---
title: "Security digest: February 24, 2026"
url: https://erroneo.us/security/2026-02-24/
description: "February 24, 2026 vulnerability digest: 1 CISA KEV addition (Soliton Systems K.K); 4 critical advisories (npm, Composer (PHP)). What to patch and who can…"
type: security-digest-day
section: "Security Digest"
date_published: 2026-02-24
date_modified: 2026-02-24
publisher: erroneo.us
author: erroneo.us Security Desk
license: All rights reserved. Quote with attribution and a link.
---

# Security digest: February 24, 2026

1 known exploited (cisa kev) addition and 4 critical advisories.

## Take stock

- Do you run any of these? Soliton Systems K.K FileZen. They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2026-03-17.
- npm: 3 critical advisories ( @oneuptime/common , @actual-app/sync-server , @frangoteam/fuxa ). Check with npm audit (or: npm ls <package>) .
- Composer (PHP): 1 critical advisory ( statamic/cms ). Check with composer audit .
- None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

## Known exploited (CISA KEV)

- [CVE-2026-25108](https://erroneo.us/security/cve/CVE-2026-25108/index.md) Soliton Systems K.K FileZen: Soliton Systems K.K FileZen OS Command Injection Vulnerability (CISA due 2026-03-17)

## Critical advisories

- [CVE-2026-27574](https://erroneo.us/security/cve/CVE-2026-27574/index.md) OneUptime:: node:vm sandbox escape in probe allows any project member to achieve RCE — npm @oneuptime/common < 10.0.0 → 10.0.0
- [CVE-2026-27584](https://erroneo.us/security/cve/CVE-2026-27584/index.md) ActualBudget server is Missing Authentication for SimpleFIN and Pluggy AI bank sync endpoints — npm @actual-app/sync-server < 26.2.1 → 26.2.1
- [CVE-2026-27593](https://erroneo.us/security/cve/CVE-2026-27593/index.md) Statamic is vulnerable to account takeover via password reset link injection — Composer (PHP) statamic/cms < 5.73.10 → 5.73.10; Composer (PHP) statamic/cms >= 6.0.0-alpha.1, < 6.7.1 → 6.7.1
- [CVE-2025-69985](https://erroneo.us/security/cve/CVE-2025-69985/index.md) FUXA has JWT Authentication Bypass via HTTP Referer header spoofing — npm @frangoteam/fuxa <= 1.2.8 → no fix

---
Source page: https://erroneo.us/security/2026-02-24/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt