---
title: "Security digest: September 15, 2026"
url: https://erroneo.us/security/2026-09-15/
description: "September 15, 2026 vulnerability digest: 2 briefs (Google Pixel Modem CVE-2026-58704: Exploited…); 3 critical advisories (npm, Maven). What to patch and who…"
type: security-digest-day
section: "Security Digest"
date_published: 2026-09-15
date_modified: 2026-10-21
publisher: erroneo.us
author: erroneo.us Security Desk
license: All rights reserved. Quote with attribution and a link.
---

# Security digest: September 15, 2026

2 editorial briefs and 3 critical advisories.

## Take stock

- Patch this week: Google Pixel Modem CVE-2026-58704: Exploited Zero-Day . Organizations with company-owned or BYOD Pixel phones that access corporate data, especially those used by executives, administrators, journalists or staff who travel.
- Check exposure: Acronis Backup cPanel Plugin CVE-2026-87886: Exploited LPE . Hosting providers and server admins with the Acronis Backup plugin or extension installed on Linux cPanel & WHM, Plesk or DirectAdmin servers, above all shared-hosting servers where many users or websites have local access.
- npm: 2 critical advisories ( @zereight/mcp-gitlab ). Check with npm audit (or: npm ls <package>) .
- Maven: 1 critical advisory ( org.http4s:http4s-ember-core_2.12 , org.http4s:http4s-ember-core_2.13 , org.http4s:http4s-ember-core_3 ). Check with mvn dependency:tree -Dincludes=<groupId>:<artifactId> .
- None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

## Editorial briefs

- **Patch this week** [Google Pixel Modem CVE-2026-58704: Exploited Zero-Day](https://erroneo.us/security/briefs/google-pixel-modem-cve-2026-58704-zero-day/index.md): A targeted, no-interaction modem bug on Pixel phones with a fix already out: make 2026-09-05 the minimum patch level for every managed Pixel this week, and sooner for high-risk users.
- **Check exposure** [Acronis Backup cPanel Plugin CVE-2026-87886: Exploited LPE](https://erroneo.us/security/briefs/acronis-backup-cpanel-plesk-lpe-cve-2026-87886/index.md): Only hosting servers running the Acronis Backup plugin for cPanel & WHM, Plesk or DirectAdmin are affected; on those, especially multi-tenant cPanel boxes, update the plugin now because it is being exploited.

## Known exploited (CISA KEV)

None.

## Critical advisories

- [CVE-2026-61568](https://erroneo.us/security/cve/CVE-2026-61568/index.md) @zereight/mcp-gitlab: DNS rebinding reaches local Streamable HTTP MCP transport — npm @zereight/mcp-gitlab < 2.1.30 → 2.1.30
- [CVE-2026-69204](https://erroneo.us/security/cve/CVE-2026-69204/index.md) Http4s Ember accepts Transfer-Encoding combined with Content-Length (CL.TE request smuggling) — Maven org.http4s:http4s-ember-core_2.12 <= 0.23.34 → 0.23.35; Maven org.http4s:http4s-ember-core_2.13 <= 0.23.34 → 0.23.35; Maven org.http4s:http4s-ember-core_3 <= 0.23.34 → 0.23.35
- [CVE-2026-61559](https://erroneo.us/security/cve/CVE-2026-61559/index.md) @zereight/mcp-gitlab Vulnerable to Server-Side Request Forgery — npm @zereight/mcp-gitlab >= 0.0.1, < 2.1.27 → 2.1.27

---
Source page: https://erroneo.us/security/2026-09-15/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt