapi-npm-pwn-request-miasma-rat/index.md", "verdict": "check-exposure" }, { "url": "https://erroneo.us/security/briefs/servicenow-cve-2026-6875-sandbox-escape-rce/", "path": "/security/briefs/servicenow-cve-2026-6875-sandbox-escape-rce/", "title": "ServiceNow CVE-2026-6875: Pre-Auth Sandbox Escape RCE", "description": "ServiceNow-hosted customers were protected in April; the real risk is self-hosted and partner-hosted instances that have not taken the July 13, 2026 patches.", "type": "security-brief", "section": "Security Digest", "date_published": "2026-07-13", "date_modified": "2026-07-13", "markdown_url": "https://erroneo.us/security/briefs/servicenow-cve-2026-6875-sandbox-escape-rce/index.md", "verdict": "check-exposure" }, { "url": "https://erroneo.us/security/briefs/cisco-ios-12-4-csrf-cve-2008-4128-fsb-kev/", "path": "/security/briefs/cisco-ios-12-4-csrf-cve-2008-4128-fsb-kev/", "title": "Cisco IOS CVE-2008-4128: 18-Year-Old CSRF in CISA KEV", "description": "Only organizations still running retired IOS 12.4 routers are exposed, but a Russian state unit is using this bug; find those boxes, turn off their web server today and replace them.", "type": "security-brief", "section": "Security Digest", "date_published": "2026-07-13", "date_modified": "2026-07-13", "markdown_url": "https://erroneo.us/security/briefs/cisco-ios-12-4-csrf-cve-2008-4128-fsb-kev/index.md", "verdict": "check-exposure" }, { "url": "https://erroneo.us/security/briefs/jscrambler-npm-compromise-infostealer/", "path": "/security/briefs/jscrambler-npm-compromise-infostealer/", "title": "jscrambler npm Compromise: Infostealer in CLI Releases", "description": "Only builds that installed one of the poisoned versions during a roughly three-hour window on July 11 are at risk, but any machine that did should be treated as compromised.", "type": "security-brief", "section": "Security Digest", "date_published": "2026-07-11", "date_modified": "2026-07-11", "markdown_url": "https://erroneo.us/security/briefs/jscrambler-npm-compromise-infostealer/index.md", "verdict": "check-exposure" }, { "url": "https://erroneo.us/security/briefs/balbooa-forms-joomla-file-upload-cve-2026-56291/", "path": "/security/briefs/balbooa-forms-joomla-file-upload-cve-2026-56291/", "title": "Balbooa Forms CVE-2026-56291: Exploited Joomla Upload RCE", "description": "Only Joomla sites running Balbooa Forms are at risk, but for them this is an emergency: an unauthenticated web-shell upload exploited before the patch, followed by more pre-auth bugs, so update to 2.4.3.4 or later and hunt for shells.", "type": "security-brief", "section": "Security Digest", "date_published": "2026-07-09", "date_modified": "2026-07-09", "markdown_url": "https://erroneo.us/security/briefs/balbooa-forms-joomla-file-upload-cve-2026-56291/index.md", "verdict": "check-exposure" }, { "url": "https://erroneo.us/security/briefs/netscaler-gateway-saml-rce-cve-2026-8452/", "path": "/security/briefs/netscaler-gateway-saml-rce-cve-2026-8452/", "title": "NetScaler CVE-2026-8452: DoS Bug Exploited as Pre-Auth RCE", "description": "Any NetScaler configured as a Gateway or AAA server that is still below the June 30 builds needs patching today and a check for web shells; the bug the vendor called DoS is a public pre-auth RCE under attack.", "type": "security-brief", "section": "Security Digest", "date_published": "2026-06-30", "date_modified": "2026-06-30", "markdown_url": "https://erroneo.us/security/briefs/netscaler-gateway-saml-rce-cve-2026-8452/index.md", "verdict": "act-now" }, { "url": "https://erroneo.us/security/briefs/adobe-coldfusion-cve-2026-48282-rds-path-traversal/", "path": "/security/briefs/adobe-coldfusion-cve-2026-48282-rds-path-traversal/", "title": "ColdFusion CVE-2026-48282: Exploited RDS Path Traversal", "description": "Every ColdFusion 2023/2025 server should already be on the June updates; if RDS was enabled without authentication and reachable, assume the box may be compromised and hunt.", "type": "security-brief", "section": "Security Digest", "date_published": "2026-06-30", "date_modified": "2026-06-30", "markdown_url": "https://erroneo.us/security/briefs/adobe-coldfusion-cve-2026-48282-rds-path-traversal/index.md", "verdict": "check-exposure" }, { "url": "https://erroneo.us/security/briefs/joomlack-page-builder-ck-cve-2026-56290-file-upload-rce/", "path": "/security/briefs/joomlack-page-builder-ck-cve-2026-56290-file-upload-rce/", "title": "Page Builder CK CVE-2026-56290: Exploited Joomla Upload RCE", "description": "Only Joomla sites running Page Builder CK are at risk, but for them this is an emergency: an unauthenticated web-shell upload exploited within hours of the patch, with an incomplete first fix, so update to 3.6.5 or later and hunt for shells.", "type": "security-brief", "section": "Security Digest", "date_published": "2026-06-27", "date_modified": "2026-06-27", "markdown_url": "https://erroneo.us/security/briefs/joomlack-page-builder-ck-cve-2026-56290-file-upload-rce/index.md", "verdict": "check-exposure" }, { "url": "https://erroneo.us/security/briefs/trueconf-server-cve-2026-72529-72530-head-mare/", "path": "/security/briefs/trueconf-server-cve-2026-72529-72530-head-mare/", "title": "TrueConf Server: Exploited Pre-Auth RCE Chain on Port 4307", "description": "Only organizations that run TrueConf Server, or whose staff join meetings on other companies' TrueConf servers, are exposed; for them an unpatched, reachable server should be treated as compromised, because the chain is unauthenticated, yields SYSTEM and was used to infect the server's own users.", "type": "security-brief", "section": "Security Digest", "date_published": "2026-06-18", "date_modified": "2026-06-18", "markdown_url": "https://erroneo.us/security/briefs/trueconf-server-cve-2026-72529-72530-head-mare/index.md", "verdict": "check-exposure" }, { "url": "https://erroneo.us/security/briefs/zyxel-gs1900-cve-2026-7273-cgi-buffer-overflow/", "path": "/security/briefs/zyxel-gs1900-cve-2026-7273-cgi-buffer-overflow/", "title": "Zyxel GS1900 Switches: Exploited CGI Overflow (KEV)", "description": "Patch every GS1900 to the June firmware, but the urgency depends on reach: if the switch's web interface is exposed to the internet, a guest network or a flat LAN, treat it as compromised until checked; if only a locked-down admin VLAN can reach it, patch on a normal cycle this month.", "type": "security-brief", "section": "Security Digest", "date_published": "2026-06-16", "date_modified": "2026-06-16", "markdown_url": "https://erroneo.us/security/briefs/zyxel-gs1900-cve-2026-7273-cgi-buffer-overflow/index.md", "verdict": "check-exposure" }, { "url": "https://erroneo.us/security/briefs/sp-page-builder-cve-2026-48908-unauthenticated-upload-rce/", "path": "/security/briefs/sp-page-builder-cve-2026-48908-unauthenticated-upload-rce/", "title": "SP Page Builder CVE-2026-48908: Exploited Joomla RCE", "description": "Any Joomla site still on SP Page Builder 6.6.1 or older should be updated today and treated as compromised, because automated attacks have been planting web shells and admin accounts since June.", "type": "security-brief", "section": "Security Digest", "date_published": "2026-06-15", "date_modified": "2026-06-15", "markdown_url": "https://erroneo.us/security/briefs/sp-page-builder-cve-2026-48908-unauthenticated-upload-rce/index.md", "verdict": "act-now" }, { "url": "https://erroneo.us/security/briefs/icagenda-joomla-cve-2026-48939-file-upload-rce/", "path": "/security/briefs/icagenda-joomla-cve-2026-48939-file-upload-rce/", "title": "iCagenda CVE-2026-48939: Exploited Joomla Upload-to-RCE", "description": "Only Joomla 6.0.0-6.1.1 sites running iCagenda before 4.0.8 were open to web shells; those sites need a web-shell hunt, while everyone else on iCagenda simply updates.", "type": "security-brief", "section": "Security Digest", "date_published": "2026-06-15", "date_modified": "2026-06-15", "markdown_url": "https://erroneo.us/security/briefs/icagenda-joomla-cve-2026-48939-file-upload-rce/index.md", "verdict": "check-exposure" }, { "url": "https://erroneo.us/security/briefs/oracle-peoplesoft-cve-2026-35273-shinyhunters/", "path": "/security/briefs/oracle-peoplesoft-cve-2026-35273-shinyhunters/", "title": "Oracle PeopleSoft CVE-2026-35273: ShinyHunters Zero-Day", "description": "If you run PeopleTools 8.61 or 8.62 with PIA reachable from the internet, apply Oracle's fix and lock down the EMHub/PSIGW paths today, then hunt back to May 27, 2026.", "type": "security-brief", "section": "Security Digest", "date_published": "2026-06-10", "date_modified": "2026-06-10", "markdown_url": "https://erroneo.us/security/briefs/oracle-peoplesoft-cve-2026-35273-shinyhunters/index.md", "verdict": "act-now" }, { "url": "https://erroneo.us/security/briefs/progress-loadmaster-cve-2026-8037-pre-auth-rce/", "path": "/security/briefs/progress-loadmaster-cve-2026-8037-pre-auth-rce/", "title": "Progress LoadMaster CVE-2026-8037: Exploited Pre-Auth RCE", "description": "Only LoadMaster-based appliances with the API enabled are exposed, but for those this is unauthenticated root RCE with a public exploit; if that's you and you're below 7.2.63.2 or 7.2.54.18, patch today.", "type": "security-brief", "section": "Security Digest", "date_published": "2026-06-04", "date_modified": "2026-06-04", "markdown_url": "https://erroneo.us/security/briefs/progress-loadmaster-cve-2026-8037-pre-auth-rce/index.md", "verdict": "check-exposure" }, { "url": "https://erroneo.us/security/briefs/kestra-cve-2026-49869-auth-bypass-rce/", "path": "/security/briefs/kestra-cve-2026-49869-auth-bypass-rce/", "title": "Kestra CVE-2026-49869: Exploited Unauthenticated RCE", "description": "If you run Kestra OSS below 1.0.45 or 1.3.21 and anyone untrusted can reach its API, assume it is compromised: upgrade, then rotate every secret the workers could see.", "type": "security-brief", "section": "Security Digest", "date_published": "2026-06-03", "date_modified": "2026-06-03", "markdown_url": "https://erroneo.us/security/briefs/kestra-cve-2026-49869-auth-bypass-rce/index.md", "verdict": "act-now" }, { "url": "https://erroneo.us/security/briefs/oracle-ebs-payments-cve-2026-46817-kev/", "path": "/security/briefs/oracle-ebs-payments-cve-2026-46817-kev/", "title": "Oracle EBS Payments CVE-2026-46817: Exploited Takeover", "description": "If you run Oracle E-Business Suite 12.2 without the May 2026 Critical Security Patch Update, patch now; this is an unauthenticated, low-complexity takeover of the payments module and it has been exploited since late June.", "type": "security-brief", "section": "Security Digest", "date_published": "2026-05-28", "date_modified": "2026-05-28", "markdown_url": "https://erroneo.us/security/briefs/oracle-ebs-payments-cve-2026-46817-kev/index.md", "verdict": "act-now" }, { "url": "https://erroneo.us/security/briefs/starlette-badhost-host-header-bypass-cve-2026-48710/", "path": "/security/briefs/starlette-badhost-host-header-bypass-cve-2026-48710/", "title": "Starlette BadHost: Host Header Auth Bypass in CISA KEV", "description": "Bump starlette to 1.0.1 or later in every Python service this week; it is urgent where an ASGI server faces untrusted clients directly and middleware makes security decisions from request.url.", "type": "security-brief", "section": "Security Digest", "date_published": "2026-05-21", "date_modified": "2026-05-21", "markdown_url": "https://erroneo.us/security/briefs/starlette-badhost-host-header-bypass-cve-2026-48710/index.md", "verdict": "patch-this-week" }, { "url": "https://erroneo.us/security/briefs/mini-shai-hulud-tanstack-npm-worm/", "path": "/security/briefs/mini-shai-hulud-tanstack-npm-worm/", "title": "Mini Shai-Hulud: TanStack npm Worm With Valid Provenance", "description": "If a lockfile picked up one of the bad TanStack Router/Start, Mistral or OpenSearch versions in mid-May 2026, treat that host as fully compromised and disable the dead-man's switch before rotating anything; everyone else can confirm and move on.", "type": "security-brief", "section": "Security Digest", "date_published": "2026-05-11", "date_modified": "2026-05-11", "markdown_url": "https://erroneo.us/security/briefs/mini-shai-hulud-tanstack-npm-worm/index.md", "verdict": "check-exposure" }, { "url": "https://erroneo.us/security/briefs/wso2-api-manager-cve-2026-5430-jwt-auth-bypass/", "path": "/security/briefs/wso2-api-manager-cve-2026-5430-jwt-auth-bypass/", "title": "WSO2 API Manager CVE-2026-5430: Exploited JWT Auth Bypass", "description": "Any self-managed WSO2 API Manager 4.1-4.6, API Control Plane, Traffic Manager or Universal Gateway below the fixed update level should be patched now and checked for forged-token use; attackers have been sending forged admin JWTs since mid-September.", "type": "security-brief", "section": "Security Digest", "date_published": "2026-05-03", "date_modified": "2026-05-03", "markdown_url": "https://erroneo.us/security/briefs/wso2-api-manager-cve-2026-5430-jwt-auth-bypass/index.md", "verdict": "act-now" }, { "url": "https://erroneo.us/security/briefs/bleeding-llama-ollama-memory-leak-cve-2026-7482/", "path": "/security/briefs/bleeding-llama-ollama-memory-leak-cve-2026-7482/", "title": "Bleeding Llama: Unauthenticated Memory Leak in Ollama", "description": "A laptop running Ollama on its default localhost binding is not reachable; a server you exposed with OLLAMA_HOST=0.0.0.0 or a published Docker port is, and it should be updated and its secrets rotated.", "type": "security-brief", "section": "Security Digest", "date_published": "2026-05-02", "date_modified": "2026-05-02", "markdown_url": "https://erroneo.us/security/briefs/bleeding-llama-ollama-memory-leak-cve-2026-7482/index.md", "verdict": "check-exposure" }, { "url": "https://erroneo.us/security/briefs/copy-fail-linux-kernel-lpe-cve-2026-31431/", "path": "/security/briefs/copy-fail-linux-kernel-lpe-cve-2026-31431/", "title": "Copy Fail: Exploited Linux Kernel Root Exploit Since 2017", "description": "Any Linux box that runs code from more than one trust level (CI runners, container hosts, shared servers) needs a patched kernel and reboot now; single-user machines can patch on a short cycle.", "type": "security-brief", "section": "Security Digest", "date_published": "2026-04-29", "date_modified": "2026-04-29", "markdown_url": "https://erroneo.us/security/briefs/copy-fail-linux-kernel-lpe-cve-2026-31431/index.md", "verdict": "act-now" }, { "url": "https://erroneo.us/security/briefs/fortinet-fortisandbox-cve-2026-39808-25089-unauth-command-injection/", "path": "/security/briefs/fortinet-fortisandbox-cve-2026-39808-25089-unauth-command-injection/", "title": "FortiSandbox: Two Exploited Pre-Auth Command Injections", "description": "If any FortiSandbox runs 4.2, 4.4 below 4.4.9 or 5.0 below 5.0.6, upgrade now and check it for compromise: both bugs need no login, one has a public exploit, and attacks began in June.", "type": "security-brief", "section": "Security Digest", "date_published": "2026-04-14", "date_modified": "2026-04-14", "markdown_url": "https://erroneo.us/security/briefs/fortinet-fortisandbox-cve-2026-39808-25089-unauth-command-injection/index.md", "verdict": "act-now" }, { "url": "https://erroneo.us/security/briefs/windows-ike-cve-2026-33824-pre-auth-rce/", "path": "/security/briefs/windows-ike-cve-2026-33824-pre-auth-rce/", "title": "Windows IKE CVE-2026-33824: Exploited Pre-Auth RCE", "description": "The fix shipped in April, so most fleets are already covered; the real risk is any unpatched Windows host that answers IKE on UDP 500 or 4500 from untrusted networks, and those need patching or blocking today.", "type": "security-brief", "section": "Security Digest", "date_published": "2026-04-14", "date_modified": "2026-04-14", "markdown_url": "https://erroneo.us/security/briefs/windows-ike-cve-2026-33824-pre-auth-rce/index.md", "verdict": "check-exposure" }, { "url": "https://erroneo.us/security/briefs/apache-tomcat-cve-2026-34486-encryptinterceptor-bypass/", "path": "/security/briefs/apache-tomcat-cve-2026-34486-encryptinterceptor-bypass/", "title": "Tomcat CVE-2026-34486: Cluster EncryptInterceptor Bypass", "description": "Exploited, but only against three specific Tomcat releases running session-replication clustering with the EncryptInterceptor and a reachable cluster port; check those three things today, and most Tomcat users will find they are not exposed.", "type": "security-brief", "section": "Security Digest", "date_published": "2026-04-09", "date_modified": "2026-04-09", "markdown_url": "https://erroneo.us/security/briefs/apache-tomcat-cve-2026-34486-encryptinterceptor-bypass/index.md", "verdict": "check-exposure" }, { "url": "https://erroneo.us/security/briefs/axios-npm-compromise-plain-crypto-js-rat/", "path": "/security/briefs/axios-npm-compromise-plain-crypto-js-rat/", "title": "axios 1.14.1 and 0.30.4: npm Hijack Drops North Korean RAT", "description": "axios is everywhere, but the bad versions lived only about three hours on March 31, 2026; if nothing resolved a fresh axios in that window you are fine, and if something did, that machine ran a remote-access trojan.", "type": "security-brief", "section": "Security Digest", "date_published": "2026-03-31", "date_modified": "2026-03-31", "markdown_url": "https://erroneo.us/security/briefs/axios-npm-compromise-plain-crypto-js-rat/index.md", "verdict": "check-exposure" }, { "url": "https://erroneo.us/security/briefs/trivy-action-teampcp-supply-chain-compromise/", "path": "/security/briefs/trivy-action-teampcp-supply-chain-compromise/", "title": "Trivy Supply-Chain Hijack: trivy-action Steals CI Secrets", "description": "If any pipeline ran trivy-action by tag, setup-trivy, or Trivy 0.69.4 to 0.69.6 during the March 19-23, 2026 windows, every secret that job could see is burned; if you pinned SHAs, digests or 0.69.3, you were fine.", "type": "security-brief", "section": "Security Digest", "date_published": "2026-03-19", "date_modified": "2026-03-19", "markdown_url": "https://erroneo.us/security/briefs/trivy-action-teampcp-supply-chain-compromise/index.md", "verdict": "check-exposure" }, { "url": "https://erroneo.us/security/briefs/cisco-fmc-cve-2026-20079-auth-bypass-root/", "path": "/security/briefs/cisco-fmc-cve-2026-20079-auth-bypass-root/", "title": "Cisco FMC CVE-2026-20079: Exploited Pre-Auth Root Bypass", "description": "If you run an on-prem Cisco Secure FMC that is not on a September 2026 hardening release, upgrade now and check it for compromise; state and ransomware actors are using this bug to take root on the box that controls your firewalls.", "type": "security-brief", "section": "Security Digest", "date_published": "2026-03-04", "date_modified": "2026-03-04", "markdown_url": "https://erroneo.us/security/briefs/cisco-fmc-cve-2026-20079-auth-bypass-root/index.md", "verdict": "act-now" }, { "url": "https://erroneo.us/security/briefs/cisco-catalyst-sd-wan-cve-2026-20127-auth-bypass/", "path": "/security/briefs/cisco-catalyst-sd-wan-cve-2026-20127-auth-bypass/", "title": "Cisco SD-WAN CVE-2026-20127: CVSS 10 Bypass, ED 26-03", "description": "If you run on-prem Catalyst SD-WAN control components, upgrade and hunt now: a sophisticated actor has used this bypass for years, and the follow-on SD-WAN bugs CISA keeps adding to KEV show the platform is still being targeted.", "type": "security-brief", "section": "Security Digest", "date_published": "2026-02-25", "date_modified": "2026-02-25", "markdown_url": "https://erroneo.us/security/briefs/cisco-catalyst-sd-wan-cve-2026-20127-auth-bypass/index.md", "verdict": "act-now" }, { "url": "https://erroneo.us/security/briefs/fortios-ssl-vpn-symlink-patch-bypass-cve-2025-68686/", "path": "/security/briefs/fortios-ssl-vpn-symlink-patch-bypass-cve-2025-68686/", "title": "FortiOS CVE-2025-68686: SSL-VPN Symlink Patch Bypass in KEV", "description": "This is not a way in, only a way to stay in on FortiGates that ran SSL-VPN and were already breached; the real problem is that FortiOS 7.2, 7.0 and 6.4 will never get a fix, so plan the move to 7.4.7+ or 7.6.2+.", "type": "security-brief", "section": "Security Digest", "date_published": "2026-02-10", "date_modified": "2026-02-10", "markdown_url": "https://erroneo.us/security/briefs/fortios-ssl-vpn-symlink-patch-bypass-cve-2025-68686/index.md", "verdict": "check-exposure" }, { "url": "https://erroneo.us/security/briefs/notepad-plus-plus-updater-hijack-cve-2025-15556/", "path": "/security/briefs/notepad-plus-plus-updater-hijack-cve-2025-15556/", "title": "Notepad++ Updater Hijack: State Actor Served Bad Updates", "description": "Targeting was narrow (about a dozen machines in Kaspersky's telemetry), but any fleet that auto-updated Notepad++ between June and December 2025 should update to v8.9.1+ and check the published IoCs.", "type": "security-brief", "section": "Security Digest", "date_published": "2026-02-02", "date_modified": "2026-02-02", "markdown_url": "https://erroneo.us/security/briefs/notepad-plus-plus-updater-hijack-cve-2025-15556/index.md", "verdict": "check-exposure" }, { "url": "https://erroneo.us/security/briefs/openclaw-one-click-rce-gatewayurl-token/", "path": "/security/briefs/openclaw-one-click-rce-gatewayurl-token/", "title": "OpenClaw CVE-2026-25253: One-Click RCE via Token Leak", "description": "Fixed since January, but any OpenClaw install that missed updates can be taken over by its owner clicking one link, and a loopback-only setup does not save it.", "type": "security-brief", "section": "Security Digest", "date_published": "2026-01-31", "date_modified": "2026-01-31", "markdown_url": "https://erroneo.us/security/briefs/openclaw-one-click-rce-gatewayurl-token/index.md", "verdict": "patch-this-week" }, { "url": "https://erroneo.us/security/briefs/ivanti-epmm-cve-2026-1281-1340-zero-day-rce/", "path": "/security/briefs/ivanti-epmm-cve-2026-1281-1340-zero-day-rce/", "title": "Ivanti EPMM Zero-Day RCE: CVE-2026-1281 and CVE-2026-1340", "description": "On-premises Ivanti EPMM was open to unauthenticated remote command execution, exploited before disclosure and with a public PoC a day later; patch, confirm the RPM survived any later upgrade, and hunt for compromise.", "type": "security-brief", "section": "Security Digest", "date_published": "2026-01-29", "date_modified": "2026-01-29", "markdown_url": "https://erroneo.us/security/briefs/ivanti-epmm-cve-2026-1281-1340-zero-day-rce/index.md", "verdict": "act-now" }, { "url": "https://erroneo.us/security/briefs/forticloud-sso-cross-account-bypass-cve-2026-24858/", "path": "/security/briefs/forticloud-sso-cross-account-bypass-cve-2026-24858/", "title": "FortiCloud SSO Cross-Account Login: CVE-2026-24858", "description": "Any Fortinet device that relies on FortiCloud SSO needs the January 2026 builds (FortiCloud now refuses SSO from vulnerable versions anyway), and any device with SSO enabled before then should be checked for rogue admins.", "type": "security-brief", "section": "Security Digest", "date_published": "2026-01-27", "date_modified": "2026-01-27", "markdown_url": "https://erroneo.us/security/briefs/forticloud-sso-cross-account-bypass-cve-2026-24858/index.md", "verdict": "act-now" }, { "url": "https://erroneo.us/security/briefs/oracle-http-server-weblogic-proxy-cve-2026-21962/", "path": "/security/briefs/oracle-http-server-weblogic-proxy-cve-2026-21962/", "title": "Oracle HTTP Server CVE-2026-21962: CVSS 10 Flaw in KEV", "description": "If an Oracle HTTP Server, Apache or IIS front end with the WebLogic proxy plug-in still lacks the January 2026 CPU, patch it now; exploit code has been public since January and the bug is now confirmed exploited.", "type": "security-brief", "section": "Security Digest", "date_published": "2026-01-20", "date_modified": "2026-01-20", "markdown_url": "https://erroneo.us/security/briefs/oracle-http-server-weblogic-proxy-cve-2026-21962/index.md", "verdict": "act-now" }, { "url": "https://erroneo.us/security/briefs/fortios-cve-2025-25249-capwap-rce-cve-2025-61624/", "path": "/security/briefs/fortios-cve-2025-25249-capwap-rce-cve-2025-61624/", "title": "FortiOS CVE-2025-25249 and CVE-2025-61624 Now Exploited", "description": "If you run FortiGates, get to FortiOS 7.4.10+ or 7.6.5+ now and hunt for implants: one bug gives unauthenticated attackers code execution over CAPWAP and is being exploited at scale, and the other turns stolen admin logins into root implants.", "type": "security-brief", "section": "Security Digest", "date_published": "2026-01-13", "date_modified": "2026-01-13", "markdown_url": "https://erroneo.us/security/briefs/fortios-cve-2025-25249-capwap-rce-cve-2025-61624/index.md", "verdict": "act-now" }, { "url": "https://erroneo.us/security/briefs/ni8mare-n8n-unauthenticated-file-read-rce/", "path": "/security/briefs/ni8mare-n8n-unauthenticated-file-read-rce/", "title": "Ni8mare: n8n Unauthenticated Takeover, Plus a KEV RCE", "description": "If you self-host n8n and anything about it is reachable from the internet, upgrade today: one bug lets strangers in through public forms, and its companion RCE is on CISA's exploited list.", "type": "security-brief", "section": "Security Digest", "date_published": "2026-01-07", "date_modified": "2026-01-07", "markdown_url": "https://erroneo.us/security/briefs/ni8mare-n8n-unauthenticated-file-read-rce/index.md", "verdict": "act-now" }, { "url": "https://erroneo.us/security/briefs/langgrinch-langchain-core-serialization-injection/", "path": "/security/briefs/langgrinch-langchain-core-serialization-injection/", "title": "LangGrinch: LangChain Core Serialization Injection", "description": "A real design flaw in a library almost every Python agent stack pulls in, but it needs a serialize-then-deserialize path over attacker-influenced data; bump langchain-core in your next routine dependency update.", "type": "security-brief", "section": "Security Digest", "date_published": "2025-12-23", "date_modified": "2025-12-23", "markdown_url": "https://erroneo.us/security/briefs/langgrinch-langchain-core-serialization-injection/index.md", "verdict": "patch-this-week" }, { "url": "https://erroneo.us/security/briefs/mongobleed-mongodb-zlib-memory-leak/", "path": "/security/briefs/mongobleed-mongodb-zlib-memory-leak/", "title": "MongoBleed: Pre-Auth Memory Leak in MongoDB Server", "description": "Atlas users are already patched; self-hosted MongoDB that untrusted networks can reach must be upgraded (or have zlib disabled) now, and internet-exposed instances should rotate credentials.", "type": "security-brief", "section": "Security Digest", "date_published": "2025-12-19", "date_modified": "2025-12-19", "markdown_url": "https://erroneo.us/security/briefs/mongobleed-mongodb-zlib-memory-leak/index.md", "verdict": "patch-this-week" }, { "url": "https://erroneo.us/security/briefs/forticloud-sso-saml-bypass-cve-2025-59718/", "path": "/security/briefs/forticloud-sso-saml-bypass-cve-2025-59718/", "title": "FortiCloud SSO SAML Bypass: CVE-2025-59718/59719", "description": "If any Fortinet device has FortiCloud SSO admin login turned on, it was open to unauthenticated admin takeover; upgrade, then also apply the January 2026 fix for CVE-2026-24858, which bypassed this patch.", "type": "security-brief", "section": "Security Digest", "date_published": "2025-12-09", "date_modified": "2025-12-09", "markdown_url": "https://erroneo.us/security/briefs/forticloud-sso-saml-bypass-cve-2025-59718/index.md", "verdict": "act-now" }, { "url": "https://erroneo.us/security/briefs/react2shell-react-server-components-rce/", "path": "/security/briefs/react2shell-react-server-components-rce/", "title": "React2Shell: Unauthenticated RCE in React Server Components", "description": "If any server you run renders React Server Components and was not patched in December 2025, treat it as compromised until shown otherwise: patch, redeploy, and rotate its secrets.", "type": "security-brief", "section": "Security Digest", "date_published": "2025-12-03", "date_modified": "2025-12-03", "markdown_url": "https://erroneo.us/security/briefs/react2shell-react-server-components-rce/index.md", "verdict": "act-now" }, { "url": "https://erroneo.us/security/briefs/ray-cve-2025-62593-browser-dns-rebinding-rce/", "path": "/security/briefs/ray-cve-2025-62593-browser-dns-rebinding-rce/", "title": "Ray CVE-2025-62593: Browser-Driven RCE Against Ray Devs", "description": "Upgrade Ray to 2.52.0 or later on developer machines and internal clusters this week; the attack needs a Firefox or Safari user to load a hostile page while a pre-2.52 dashboard is running, and the public evidence of real-world use is thin.", "type": "security-brief", "section": "Security Digest", "date_published": "2025-11-26", "date_modified": "2025-11-26", "markdown_url": "https://erroneo.us/security/briefs/ray-cve-2025-62593-browser-dns-rebinding-rce/index.md", "verdict": "patch-this-week" }, { "url": "https://erroneo.us/security/briefs/shai-hulud-2-npm-worm/", "path": "/security/briefs/shai-hulud-2-npm-worm/", "title": "Shai-Hulud 2.0: npm Worm Hits PostHog, Zapier, Postman", "description": "The worm is long dead on npm, but any machine or CI runner that installed a trojanized version between Nov 21 and Nov 27, 2025 should be treated as having leaked every secret it could reach.", "type": "security-brief", "section": "Security Digest", "date_published": "2025-11-24", "date_modified": "2025-11-24", "markdown_url": "https://erroneo.us/security/briefs/shai-hulud-2-npm-worm/index.md", "verdict": "check-exposure" }, { "url": "https://erroneo.us/security/briefs/fortiweb-cve-2025-64446-path-traversal/", "path": "/security/briefs/fortiweb-cve-2025-64446-path-traversal/", "title": "FortiWeb CVE-2025-64446: Exploited Unauthenticated Takeover", "description": "Any FortiWeb still below the fixed builds with its web GUI reachable from the internet should be presumed compromised and rebuilt, not just patched.", "type": "security-brief", "section": "Security Digest", "date_published": "2025-11-14", "date_modified": "2025-11-14", "markdown_url": "https://erroneo.us/security/briefs/fortiweb-cve-2025-64446-path-traversal/index.md", "verdict": "act-now" }, { "url": "https://erroneo.us/security/briefs/runc-container-escape-cve-2025-31133/", "path": "/security/briefs/runc-container-escape-cve-2025-31133/", "title": "runc Container Escapes: Three Mount-Race CVEs Fixed", "description": "Not remotely exploitable and not seen in attacks, but anyone who runs or builds images they do not fully trust (CI runners, multi-tenant clusters) should roll out patched runc this week.", "type": "security-brief", "section": "Security Digest", "date_published": "2025-11-05", "date_modified": "2025-11-05", "markdown_url": "https://erroneo.us/security/briefs/runc-container-escape-cve-2025-31133/index.md", "verdict": "patch-this-week" }, { "url": "https://erroneo.us/security/briefs/microsoft-wsus-cve-2025-59287-rce/", "path": "/security/briefs/microsoft-wsus-cve-2025-59287-rce/", "title": "Microsoft WSUS CVE-2025-59287: Unauthenticated SYSTEM RCE", "description": "Only servers with the WSUS role are at risk, but on those it is unauthenticated SYSTEM code execution: patch them now, and treat any WSUS server exposed on 8530/8531 to the internet as a likely incident.", "type": "security-brief", "section": "Security Digest", "date_published": "2025-10-23", "date_modified": "2025-10-23", "markdown_url": "https://erroneo.us/security/briefs/microsoft-wsus-cve-2025-59287-rce/index.md", "verdict": "patch-this-week" }, { "url": "https://erroneo.us/security/briefs/glassworm-open-vsx-extension-malware/", "path": "/security/briefs/glassworm-open-vsx-extension-malware/", "title": "GlassWorm: Invisible-Unicode Malware in Open VSX Extensions", "description": "This is a recurring campaign rather than a single event; developers on VS Code forks that pull from Open VSX should audit installed extensions and auto-updates, while most stock VS Code users with mainstream extensions were not affected.", "type": "security-brief", "section": "Security Digest", "date_published": "2025-10-17", "date_modified": "2025-10-17", "markdown_url": "https://erroneo.us/security/briefs/glassworm-open-vsx-extension-malware/index.md", "verdict": "check-exposure" }, { "url": "https://erroneo.us/security/briefs/f5-big-ip-source-code-breach/", "path": "/security/briefs/f5-big-ip-source-code-breach/", "title": "F5 Breach: Nation-State Stole BIG-IP Source Code", "description": "The breach itself needs no new action a year on, but its aftermath does: two unauthenticated BIG-IP APM RCEs are now on CISA's exploited list, so every BIG-IP owner should be on current fixed builds with management interfaces off the internet.", "type": "security-brief", "section": "Security Digest", "date_published": "2025-10-15", "date_modified": "2025-10-15", "markdown_url": "https://erroneo.us/security/briefs/f5-big-ip-source-code-breach/index.md", "verdict": "patch-this-week" }, { "url": "https://erroneo.us/security/briefs/oracle-ebs-cve-2025-61882-cl0p-zero-day/", "path": "/security/briefs/oracle-ebs-cve-2025-61882-cl0p-zero-day/", "title": "Oracle EBS CVE-2025-61882: Cl0p Zero-Day Data Theft", "description": "Any internet-reachable Oracle EBS 12.2.x server that missed the October 2025 alerts should be treated as compromised until a hunt proves otherwise.", "type": "security-brief", "section": "Security Digest", "date_published": "2025-10-04", "date_modified": "2025-10-04", "markdown_url": "https://erroneo.us/security/briefs/oracle-ebs-cve-2025-61882-cl0p-zero-day/index.md", "verdict": "act-now" }, { "url": "https://erroneo.us/security/briefs/redishell-redis-lua-rce-cve-2025-49844/", "path": "/security/briefs/redishell-redis-lua-rce-cve-2025-49844/", "title": "RediShell: 13-Year-Old Lua Use-After-Free RCE in Redis", "description": "Exploitation needs an authenticated session, so properly locked-down Redis can be patched in a normal urgent window; instances reachable without a password are effectively unauthenticated RCE and should be fixed today.", "type": "security-brief", "section": "Security Digest", "date_published": "2025-10-03", "date_modified": "2025-10-03", "markdown_url": "https://erroneo.us/security/briefs/redishell-redis-lua-rce-cve-2025-49844/index.md", "verdict": "patch-this-week" }, { "url": "https://erroneo.us/security/briefs/cisco-asa-ftd-vpn-cve-2025-20333-20362-arcanedoor/", "path": "/security/briefs/cisco-asa-ftd-vpn-cve-2025-20333-20362-arcanedoor/", "title": "Cisco ASA/FTD VPN Zero-Days Tied to ArcaneDoor", "description": "Still live in October 2026: the actor added a persistence mechanism in April 2026 that survives the September 2025 fixes, so ASA/FTD owners with VPN web services need the latest updates and a physical power cycle, not just last year's patch.", "type": "security-brief", "section": "Security Digest", "date_published": "2025-09-25", "date_modified": "2025-09-25", "markdown_url": "https://erroneo.us/security/briefs/cisco-asa-ftd-vpn-cve-2025-20333-20362-arcanedoor/index.md", "verdict": "patch-this-week" }, { "url": "https://erroneo.us/security/briefs/shai-hulud-self-replicating-npm-worm/", "path": "/security/briefs/shai-hulud-self-replicating-npm-worm/", "title": "Shai-Hulud: Self-Replicating Worm Hits 500+ npm Packages", "description": "The worm's packages were removed in September 2025, but every machine that installed one handed over its npm, GitHub and cloud credentials, so the open question is whether you rotated them and removed the backdoor workflow.", "type": "security-brief", "section": "Security Digest", "date_published": "2025-09-15", "date_modified": "2025-09-15", "markdown_url": "https://erroneo.us/security/briefs/shai-hulud-self-replicating-npm-worm/index.md", "verdict": "check-exposure" }, { "url": "https://erroneo.us/security/briefs/chalk-debug-npm-qix-phishing-hijack/", "path": "/security/briefs/chalk-debug-npm-qix-phishing-hijack/", "title": "chalk, debug and 16+ npm Packages Hijacked via Phishing", "description": "Despite billions of weekly downloads, the bad versions were live for about two hours and the payload only swapped crypto addresses inside browsers, so most teams just need to confirm no lockfile or bundle captured them.", "type": "security-brief", "section": "Security Digest", "date_published": "2025-09-08", "date_modified": "2025-09-08", "markdown_url": "https://erroneo.us/security/briefs/chalk-debug-npm-qix-phishing-hijack/index.md", "verdict": "most-can-relax" }, { "url": "https://erroneo.us/security/briefs/nx-s1ngularity-malicious-npm-releases/", "path": "/security/briefs/nx-s1ngularity-malicious-npm-releases/", "title": "Nx s1ngularity: Malicious npm Releases Hijack AI CLIs", "description": "The packages were live for about four hours in August 2025, but anything they stole (GitHub and npm tokens, SSH keys, .env files, wallets) stays useful until rotated, so confirm you were not hit rather than assume.", "type": "security-brief", "section": "Security Digest", "date_published": "2025-08-26", "date_modified": "2025-08-26", "markdown_url": "https://erroneo.us/security/briefs/nx-s1ngularity-malicious-npm-releases/index.md", "verdict": "check-exposure" }, { "url": "https://erroneo.us/security/briefs/salesloft-drift-oauth-salesforce-data-theft/", "path": "/security/briefs/salesloft-drift-oauth-salesforce-data-theft/", "title": "Salesloft Drift OAuth Token Theft Hits Salesforce Orgs", "description": "Contained since September 2025, but if your org ever connected Drift, verify that every token and every secret sitting in your CRM or support cases was rotated, because the theft was aimed at exactly those secrets.", "type": "security-brief", "section": "Security Digest", "date_published": "2025-08-26", "date_modified": "2025-08-26", "markdown_url": "https://erroneo.us/security/briefs/salesloft-drift-oauth-salesforce-data-theft/index.md", "verdict": "check-exposure" }, { "url": "https://erroneo.us/security/briefs/github-copilot-yolo-mode-prompt-injection-rce/", "path": "/security/briefs/github-copilot-yolo-mode-prompt-injection-rce/", "title": "GitHub Copilot \"YOLO Mode\" Prompt Injection RCE", "description": "Patched in August 2025 and not known to be exploited, but enterprise Visual Studio installs lag and the autoApprove setting can still be turned on by hand, so verify both.", "type": "security-brief", "section": "Security Digest", "date_published": "2025-08-12", "date_modified": "2025-08-12", "markdown_url": "https://erroneo.us/security/briefs/github-copilot-yolo-mode-prompt-injection-rce/index.md", "verdict": "check-exposure" }, { "url": "https://erroneo.us/security/briefs/winrar-cve-2025-8088-ads-path-traversal/", "path": "/security/briefs/winrar-cve-2025-8088-ads-path-traversal/", "title": "WinRAR CVE-2025-8088: ADS Path Traversal Exploited by RomCom", "description": "Fixed since July 2025 but still heavily exploited, and WinRAR does not update itself, so hunt down every copy at 7.12 or older and update it today.", "type": "security-brief", "section": "Security Digest", "date_published": "2025-08-11", "date_modified": "2025-08-11", "markdown_url": "https://erroneo.us/security/briefs/winrar-cve-2025-8088-ads-path-traversal/index.md", "verdict": "check-exposure" }, { "url": "https://erroneo.us/security/briefs/exchange-hybrid-cve-2025-53786-privilege-escalation/", "path": "/security/briefs/exchange-hybrid-cve-2025-53786-privilege-escalation/", "title": "Exchange Hybrid CVE-2025-53786: On-Prem to Cloud Escalation", "description": "Not known to be exploited and requires on-prem Exchange admin first, but it turns any on-prem compromise into a quiet cloud takeover, so verify the dedicated hybrid app is in place and the old shared credential is gone.", "type": "security-brief", "section": "Security Digest", "date_published": "2025-08-06", "date_modified": "2025-08-06", "markdown_url": "https://erroneo.us/security/briefs/exchange-hybrid-cve-2025-53786-privilege-escalation/index.md", "verdict": "check-exposure" }, { "url": "https://erroneo.us/security/briefs/cursor-curxecute-mcp-prompt-injection-rce/", "path": "/security/briefs/cursor-curxecute-mcp-prompt-injection-rce/", "title": "Cursor CurXecute: Prompt Injection to RCE via mcp.json", "description": "Cursor auto-updates and both bugs were fixed by mid-2025; the lasting takeaway is to treat any agent that can write its own tool config as a code-execution path.", "type": "security-brief", "section": "Security Digest", "date_published": "2025-08-01", "date_modified": "2025-08-01", "markdown_url": "https://erroneo.us/security/briefs/cursor-curxecute-mcp-prompt-injection-rce/index.md", "verdict": "most-can-relax" }, { "url": "https://erroneo.us/security/briefs/amazon-q-vscode-extension-wiper-prompt/", "path": "/security/briefs/amazon-q-vscode-extension-wiper-prompt/", "title": "Amazon Q VS Code Extension 1.84.0 Shipped a Wiper Prompt", "description": "A real supply-chain compromise with a payload that AWS says could not run; if nothing in your fleet still has 1.84.0, there is nothing left to do.", "type": "security-brief", "section": "Security Digest", "date_published": "2025-07-23", "date_modified": "2025-07-23", "markdown_url": "https://erroneo.us/security/briefs/amazon-q-vscode-extension-wiper-prompt/index.md", "verdict": "most-can-relax" }, { "url": "https://erroneo.us/security/briefs/toolshell-sharepoint-cve-2025-53770/", "path": "/security/briefs/toolshell-sharepoint-cve-2025-53770/", "title": "ToolShell: SharePoint On-Prem Unauthenticated RCE Chain", "description": "Fixes shipped in July 2025, but ToolShell stole ASP.NET machine keys that survive patching, so any on-prem SharePoint that was internet-facing then needs proof that keys were rotated and no backdoor remains.", "type": "security-brief", "section": "Security Digest", "date_published": "2025-07-19", "date_modified": "2025-07-19", "markdown_url": "https://erroneo.us/security/briefs/toolshell-sharepoint-cve-2025-53770/index.md", "verdict": "check-exposure" }, { "url": "https://erroneo.us/security/briefs/mcp-remote-oauth-command-injection/", "path": "/security/briefs/mcp-remote-oauth-command-injection/", "title": "mcp-remote: OS Command Injection via OAuth Endpoint", "description": "The fix is more than a year old, but version-pinned MCP client configs and stale npx caches can keep a vulnerable mcp-remote alive, so confirm the version and move on.", "type": "security-brief", "section": "Security Digest", "date_published": "2025-07-09", "date_modified": "2025-07-09", "markdown_url": "https://erroneo.us/security/briefs/mcp-remote-oauth-command-injection/index.md", "verdict": "check-exposure" }, { "url": "https://erroneo.us/security/briefs/sudo-chroot-privilege-escalation-cve-2025-32463/", "path": "/security/briefs/sudo-chroot-privilege-escalation-cve-2025-32463/", "title": "sudo --chroot Local Root Escalation (CVE-2025-32463)", "description": "Distros patched this in mid-2025 and it is now known-exploited; any multi-user or shared Linux host still on sudo 1.9.14-1.9.17 without the vendor fix hands root to every local account.", "type": "security-brief", "section": "Security Digest", "date_published": "2025-06-30", "date_modified": "2025-06-30", "markdown_url": "https://erroneo.us/security/briefs/sudo-chroot-privilege-escalation-cve-2025-32463/index.md", "verdict": "check-exposure" }, { "url": "https://erroneo.us/security/briefs/citrix-bleed-2-netscaler-cve-2025-5777/", "path": "/security/briefs/citrix-bleed-2-netscaler-cve-2025-5777/", "title": "Citrix Bleed 2: NetScaler Gateway Memory Leak", "description": "A pre-auth memory leak on internet-facing VPN gateways that was exploited within weeks; patched since June 2025, so the job now is proving you patched, killed sessions and were not session-hijacked.", "type": "security-brief", "section": "Security Digest", "date_published": "2025-06-17", "date_modified": "2025-06-17", "markdown_url": "https://erroneo.us/security/briefs/citrix-bleed-2-netscaler-cve-2025-5777/index.md", "verdict": "check-exposure" }, { "url": "https://erroneo.us/security/briefs/mcp-inspector-unauthenticated-rce/", "path": "/security/briefs/mcp-inspector-unauthenticated-rce/", "title": "MCP Inspector: Unauthenticated RCE via Browser CSRF", "description": "Fixed since June 2025, but Inspector sits in project devDependencies and npx caches, so old copies survive; confirm 0.14.1+ and never run it with auth disabled.", "type": "security-brief", "section": "Security Digest", "date_published": "2025-06-13", "date_modified": "2025-06-13", "markdown_url": "https://erroneo.us/security/briefs/mcp-inspector-unauthenticated-rce/index.md", "verdict": "check-exposure" }, { "url": "https://erroneo.us/security/briefs/echoleak-m365-copilot-cve-2025-32711/", "path": "/security/briefs/echoleak-m365-copilot-cve-2025-32711/", "title": "EchoLeak: Zero-Click Data Leak in Microsoft 365 Copilot", "description": "Nothing to patch: Microsoft fixed it in its cloud service before disclosure and saw no exploitation, but it is the reference case for why AI assistants that read untrusted content need guardrails.", "type": "security-brief", "section": "Security Digest", "date_published": "2025-06-11", "date_modified": "2025-06-11", "markdown_url": "https://erroneo.us/security/briefs/echoleak-m365-copilot-cve-2025-32711/index.md", "verdict": "most-can-relax" }, { "url": "https://erroneo.us/security/briefs/sap-netweaver-visual-composer-cve-2025-31324/", "path": "/security/briefs/sap-netweaver-visual-composer-cve-2025-31324/", "title": "SAP NetWeaver Visual Composer: Unauthenticated Upload RCE", "description": "Patches have existed since April and May 2025, but this was a mass-exploited zero-day used by ransomware crews, so every SAP Java shop should confirm the fix and hunt for leftover webshells.", "type": "security-brief", "section": "Security Digest", "date_published": "2025-04-24", "date_modified": "2025-04-24", "markdown_url": "https://erroneo.us/security/briefs/sap-netweaver-visual-composer-cve-2025-31324/index.md", "verdict": "check-exposure" }, { "url": "https://erroneo.us/security/briefs/erlang-otp-ssh-unauthenticated-rce-cve-2025-32433/", "path": "/security/briefs/erlang-otp-ssh-unauthenticated-rce-cve-2025-32433/", "title": "Erlang/OTP SSH: Unauthenticated RCE (CVE-2025-32433)", "description": "The OTP fix is 18 months old, but the bug hides inside appliances and OT gear that patch slowly; inventory anything exposing an Erlang SSH daemon rather than assuming your servers' OpenSSH covers you.", "type": "security-brief", "section": "Security Digest", "date_published": "2025-04-16", "date_modified": "2025-04-16", "markdown_url": "https://erroneo.us/security/briefs/erlang-otp-ssh-unauthenticated-rce-cve-2025-32433/index.md", "verdict": "check-exposure" }, { "url": "https://erroneo.us/security/briefs/langflow-unauthenticated-rce-cve-2025-3248/", "path": "/security/briefs/langflow-unauthenticated-rce-cve-2025-3248/", "title": "Langflow Unauthenticated Code Execution (CVE-2025-3248)", "description": "Fixed in March 2025 and exploited in the wild since; if any Langflow below 1.3.0 is reachable from the internet, treat it as compromised, not merely unpatched.", "type": "security-brief", "section": "Security Digest", "date_published": "2025-04-07", "date_modified": "2025-04-07", "markdown_url": "https://erroneo.us/security/briefs/langflow-unauthenticated-rce-cve-2025-3248/index.md", "verdict": "check-exposure" }, { "url": "https://erroneo.us/security/briefs/chrome-cve-2025-2783-mojo-sandbox-escape/", "path": "/security/briefs/chrome-cve-2025-2783-mojo-sandbox-escape/", "title": "Chrome CVE-2025-2783: Mojo Sandbox Escape Zero-Day", "description": "A real zero-day used for espionage in early 2025, long since fixed by Chrome's automatic updates; the lasting lesson is to make sure auto-update actually works on your fleet.", "type": "security-brief", "section": "Security Digest", "date_published": "2025-03-25", "date_modified": "2025-03-25", "markdown_url": "https://erroneo.us/security/briefs/chrome-cve-2025-2783-mojo-sandbox-escape/index.md", "verdict": "most-can-relax" }, { "url": "https://erroneo.us/security/briefs/ingressnightmare-ingress-nginx-cve-2025-1974/", "path": "/security/briefs/ingressnightmare-ingress-nginx-cve-2025-1974/", "title": "IngressNightmare: ingress-nginx Cluster Takeover RCE", "description": "Patched since March 2025. If any cluster still runs ingress-nginx below 1.11.5 or 1.12.1, that is a cluster-takeover risk, and the controller itself is now retired, so plan the migration while you check.", "type": "security-brief", "section": "Security Digest", "date_published": "2025-03-24", "date_modified": "2025-03-24", "markdown_url": "https://erroneo.us/security/briefs/ingressnightmare-ingress-nginx-cve-2025-1974/index.md", "verdict": "check-exposure" }, { "url": "https://erroneo.us/security/briefs/crushftp-auth-bypass-cve-2025-31161/", "path": "/security/briefs/crushftp-auth-bypass-cve-2025-31161/", "title": "CrushFTP Auth Bypass CVE-2025-31161 Exploited in the Wild", "description": "Fixed since March 2025 and widely exploited from early April; if you run CrushFTP, make sure you are on a current build (later CrushFTP flaws raised the minimum) and audit for backdoor admin accounts.", "type": "security-brief", "section": "Security Digest", "date_published": "2025-03-21", "date_modified": "2025-03-21", "markdown_url": "https://erroneo.us/security/briefs/crushftp-auth-bypass-cve-2025-31161/index.md", "verdict": "check-exposure" }, { "url": "https://erroneo.us/security/briefs/nextjs-middleware-bypass-cve-2025-29927/", "path": "/security/briefs/nextjs-middleware-bypass-cve-2025-29927/", "title": "Next.js Middleware Authorization Bypass (CVE-2025-29927)", "description": "Patched since March 2025 and easy to fix; if you self-host Next.js and lean on middleware for auth, confirm you are on a fixed release and that the header is stripped at your edge.", "type": "security-brief", "section": "Security Digest", "date_published": "2025-03-21", "date_modified": "2025-03-21", "markdown_url": "https://erroneo.us/security/briefs/nextjs-middleware-bypass-cve-2025-29927/index.md", "verdict": "check-exposure" }, { "url": "https://erroneo.us/security/briefs/tj-actions-changed-files-compromise/", "path": "/security/briefs/tj-actions-changed-files-compromise/", "title": "tj-actions/changed-files: