erroneo.us
Search all guides⌘K

Digest · Tuesday

Security digest: September 15, 2026

2 editorial briefs and 3 critical advisories.

All digests · RSS · Markdown

Take stock

  • Patch this week: Google Pixel Modem CVE-2026-58704: Exploited Zero-Day. Organizations with company-owned or BYOD Pixel phones that access corporate data, especially those used by executives, administrators, journalists or staff who travel.
  • Check exposure: Acronis Backup cPanel Plugin CVE-2026-87886: Exploited LPE. Hosting providers and server admins with the Acronis Backup plugin or extension installed on Linux cPanel & WHM, Plesk or DirectAdmin servers, above all shared-hosting servers where many users or websites have local access.
  • npm: 2 critical advisories (@zereight/mcp-gitlab). Check with npm audit (or: npm ls <package>).
  • Maven: 1 critical advisory (org.http4s:http4s-ember-core_2.12, org.http4s:http4s-ember-core_2.13, org.http4s:http4s-ember-core_3). Check with mvn dependency:tree -Dincludes=<groupId>:<artifactId>.
  • None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

Editorial briefs

Patch this week

· Vulnerability · CVE-2026-58704

Google Pixel Modem CVE-2026-58704: Exploited Zero-Day

A targeted, no-interaction modem bug on Pixel phones with a fix already out: make 2026-09-05 the minimum patch level for every managed Pixel this week, and sooner for high-risk users.

Must act: Organizations with company-owned or BYOD Pixel phones that access corporate data, especially those used by executives, administrators, journalists or staff who travel.

Can relax: Fleets with no Pixel phones, and Pixel devices already on patch level 2026-09-05 or later, since Google's bulletin covers only Google devices.

  1. Pull the security patch level of every managed Pixel from your MDM and list any device below 2026-09-05.
  2. Set a compliance rule that blocks corporate access for Pixel devices below patch level 2026-09-05.
  3. Push or prompt the update on non-compliant devices, starting with high-risk users.

Read the brief →

Check exposure

· Vulnerability · CVE-2026-87886

Acronis Backup cPanel Plugin CVE-2026-87886: Exploited LPE

Only hosting servers running the Acronis Backup plugin for cPanel & WHM, Plesk or DirectAdmin are affected; on those, especially multi-tenant cPanel boxes, update the plugin now because it is being exploited.

Must act: Hosting providers and server admins with the Acronis Backup plugin or extension installed on Linux cPanel & WHM, Plesk or DirectAdmin servers, above all shared-hosting servers where many users or websites have local access.

Can relax: Everyone without these specific Acronis hosting-panel integrations, including users of other Acronis products not listed in SEC-10986.

  1. Inventory every cPanel & WHM, Plesk and DirectAdmin server with the Acronis Backup plugin or extension installed.
  2. Update cPanel & WHM servers to plugin 1.9.3 HF3 (build 1.9.3.1021) or later first, since that is where exploitation was seen.
  3. Update the Plesk extension to 1.8.11 (build 1.8.11.638) and the DirectAdmin plugin to build 1.2.3.238 or later.

Read the brief →

Known exploited (CISA KEV) 0

Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.

None.

Critical advisories by ecosystem 3

GitHub-reviewed advisories rated critical, published this day (Pacific time).

npm 2

Check: npm audit (or: npm ls <package>)

Maven 1

Check: mvn dependency:tree -Dincludes=<groupId>:<artifactId>