---
title: "Security digest: September 24, 2026"
url: https://erroneo.us/security/2026-09-24/
description: "September 24, 2026 vulnerability digest: 1 brief (Mini Shai-Hulud); 2 CISA KEV additions (Adobe, WSO2); 5 critical advisories (Go, PyPI, npm, Maven). What…"
type: security-digest-day
section: "Security Digest"
date_published: 2026-09-24
date_modified: 2026-10-21
publisher: erroneo.us
author: erroneo.us Security Desk
license: All rights reserved. Quote with attribution and a link.
---

# Security digest: September 24, 2026

1 editorial brief, 2 known exploited (cisa kev) additions and 5 critical advisories.

## Take stock

- Check exposure: Mini Shai-Hulud . Owners of repositories whose workflows call actions-cool/issues-helper or actions-cool/maintain-one-comment by a version tag such as @v2.2.1 or @v3, and developers who pulled from those repositories after September 16, 2026.
- Do you run any of these? Adobe Commerce and Magento, WSO2 Multiple Products. They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2026-09-27.
- npm: 2 critical advisories ( @bytebase/dbhub , suneditor ). Check with npm audit (or: npm ls <package>) .
- Go: 1 critical advisory ( github.com/ixofoundation/ixo-blockchain/v8 , github.com/ixofoundation/ixo-blockchain/v7 , github.com/ixofoundation/ixo-blockchain/v6 , github.com/ixofoundation/ixo-blockchain/v5 , github.com/ixofoundation/ixo-blockchain/v4 , github.com/ixofoundation/ixo-blockchain/v3 , github.com/ixofoundation/ixo-blockchain ). Check with govulncheck ./... .
- PyPI: 1 critical advisory ( decepticon-core , decepticon , decepticon-sdk ). Check with pip-audit (or: pip show <package>) .
- Maven: 1 critical advisory ( org.http4s:http4s-scala-xml_2.12 , org.http4s:http4s-scala-xml_2.13 , org.http4s:http4s-scala-xml_3 ). Check with mvn dependency:tree -Dincludes=<groupId>:<artifactId> .
- None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

## Editorial briefs

- **Check exposure** [actions-cool Actions Re-Enabled With Mini Shai-Hulud Payload](https://erroneo.us/security/briefs/actions-cool-mini-shai-hulud-reactivation/index.md): If any workflow referenced either actions-cool action by tag and ran between September 16 and 25, 2026, assume its secrets and repository were compromised; everyone else can confirm with one grep.

## Known exploited (CISA KEV)

- [CVE-2026-71362](https://erroneo.us/security/cve/CVE-2026-71362/index.md) Adobe Commerce and Magento : Adobe Commerce and Magento Incorrect Authorization Vulnerability  (CISA due 2026-09-27)
- [CVE-2026-5430](https://erroneo.us/security/cve/CVE-2026-5430/index.md) WSO2 Multiple Products: WSO2 Multiple Products Path Traversal Vulnerability  (CISA due 2026-09-27)

## Critical advisories

- [CVE-2026-61604](https://erroneo.us/security/cve/CVE-2026-61604/index.md) ixo Blockchain x/bonds DID-resolved payer drain + x/entity ICA authorization bypass — Go github.com/ixofoundation/ixo-blockchain/v8 < 8.0.0 → 8.0.0; Go github.com/ixofoundation/ixo-blockchain/v7 <= 7.0.0 → no fix; Go github.com/ixofoundation/ixo-blockchain/v6 <= 6.0.1 → no fix
- [CVE-2026-61732](https://erroneo.us/security/cve/CVE-2026-61732/index.md) Decepticon: Role-boundary forgery via ChatML special-token literals in web crawl output composed into LLM context — PyPI decepticon-core <= 1.1.16 → 1.1.17; PyPI decepticon <= 1.1.16 → 1.1.17; PyPI decepticon-sdk <= 1.1.16 → 1.1.17
- [CVE-2026-61742](https://erroneo.us/security/cve/CVE-2026-61742/index.md) DBHub HTTP transport DNS rebinding allows unauthenticated browser-origin SQL execution — npm @bytebase/dbhub <= 0.22.4 → 0.22.5
- [CVE-2026-61741](https://erroneo.us/security/cve/CVE-2026-61741/index.md) http4s-scala-xml has an XML External Entity (XXE) processing issue — Maven org.http4s:http4s-scala-xml_2.12 <= 0.24.0 → 0.24.1; Maven org.http4s:http4s-scala-xml_2.13 <= 0.24.0 → 0.24.1; Maven org.http4s:http4s-scala-xml_2.13 >= 1.0.0-M1, <= 1.0.0-M38.1 → 1.0.0-M39
- [CVE-2026-59167](https://erroneo.us/security/cve/CVE-2026-59167/index.md) SunEditor: Critical XSS vulnerability - sanitizer bypass — npm suneditor <= 2.47.10 → 2.47.11

---
Source page: https://erroneo.us/security/2026-09-24/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt