---
title: "Security digest: October 30, 2026"
url: https://erroneo.us/security/2026-10-30/
description: "October 30, 2026 vulnerability digest: 1 brief (Northflank Breach: Rotate Every Secret, AI Keys…); 2 CISA KEV additions (Ivanti); 3 critical advisories (Go…"
type: security-digest-day
section: "Security Digest"
date_published: 2026-10-30
date_modified: 2026-11-01
publisher: erroneo.us
author: erroneo.us Security Desk
license: All rights reserved. Quote with attribution and a link.
---

# Security digest: October 30, 2026

1 editorial brief, 2 known exploited (cisa kev) additions and 3 critical advisories.

## Take stock

- Act now: Northflank Breach: Rotate Every Secret, AI Keys Abused . Every Northflank customer that stores API keys, AI provider keys, cloud credentials or database passwords in environment variables, secret groups or global secrets, or runs Northflank database add-ons.
- Do you run any of these? Ivanti Connect Secure. They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2026-11-02.
- Go: 1 critical advisory ( github.com/imgproxy/imgproxy/v3 , github.com/imgproxy/imgproxy/v2 , github.com/imgproxy/imgproxy ). Check with govulncheck ./... .
- GitHub Actions: 1 critical advisory ( pypa/gh-action-pypi-publish ). Check with grep -rn 'uses: <owner>/<action>' .github/workflows .
- npm: 1 critical advisory ( signalk-server , @signalk/resources-provider ). Check with npm audit (or: npm ls <package>) .
- None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

## Editorial briefs

- **Act now** [Northflank Breach: Rotate Every Secret, AI Keys Abused](https://erroneo.us/security/briefs/northflank-environment-variable-breach-ai-keys/index.md): If you keep any secret in Northflank, revoke and reissue it at its source today, starting with AI provider keys; Northflank tells every customer to assume their environment variables were decrypted, and stolen AI keys are already being used.

## Known exploited (CISA KEV)

- [CVE-2026-118527](https://erroneo.us/security/cve/CVE-2026-118527/index.md) Ivanti Connect Secure: Ivanti Connect Secure Generation of Predictable Numbers or Identifiers Vulnerability (CISA due 2026-11-13)
- [CVE-2026-111357](https://erroneo.us/security/cve/CVE-2026-111357/index.md) Ivanti Connect Secure: Ivanti Connect Secure Missing Authentication for Critical Function Vulnerability (CISA due 2026-11-02)

## Critical advisories

- [GHSA-hff9-5pqw-6w9f](https://erroneo.us/security/ghsa/GHSA-hff9-5pqw-6w9f/index.md) imgproxy has integer overflow in imgproxy ICO loader that causes denial of service and may permit remote code execution — Go github.com/imgproxy/imgproxy/v3 >= 4.0.0, < 4.0.16 → 4.0.16; Go github.com/imgproxy/imgproxy/v2 >= 4.0.0, < 4.0.16 → 4.0.16; Go github.com/imgproxy/imgproxy >= 4.0.0, < 4.0.16 → 4.0.16
- [GHSA-5xjx-3w67-w9x9](https://erroneo.us/security/ghsa/GHSA-5xjx-3w67-w9x9/index.md) pypi-publish action revocation of CA in the chain that Sigstore uses in Trusted Publishing and Digital Attestations for PyPI — GitHub Actions pypa/gh-action-pypi-publish <= 1.14.2 → 1.14.3
- [GHSA-4xm8-rg9h-jhq2](https://erroneo.us/security/ghsa/GHSA-4xm8-rg9h-jhq2/index.md) Signal K resources API path traversal can disclose the JWT signing secret and enable remote code execution — npm signalk-server >= 2.0.0, < 2.34.0 → 2.34.0; npm @signalk/resources-provider >= 1.0.0, < 1.5.3 → 1.5.3

---
Source page: https://erroneo.us/security/2026-10-30/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt