---
title: "Security briefs"
url: https://erroneo.us/security/briefs/
description: "198 editorial security briefs since 2023: what happened, who must act, who can relax, and the exact steps, with original sources."
type: security-brief-index
section: "Security Digest"
date_modified: 2026-10-21
publisher: erroneo.us
author: erroneo.us Security Desk
license: All rights reserved. Quote with attribution and a link.
---

# Security briefs

- [PHP2Shell: Critical Unauthenticated RCE in PHP](https://erroneo.us/security/briefs/php2shell-php-rce/index.md) — 2026-10-21 · Act now · If PHP answers HTTP requests anywhere you run it, patch or apply a vendor fix today; this is pre-application, unauthenticated, and attack traffic started before the patch shipped.
- [Node.js October 2026 Security Releases: 10 CVEs Fixed](https://erroneo.us/security/briefs/nodejs-october-2026-security-releases/index.md) — 2026-10-21 · Patch this week · Four high-severity fixes, including a Brotli decoder memory-corruption bug the project says permits remote code execution, make this a routine-but-real upgrade: roll every supported line forward this week.
- [LiteLLM 1.107.0: Malicious PyPI and Docker Release](https://erroneo.us/security/briefs/litellm-1-107-0-supply-chain-compromise/index.md) — 2026-10-21 · Act now · Check right now whether anything installed litellm 1.107.0 or pulled a LiteLLM image by a floating tag on October 21; if it did, assume every secret that host could read is stolen.
- [Plex2Shell: Exploited RCE Chain in Plex Media Server](https://erroneo.us/security/briefs/plex2shell-plex-media-server-rce-chain/index.md) — 2026-10-20 · Act now · A public proof of concept chains four Plex bugs into code execution without credentials, and attackers have used it since October 17: update any internet-reachable server now, then check it for a miner or proxy.
- [eMudhra CA Key Compromise: Update Non-Browser TLS Clients](https://erroneo.us/security/briefs/emudhra-emsign-intermediate-ca-key-compromise/index.md) — 2026-10-20 · Patch this week · Anyone can mint certificates from these broken CA keys, but only clients that skip Certificate Transparency and still trust the emSign root are exposed, and only to an on-path attacker: update those trust bundles this week, build machines first.
- [ConnectWise Cloud Backup: App Credential Abused in M365](https://erroneo.us/security/briefs/connectwise-cloud-backup-skykick-m365-oauth-compromise/index.md) — 2026-10-16 · Act now · If any tenant you run or manage ever consented to a ConnectWise or SkyKick app, disable those apps and audit the tenant today; attackers used the vendor's own credential to sign in as the app, so MFA did not stop them.
- [Pillow 13.0.0: Critical Image-Parsing Memory Bugs Fixed](https://erroneo.us/security/briefs/pillow-13-0-0-security-release-image-parsing-rce/index.md) — 2026-10-16 · Patch this week · If your service opens images that users or the internet supply, move to Pillow 13.0.0 this week; the worst bugs are memory corruption reachable from a crafted file, and reproducers are in the published advisories.
- [BeyondTrust Remote Support CVE-2026-102764 Zero-Day](https://erroneo.us/security/briefs/beyondtrust-remote-support-cve-2026-102764-zero-day/index.md) — 2026-10-15 · Act now · If you run a self-hosted BeyondTrust Remote Support appliance, patch it today and assume it may already be compromised; an espionage group used this as a zero-day for about seven weeks.
- [Siemens Software Center DLL Flaw Abused in ClickFix Attacks](https://erroneo.us/security/briefs/siemens-software-center-dll-sideloading-cve-2026-110936/index.md) — 2026-10-15 · Check exposure · Siemens users get the fix automatically, but the real threat is attackers shipping their own signed, older copy as a malware loader, so Windows defenders should block the indicators and hunt rather than rely on patching.
- [Next.js: Two Critical Unauthenticated RCEs (Oct 14)](https://erroneo.us/security/briefs/nextjs-use-cache-image-optimizer-rce/index.md) — 2026-10-14 · Patch this week · Self-hosted Next.js apps should move to 16.4.1 or 15.5.28 this week; both RCEs have preconditions and no exploitation is reported, but the fix is a routine minor upgrade.
- [PAN-OS CVE-2026-0322: Exploited Management-Interface RCE](https://erroneo.us/security/briefs/pan-os-cve-2026-0322-management-interface-rce/index.md) — 2026-10-14 · Patch this week · Patch every PAN-OS firewall and Panorama this week, and today if the management interface is reachable from the internet; the bug needs an admin login but is already being exploited.
- [SiteGuard WAF CVE-2026-106931: Exploited Command Injection](https://erroneo.us/security/briefs/siteguard-server-edition-cve-2026-106931-zero-day/index.md) — 2026-10-14 · Patch this week · If you run SiteGuard Server Edition, save its diagnostic data and patch this week, sooner on public web servers; the bug is exploited, but its local rating means attackers need a foothold first.
- [Ivanti Connect Secure CVE-2026-104935: Exploited Zero-Day](https://erroneo.us/security/briefs/ivanti-connect-secure-cve-2026-104935-zero-day/index.md) — 2026-10-13 · Act now · Upgrade Connect Secure today and investigate with memory and network forensics, because the Integrity Checker missed this compromise and part of the attack chain still has no fix.
- [Visual Studio Copilot CVE-2026-103572: Trailing-Dot RCE](https://erroneo.us/security/briefs/visual-studio-copilot-cve-2026-103572-rce/index.md) — 2026-10-13 · Patch this week · If your developers use Copilot in Visual Studio or SSMS, update this week: exploitation needs only text the agent reads, and the researcher's write-up spells out the chain.
- [Windows Shell CVE-2026-96951: Exploited MOTW Bypass](https://erroneo.us/security/briefs/windows-shell-motw-bypass-cve-2026-96951/index.md) — 2026-10-13 · Patch this week · Roll the October 2026 Windows update out to every desktop this week; attackers are using this to make malicious attachments and downloads skip the warnings that would stop them.
- [Podman CVE-2026-94603: Images Can Disable the Sandbox](https://erroneo.us/security/briefs/podman-checkpoint-image-sandbox-bypass-cve-2026-94603/index.md) — 2026-10-13 · Check exposure · If you run third-party images with rootful Podman, upgrade to 5.8.8 or 6.1.3 now, because an image can switch off the sandbox you asked for; rootless Podman and trusted-image-only hosts can patch on a normal cycle.
- [SlugFest: npm Trusted Publishing Repo-Name Hijack](https://erroneo.us/security/briefs/slugfest-npm-trusted-publishing-slug-hijack/index.md) — 2026-10-13 · Most can relax · The hole was closed on npm's side on October 2, 2026 and no abuse has been reported, so most teams have nothing to patch; maintainers should still spend five minutes auditing trusted publisher bindings and recent publishes.
- [Go October 2026 Security Releases: 16 Stdlib Fixes](https://erroneo.us/security/briefs/go-october-2026-security-releases/index.md) — 2026-10-08 · Patch this week · Rebuild and redeploy Go services with Go 1.27.3 or 1.26.10 this week, starting with internet-facing HTTP/2 servers and reverse proxies; none of these bugs is known to be exploited.
- [ProFTPD mod_copy CVE-2015-3306: 2015 Bug Added to KEV](https://erroneo.us/security/briefs/proftpd-mod-copy-cve-2015-3306-kev/index.md) — 2026-10-08 · Check exposure · Nearly everyone fixed this a decade ago; the real job is finding any ProFTPD 1.3.5-era build with mod_copy still answering on port 21, usually inside old appliances, and replacing or removing it.
- [Argo CD: Repo-Server RCE and AppProject Bypass (Oct 2026)](https://erroneo.us/security/briefs/argo-cd-october-2026-repo-server-rce-appproject-bypass/index.md) — 2026-10-07 · Patch this week · Upgrade Argo CD to a patched 3.3, 3.4 or 3.5 release this week, and today on shared instances where people you do not fully trust can push to tracked repos or merely view an Application.
