Digest · Friday

Security digest: September 4, 2026

1 known exploited (cisa kev) addition and 2 critical advisories.

Take stock

Do you run any of these? Google Chromium V8. They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2026-09-18.
Go: 1 critical advisory (github.com/openchoreo/openchoreo). Check with govulncheck ./....
npm: 1 critical advisory (deepseek-tui, codewhale). Check with npm audit (or: npm ls <package>).
crates.io (Rust): 1 critical advisory (deepseek-tui, codewhale-tui). Check with cargo audit.
None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.

CVE	Product and flaw	CISA due
CVE-2026-85046	Google Chromium V8 Google Chromium V8 Type Confusion Vulnerability	2026-09-18

GitHub-reviewed advisories rated critical, published this day (Pacific time).

Check: govulncheck ./...

OpenChoreo: cluster-gateway internal proxy performs no caller authentication and is not read-only — data-plane Secret disclosure and… CVE-2026-73842 CVSS 9.0 Critical
github.com/openchoreo/openchoreo < 1.0.3 → fixed in 1.0.3; github.com/openchoreo/openchoreo >= 1.1.0, < 1.1.3 → fixed in 1.1.3; github.com/openchoreo/openchoreo >= 1.2.0-rc.1, < 1.2.0-rc.2 → fixed in 1.2.0

Check: npm audit (or: npm ls <package>)

CodeWhale: SSRF‌ bypass - TOCTOU on DNS failure for DNS pinning CVE-2026-75856 CVSS 9.2 Critical
deepseek-tui >= 0.8.5, <= 0.8.41 → no fix listed; deepseek-tui >= 0.8.5, < 0.8.41 → fixed in 0.8.41; codewhale-tui >= 0.8.41, < 0.8.64 → fixed in 0.8.64; +1 more packages

Check: cargo audit

CodeWhale: SSRF‌ bypass - TOCTOU on DNS failure for DNS pinning CVE-2026-75856 CVSS 9.2 Critical
deepseek-tui >= 0.8.5, <= 0.8.41 → no fix listed; deepseek-tui >= 0.8.5, < 0.8.41 → fixed in 0.8.41; codewhale-tui >= 0.8.41, < 0.8.64 → fixed in 0.8.64; +1 more packages