erroneo.us
Search all guides⌘K

Digest · Friday

Security digest: October 30, 2026

1 editorial brief, 2 known exploited (cisa kev) additions and 3 critical advisories.

All digests · RSS · Markdown

Take stock

  • Act now: Northflank Breach: Rotate Every Secret, AI Keys Abused. Every Northflank customer that stores API keys, AI provider keys, cloud credentials or database passwords in environment variables, secret groups or global secrets, or runs Northflank database add-ons.
  • Do you run any of these? Ivanti Connect Secure. They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2026-11-02.
  • Go: 1 critical advisory (github.com/imgproxy/imgproxy/v3, github.com/imgproxy/imgproxy/v2, github.com/imgproxy/imgproxy). Check with govulncheck ./....
  • GitHub Actions: 1 critical advisory (pypa/gh-action-pypi-publish). Check with grep -rn 'uses: <owner>/<action>' .github/workflows.
  • npm: 1 critical advisory (signalk-server, @signalk/resources-provider). Check with npm audit (or: npm ls <package>).
  • None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

Editorial briefs

Act now

· Breach

Northflank Breach: Rotate Every Secret, AI Keys Abused

If you keep any secret in Northflank, revoke and reissue it at its source today, starting with AI provider keys; Northflank tells every customer to assume their environment variables were decrypted, and stolen AI keys are already being used.

Must act: Every Northflank customer that stores API keys, AI provider keys, cloud credentials or database passwords in environment variables, secret groups or global secrets, or runs Northflank database add-ons.

Can relax: Teams that do not use Northflank; Northflank workloads that hold no secrets still need add-on credentials rotated but have little else to do.

  1. List every environment variable, secret group and global secret across all Northflank projects and treat each value as stolen.
  2. Revoke and reissue AI provider keys first at the provider, then cloud IAM, payment and database credentials; deactivate the old values, not just the Northflank copy.
  3. Rotate every add-on credential with Northflank's new rotation feature and disable public access on add-ons that do not need it.

Read the brief →

Known exploited (CISA KEV) 2

Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.

CVEProduct and flawCISA due
CVE-2026-118527Ivanti Connect Secure
Ivanti Connect Secure Generation of Predictable Numbers or Identifiers Vulnerability		2026-11-13
CVE-2026-111357Ivanti Connect Secure
Ivanti Connect Secure Missing Authentication for Critical Function Vulnerability		2026-11-02

Critical advisories by ecosystem 3

GitHub-reviewed advisories rated critical, published this day (Pacific time).

GitHub Actions 1

Check: grep -rn 'uses: <owner>/<action>' .github/workflows

Go 1

Check: govulncheck ./...

npm 1

Check: npm audit (or: npm ls <package>)