- [GhostAction: Fake Security Workflows Steal GitHub Secrets](https://erroneo.us/security/briefs/ghostaction-github-workflow-credential-theft/index.md) — 2026-10-07 · Check exposure · If any repository you own or contribute to gained a security-audit.yml or github_actions_security.yml workflow you did not write, treat its Actions secrets, every credential ever committed to it, and the pushing account as compromised.
- [Atlassian Data Center File Read CVE-2026-21589 Exploited](https://erroneo.us/security/briefs/atlassian-data-center-file-read-cve-2026-21589/index.md) — 2026-10-05 · Act now · Every self-managed Atlassian Data Center product is affected, a public detection script exists and CISA confirms exploitation; patch to a fixed LTS or block traversal patterns at the edge today.
- [AhsayCBS: Exploited Pre-Auth RCE Chain in Backup Server](https://erroneo.us/security/briefs/ahsaycbs-cve-2026-105133-105134-backup-server-rce/index.md) — 2026-10-04 · Act now · If you or your MSP run an AhsayCBS backup server, install the October 12 hotfix today and hunt for webshells: the chain is unauthenticated, runs as SYSTEM, is being exploited by several actors, and the August patch did not fix it.
- [FortiMail CVE-2026-104286: Exploited Pre-Auth File Write](https://erroneo.us/security/briefs/fortimail-ibe-path-traversal-cve-2026-104286/index.md) — 2026-10-01 · Act now · If you run a self-managed FortiMail, upgrade today and check Fortinet's indicators; this is an unauthenticated file-write zero-day on an internet-facing mail gateway.
- [Cisco SD-WAN Manager CVE-2026-76504: Exploited Auth Bypass](https://erroneo.us/security/briefs/cisco-sd-wan-manager-cve-2026-76504-api-auth-bypass/index.md) — 2026-09-30 · Act now · If you run SD-WAN Manager on-prem, upgrade now and check the logs Cisco names; one crafted HTTP request gives an unauthenticated attacker admin over the controller for your whole WAN.
- [Zammad CVE-2026-102489/102490: Exploited RCE-to-Root Chain](https://erroneo.us/security/briefs/zammad-cve-2026-102489-102490-rce-root-chain/index.md) — 2026-09-30 · Act now · Self-hosted Zammad on 6.x is remotely exploitable and was used in a real breach: upgrade to 7.2.2 today (6.5.5 only as a stopgap), and patch DEB/RPM installs of any version to close the root escalation.
- [Apple CoreGraphics CVE-2026-86950: Exploited Zero-Day](https://erroneo.us/security/briefs/apple-coregraphics-cve-2026-86950-exploited-zero-day/index.md) — 2026-09-28 · Patch this week · A targeted file-parsing zero-day with a fix out since September 28: confirm every iPhone, iPad and Mac is on 26.7.1, 15.8.1 or a 27.x release this week, and today for high-risk users.
- [NetScaler CVE-2026-88771/88772: Exploited Pre-Auth RCE](https://erroneo.us/security/briefs/citrix-netscaler-cve-2026-88771-88772-zero-days/index.md) — 2026-09-27 · Act now · Every customer-managed NetScaler ADC or Gateway needs the latest build today, and any appliance that was unpatched in September should be investigated as compromised, because patching does not evict attackers.
- [actions-cool Actions Re-Enabled With Mini Shai-Hulud Payload](https://erroneo.us/security/briefs/actions-cool-mini-shai-hulud-reactivation/index.md) — 2026-09-24 · Check exposure · If any workflow referenced either actions-cool action by tag and ran between September 16 and 25, 2026, assume its secrets and repository were compromised; everyone else can confirm with one grep.
- [WordPress Core: Page-Template File Inclusion to RCE](https://erroneo.us/security/briefs/wordpress-core-page-template-lfi-cve-2026-87902/index.md) — 2026-09-22 · Act now · Every WordPress branch back to 4.7 was affected, no login is needed, public scanning tooling exists and attackers are already writing files through pearcmd.php, so confirm you are on a fixed release today.
- [Linux AF_UNIX CVE-2026-80521: Public Container Escape](https://erroneo.us/security/briefs/linux-af-unix-gc-container-escape-cve-2026-80521/index.md) — 2026-09-22 · Patch this week · If you run untrusted or third-party code in containers on a 6.10+ kernel, install fixed kernels as they ship and move that code behind stronger isolation now; a public exploit turns an unprivileged container process into a host compromise.
- [Graphalgo Malware in Go Modules and Terraform Providers](https://erroneo.us/security/briefs/graphalgo-go-modules-terraform-provider-typosquats/index.md) — 2026-09-22 · Check exposure · Grep your go.mod, go.sum and Terraform files for four names; if none match you are done, and if one does, treat the machine as compromised.
- [Linux Kernel: Five Exploited Root Bugs Added to CISA KEV](https://erroneo.us/security/briefs/linux-kernel-five-exploited-lpe-bugs-kev/index.md) — 2026-09-18 · Patch this week · Five local root bugs, all with fixes and most with public exploits, are now confirmed exploited; get every Linux host onto a current kernel and reboot this week, container hosts, CI runners and shared servers first.
- [Plugin4Shell: Plugin Pin Bypass in AI Coding Agents](https://erroneo.us/security/briefs/plugin4shell-ai-agent-plugin-sha-pin-bypass/index.md) — 2026-09-17 · Check exposure · Claude Code and Codex users on current versions are fixed; the real exposure is Copilot or Gemini CLI plugins that auto-update from repositories hosted outside GitHub.
- [Cisco ISE CVE-2026-76460: Exploited CVSS 10 Auth Bypass](https://erroneo.us/security/briefs/cisco-ise-cve-2026-76460-api-auth-bypass/index.md) — 2026-09-16 · Act now · If you run Cisco ISE or ISE-PIC on any release before the fixed patches, patch now and hunt every node; the bug needs no login, is exploited, and Cisco warns attackers may get root and erase their tracks.
- [Google Pixel Modem CVE-2026-58704: Exploited Zero-Day](https://erroneo.us/security/briefs/google-pixel-modem-cve-2026-58704-zero-day/index.md) — 2026-09-15 · Patch this week · A targeted, no-interaction modem bug on Pixel phones with a fix already out: make 2026-09-05 the minimum patch level for every managed Pixel this week, and sooner for high-risk users.
- [Acronis Backup cPanel Plugin CVE-2026-87886: Exploited LPE](https://erroneo.us/security/briefs/acronis-backup-cpanel-plesk-lpe-cve-2026-87886/index.md) — 2026-09-15 · Check exposure · Only hosting servers running the Acronis Backup plugin for cPanel & WHM, Plesk or DirectAdmin are affected; on those, especially multi-tenant cPanel boxes, update the plugin now because it is being exploited.
- [Cisco Secure Email Gateway: Two Exploited Root RCE Bugs](https://erroneo.us/security/briefs/cisco-secure-email-gateway-cve-2026-76461-76519-root-rce/index.md) — 2026-09-14 · Act now · Every on-premises Secure Email Gateway below 15.5.5-014 or 16.5.0-780 can be rooted by an email and both bugs are exploited: upgrade now, and check for compromise before and after, because attackers can wipe local evidence.
- [GitLab CVE-2026-85706: Unauthenticated File Read, Exploited](https://erroneo.us/security/briefs/gitlab-commits-api-file-read-cve-2026-85706/index.md) — 2026-09-10 · Act now · Any unpatched self-managed GitLab 18.7 or later can have its configuration and secret keys read by anyone on the network, and CISA says it is being exploited; upgrade today and rotate secrets if you were exposed.
