--- title: "Security digest: October 8, 2026" url: https://erroneo.us/security/2026-10-08/ description: "October 8, 2026 vulnerability digest: 2 briefs (Go October 2026 Security Releases: 16 Stdlib…); 5 CISA KEV additions (Apache, ISC, ONLYOFFICE, ProFTPD…" type: security-digest-day section: "Security Digest" date_published: 2026-10-08 date_modified: 2026-10-21 publisher: erroneo.us author: erroneo.us Security Desk license: All rights reserved. Quote with attribution and a link. --- # Security digest: October 8, 2026 2 editorial briefs, 5 known exploited (cisa kev) additions and 7 critical advisories. ## Take stock - Patch this week: Go October 2026 Security Releases: 16 Stdlib Fixes . Teams shipping Go binaries that serve HTTP/2 or HTTP/1 to untrusted clients, Go reverse proxies, apps rendering JavaScript through html/template, and anyone verifying TLS chains with crypto/x509 on systems with stale trust stores. - Check exposure: ProFTPD mod_copy CVE-2015-3306: 2015 Bug Added to KEV . Operators of internet-facing FTP servers, NAS boxes, hosting servers or embedded appliances running ProFTPD 1.3.5 or older builds with mod_copy loaded and no 2015 patch. - Do you run any of these? Strapi Strapi, ONLYOFFICE Docs, Apache Struts, ISC BIND, ProFTPD ProFTPD. They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2026-10-11. - npm: 3 critical advisories ( fast-jwt , handlebars ). Check with npm audit (or: npm ls ) . - Maven: 2 critical advisories ( org.asynchttpclient:async-http-client , com.hazelcast:hazelcast ). Check with mvn dependency:tree -Dincludes=: . - PyPI: 2 critical advisories ( praisonai , praisonaiagents ). Check with pip-audit (or: pip show ) . - None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully. ## Editorial briefs - **Patch this week** [Go October 2026 Security Releases: 16 Stdlib Fixes](https://erroneo.us/security/briefs/go-october-2026-security-releases/index.md): Rebuild and redeploy Go services with Go 1.27.3 or 1.26.10 this week, starting with internet-facing HTTP/2 servers and reverse proxies; none of these bugs is known to be exploited. - **Check exposure** [ProFTPD mod_copy CVE-2015-3306: 2015 Bug Added to KEV](https://erroneo.us/security/briefs/proftpd-mod-copy-cve-2015-3306-kev/index.md): Nearly everyone fixed this a decade ago; the real job is finding any ProFTPD 1.3.5-era build with mod_copy still answering on port 21, usually inside old appliances, and replacing or removing it. ## Known exploited (CISA KEV) - [CVE-2023-22894](https://erroneo.us/security/cve/CVE-2023-22894/index.md) Strapi Strapi: Strapi Cleartext Storage of Sensitive Information Vulnerability (CISA due 2026-10-11) - [CVE-2021-3199](https://erroneo.us/security/cve/CVE-2021-3199/index.md) ONLYOFFICE Docs: ONLYOFFICE Docs Server Path Traversal Vulnerability (CISA due 2026-10-11) - [CVE-2016-3081](https://erroneo.us/security/cve/CVE-2016-3081/index.md) Apache Struts: Apache Struts Command Injection Vulnerability (CISA due 2026-10-11) - [CVE-2015-5477](https://erroneo.us/security/cve/CVE-2015-5477/index.md) ISC BIND: ISC BIND Data Processing Errors Vulnerability (CISA due 2026-10-11) - [CVE-2015-3306](https://erroneo.us/security/cve/CVE-2015-3306/index.md) ProFTPD ProFTPD: ProFTPD Improper Access Control Vulnerability (CISA due 2026-10-11) ## Critical advisories - [CVE-2026-107722](https://erroneo.us/security/cve/CVE-2026-107722/index.md) fast-jwt: Incomplete patch of CVE-2026-34950: Non-whitespace key-prefix re-enables RSA→HS256 algorithm confusion — npm fast-jwt >= 6.2.0, <= 6.2.4 → 6.3.0 - [CVE-2026-106445](https://erroneo.us/security/cve/CVE-2026-106445/index.md) Handlebars: JavaScript Injection via Own Property Check Bypass — npm handlebars >= 3.0.0, <= 4.7.9 → 4.7.10 - [CVE-2026-107282](https://erroneo.us/security/cve/CVE-2026-107282/index.md) AsyncHttpClient: Replay to a different host sends the original host request and credentials to the new host — Maven org.asynchttpclient:async-http-client >= 3.0.0, <= 3.0.12 → 3.0.13; Maven org.asynchttpclient:async-http-client >= 2.0.0, <= 2.16.0 → 2.16.1 - [CVE-2026-61445](https://erroneo.us/security/cve/CVE-2026-61445/index.md) PraisonAI: AICoder Arbitrary File Write and Command Execution via LLM Tool Calls — PyPI praisonai <= 4.6.77 → 4.6.78 - [CVE-2026-106446](https://erroneo.us/security/cve/CVE-2026-106446/index.md) Handlebars: JavaScript Injection via AST Type Confusion in compile (bypass of CVE-2026-33937) — npm handlebars >= 4.0.0, <= 4.7.9 → 4.7.10 - [CVE-2026-107726](https://erroneo.us/security/cve/CVE-2026-107726/index.md) Hazelcast allows arbitrary member memory access by low-privileged client — Maven com.hazelcast:hazelcast = 5.6.0 → 5.7.0; Maven com.hazelcast:hazelcast >= 5.5.0, < 5.5.10 → 5.7.0; Maven com.hazelcast:hazelcast < 5.4.5 → 5.7.0 - [CVE-2026-61447](https://erroneo.us/security/cve/CVE-2026-61447/index.md) PraisonAI: CodeAgent Executes LLM-Generated Code Without Sandboxing and Leaks All Environment Secrets — PyPI praisonaiagents <= 1.6.77 → 1.6.78 --- Source page: https://erroneo.us/security/2026-10-08/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt