erroneo.us
Search all guides⌘K

Digest · Thursday

Security digest: June 18, 2026

1 editorial brief, 1 known exploited (cisa kev) addition and 25 critical advisories.

All digests · RSS · Markdown

Take stock

  • Check exposure: TrueConf Server: Exploited Pre-Auth RCE Chain on Port 4307. Anyone running TrueConf Server on Windows or Linux below 5.3.9, 5.4.9 or 5.5.5, and organizations whose staff join conferences on contractors' TrueConf servers.
  • Do you run any of these? Splunk Enterprise. They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2026-06-21.
  • PyPI: 15 critical advisories (praisonaiagents, python-statemachine, crawl4ai, praisonai, netlicensing-mcp, jupyter-server, praisonai-platform). Check with pip-audit (or: pip show <package>).
  • npm: 6 critical advisories (praisonai, @acastellon/auth, gemini-mcp-tool). Check with npm audit (or: npm ls <package>).
  • Composer (PHP): 2 critical advisories (getkirby/cms, cotonti/cotonti). Check with composer audit.
  • Go: 2 critical advisories (github.com/googleapis/mcp-toolbox). Check with govulncheck ./....
  • None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

Editorial briefs

Check exposure

· Vulnerability · CVE-2026-72529, CVE-2026-72530

TrueConf Server: Exploited Pre-Auth RCE Chain on Port 4307

Only organizations that run TrueConf Server, or whose staff join meetings on other companies' TrueConf servers, are exposed; for them an unpatched, reachable server should be treated as compromised, because the chain is unauthenticated, yields SYSTEM and was used to infect the server's own users.

Must act: Anyone running TrueConf Server on Windows or Linux below 5.3.9, 5.4.9 or 5.5.5, and organizations whose staff join conferences on contractors' TrueConf servers.

Can relax: Organizations with no TrueConf Server and no staff using TrueConf clients to join outside meetings; this does not touch other video-conferencing platforms.

  1. Find every TrueConf Server instance and note its version and build.
  2. Back up, then upgrade to 5.5.5, 5.4.9 or 5.3.9 or later; for 5.2 and older, contact TrueConf support.
  3. Limit who can reach TCP 4307 to the networks and clients that need it.

Read the brief →

Known exploited (CISA KEV) 1

Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.

CVEProduct and flawCISA due
CVE-2026-20253Splunk Enterprise
Splunk Enterprise Missing Authentication for Critical Function Vulnerability		2026-06-21

Critical advisories by ecosystem 25

GitHub-reviewed advisories rated critical, published this day (Pacific time).

PyPI 15

Check: pip-audit (or: pip show <package>)

npm 6

Check: npm audit (or: npm ls <package>)

Composer (PHP) 2

Check: composer audit

Go 2

Check: govulncheck ./...