GitHub Action Leaked CI Secrets", "description": "The malicious tags were cleaned up within about a day in March 2025; today the job is confirming you rotated any secret that a March 14-15, 2025 workflow run could have printed, and that you pin Actions by SHA.", "type": "security-brief", "section": "Security Digest", "date_published": "2025-03-14", "date_modified": "2025-03-14", "markdown_url": "https://erroneo.us/security/briefs/tj-actions-changed-files-compromise/index.md", "verdict": "check-exposure" }, { "url": "https://erroneo.us/security/briefs/apache-tomcat-partial-put-cve-2025-24813/", "path": "/security/briefs/apache-tomcat-partial-put-cve-2025-24813/", "title": "Apache Tomcat Partial PUT RCE (CVE-2025-24813)", "description": "It is in KEV and attacks were seen within days, but exploitation needs the default servlet's write support turned on, which is off by default and rare; upgrade on your normal cycle and check that one setting.", "type": "security-brief", "section": "Security Digest", "date_published": "2025-03-10", "date_modified": "2025-03-10", "markdown_url": "https://erroneo.us/security/briefs/apache-tomcat-partial-put-cve-2025-24813/index.md", "verdict": "most-can-relax" }, { "url": "https://erroneo.us/security/briefs/rsync-heap-overflow-cve-2024-12084/", "path": "/security/briefs/rsync-heap-overflow-cve-2024-12084/", "title": "rsync: Six Flaws Incl. Daemon Heap Overflow (CVE-2024-12084)", "description": "Distros shipped fixes in January 2025 and there is no known exploitation, but internet-facing rsync daemons have since needed two more security releases, so verify you run a current rsync rather than just 3.4.0.", "type": "security-brief", "section": "Security Digest", "date_published": "2025-01-14", "date_modified": "2025-01-14", "markdown_url": "https://erroneo.us/security/briefs/rsync-heap-overflow-cve-2024-12084/index.md", "verdict": "check-exposure" }, { "url": "https://erroneo.us/security/briefs/fortios-websocket-auth-bypass-cve-2024-55591/", "path": "/security/briefs/fortios-websocket-auth-bypass-cve-2024-55591/", "title": "FortiOS 7.0 Websocket Auth Bypass to Super-Admin", "description": "Exploited as a zero-day in late 2024 and patched in January 2025; anyone whose FortiOS 7.0 admin interface was internet-facing back then should audit admin and VPN accounts, not just the firmware version.", "type": "security-brief", "section": "Security Digest", "date_published": "2025-01-14", "date_modified": "2025-01-14", "markdown_url": "https://erroneo.us/security/briefs/fortios-websocket-auth-bypass-cve-2024-55591/index.md", "verdict": "check-exposure" }, { "url": "https://erroneo.us/security/briefs/ivanti-connect-secure-cve-2025-0282/", "path": "/security/briefs/ivanti-connect-secure-cve-2025-0282/", "title": "Ivanti Connect Secure Zero-Day RCE (CVE-2025-0282)", "description": "A real zero-day used for espionage and patched in January 2025; if you ran Connect Secure below 22.7R2.5 last winter, a clean patch level today does not prove you were never backdoored.", "type": "security-brief", "section": "Security Digest", "date_published": "2025-01-08", "date_modified": "2025-01-08", "markdown_url": "https://erroneo.us/security/briefs/ivanti-connect-secure-cve-2025-0282/index.md", "verdict": "check-exposure" }, { "url": "https://erroneo.us/security/briefs/ultralytics-pypi-cache-poisoning-compromise/", "path": "/security/briefs/ultralytics-pypi-cache-poisoning-compromise/", "title": "Ultralytics PyPI Releases Shipped a Crypto Miner", "description": "The four bad versions were pulled from PyPI within hours to about half a day in December 2024 and carried a coin miner, not a credential stealer; unless something still pins one of them, there is nothing to do but learn the CI lessons.", "type": "security-brief", "section": "Security Digest", "date_published": "2024-12-04", "date_modified": "2024-12-04", "markdown_url": "https://erroneo.us/security/briefs/ultralytics-pypi-cache-poisoning-compromise/index.md", "verdict": "most-can-relax" }, { "url": "https://erroneo.us/security/briefs/pan-os-cve-2024-0012-9474-lunar-peek/", "path": "/security/briefs/pan-os-cve-2024-0012-9474-lunar-peek/", "title": "PAN-OS Management Auth Bypass Chain (Lunar Peek)", "description": "Exploited at scale in late 2024 and patched for almost two years; if your management interface was ever internet-reachable, verify the fix and hunt for leftovers rather than assume you are clean.", "type": "security-brief", "section": "Security Digest", "date_published": "2024-11-18", "date_modified": "2024-11-18", "markdown_url": "https://erroneo.us/security/briefs/pan-os-cve-2024-0012-9474-lunar-peek/index.md", "verdict": "check-exposure" }, { "url": "https://erroneo.us/security/briefs/cups-browsed-rce-chain-cve-2024-47176/", "path": "/security/briefs/cups-browsed-rce-chain-cve-2024-47176/", "title": "CUPS cups-browsed RCE Chain: Real, but Needs a Print Job", "description": "Not the internet-ending bug the pre-disclosure hype suggested: code runs only when someone prints to the rogue printer, as the unprivileged lp user; but nothing should expose UDP 631 to the internet, and exposed hosts can be abused for DDoS.", "type": "security-brief", "section": "Security Digest", "date_published": "2024-09-26", "date_modified": "2024-09-26", "markdown_url": "https://erroneo.us/security/briefs/cups-browsed-rce-chain-cve-2024-47176/index.md", "verdict": "check-exposure" }, { "url": "https://erroneo.us/security/briefs/veeam-backup-replication-rce-cve-2024-40711/", "path": "/security/briefs/veeam-backup-replication-rce-cve-2024-40711/", "title": "Veeam Backup & Replication RCE (CVE-2024-40711)", "description": "Ransomware crews have used this to take over backup servers; any Veeam Backup & Replication v12 server below 12.2 is an emergency, and backup servers should never be reachable from user or internet networks.", "type": "security-brief", "section": "Security Digest", "date_published": "2024-09-04", "date_modified": "2024-09-04", "markdown_url": "https://erroneo.us/security/briefs/veeam-backup-replication-rce-cve-2024-40711/index.md", "verdict": "act-now" }, { "url": "https://erroneo.us/security/briefs/windows-tcpip-ipv6-rce-cve-2024-38063/", "path": "/security/briefs/windows-tcpip-ipv6-rce-cve-2024-38063/", "title": "Windows TCP/IP IPv6 Remote Code Execution (CVE-2024-38063)", "description": "Serious on paper and worth patching promptly, but there is no known in-the-wild exploitation, public code is a flaky crash-oriented proof of concept, and any machine on August 2024 or later cumulative updates is already fixed.", "type": "security-brief", "section": "Security Digest", "date_published": "2024-08-13", "date_modified": "2024-08-13", "markdown_url": "https://erroneo.us/security/briefs/windows-tcpip-ipv6-rce-cve-2024-38063/index.md", "verdict": "patch-this-week" }, { "url": "https://erroneo.us/security/briefs/apache-ofbiz-pre-auth-rce-cve-2024-38856/", "path": "/security/briefs/apache-ofbiz-pre-auth-rce-cve-2024-38856/", "title": "Apache OFBiz: Unauthenticated RCE (CVE-2024-38856)", "description": "Any internet-reachable OFBiz older than 18.12.16 should be treated as compromised-until-proven-otherwise and upgraded immediately; this bug class has been exploited repeatedly.", "type": "security-brief", "section": "Security Digest", "date_published": "2024-08-05", "date_modified": "2024-08-05", "markdown_url": "https://erroneo.us/security/briefs/apache-ofbiz-pre-auth-rce-cve-2024-38856/index.md", "verdict": "act-now" }, { "url": "https://erroneo.us/security/briefs/regresshion-openssh-signal-race-cve-2024-6387/", "path": "/security/briefs/regresshion-openssh-signal-race-cve-2024-6387/", "title": "regreSSHion: OpenSSH sshd Signal Race RCE (CVE-2024-6387)", "description": "Serious on paper (unauthenticated root RCE in sshd), but the only demonstrated exploit needed a 32-bit glibc target and 6-8 hours of continuous connections in a lab, so patch promptly through your distro instead of panicking.", "type": "security-brief", "section": "Security Digest", "date_published": "2024-07-01", "date_modified": "2024-07-01", "markdown_url": "https://erroneo.us/security/briefs/regresshion-openssh-signal-race-cve-2024-6387/index.md", "verdict": "patch-this-week" }, { "url": "https://erroneo.us/security/briefs/moveit-transfer-sftp-auth-bypass-cve-2024-5806/", "path": "/security/briefs/moveit-transfer-sftp-auth-bypass-cve-2024-5806/", "title": "MOVEit Transfer: SFTP Authentication Bypass (CVE-2024-5806)", "description": "If you run MOVEit Transfer with SFTP exposed and are not on a fixed build, treat it as urgent: exploit details went public on disclosure day and attempts followed within hours.", "type": "security-brief", "section": "Security Digest", "date_published": "2024-06-25", "date_modified": "2024-06-25", "markdown_url": "https://erroneo.us/security/briefs/moveit-transfer-sftp-auth-bypass-cve-2024-5806/index.md", "verdict": "act-now" }, { "url": "https://erroneo.us/security/briefs/polyfill-io-cdn-supply-chain-compromise/", "path": "/security/briefs/polyfill-io-cdn-supply-chain-compromise/", "title": "polyfill.io CDN Supply-Chain Compromise Hits 100K+ Sites", "description": "The malicious domain has been suspended since June 27, 2024, but any page that still loads a script from polyfill.io or its sister domains is trusting an attacker-linked host and should be cleaned up.", "type": "security-brief", "section": "Security Digest", "date_published": "2024-06-25", "date_modified": "2024-06-25", "markdown_url": "https://erroneo.us/security/briefs/polyfill-io-cdn-supply-chain-compromise/index.md", "verdict": "check-exposure" }, { "url": "https://erroneo.us/security/briefs/ollama-probllama-path-traversal-rce-cve-2024-37032/", "path": "/security/briefs/ollama-probllama-path-traversal-rce-cve-2024-37032/", "title": "Probllama: Ollama Path Traversal to RCE (CVE-2024-37032)", "description": "The bug was fixed in May 2024, so anything current is patched; the lasting risk is Ollama servers left reachable from the internet with no authentication, which is still very common.", "type": "security-brief", "section": "Security Digest", "date_published": "2024-06-24", "date_modified": "2024-06-24", "markdown_url": "https://erroneo.us/security/briefs/ollama-probllama-path-traversal-rce-cve-2024-37032/index.md", "verdict": "check-exposure" }, { "url": "https://erroneo.us/security/briefs/php-cgi-windows-argument-injection-cve-2024-4577/", "path": "/security/briefs/php-cgi-windows-argument-injection-cve-2024-4577/", "title": "CVE-2024-4577: PHP-CGI Argument Injection RCE on Windows", "description": "If you run PHP on Windows behind Apache in CGI mode (including any default XAMPP install), treat it as compromised-until-proven-otherwise and patch or remove CGI today; everyone else can relax.", "type": "security-brief", "section": "Security Digest", "date_published": "2024-06-06", "date_modified": "2024-06-06", "markdown_url": "https://erroneo.us/security/briefs/php-cgi-windows-argument-injection-cve-2024-4577/index.md", "verdict": "act-now" }, { "url": "https://erroneo.us/security/briefs/snowflake-unc5537-customer-account-breaches/", "path": "/security/briefs/snowflake-unc5537-customer-account-breaches/", "title": "Snowflake UNC5537: Customer Accounts Hit With Stolen Logins", "description": "There was no Snowflake bug to patch; the lesson is that any cloud data platform reachable with a password alone will eventually be logged into by someone holding an infostealer log.", "type": "security-brief", "section": "Security Digest", "date_published": "2024-06-02", "date_modified": "2024-06-02", "markdown_url": "https://erroneo.us/security/briefs/snowflake-unc5537-customer-account-breaches/index.md", "verdict": "check-exposure" }, { "url": "https://erroneo.us/security/briefs/pan-os-globalprotect-cve-2024-3400/", "path": "/security/briefs/pan-os-globalprotect-cve-2024-3400/", "title": "PAN-OS GlobalProtect Zero-Day RCE (CVE-2024-3400)", "description": "Any PAN-OS 10.2, 11.0 or 11.1 firewall with a GlobalProtect gateway or portal that is not on a fixed hotfix is exposed to unauthenticated root code execution and should be patched and checked immediately.", "type": "security-brief", "section": "Security Digest", "date_published": "2024-04-12", "date_modified": "2024-04-12", "markdown_url": "https://erroneo.us/security/briefs/pan-os-globalprotect-cve-2024-3400/index.md", "verdict": "act-now" }, { "url": "https://erroneo.us/security/briefs/xz-utils-backdoor/", "path": "/security/briefs/xz-utils-backdoor/", "title": "xz-utils Backdoor in liblzma 5.6.0/5.6.1 (CVE-2024-3094)", "description": "The backdoor only reached rolling and pre-release distributions for a few weeks before discovery; stable enterprise releases never shipped it, but any machine that ran xz 5.6.0 or 5.6.1 should be checked.", "type": "security-brief", "section": "Security Digest", "date_published": "2024-03-29", "date_modified": "2024-03-29", "markdown_url": "https://erroneo.us/security/briefs/xz-utils-backdoor/index.md", "verdict": "check-exposure" }, { "url": "https://erroneo.us/security/briefs/shadowray-ray-jobs-api-cve-2023-48022/", "path": "/security/briefs/shadowray-ray-jobs-api-cve-2023-48022/", "title": "ShadowRay: Exposed Ray Clusters Hijacked (CVE-2023-48022)", "description": "There is no patch to install: if any Ray dashboard, Jobs or Client port is reachable from an untrusted network, anyone who can reach it can run code on your cluster.", "type": "security-brief", "section": "Security Digest", "date_published": "2024-03-26", "date_modified": "2024-03-26", "markdown_url": "https://erroneo.us/security/briefs/shadowray-ray-jobs-api-cve-2023-48022/index.md", "verdict": "check-exposure" }, { "url": "https://erroneo.us/security/briefs/hugging-face-malicious-pickle-models/", "path": "/security/briefs/hugging-face-malicious-pickle-models/", "title": "Malicious Hugging Face Models: Pickle Code Execution", "description": "This is a standing risk, not a one-off bug: loading a pickle-based model from an untrusted repo is running that author's code, so check how your pipelines load third-party weights.", "type": "security-brief", "section": "Security Digest", "date_published": "2024-02-27", "date_modified": "2024-02-27", "markdown_url": "https://erroneo.us/security/briefs/hugging-face-malicious-pickle-models/index.md", "verdict": "check-exposure" }, { "url": "https://erroneo.us/security/briefs/connectwise-screenconnect-auth-bypass-cve-2024-1709/", "path": "/security/briefs/connectwise-screenconnect-auth-bypass-cve-2024-1709/", "title": "ScreenConnect Auth Bypass CVE-2024-1709 (CVSS 10)", "description": "Any on-premises ScreenConnect server still below 23.9.8 should be treated as compromised until proven otherwise; cloud-hosted customers were patched by ConnectWise.", "type": "security-brief", "section": "Security Digest", "date_published": "2024-02-19", "date_modified": "2024-02-19", "markdown_url": "https://erroneo.us/security/briefs/connectwise-screenconnect-auth-bypass-cve-2024-1709/index.md", "verdict": "act-now" }, { "url": "https://erroneo.us/security/briefs/fortios-ssl-vpn-out-of-bounds-write-rce/", "path": "/security/briefs/fortios-ssl-vpn-out-of-bounds-write-rce/", "title": "FortiOS SSL VPN Pre-Auth RCE (CVE-2024-21762)", "description": "Any FortiGate or FortiProxy with SSL VPN enabled on an unfixed build is exposed to unauthenticated remote code execution that has been exploited; upgrade or disable SSL VPN today.", "type": "security-brief", "section": "Security Digest", "date_published": "2024-02-08", "date_modified": "2024-02-08", "markdown_url": "https://erroneo.us/security/briefs/fortios-ssl-vpn-out-of-bounds-write-rce/index.md", "verdict": "act-now" }, { "url": "https://erroneo.us/security/briefs/runc-leaky-vessels-container-escape/", "path": "/security/briefs/runc-leaky-vessels-container-escape/", "title": "Leaky Vessels: runc Container Escape (CVE-2024-21626)", "description": "A real container escape, but it needs you to run an attacker-controlled image or a crafted exec; patch runc everywhere promptly, urgently where untrusted images or multi-tenant builds run.", "type": "security-brief", "section": "Security Digest", "date_published": "2024-01-31", "date_modified": "2024-01-31", "markdown_url": "https://erroneo.us/security/briefs/runc-leaky-vessels-container-escape/index.md", "verdict": "patch-this-week" }, { "url": "https://erroneo.us/security/briefs/jenkins-cli-args4j-arbitrary-file-read/", "path": "/security/briefs/jenkins-cli-args4j-arbitrary-file-read/", "title": "Jenkins CLI Arbitrary File Read (CVE-2024-23897)", "description": "An unpatched Jenkins controller reachable by untrusted users leaks files and secrets that can lead to full takeover; upgrade now or disable the CLI.", "type": "security-brief", "section": "Security Digest", "date_published": "2024-01-24", "date_modified": "2024-01-24", "markdown_url": "https://erroneo.us/security/briefs/jenkins-cli-args4j-arbitrary-file-read/index.md", "verdict": "act-now" }, { "url": "https://erroneo.us/security/briefs/gitlab-password-reset-account-takeover/", "path": "/security/briefs/gitlab-password-reset-account-takeover/", "title": "GitLab Password Reset Flaw Enables Account Takeover", "description": "Any self-managed GitLab still on 16.1 through 16.7.1 lets anyone take over accounts without 2FA by email alone; upgrade immediately and turn on 2FA.", "type": "security-brief", "section": "Security Digest", "date_published": "2024-01-11", "date_modified": "2024-01-11", "markdown_url": "https://erroneo.us/security/briefs/gitlab-password-reset-account-takeover/index.md", "verdict": "act-now" }, { "url": "https://erroneo.us/security/briefs/ivanti-connect-secure-auth-bypass-command-injection/", "path": "/security/briefs/ivanti-connect-secure-auth-bypass-command-injection/", "title": "Ivanti Connect Secure Zero-Day Chain: Unauthenticated RCE", "description": "This chain was exploited as a zero-day by a suspected nation-state actor and then mass-exploited; any unpatched appliance should be assumed compromised, not just patched.", "type": "security-brief", "section": "Security Digest", "date_published": "2024-01-10", "date_modified": "2024-01-10", "markdown_url": "https://erroneo.us/security/briefs/ivanti-connect-secure-auth-bypass-command-injection/index.md", "verdict": "act-now" }, { "url": "https://erroneo.us/security/briefs/confluence-improper-authorization-cve-2023-22518/", "path": "/security/briefs/confluence-improper-authorization-cve-2023-22518/", "title": "Confluence CVE-2023-22518: Unauthenticated Reset to Admin", "description": "Any self-hosted Confluence that is reachable from the internet and not on a fixed release can be wiped and taken over by an unauthenticated request; patch or pull it offline, and Atlassian Cloud users have nothing to do.", "type": "security-brief", "section": "Security Digest", "date_published": "2023-10-31", "date_modified": "2023-10-31", "markdown_url": "https://erroneo.us/security/briefs/confluence-improper-authorization-cve-2023-22518/index.md", "verdict": "act-now" }, { "url": "https://erroneo.us/security/briefs/cisco-ios-xe-web-ui-cve-2023-20198/", "path": "/security/briefs/cisco-ios-xe-web-ui-cve-2023-20198/", "title": "Cisco IOS XE Web UI Zero-Day Chain Implants Devices", "description": "If any IOS XE device has its HTTP or HTTPS server reachable from an untrusted network and is not on a fixed release, treat it as compromised until proven otherwise; devices with the web UI disabled were never exposed.", "type": "security-brief", "section": "Security Digest", "date_published": "2023-10-16", "date_modified": "2023-10-16", "markdown_url": "https://erroneo.us/security/briefs/cisco-ios-xe-web-ui-cve-2023-20198/index.md", "verdict": "act-now" }, { "url": "https://erroneo.us/security/briefs/curl-socks5-heap-overflow-cve-2023-38545/", "path": "/security/briefs/curl-socks5-heap-overflow-cve-2023-38545/", "title": "curl SOCKS5 Heap Overflow: Hyped, but Narrow in Practice", "description": "Pre-announced as the worst curl flaw in a long time, the bug only bites when libcurl uses a SOCKS5 proxy with remote name resolution and an attacker can supply a very long hostname; take 8.4.0 or later in normal patching, and hurry only if that proxy setup applies to you.", "type": "security-brief", "section": "Security Digest", "date_published": "2023-10-11", "date_modified": "2023-10-11", "markdown_url": "https://erroneo.us/security/briefs/curl-socks5-heap-overflow-cve-2023-38545/index.md", "verdict": "most-can-relax" }, { "url": "https://erroneo.us/security/briefs/citrix-bleed-netscaler-cve-2023-4966/", "path": "/security/briefs/citrix-bleed-netscaler-cve-2023-4966/", "title": "Citrix Bleed: NetScaler Gateway Leaks Session Tokens", "description": "If a NetScaler configured as a Gateway or AAA server is still on a vulnerable build, assume it is being probed and patch, kill every session, and hunt; patching alone does not evict an attacker holding a stolen session.", "type": "security-brief", "section": "Security Digest", "date_published": "2023-10-10", "date_modified": "2023-10-10", "markdown_url": "https://erroneo.us/security/briefs/citrix-bleed-netscaler-cve-2023-4966/index.md", "verdict": "act-now" }, { "url": "https://erroneo.us/security/briefs/http2-rapid-reset-ddos-cve-2023-44487/", "path": "/security/briefs/http2-rapid-reset-ddos-cve-2023-44487/", "title": "HTTP/2 Rapid Reset: Record DDoS Flaw in HTTP/2 Servers", "description": "This is availability-only and was exploited at record scale, but if your HTTP/2 traffic terminates at a major CDN or cloud load balancer the provider already absorbed it; check what terminates HTTP/2 on your own servers.", "type": "security-brief", "section": "Security Digest", "date_published": "2023-10-10", "date_modified": "2023-10-10", "markdown_url": "https://erroneo.us/security/briefs/http2-rapid-reset-ddos-cve-2023-44487/index.md", "verdict": "check-exposure" }, { "url": "https://erroneo.us/security/briefs/langchain-palchain-prompt-injection-rce-cve-2023-44467/", "path": "/security/briefs/langchain-palchain-prompt-injection-rce-cve-2023-44467/", "title": "LangChain PALChain: Prompt Injection to RCE (CVE-2023-44467)", "description": "Only apps that feed untrusted text into PALChain (or similar LLM-to-Python chains) are at risk, but for them it is full code execution, and blocklist fixes kept getting bypassed, so remove the pattern rather than trust the patch.", "type": "security-brief", "section": "Security Digest", "date_published": "2023-10-09", "date_modified": "2023-10-09", "markdown_url": "https://erroneo.us/security/briefs/langchain-palchain-prompt-injection-rce-cve-2023-44467/index.md", "verdict": "check-exposure" }, { "url": "https://erroneo.us/security/briefs/knx-bcu-key-lockout-cve-2023-4346/", "path": "/security/briefs/knx-bcu-key-lockout-cve-2023-4346/", "title": "KNX CVE-2023-4346: Building Automation BCU Key Lockout", "description": "Only buildings with KNX devices that have no BCU key set and a network path to the KNX bus are at risk, but there is no patch and a lockout can mean physically replacing devices.", "type": "security-brief", "section": "Security Digest", "date_published": "2023-08-24", "date_modified": "2023-08-24", "markdown_url": "https://erroneo.us/security/briefs/knx-bcu-key-lockout-cve-2023-4346/index.md", "verdict": "check-exposure" }, { "url": "https://erroneo.us/security/briefs/strapi-cve-2023-22894-private-field-leak-kev/", "path": "/security/briefs/strapi-cve-2023-22894-private-field-leak-kev/", "title": "Strapi CVE-2023-22894: 2023 Password-Hash Leak Now in KEV", "description": "Only Strapi builds older than 4.8.0 (March 2023) are affected, but on those an unauthenticated attacker can take over the super admin, so any you find should be upgraded or taken offline today.", "type": "security-brief", "section": "Security Digest", "date_published": "2023-04-17", "date_modified": "2023-04-17", "markdown_url": "https://erroneo.us/security/briefs/strapi-cve-2023-22894-private-field-leak-kev/index.md", "verdict": "check-exposure" }, { "url": "https://erroneo.us/security/briefs/ajaxpro-deserialization-rce-cve-2021-23758/", "path": "/security/briefs/ajaxpro-deserialization-rce-cve-2021-23758/", "title": "AjaxPro CVE-2021-23758: Old ASP.NET RCE Now in CISA KEV", "description": "If an ASP.NET app you run still ships AjaxPro, treat it as an unauthenticated RCE and upgrade or remove the library now; if you never used AjaxPro, there is nothing to do.", "type": "security-brief", "section": "Security Digest", "date_published": "2021-12-03", "date_modified": "2021-12-03", "markdown_url": "https://erroneo.us/security/briefs/ajaxpro-deserialization-rce-cve-2021-23758/index.md", "verdict": "check-exposure" }, { "url": "https://erroneo.us/security/briefs/dd-wrt-upnp-ssdp-overflow-cve-2021-27137/", "path": "/security/briefs/dd-wrt-upnp-ssdp-overflow-cve-2021-27137/", "title": "DD-WRT CVE-2021-27137: UPnP Overflow Used by C0XMO Botnet", "description": "Only routers running an old DD-WRT build with UPnP turned on are at risk; find any you own, update or retire them, and switch UPnP off where nobody needs it.", "type": "security-brief", "section": "Security Digest", "date_published": "2021-03-24", "date_modified": "2021-03-24", "markdown_url": "https://erroneo.us/security/briefs/dd-wrt-upnp-ssdp-overflow-cve-2021-27137/index.md", "verdict": "check-exposure" }, { "url": "https://erroneo.us/security/briefs/onlyoffice-document-server-path-traversal-cve-2021-3199/", "path": "/security/briefs/onlyoffice-document-server-path-traversal-cve-2021-3199/", "title": "ONLYOFFICE Docs CVE-2021-3199: Old Upload RCE Now in KEV", "description": "Only Document Server installs older than 5.6.3, a release from August 2020, are at risk, but any you find should be treated as exposed and upgraded or pulled offline today.", "type": "security-brief", "section": "Security Digest", "date_published": "2021-01-22", "date_modified": "2021-01-22", "markdown_url": "https://erroneo.us/security/briefs/onlyoffice-document-server-path-traversal-cve-2021-3199/index.md", "verdict": "check-exposure" }, { "url": "https://erroneo.us/security/briefs/microsoft-sql-server-cve-2019-1068-authenticated-rce-kev/", "path": "/security/briefs/microsoft-sql-server-cve-2019-1068-authenticated-rce-kev/", "title": "SQL Server CVE-2019-1068: 2019 RCE Added to CISA KEV", "description": "Any SQL Server 2014, 2016 or 2017 instance updated since July 2019 already has the fix; the real work is finding the instances that never got it, now that CISA says attackers are exploiting the bug, and patching or retiring them.", "type": "security-brief", "section": "Security Digest", "date_published": "2019-07-09", "date_modified": "2019-07-09", "markdown_url": "https://erroneo.us/security/briefs/microsoft-sql-server-cve-2019-1068-authenticated-rce-kev/index.md", "verdict": "check-exposure" }, { "url": "https://erroneo.us/security/briefs/apache-struts-s2-032-cve-2016-3081-dmi-rce/", "path": "/security/briefs/apache-struts-s2-032-cve-2016-3081-dmi-rce/", "title": "Apache Struts S2-032 (CVE-2016-3081): 2016 RCE Now in KEV", "description": "Only Struts 2.3.20 to 2.3.28 apps with Dynamic Method Invocation turned on are exposed, but any Struts 2.3.x you find is end-of-life, open to worse KEV-listed bugs, and should be fixed or pulled now.", "type": "security-brief", "section": "Security Digest", "date_published": "2016-04-19", "date_modified": "2016-04-19", "markdown_url": "https://erroneo.us/security/briefs/apache-struts-s2-032-cve-2016-3081-dmi-rce/index.md", "verdict": "check-exposure" }, { "url": "https://erroneo.us/security/briefs/abrt-symlink-privilege-escalation-cve-2015-5287/", "path": "/security/briefs/abrt-symlink-privilege-escalation-cve-2015-5287/", "title": "ABRT CVE-2015-5287: 2015 RHEL 7 Local Root Bug Now in KEV", "description": "This is a ten-year-old local root bug that any RHEL 7 or CentOS 7 host updated since late 2015 already has fixed; the KEV listing matters only for forgotten, never-patched machines, and those have bigger problems.", "type": "security-brief", "section": "Security Digest", "date_published": "2015-11-23", "date_modified": "2015-11-23", "markdown_url": "https://erroneo.us/security/briefs/abrt-symlink-privilege-escalation-cve-2015-5287/index.md", "verdict": "most-can-relax" }, { "url": "https://erroneo.us/security/briefs/bind-tkey-assertion-dos-cve-2015-5477/", "path": "/security/briefs/bind-tkey-assertion-dos-cve-2015-5477/", "title": "BIND CVE-2015-5477: 2015 TKEY DNS Crash Bug Now in KEV", "description": "Any BIND release from the past decade is fixed, so most teams have nothing to do; the real risk is forgotten DNS servers and appliances still running pre-mid-2015 BIND, which one packet can knock offline.", "type": "security-brief", "section": "Security Digest", "date_published": "2015-07-28", "date_modified": "2015-07-28", "markdown_url": "https://erroneo.us/security/briefs/bind-tkey-assertion-dos-cve-2015-5477/index.md", "verdict": "check-exposure" }, { "url": "https://erroneo.us/security/briefs/libuser-userhelper-passwd-race-cve-2015-3246/", "path": "/security/briefs/libuser-userhelper-passwd-race-cve-2015-3246/", "title": "libuser CVE-2015-3246: 2015 Linux Root Bug Lands in KEV", "description": "Any RHEL or CentOS 6 or 7 host that has taken updates since July 2015 is already fixed; the real risk is forgotten legacy Linux servers, where this is one of several old root exploits attackers now chain after a web compromise.", "type": "security-brief", "section": "Security Digest", "date_published": "2015-07-23", "date_modified": "2015-07-23", "markdown_url": "https://erroneo.us/security/briefs/libuser-userhelper-passwd-race-cve-2015-3246/index.md", "verdict": "most-can-relax" }, { "url": "https://erroneo.us/security/", "path": "/security/", "title": "Security Digest", "type": "security-hub", "section": "Security Digest", "description": "Daily vulnerability digest; every CVE, advisory and digest day is in /api/security/index.json", "date_modified": "2026-10-21", "markdown_url": "https://erroneo.us/security/index.md" } ] }