---
title: "Security digest: August 7, 2026"
url: https://erroneo.us/security/2026-08-07/
description: "August 7, 2026 vulnerability digest: 1 CISA KEV addition (Progress); 4 critical advisories (Composer (PHP), npm). What to patch and who can relax."
type: security-digest-day
section: "Security Digest"
date_published: 2026-08-07
date_modified: 2026-08-07
publisher: erroneo.us
author: erroneo.us Security Desk
license: All rights reserved. Quote with attribution and a link.
---

# Security digest: August 7, 2026

1 known exploited (cisa kev) addition and 4 critical advisories.

## Take stock

- Do you run any of these? Progress LoadMaster. They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2026-08-10.
- Composer (PHP): 3 critical advisories ( craftcms/cms , codeigniter4/framework ). Check with composer audit .
- npm: 1 critical advisory ( crypto-js ). Check with npm audit (or: npm ls <package>) .
- None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

## Known exploited (CISA KEV)

- [CVE-2026-8037](https://erroneo.us/security/cve/CVE-2026-8037/index.md) Progress LoadMaster: Progress LoadMaster Command Injection Vulnerability (CISA due 2026-08-10)

## Critical advisories

- [GHSA-wg23-69c2-gjc8](https://erroneo.us/security/ghsa/GHSA-wg23-69c2-gjc8/index.md) Craft CMS: Passkey login accepts replayed WebAuthn assertions — Composer (PHP) craftcms/cms >= 5.0.0-RC1, < 5.10.5 → 5.10.5
- [CVE-2026-71851](https://erroneo.us/security/cve/CVE-2026-71851/index.md) crypto-js: Insufficient Entropy in Cryptographic Secret Generation via Vulnerable CryptoJS Dependency Chain — npm crypto-js < 4.0.0 → 4.0.0
- [CVE-2026-63223](https://erroneo.us/security/cve/CVE-2026-63223/index.md) CodeIgniter: Uploaded file extension validation bypass in `is_image` and `mime_in` rules — Composer (PHP) codeigniter4/framework < 4.7.4 → 4.7.4
- [CVE-2026-63221](https://erroneo.us/security/cve/CVE-2026-63221/index.md) CodeIgniter: SQL injection in Query Builder deleteBatch() when used with where() conditions — Composer (PHP) codeigniter4/framework >= 4.3.0, < 4.7.4 → 4.7.4

---
Source page: https://erroneo.us/security/2026-08-07/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt