erroneo.us
Search all guides⌘K

Digest · Tuesday

Security digest: June 16, 2026

1 editorial brief, 1 known exploited (cisa kev) addition and 7 critical advisories.

All digests · RSS · Markdown

Take stock

  • Check exposure: Zyxel GS1900 Switches: Exploited CGI Overflow (KEV). Owners of GS1900-8, -8HP, -10HP, -16, -24, -24E, -24EP, -24HPv2, -48 or -48HPv2 switches on 2.90(xxxx.1)C0 or earlier, today if the web interface is reachable from the internet or untrusted networks.
  • Do you run any of these? Widget Factory Joomla Content Editor. They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2026-06-19.
  • PyPI: 5 critical advisories (langflow, crawl4ai, vllm, litellm). Check with pip-audit (or: pip show <package>).
  • npm: 1 critical advisory (@lobehub/lobehub). Check with npm audit (or: npm ls <package>).
  • Go: 1 critical advisory (github.com/rclone/rclone). Check with govulncheck ./....
  • None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

Editorial briefs

Check exposure

· Vulnerability · CVE-2026-7273

Zyxel GS1900 Switches: Exploited CGI Overflow (KEV)

Patch every GS1900 to the June firmware, but the urgency depends on reach: if the switch's web interface is exposed to the internet, a guest network or a flat LAN, treat it as compromised until checked; if only a locked-down admin VLAN can reach it, patch on a normal cycle this month.

Must act: Owners of GS1900-8, -8HP, -10HP, -16, -24, -24E, -24EP, -24HPv2, -48 or -48HPv2 switches on 2.90(xxxx.1)C0 or earlier, today if the web interface is reachable from the internet or untrusted networks.

Can relax: Sites with no GS1900 switches, and sites already on the .2 firmware whose switch management is reachable only from a restricted admin network.

  1. Inventory GS1900 switches and their firmware versions and compare them with Zyxel's table.
  2. Upgrade each switch to its 2.90(xxxx.2)C0 build.
  3. Remove any internet path to switch management and keep the web interface on a management VLAN behind upstream ACLs; verify from outside with nmap.

Read the brief →

Known exploited (CISA KEV) 1

Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.

CVEProduct and flawCISA due
CVE-2026-48907Widget Factory Joomla Content Editor
Widget Factory Joomla Content Editor Improper Access Control Vulnerability		2026-06-19

Critical advisories by ecosystem 7

GitHub-reviewed advisories rated critical, published this day (Pacific time).

PyPI 5

Check: pip-audit (or: pip show <package>)

Go 1

Check: govulncheck ./...

npm 1

Check: npm audit (or: npm ls <package>)