Digest · Wednesday

Security digest: August 13, 2025

2 known exploited (cisa kev) additions and 3 critical advisories.

Take stock

Do you run any of these? N-able N-Central. They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2025-08-20.
RubyGems: 2 critical advisories (activestorage, spree). Check with bundle audit check --update.
GitHub Actions: 1 critical advisory (m00nl1ght-dev/steam-workshop-deploy, BoldestDungeon/steam-workshop-deploy). Check with grep -rn 'uses: <owner>/<action>' .github/workflows.
None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.

CVE	Product and flaw	CISA due
CVE-2025-8876	N-able N-Central N-able N-Central Command Injection Vulnerability	2025-08-20
CVE-2025-8875	N-able N-Central N-able N-Central Insecure Deserialization Vulnerability	2025-08-20

GitHub-reviewed advisories rated critical, published this day (Pacific time).

Check: bundle audit check --update

Active Storage allowed transformation methods that were potentially unsafe CVE-2025-24293 CVSS 9.2 Critical
activestorage >= 8.0, < 8.0.2.1 → fixed in 8.0.2.1; activestorage >= 7.2, < 7.2.2.2 → fixed in 7.2.2.2; activestorage >= 5.2.0, < 7.1.5.2 → fixed in 7.1.5.2
Spree has Remote Command Execution vulnerability in search functionality CVE-2011-10019 CVSS 10.0 Critical
spree < 0.60.2 → fixed in 0.60.2

Check: grep -rn 'uses: <owner>/<action>' .github/workflows

m00nl1ght-dev/steam-workshop-deploy: Exposure of Version-Control Repository to an Unauthorized Control Sphere and Insufficiently Protected… GHSA-x6gv-2rvh-qmp6 CVSS 10.0 Critical
m00nl1ght-dev/steam-workshop-deploy < 4 → fixed in 4; BoldestDungeon/steam-workshop-deploy < 2.0.0 → fixed in 2.0.0