erroneo.us
Search all guides⌘K

Digest · Thursday

Security digest: September 10, 2026

1 editorial brief, 2 known exploited (cisa kev) additions and 4 critical advisories.

All digests · RSS · Markdown

Take stock

  • Act now: GitLab CVE-2026-85706: Unauthenticated File Read, Exploited. Administrators of self-managed GitLab CE/EE 18.7 and later (Omnibus, source, Helm), above all instances reachable from the internet.
  • Do you run any of these? MikroTik RouterOS. They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2026-09-13.
  • Go: 3 critical advisories (github.com/rclone/rclone, github.com/traefik/traefik/v3, github.com/traefik/traefik/v2). Check with govulncheck ./....
  • npm: 1 critical advisory (omniroute). Check with npm audit (or: npm ls <package>).
  • None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

Editorial briefs

Act now

· Vulnerability · CVE-2026-85706

GitLab CVE-2026-85706: Unauthenticated File Read, Exploited

Any unpatched self-managed GitLab 18.7 or later can have its configuration and secret keys read by anyone on the network, and CISA says it is being exploited; upgrade today and rotate secrets if you were exposed.

Must act: Administrators of self-managed GitLab CE/EE 18.7 and later (Omnibus, source, Helm), above all instances reachable from the internet.

Can relax: GitLab.com and GitLab Dedicated customers (GitLab patched those), and self-managed instances still on versions before 18.7, which are outside the affected range.

  1. Check your version (Admin > Overview, or /help) and upgrade to 19.3.2, 19.2.6, 19.1.8, 19.0.9 or 18.11.12 or later.
  2. If you cannot upgrade immediately, remove internet exposure of the instance until you can.
  3. Search api_json.log for unauthenticated POSTs to repository commits or files APIs carrying a file.path parameter.

Read the brief →

Known exploited (CISA KEV) 2

Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.

CVEProduct and flawCISA due
CVE-2026-86060MikroTik RouterOS
MikroTik RouterOS Improper Neutralization of Argument Delimiters in a Command Vulnerability		2026-09-13
CVE-2026-67277MikroTik RouterOS
MikroTik RouterOS Missing Authentication for Critical Function Vulnerability		2026-09-13

Critical advisories by ecosystem 4

GitHub-reviewed advisories rated critical, published this day (Pacific time).

Go 3

Check: govulncheck ./...

npm 1

Check: npm audit (or: npm ls <package>)