--- title: "Security digest: June 25, 2024" url: https://erroneo.us/security/2024-06-25/ description: "June 25, 2024 vulnerability digest: 2 briefs (MOVEit Transfer: SFTP Authentication Bypass…); 1 critical advisory (Composer (PHP)). What to patch and who can…" type: security-digest-day section: "Security Digest" date_published: 2024-06-25 date_modified: 2026-10-21 publisher: erroneo.us author: erroneo.us Security Desk license: All rights reserved. Quote with attribution and a link. --- # Security digest: June 25, 2024 2 editorial briefs and 1 critical advisory. ## Take stock - Act now: MOVEit Transfer: SFTP Authentication Bypass (CVE-2024-5806) . Organizations running self-hosted MOVEit Transfer 2023.0, 2023.1 or 2024.0 builds older than the fixed releases, especially with the SFTP service reachable from the internet. - Check exposure: polyfill.io . Site owners whose HTML, templates, themes or plugins still reference cdn.polyfill.io, polyfill.com, or the related bootcdn, bootcss and staticfile domains. - Composer (PHP): 1 critical advisory ( craftcms/cms ). Check with composer audit . - None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully. ## Editorial briefs - **Act now** [MOVEit Transfer: SFTP Authentication Bypass (CVE-2024-5806)](https://erroneo.us/security/briefs/moveit-transfer-sftp-auth-bypass-cve-2024-5806/index.md): If you run MOVEit Transfer with SFTP exposed and are not on a fixed build, treat it as urgent: exploit details went public on disclosure day and attempts followed within hours. - **Check exposure** [polyfill.io CDN Supply-Chain Compromise Hits 100K+ Sites](https://erroneo.us/security/briefs/polyfill-io-cdn-supply-chain-compromise/index.md): The malicious domain has been suspended since June 27, 2024, but any page that still loads a script from polyfill.io or its sister domains is trusting an attacker-linked host and should be cleaned up. ## Known exploited (CISA KEV) None. ## Critical advisories - [CVE-2024-37843](https://erroneo.us/security/cve/CVE-2024-37843/index.md) Craft CMS SQL injection vulnerability via the GraphQL API endpoint — Composer (PHP) craftcms/cms <= 3.7.31 → no fix --- Source page: https://erroneo.us/security/2024-06-25/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt