---
title: "Security digest: June 9, 2026"
url: https://erroneo.us/security/2026-06-09/
description: "June 9, 2026 vulnerability digest: 3 CISA KEV additions (Arista, Cisco, Google); 3 critical advisories (npm, Composer (PHP), Hex…). What to patch and who…"
type: security-digest-day
section: "Security Digest"
date_published: 2026-06-09
date_modified: 2026-06-09
publisher: erroneo.us
author: erroneo.us Security Desk
license: All rights reserved. Quote with attribution and a link.
---

# Security digest: June 9, 2026

3 known exploited (cisa kev) additions and 3 critical advisories.

## Take stock

- Do you run any of these? Arista Extensible Operating System, Cisco Catalyst SD-WAN Manager, Google Chromium V8. They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2026-06-23.
- npm: 1 critical advisory ( shell-quote ). Check with npm audit (or: npm ls <package>) .
- Composer (PHP): 1 critical advisory ( pheditor/pheditor ). Check with composer audit .
- Hex (Erlang/Elixir): 1 critical advisory ( phoenix_storybook ). Check with mix hex.audit .
- None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

## Known exploited (CISA KEV)

- [CVE-2026-7473](https://erroneo.us/security/cve/CVE-2026-7473/index.md) Arista Extensible Operating System: Arista Extensible Operating System Incomplete Comparison with Missing Factors Vulnerability (CISA due 2026-06-23)
- [CVE-2026-20245](https://erroneo.us/security/cve/CVE-2026-20245/index.md) Cisco Catalyst SD-WAN Manager: Cisco Catalyst SD-WAN Manager Improper Encoding or Escaping of Output Vulnerability (CISA due 2026-06-23)
- [CVE-2026-11645](https://erroneo.us/security/cve/CVE-2026-11645/index.md) Google Chromium V8: Google Chromium V8 Out-of-Bounds Read and Write Vulnerability (CISA due 2026-06-23)

## Critical advisories

- [CVE-2026-9277](https://erroneo.us/security/cve/CVE-2026-9277/index.md) shell-quote quote() does not escape newlines in object .op values — npm shell-quote >= 1.1.0, <= 1.8.3 → 1.8.4
- [CVE-2026-48030](https://erroneo.us/security/cve/CVE-2026-48030/index.md) Pheditor: OS Command Injection in terminal handler via unsanitized 'dir' parameter — Composer (PHP) pheditor/pheditor >= 2.0.1, <= 2.0.3 → 2.0.4
- [CVE-2026-8467](https://erroneo.us/security/cve/CVE-2026-8467/index.md) PhoenixStorybook: Unauthenticated remote code execution via HEEx template injection in phoenix_storybook playground — Hex (Erlang/Elixir) phoenix_storybook >= 0.5.0, < 1.1.0 → 1.1.0

---
Source page: https://erroneo.us/security/2026-06-09/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt