erroneo.us
Search all guides⌘K

Digest · Thursday

Security digest: October 8, 2026

2 editorial briefs, 5 known exploited (cisa kev) additions and 7 critical advisories.

All digests · RSS · Markdown

Take stock

  • Patch this week: Go October 2026 Security Releases: 16 Stdlib Fixes. Teams shipping Go binaries that serve HTTP/2 or HTTP/1 to untrusted clients, Go reverse proxies, apps rendering JavaScript through html/template, and anyone verifying TLS chains with crypto/x509 on systems with stale trust stores.
  • Check exposure: ProFTPD mod_copy CVE-2015-3306: 2015 Bug Added to KEV. Operators of internet-facing FTP servers, NAS boxes, hosting servers or embedded appliances running ProFTPD 1.3.5 or older builds with mod_copy loaded and no 2015 patch.
  • Do you run any of these? Strapi Strapi, ONLYOFFICE Docs, Apache Struts, ISC BIND, ProFTPD ProFTPD. They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2026-10-11.
  • npm: 3 critical advisories (fast-jwt, handlebars). Check with npm audit (or: npm ls <package>).
  • Maven: 2 critical advisories (org.asynchttpclient:async-http-client, com.hazelcast:hazelcast). Check with mvn dependency:tree -Dincludes=<groupId>:<artifactId>.
  • PyPI: 2 critical advisories (praisonai, praisonaiagents). Check with pip-audit (or: pip show <package>).
  • None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

Editorial briefs

Patch this week

· Vulnerability · CVE-2026-97032, CVE-2026-78659

Go October 2026 Security Releases: 16 Stdlib Fixes

Rebuild and redeploy Go services with Go 1.27.3 or 1.26.10 this week, starting with internet-facing HTTP/2 servers and reverse proxies; none of these bugs is known to be exploited.

Must act: Teams shipping Go binaries that serve HTTP/2 or HTTP/1 to untrusted clients, Go reverse proxies, apps rendering JavaScript through html/template, and anyone verifying TLS chains with crypto/x509 on systems with stale trust stores.

Can relax: Go code that never serves network traffic or renders templates can take the update on its next release; Windows-only Root.Mkdir and toolchain checksum issues need a malicious project or proxy you chose to use.

  1. Check the toolchain and the binaries you ship: go version, and go version -m ./yourbinary for deployed builds.
  2. Move builds to Go 1.27.3 or 1.26.10 (for example go get toolchain@go1.27.3, or update the golang base image in your Dockerfile), then rebuild and redeploy every service.
  3. If you use golang.org/x/net/http2 directly, run go get golang.org/x/net@v0.60.0 && go mod tidy.

Read the brief →

Check exposure

· Vulnerability · CVE-2015-3306

ProFTPD mod_copy CVE-2015-3306: 2015 Bug Added to KEV

Nearly everyone fixed this a decade ago; the real job is finding any ProFTPD 1.3.5-era build with mod_copy still answering on port 21, usually inside old appliances, and replacing or removing it.

Must act: Operators of internet-facing FTP servers, NAS boxes, hosting servers or embedded appliances running ProFTPD 1.3.5 or older builds with mod_copy loaded and no 2015 patch.

Can relax: Anyone on ProFTPD 1.3.5a or later, on a distribution package patched in 2015, or running a build without mod_copy, which upstream does not compile by default.

  1. Scan your external address ranges for FTP on port 21 and flag any banner reporting ProFTPD 1.3.5 or older.
  2. On each ProFTPD host, run proftpd -v and proftpd -l, and grep the configuration for LoadModule mod_copy.c, to see the version and whether mod_copy is present.
  3. Upgrade to a current ProFTPD release or a distro package with the 2015 fix, and replace appliances whose firmware still ships 1.3.5.

Read the brief →

Known exploited (CISA KEV) 5

Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.

CVEProduct and flawCISA due
CVE-2023-22894Strapi Strapi
Strapi Cleartext Storage of Sensitive Information Vulnerability		2026-10-11
CVE-2021-3199ONLYOFFICE Docs
ONLYOFFICE Docs Server Path Traversal Vulnerability		2026-10-11
CVE-2016-3081Apache Struts
Apache Struts Command Injection Vulnerability		2026-10-11
CVE-2015-5477ISC BIND
ISC BIND Data Processing Errors Vulnerability		2026-10-11
CVE-2015-3306ProFTPD ProFTPD
ProFTPD Improper Access Control Vulnerability		2026-10-11

Critical advisories by ecosystem 7

GitHub-reviewed advisories rated critical, published this day (Pacific time).

npm 3

Check: npm audit (or: npm ls <package>)

Maven 2

Check: mvn dependency:tree -Dincludes=<groupId>:<artifactId>

PyPI 2

Check: pip-audit (or: pip show <package>)