--- title: "Security digest: September 22, 2026" url: https://erroneo.us/security/2026-09-22/ description: "September 22, 2026 vulnerability digest: 3 briefs (WordPress Core: Page-Template File Inclusion to…); 4 CISA KEV additions (Arista, Check Point, F5); 4…" type: security-digest-day section: "Security Digest" date_published: 2026-09-22 date_modified: 2026-10-21 publisher: erroneo.us author: erroneo.us Security Desk license: All rights reserved. Quote with attribution and a link. --- # Security digest: September 22, 2026 3 editorial briefs, 4 known exploited (cisa kev) additions and 4 critical advisories. ## Take stock - Act now: WordPress Core: Page-Template File Inclusion to RCE . Anyone running self-managed WordPress 4.7 through 7.1.1, especially with a theme that has a top-level page-* directory or PHP with register_argc_argv enabled (official php Docker images, cPanel on PHP below 8.5). - Patch this week: Linux AF_UNIX CVE-2026-80521: Public Container Escape . Operators of CI runners, multi-tenant Kubernetes clusters, code-execution sandboxes and shared container hosts on Linux 6.10 or later, or on 6.1/6.6 kernels that carry the new AF_UNIX garbage collector. - Check exposure: Graphalgo . Go developers and infrastructure teams who added gocommunity.io/orderedbtree, gogets.dev/btreex, or the kreuzwenker/docker or gocommunity-io/dockerd Terraform providers, including through a coding task or sample repository someone sent them. - Do you run any of these? F5 BIG-IP APM, Arista VeloCloud Orchestrator, Check Point Multiple Products. They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2026-09-25. - PyPI: 3 critical advisories ( homeassistant , mcp-atlassian , lightrag-hku ). Check with pip-audit (or: pip show ) . - Go: 1 critical advisory ( github.com/openbao/openbao ). Check with govulncheck ./... . - None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully. ## Editorial briefs - **Act now** [WordPress Core: Page-Template File Inclusion to RCE](https://erroneo.us/security/briefs/wordpress-core-page-template-lfi-cve-2026-87902/index.md): Every WordPress branch back to 4.7 was affected, no login is needed, public scanning tooling exists and attackers are already writing files through pearcmd.php, so confirm you are on a fixed release today. - **Patch this week** [Linux AF_UNIX CVE-2026-80521: Public Container Escape](https://erroneo.us/security/briefs/linux-af-unix-gc-container-escape-cve-2026-80521/index.md): If you run untrusted or third-party code in containers on a 6.10+ kernel, install fixed kernels as they ship and move that code behind stronger isolation now; a public exploit turns an unprivileged container process into a host compromise. - **Check exposure** [Graphalgo Malware in Go Modules and Terraform Providers](https://erroneo.us/security/briefs/graphalgo-go-modules-terraform-provider-typosquats/index.md): Grep your go.mod, go.sum and Terraform files for four names; if none match you are done, and if one does, treat the machine as compromised. ## Known exploited (CISA KEV) - [CVE-2026-94127](https://erroneo.us/security/cve/CVE-2026-94127/index.md) F5 BIG-IP APM: F5 BIG-IP APM Heap-based Buffer Overflow Vulnerability (CISA due 2026-09-25) - [CVE-2026-93952](https://erroneo.us/security/cve/CVE-2026-93952/index.md) Arista VeloCloud Orchestrator: Arista VeloCloud Orchestrator Improper Input Validation Vulnerability (CISA due 2026-09-25) - [CVE-2026-93616](https://erroneo.us/security/cve/CVE-2026-93616/index.md) Check Point Multiple Products: Check Point Multiple Products Path Traversal Vulnerability (CISA due 2026-09-25) - [CVE-2026-85102](https://erroneo.us/security/cve/CVE-2026-85102/index.md) Check Point Multiple Products: Check Point Multiple Products Improper Certificate Validation Vulnerability (CISA due 2026-09-25) ## Critical advisories - [CVE-2026-91130](https://erroneo.us/security/cve/CVE-2026-91130/index.md) Home Assistant: XSS in Statistics Graph Card — PyPI homeassistant < 2026.7.0 → 2026.7.0 - [CVE-2026-77244](https://erroneo.us/security/cve/CVE-2026-77244/index.md) [mcp-atlassian] Authentication bypass in HTTP transport: AtlassianOpaqueTokenVerifier accepts any non-empty token — PyPI mcp-atlassian < 0.22.0 → 0.22.0 - [CVE-2026-85734](https://erroneo.us/security/cve/CVE-2026-85734/index.md) lightrag-hku: No Rate Limiting on /login Endpoint Allows Brute-Force Attacks — PyPI lightrag-hku < 1.5.5 → 1.5.5 - [CVE-2026-63132](https://erroneo.us/security/cve/CVE-2026-63132/index.md) OpenBao's Recovery Mode Vulnerable To Token Leakage via Timing Attack — Go github.com/openbao/openbao < 0.0.0-20260713141742-763625a20721 → 0.0.0-20260713141742-763625a20721; Go github.com/openbao/openbao >= 0.1.0, <= 1.1.5 → no fix --- Source page: https://erroneo.us/security/2026-09-22/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt