erroneo.us
Search all guides⌘K

Digest · Thursday

Security digest: September 24, 2026

1 editorial brief, 2 known exploited (cisa kev) additions and 5 critical advisories.

All digests · RSS · Markdown

Take stock

  • Check exposure: Mini Shai-Hulud. Owners of repositories whose workflows call actions-cool/issues-helper or actions-cool/maintain-one-comment by a version tag such as @v2.2.1 or @v3, and developers who pulled from those repositories after September 16, 2026.
  • Do you run any of these? Adobe Commerce and Magento, WSO2 Multiple Products. They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2026-09-27.
  • npm: 2 critical advisories (@bytebase/dbhub, suneditor). Check with npm audit (or: npm ls <package>).
  • Go: 1 critical advisory (github.com/ixofoundation/ixo-blockchain/v8, github.com/ixofoundation/ixo-blockchain/v7, github.com/ixofoundation/ixo-blockchain/v6, github.com/ixofoundation/ixo-blockchain/v5, github.com/ixofoundation/ixo-blockchain/v4, github.com/ixofoundation/ixo-blockchain/v3, github.com/ixofoundation/ixo-blockchain). Check with govulncheck ./....
  • PyPI: 1 critical advisory (decepticon-core, decepticon, decepticon-sdk). Check with pip-audit (or: pip show <package>).
  • Maven: 1 critical advisory (org.http4s:http4s-scala-xml_2.12, org.http4s:http4s-scala-xml_2.13, org.http4s:http4s-scala-xml_3). Check with mvn dependency:tree -Dincludes=<groupId>:<artifactId>.
  • None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

Editorial briefs

Check exposure

· Supply-chain compromise

actions-cool Actions Re-Enabled With Mini Shai-Hulud Payload

If any workflow referenced either actions-cool action by tag and ran between September 16 and 25, 2026, assume its secrets and repository were compromised; everyone else can confirm with one grep.

Must act: Owners of repositories whose workflows call actions-cool/issues-helper or actions-cool/maintain-one-comment by a version tag such as @v2.2.1 or @v3, and developers who pulled from those repositories after September 16, 2026.

Can relax: Repositories that never used these two actions, or pinned them to a full commit SHA verified to predate May 18, 2026; since about September 25, the disabled actions make workflows fail at setup instead of running the payload.

  1. Search .github/workflows/ for actions-cool/issues-helper@ and actions-cool/maintain-one-comment@ and remove or replace them.
  2. Rotate every secret and token reachable by a workflow that ran either action by tag on or after September 16, 2026.
  3. Check default branches for new .claude/settings.json, .claude/setup.mjs, .claude/index.js or .vscode/tasks.json files and revert them.

Read the brief →

Known exploited (CISA KEV) 2

Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.

CVEProduct and flawCISA due
CVE-2026-71362Adobe Commerce and Magento
Adobe Commerce and Magento Incorrect Authorization Vulnerability 		2026-09-27
CVE-2026-5430WSO2 Multiple Products
WSO2 Multiple Products Path Traversal Vulnerability 		2026-09-27

Critical advisories by ecosystem 5

GitHub-reviewed advisories rated critical, published this day (Pacific time).

npm 2

Check: npm audit (or: npm ls <package>)

Go 1

Check: govulncheck ./...

Maven 1

Check: mvn dependency:tree -Dincludes=<groupId>:<artifactId>

PyPI 1

Check: pip-audit (or: pip show <package>)