---
title: "Security digest: February 13, 2026"
url: https://erroneo.us/security/2026-02-13/
description: "February 13, 2026 vulnerability digest: 1 CISA KEV addition (BeyondTrust); 2 critical advisories (crates.io (Rust), Composer…). What to patch and who can…"
type: security-digest-day
section: "Security Digest"
date_published: 2026-02-13
date_modified: 2026-02-13
publisher: erroneo.us
author: erroneo.us Security Desk
license: All rights reserved. Quote with attribution and a link.
---

# Security digest: February 13, 2026

1 known exploited (cisa kev) addition and 2 critical advisories.

## Take stock

- Do you run any of these? BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA). They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2026-02-16.
- crates.io (Rust): 1 critical advisory ( polymarket-client-sdks ). Check with cargo audit .
- Composer (PHP): 1 critical advisory ( idno/known ). Check with composer audit .
- None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

## Known exploited (CISA KEV)

- [CVE-2026-1731](https://erroneo.us/security/cve/CVE-2026-1731/index.md) BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA): BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA) OS Command Injection Vulnerability (CISA due 2026-02-16)

## Critical advisories

- [GHSA-p5vf-5754-x7p3](https://erroneo.us/security/ghsa/GHSA-p5vf-5754-x7p3/index.md) `polymarket-client-sdks` was removed from crates.io for malicious code — crates.io (Rust) polymarket-client-sdks >= 0 → no fix
- [CVE-2026-26273](https://erroneo.us/security/cve/CVE-2026-26273/index.md) Known affected by Account Takeover via Password Reset Token Leakage — Composer (PHP) idno/known <= 1.6.2 → 1.6.3

---
Source page: https://erroneo.us/security/2026-02-13/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt