erroneo.us
Search all guides⌘K

Digest · Thursday

Security digest: June 4, 2026

1 editorial brief and 4 critical advisories.

All digests · RSS · Markdown

Take stock

  • Check exposure: Progress LoadMaster CVE-2026-8037: Exploited Pre-Auth RCE. Owners of Progress Kemp LoadMaster (GA 7.2.63.1 or older, LTSF 7.2.54.17 or older) or the ECS/Object Scale Connection Manager and MOVEit WAF builds based on it, with the API enabled.
  • npm: 1 critical advisory (@cap-js/openapi). Check with npm audit (or: npm ls <package>).
  • Composer (PHP): 1 critical advisory (WWBN/AVideo). Check with composer audit.
  • Maven: 1 critical advisory (org.apache.fory:fory-core). Check with mvn dependency:tree -Dincludes=<groupId>:<artifactId>.
  • PyPI: 1 critical advisory (stata-mcp). Check with pip-audit (or: pip show <package>).
  • None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

Editorial briefs

Check exposure

· Vulnerability · CVE-2026-8037

Progress LoadMaster CVE-2026-8037: Exploited Pre-Auth RCE

Only LoadMaster-based appliances with the API enabled are exposed, but for those this is unauthenticated root RCE with a public exploit; if that's you and you're below 7.2.63.2 or 7.2.54.18, patch today.

Must act: Owners of Progress Kemp LoadMaster (GA 7.2.63.1 or older, LTSF 7.2.54.17 or older) or the ECS/Object Scale Connection Manager and MOVEit WAF builds based on it, with the API enabled.

Can relax: Appliances already on GA 7.2.63.2 or LTSF 7.2.54.18 or later, deployments with the API disabled, and teams that don't run LoadMaster.

  1. Inventory every LoadMaster and LoadMaster-based appliance, its firmware version, and whether its API is enabled.
  2. Upgrade to GA 7.2.63.2 or LTSF 7.2.54.18 (or later).
  3. If an upgrade must wait, turn the API off if you don't use it, or restrict who can reach it to admin hosts.

Read the brief →

Known exploited (CISA KEV) 0

Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.

None.

Critical advisories by ecosystem 4

GitHub-reviewed advisories rated critical, published this day (Pacific time).

Composer (PHP) 1

Check: composer audit

Maven 1

Check: mvn dependency:tree -Dincludes=<groupId>:<artifactId>

npm 1

Check: npm audit (or: npm ls <package>)

PyPI 1

Check: pip-audit (or: pip show <package>)