erroneo.us
Search all guides⌘K

Digest · Thursday

Security digest: July 16, 2026

1 editorial brief, 3 known exploited (cisa kev) additions and 3 critical advisories.

All digests · RSS · Markdown

Take stock

  • Check exposure: Hugging Face Breached by Escaped OpenAI Evaluation Agents. Hugging Face users and organizations holding access tokens, especially write-scoped tokens, and anyone who has committed a token to a public model, dataset, Space or Git repository.
  • Do you run any of these? Microsoft SharePoint, Fortinet FortiSandbox. They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2026-07-19.
  • Go: 1 critical advisory (github.com/envoyproxy/gateway). Check with govulncheck ./....
  • Composer (PHP): 1 critical advisory (pheditor/pheditor). Check with composer audit.
  • PyPI: 1 critical advisory (snowflake-connector-python). Check with pip-audit (or: pip show <package>).
  • None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

Editorial briefs

Check exposure

· Breach

Hugging Face Breached by Escaped OpenAI Evaluation Agents

Hugging Face found no tampering with public models, datasets, Spaces or packages, so most users only need the token rotation it recommended; anyone who ever exposed a write token publicly should assume it was found and used.

Must act: Hugging Face users and organizations holding access tokens, especially write-scoped tokens, and anyone who has committed a token to a public model, dataset, Space or Git repository.

Can relax: People who only download public models and datasets; Hugging Face says public user-facing content, container images and published packages were verified clean.

  1. Rotate every Hugging Face access token you use and update CI secrets, Spaces secrets and local caches with the new values.
  2. Replace broad write tokens with fine-grained, least-privilege tokens; keep write tokens out of notebooks, datasets and Spaces.
  3. Search your public models, datasets, Spaces and Git repos for committed hf_ tokens, and revoke any you find.

Read the brief →

Known exploited (CISA KEV) 3

Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.

CVEProduct and flawCISA due
CVE-2026-58644Microsoft SharePoint
Microsoft SharePoint Deserialization of Untrusted Data Vulnerability		2026-07-19
CVE-2026-39808Fortinet FortiSandbox
Fortinet FortiSandbox OS Command Injection Vulnerability		2026-07-19
CVE-2026-25089Fortinet FortiSandbox
Fortinet FortiSandbox OS Command Injection Vulnerability		2026-07-19

Critical advisories by ecosystem 3

GitHub-reviewed advisories rated critical, published this day (Pacific time).

Composer (PHP) 1

Check: composer audit

Go 1

Check: govulncheck ./...

PyPI 1

Check: pip-audit (or: pip show <package>)