Digest · Thursday
Security digest: June 11, 2026
1 known exploited (cisa kev) addition and 2 critical advisories.
All digests · RSS · Markdown
Take stock
- Do you run any of these? Ivanti Sentry. They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2026-06-14.
- PyPI: 1 critical advisory (
meta-ads-mcp). Check withpip-audit (or: pip show <package>). - Composer (PHP): 1 critical advisory (
codeigniter4/framework). Check withcomposer audit. - None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.
Known exploited (CISA KEV) 1
Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.
| CVE | Product and flaw | CISA due |
|---|---|---|
| CVE-2026-10520 | Ivanti Sentry Ivanti Sentry OS Command Injection Vulnerability | 2026-06-14 |
Critical advisories by ecosystem 2
GitHub-reviewed advisories rated critical, published this day (Pacific time).
Composer (PHP) 1
Check: composer audit
- CodeIgniter4 has a validation bypass when uploading file extensions via `ext_in` rule CVE-2026-48062 CVSS 9.8 Critical
codeigniter4/framework< 4.7.2 → fixed in 4.7.3
PyPI 1
Check: pip-audit (or: pip show <package>)
- Meta Ads MCP: Unauthenticated HTTP MCP Tool Execution Leaks Operator Meta Access Token CVE-2026-48039 CVSS 9.1 Critical
meta-ads-mcp<= 1.0.108 → fixed in 1.0.109