erroneo.us
Search all guides⌘K

Digest · Thursday

Security digest: March 19, 2026

1 editorial brief, 1 known exploited (cisa kev) addition and 8 critical advisories.

All digests · RSS · Markdown

Take stock

  • Check exposure: Trivy / TeamPCP compromise. Teams whose CI ran aquasecurity/trivy-action by tag on March 19-20, 2026, setup-trivy unpinned, Trivy 0.69.4 from any channel or Docker Hub 0.69.5/0.69.6/latest on March 22-23, or the Checkmarx actions and Open VSX extensions on March 23.
  • Do you run any of these? Cisco Secure Firewall Management Center (FMC). They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2026-03-22.
  • Go: 3 critical advisories (github.com/smallstep/certificates, github.com/autobrr/qui, github.com/minio/minio). Check with govulncheck ./....
  • Composer (PHP): 2 critical advisories (wwbn/avideo). Check with composer audit.
  • npm: 1 critical advisory (mcp-bridge). Check with npm audit (or: npm ls <package>).
  • Maven: 1 critical advisory (org.springframework.security:spring-security-web). Check with mvn dependency:tree -Dincludes=<groupId>:<artifactId>.
  • PyPI: 1 critical advisory (langflow). Check with pip-audit (or: pip show <package>).
  • None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

Editorial briefs

Check exposure

· Supply-chain compromise · CVE-2026-33634

Trivy Supply-Chain Hijack: trivy-action Steals CI Secrets

If any pipeline ran trivy-action by tag, setup-trivy, or Trivy 0.69.4 to 0.69.6 during the March 19-23, 2026 windows, every secret that job could see is burned; if you pinned SHAs, digests or 0.69.3, you were fine.

Must act: Teams whose CI ran aquasecurity/trivy-action by tag on March 19-20, 2026, setup-trivy unpinned, Trivy 0.69.4 from any channel or Docker Hub 0.69.5/0.69.6/latest on March 22-23, or the Checkmarx actions and Open VSX extensions on March 23.

Can relax: Users who pinned the action to a commit SHA after 2025-04-09, used images by digest, installed Trivy through the official Homebrew formula, or stayed on Trivy 0.69.3 or earlier were not affected.

  1. Grep workflows for trivy-action and setup-trivy references and check run logs from March 19-20, 2026
  2. Pin actions to full commit SHAs and container images to digests
  3. Rotate every secret available to affected jobs: cloud keys, GitHub PATs, registry creds, SSH keys, Kubernetes tokens, .env values

Read the brief →

Known exploited (CISA KEV) 1

Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.

CVEProduct and flawCISA due
CVE-2026-20131Cisco Secure Firewall Management Center (FMC)
Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management Deserialization of Untrusted Data Vulnerability Ransomware		2026-03-22

Critical advisories by ecosystem 8

GitHub-reviewed advisories rated critical, published this day (Pacific time).

Go 3

Check: govulncheck ./...

Composer (PHP) 2

Check: composer audit

Maven 1

Check: mvn dependency:tree -Dincludes=<groupId>:<artifactId>

  • Spring Security HTTP Headers Are not Written Under Some Conditions CVE-2026-22732 CVSS 9.1 Critical
    org.springframework.security:spring-security-web <= 5.7.14 → no fix listed; org.springframework.security:spring-security-web >= 5.8.0, <= 5.8.16 → no fix listed; org.springframework.security:spring-security-web >= 6.0.0, <= 6.3.10 → no fix listed; +3 more packages

npm 1

Check: npm audit (or: npm ls <package>)

PyPI 1

Check: pip-audit (or: pip show <package>)