---
title: "Security digest: September 17, 2026"
url: https://erroneo.us/security/2026-09-17/
description: "September 17, 2026 vulnerability digest: 1 brief (Plugin4Shell); 9 critical advisories (Composer (PHP), NuGet, Go, npm). What to patch and who can relax."
type: security-digest-day
section: "Security Digest"
date_published: 2026-09-17
date_modified: 2026-10-21
publisher: erroneo.us
author: erroneo.us Security Desk
license: All rights reserved. Quote with attribution and a link.
---

# Security digest: September 17, 2026

1 editorial brief and 9 critical advisories.

## Take stock

- Check exposure: Plugin4Shell . Teams that install third-party plugins in GitHub Copilot or Gemini CLI, run Claude Code older than 2.1.179 or Codex older than 0.146.0, or run an internal plugin marketplace on Bitbucket or a self-hosted git server.
- Composer (PHP): 4 critical advisories ( cakephp/database , cakephp/cakephp , getgrav/grav , chamilo/chamilo-lms ). Check with composer audit .
- Go: 3 critical advisories ( github.com/rabbitmq/amqp091-go ). Check with govulncheck ./... .
- NuGet: 1 critical advisory ( Marten ). Check with dotnet list package --vulnerable --include-transitive .
- npm: 1 critical advisory ( @vendure/core ). Check with npm audit (or: npm ls <package>) .
- None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

## Editorial briefs

- **Check exposure** [Plugin4Shell: Plugin Pin Bypass in AI Coding Agents](https://erroneo.us/security/briefs/plugin4shell-ai-agent-plugin-sha-pin-bypass/index.md): Claude Code and Codex users on current versions are fixed; the real exposure is Copilot or Gemini CLI plugins that auto-update from repositories hosted outside GitHub.

## Known exploited (CISA KEV)

None.

## Critical advisories

- [CVE-2026-79752](https://erroneo.us/security/cve/CVE-2026-79752/index.md) CakePHP: Multiple methods in FunctionsBuilder vulnerable to SQL injection — Composer (PHP) cakephp/database >= 4.6.0, < 4.6.5 → 4.6.5; Composer (PHP) cakephp/database >= 5.0.0, < 5.1.9 → 5.1.9; Composer (PHP) cakephp/database >= 5.2.0, < 5.2.14 → 5.2.14
- [CVE-2026-75828](https://erroneo.us/security/cve/CVE-2026-75828/index.md) Grav: detectXss() misses an event-handler attribute after an unpaired quote in an unquoted attribute value, giving stored XSS — Composer (PHP) getgrav/grav <= 2.0.14 → 2.0.15
- [CVE-2026-75513](https://erroneo.us/security/cve/CVE-2026-75513/index.md) Marten's LINQ provider has SQL injection via unescaped string literals — NuGet Marten >= 7.0.0, <= 9.12.0 → 9.13.0
- [CVE-2026-77408](https://erroneo.us/security/cve/CVE-2026-77408/index.md) RabbitMQ amqp091-go: Silent Data Truncation and State Corruption via Shortstr Integer Overflow — Go github.com/rabbitmq/amqp091-go < 1.13.0 → 1.13.0
- [CVE-2026-45140](https://erroneo.us/security/cve/CVE-2026-45140/index.md) Chamilo LMS CStudio upload flow allows unauthenticated remote code execution — Composer (PHP) chamilo/chamilo-lms <= 2.0.0 → 2.0.1
- [CVE-2026-75827](https://erroneo.us/security/cve/CVE-2026-75827/index.md) Grav: Blueprint dynamic-data bare-function branch is denylist-gated and omits error_log, giving arbitrary file write — Composer (PHP) getgrav/grav <= 2.0.14 → 2.0.15
- [CVE-2026-77411](https://erroneo.us/security/cve/CVE-2026-77411/index.md) RabbitMQ amqp091-go: Protocol Desynchronization and Frame Injection via Integer Overflow in readLongstr — Go github.com/rabbitmq/amqp091-go < 1.13.0 → 1.13.0
- [CVE-2026-63472](https://erroneo.us/security/cve/CVE-2026-63472/index.md) Vendure affected by external-authentication account takeover: external login linked to a pre-existing account by email without verification — npm @vendure/core < 3.7.0 → 3.7.0
- [CVE-2026-77405](https://erroneo.us/security/cve/CVE-2026-77405/index.md) RabbitMQ amqp091-go: Missing Explicit TLS Minimum Version Configuration In URI Parser — Go github.com/rabbitmq/amqp091-go < 1.13.0 → 1.13.0

---
Source page: https://erroneo.us/security/2026-09-17/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt