erroneo.us
Search all guides⌘K

Digest · Tuesday

Security digest: September 8, 2026

1 editorial brief, 4 known exploited (cisa kev) additions and 14 critical advisories.

All digests · RSS · Markdown

Take stock

  • Patch this week: Windows Zero-Days: Update Stack and ALPC EoP (Sep 2026). Anyone with Windows 10, Windows 11 or Windows Server 2012 through 2025 machines that have not installed the September 8, 2026 or a later cumulative update, starting with desktops and multi-user servers.
  • Do you run any of these? N-able N-central, Microsoft Windows, Adobe Commerce and Magento. They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2026-09-11.
  • npm: 5 critical advisories (next, maplibre-gl, @deepseek-ai/dsh-client-connection, astro). Check with npm audit (or: npm ls <package>).
  • PyPI: 3 critical advisories (nltk, GitPython). Check with pip-audit (or: pip show <package>).
  • Go: 2 critical advisories (github.com/semaphoreui/semaphore, gitea.dev). Check with govulncheck ./....
  • Composer (PHP): 2 critical advisories (predis/predis, cakephp/cakephp, cakephp/database). Check with composer audit.
  • Maven: 1 critical advisory (io.netty:netty-handler). Check with mvn dependency:tree -Dincludes=<groupId>:<artifactId>.
  • NuGet: 1 critical advisory (Microsoft.Native.Quic.MsQuic.OpenSSL, Microsoft.Native.Quic.MsQuic.Schannel). Check with dotnet list package --vulnerable --include-transitive.
  • None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

Editorial briefs

Patch this week

· Vulnerability · CVE-2026-81963, CVE-2026-85880

Windows Zero-Days: Update Stack and ALPC EoP (Sep 2026)

Make sure every Windows machine has the September 2026 or a later cumulative update; both bugs are exploited, but an attacker needs code running on the box first.

Must act: Anyone with Windows 10, Windows 11 or Windows Server 2012 through 2025 machines that have not installed the September 8, 2026 or a later cumulative update, starting with desktops and multi-user servers.

Can relax: Fleets already on September or October 2026 updates, and Linux or macOS hosts; neither bug can be triggered remotely without prior code execution.

  1. Check the OS build on every Windows machine and compare it with the fixed build for its version.
  2. Install the September 2026 or any later cumulative update (October's is fine) on stragglers, then reboot.
  3. Patch Remote Desktop hosts, jump boxes and shared build agents first, since any logged-in user could become SYSTEM.

Read the brief →

Known exploited (CISA KEV) 4

Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.

CVEProduct and flawCISA due
CVE-2026-86218N-able N-central
N-able N-central Static Code Injection Vulnerability		2026-09-11
CVE-2026-85880Microsoft Windows
Microsoft Windows Heap-Based Buffer Overflow Vulnerability		2026-09-22
CVE-2026-81963Microsoft Windows
Microsoft Windows Link Following Vulnerability		2026-09-22
CVE-2026-75650Adobe Commerce and Magento
Adobe Commerce and Magento Improper Neutralization of Special Elements Used in a Template Engine Vulnerability		2026-09-11

Critical advisories by ecosystem 14

GitHub-reviewed advisories rated critical, published this day (Pacific time).

npm 5

Check: npm audit (or: npm ls <package>)

PyPI 3

Check: pip-audit (or: pip show <package>)

Composer (PHP) 2

Check: composer audit

Go 2

Check: govulncheck ./...

Maven 1

Check: mvn dependency:tree -Dincludes=<groupId>:<artifactId>

NuGet 1

Check: dotnet list package --vulnerable --include-transitive

  • Microsoft QUIC: Remote Code Execution Vulnerability CVE-2026-62815 CVSS 10.0 Critical
    Microsoft.Native.Quic.MsQuic.OpenSSL >= 2.5.3, < 2.5.10 → fixed in 2.5.10; Microsoft.Native.Quic.MsQuic.Schannel >= 2.5.3, < 2.5.10 → fixed in 2.5.10; Microsoft.Native.Quic.MsQuic.OpenSSL < 2.4.19 → fixed in 2.4.19; +1 more packages