erroneo.us
Search all guides⌘K

Digest · Friday

Security digest: September 18, 2026

1 editorial brief, 3 known exploited (cisa kev) additions and 5 critical advisories.

All digests · RSS · Markdown

Take stock

  • Patch this week: Linux Kernel: Five Exploited Root Bugs Added to CISA KEV. Anyone running Linux kernels older than their distribution's July to September 2026 security updates, most urgently where containers, CI jobs or untrusted users share a kernel.
  • Do you run any of these? Linux Kernel. They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2026-09-21.
  • PyPI: 3 critical advisories (mnemosyne-memory, anyio, lmdeploy). Check with pip-audit (or: pip show <package>).
  • Go: 1 critical advisory (github.com/kcp-dev/kcp). Check with govulncheck ./....
  • Maven: 1 critical advisory (org.xwiki.rendering:xwiki-rendering-xml). Check with mvn dependency:tree -Dincludes=<groupId>:<artifactId>.
  • None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

Editorial briefs

Patch this week

· Vulnerability · CVE-2025-39682, CVE-2025-39964

Linux Kernel: Five Exploited Root Bugs Added to CISA KEV

Five local root bugs, all with fixes and most with public exploits, are now confirmed exploited; get every Linux host onto a current kernel and reboot this week, container hosts, CI runners and shared servers first.

Must act: Anyone running Linux kernels older than their distribution's July to September 2026 security updates, most urgently where containers, CI jobs or untrusted users share a kernel.

Can relax: Hosts already booted into current distribution kernels (for example RHEL kernels from Sep 22-24, 2026, Debian 12 6.1.177-1+, Ubuntu 24.04 6.8.0-147.147+); single-user machines face local-only risk.

  1. Run uname -r on every Linux host and compare it with your distribution's fixed kernel for each CVE.
  2. Install the current kernel and reboot, starting with container hosts, Kubernetes nodes, CI runners and multi-user servers.
  3. If a reboot must wait, block the tls module where kTLS is unused and remove ebtables SNAT rules that rewrite ARP addresses (Red Hat's interim mitigations).

Read the brief →

Known exploited (CISA KEV) 3

Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.

CVEProduct and flawCISA due
CVE-2026-53266Linux Kernel
Linux Kernel Out-of-Bounds Write Vulnerability		2026-09-21
CVE-2025-39964Linux Kernel
Linux Kernel Race Condition Vulnerability		2026-09-21
CVE-2025-39682Linux Kernel
Linux Kernel Improper Check for Unusual or Exceptional Conditions Vulnerability		2026-09-21

Critical advisories by ecosystem 5

GitHub-reviewed advisories rated critical, published this day (Pacific time).

PyPI 3

Check: pip-audit (or: pip show <package>)

Go 1

Check: govulncheck ./...

Maven 1

Check: mvn dependency:tree -Dincludes=<groupId>:<artifactId>