Digest · Tuesday
Security digest: August 18, 2026
4 known exploited (cisa kev) additions and 6 critical advisories.
All digests · RSS · Markdown
Take stock
- Do you run any of these? Apple macOS, Broadcom VMware vCenter, Microsoft SharePoint, Microsoft Internet Key Exchange (IKE) Service Extensions. They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2026-08-21.
- PyPI: 2 critical advisories (
surfio,resdata). Check withpip-audit (or: pip show <package>). - Composer (PHP): 2 critical advisories (
mtdowling/jmespath.php,froxlor/froxlor). Check withcomposer audit. - RubyGems: 1 critical advisory (
kobako). Check withbundle audit check --update. - Maven: 1 critical advisory (
org.keycloak:keycloak-services). Check withmvn dependency:tree -Dincludes=<groupId>:<artifactId>. - None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.
Known exploited (CISA KEV) 4
Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.
| CVE | Product and flaw | CISA due |
|---|---|---|
| CVE-2026-65400 | Apple macOS Apple macOS Improper Authentication Vulnerability | 2026-08-21 |
| CVE-2026-59310 | Broadcom VMware vCenter Broadcom VMware vCenter Path Traversal Vulnerability Ransomware | 2026-08-21 |
| CVE-2026-55040 | Microsoft SharePoint Microsoft SharePoint Weak Authentication Vulnerability | 2026-08-21 |
| CVE-2026-33824 | Microsoft Internet Key Exchange (IKE) Service Extensions Microsoft Internet Key Exchange (IKE) Service Extensions Double Free Vulnerability | 2026-08-21 |
Critical advisories by ecosystem 6
GitHub-reviewed advisories rated critical, published this day (Pacific time).
Composer (PHP) 2
Check: composer audit
- jmespath.php has CompilerRuntime code injection via unescaped function names CVE-2026-54133 CVSS 9.8 Critical
mtdowling/jmespath.php< 2.9.1 → fixed in 2.9.1 - Froxlor: Credential and 2FA secret disclosure via Froxlor API endpoints CVE-2026-62988 CVSS 9.0 Critical
froxlor/froxlor< 2.3.8 → fixed in 2.3.8
PyPI 2
Check: pip-audit (or: pip show <package>)
- surfio has an out-of-bounds read CVE-2026-55211 CVSS 9.8 Critical
surfio< 0.0.19 → fixed in 0.0.19 - resdata has Classic Buffer Overflow, Improper Validation of Array Index, NULL Pointer Dereference and Out-of-bounds Read CVE-2026-55209 CVSS 9.8 Critical
resdata< 6.2.9 → fixed in 6.2.9
Maven 1
Check: mvn dependency:tree -Dincludes=<groupId>:<artifactId>
- Keycloak: Unauthenticated account takeover via reset-credentials flow bypass CVE-2026-18963 CVSS 9.1 Critical
org.keycloak:keycloak-services>= 26.0.0, < 26.4.15 → fixed in 26.4.15;org.keycloak:keycloak-services>= 26.5.0, < 26.6.6 → fixed in 26.6.6;org.keycloak:keycloak-services>= 26.7.0, < 26.7.2 → fixed in 26.7.2
RubyGems 1
Check: bundle audit check --update
- kobako Sandbox Escape: guest eval reaches host RCE via method_missing → public_send (any bound Service) CVE-2026-55107 CVSS 10.0 Critical
kobako>= 0.1.0, <= 0.9.0 → fixed in 0.9.1