- [Check Point: Exploited VPN Gateway and Management RCEs](https://erroneo.us/security/briefs/check-point-vpn-and-management-cve-2026-85102-93616/index.md) — 2026-09-09 · Act now · Check Point shops should patch both gateways and management servers now: each flaw is unauthenticated RCE, both are exploited, and fixing one tier does not fix the other.
- [Windows Zero-Days: Update Stack and ALPC EoP (Sep 2026)](https://erroneo.us/security/briefs/windows-update-stack-alpc-zero-days-cve-2026-81963-85880/index.md) — 2026-09-08 · Patch this week · Make sure every Windows machine has the September 2026 or a later cumulative update; both bugs are exploited, but an attacker needs code running on the box first.
- [Magento StyleSmuggler CVE-2026-75650: Exploited Pre-Auth RCE](https://erroneo.us/security/briefs/magento-stylesmuggler-cve-2026-75650-zero-day-rce/index.md) — 2026-09-07 · Act now · Any self-run Magento or Adobe Commerce store without the September hotfix should be presumed compromised: patch, then scan, then rotate the encryption key and every credential it protects, and add the October fix for the follow-on BlockStrap bug.
- [ScreenConnect CVE-2026-84869: Guest-to-Host File Execution](https://erroneo.us/security/briefs/connectwise-screenconnect-cve-2026-84869-guest-file-execution/index.md) — 2026-09-03 · Act now · If your technicians use a ScreenConnect client older than 26.6.5, a compromised machine they connect to can run code on theirs; upgrade on-premises servers and reinstall host clients now.
- [MikroTrick: Exploited MikroTik RouterOS SSH Takeover Chain](https://erroneo.us/security/briefs/mikrotik-routeros-mikrotrick-ssh-cve-2026-86060/index.md) — 2026-09-03 · Act now · If you run MikroTik routers, upgrade them now and check for an 'ops' admin account; an unauthenticated SSH chain to full admin was exploited a day before patches shipped.
- [Chrome V8 Zero-Days CVE-2026-85046 and CVE-2026-87491](https://erroneo.us/security/briefs/chrome-v8-cve-2026-85046-87491-exploited-zero-days/index.md) — 2026-09-03 · Check exposure · Both were exploited zero-days, but Chrome and Edge fixed them in early September and auto-update has had six weeks to deliver the fix; the job now is finding browsers that did not update, not a scramble.
- [LiteLLM Proxy: Three Exploited Flaws in CISA KEV](https://erroneo.us/security/briefs/litellm-proxy-mcp-auth-bypass-kev/index.md) — 2026-09-02 · Patch this week · If you run a self-hosted LiteLLM Proxy older than 1.84.0, upgrade now and treat the provider keys it holds as possibly exposed; SDK-only users are not affected.
- [GitSpawn: Repo Git Config Runs Code in AI Coding Agents](https://erroneo.us/security/briefs/gitspawn-git-fsmonitor-ai-coding-agents/index.md) — 2026-09-01 · Patch this week · Update your coding agents this week and never point one at a repository that arrived as files until you have read its .git/config; ordinary clones are not affected, and no attacks have been reported.
- [JFrog Artifactory: Exploited Auth Bypass to Admin (KEV)](https://erroneo.us/security/briefs/jfrog-artifactory-cve-2026-82329-auth-bypass-kev/index.md) — 2026-08-28 · Act now · If you run self-hosted Artifactory below the fixed builds, treat it as exploited until shown otherwise: upgrade, then hunt for rogue admins, Groovy plugins and stolen signing keys, because patching does not remove them.
- [PaperCut NG/MF: Mass-Exploited Pre-Auth RCE Chain (KEV)](https://erroneo.us/security/briefs/papercut-ng-mf-cve-2026-81578-82078-auth-bypass-rce/index.md) — 2026-08-27 · Act now · If a PaperCut NG/MF server below 24.1.10, 25.0.13 or 26.0.5 was reachable from the internet after late August, assume it was compromised: upgrade, then hunt and rebuild, because this chain gave unauthenticated attackers SYSTEM and was mass-exploited.
- [ownCloud CVE-2023-49105: 2023 WebDAV Bypass Now in KEV](https://erroneo.us/security/briefs/owncloud-cve-2023-49105-webdav-presigned-url-bypass-kev/index.md) — 2026-08-27 · Check exposure · Up-to-date ownCloud servers are fine; any ownCloud core 10.6.0 to 10.13.0 still online should be upgraded today and treated as breached, because attackers are using this bug to empty file shares.
- [Next.js: Windows, AVIF and next/og RCEs (Aug-Sep 2026)](https://erroneo.us/security/briefs/nextjs-windows-avif-next-og-rce/index.md) — 2026-08-25 · Patch this week · Self-hosted Next.js apps still below 15.5.24 or 16.3.3 should upgrade now, ideally straight to the October releases; Windows hosts and apps optimizing untrusted AVIF images are the urgent cases.
- [Apache Tomcat August 2026: Security Constraint Bypasses](https://erroneo.us/security/briefs/apache-tomcat-august-2026-security-constraint-bypasses/index.md) — 2026-08-25 · Patch this week · Upgrade Tomcat, including the copy embedded in Spring Boot apps, this week; the access-control bypasses matter wherever you rely on web.xml security constraints or container authentication, and none is known to be exploited.
- [Spring for GraphQL CVE-2026-59285: Pagination RCE Risk](https://erroneo.us/security/briefs/spring-for-graphql-cve-2026-59285-deserialization/index.md) — 2026-08-20 · Check exposure · Only Spring Boot 4 apps on Spring for GraphQL 2.0.0-2.0.4 that use Jackson 2.x and expose paginated Connection fields are at risk; if that is you, take the 2.0.5 upgrade now.
- [arrayref, internment, append-only-vec: Rust Crates Hijacked](https://erroneo.us/security/briefs/arrayref-crates-io-proc-macro1-build-script-malware/index.md) — 2026-08-20 · Check exposure · Only builds that resolved the three poisoned releases during a roughly two-hour window on August 20, 2026 ran the payload, but any machine that did should be treated as compromised.
- [NetScaler CVE-2026-19490: Exploited Gateway Auth Bypass](https://erroneo.us/security/briefs/citrix-netscaler-cve-2026-19490-gateway-aaa-auth-bypass/index.md) — 2026-08-19 · Act now · Any customer-managed NetScaler with a Gateway or AAA virtual server on an August-or-older build should be upgraded today, straight to the current builds, because this bypass is being tried in the wild and later exploited NetScaler bugs are fixed in the same upgrade.
- [vm2: 22 Critical Sandbox Escapes, Fixed in 3.12.2](https://erroneo.us/security/briefs/vm2-sandbox-escape-wave-3-12-2/index.md) — 2026-08-17 · Check exposure · If anything outside your trust boundary can get code into vm2, upgrade to 3.12.2 today and plan to move that code out of process; if vm2 only runs your own code, upgrade on a normal cycle.
- [Adobe Commerce CVE-2026-71362: Exploited Account Takeover](https://erroneo.us/security/briefs/adobe-commerce-magento-cve-2026-71362-account-takeover/index.md) — 2026-08-11 · Act now · Any Magento or Adobe Commerce store without the August 2026 isolated patch is exposed to an exploited, login-free takeover of customer accounts; apply it today.
- [Cisco ASA/FTD CVE-2026-20349: Exploited VPN Crash Bug](https://erroneo.us/security/briefs/cisco-asa-ftd-vpn-dos-cve-2026-20349/index.md) — 2026-08-11 · Patch this week · If your ASA or FTD terminates remote access VPN, SSL VPN or ZTNA, install the fixed release this week; attackers are using this to knock firewalls offline, but Cisco describes no code execution or data theft.
- [Windows AFD.sys CVE-2026-68820: Exploited Zero-Day EoP](https://erroneo.us/security/briefs/windows-afd-sys-cve-2026-68820-zero-day-eop/index.md) — 2026-08-11 · Patch this week · A local bug, but a real zero-day: North Korea's Lazarus group used it to load a kernel rootkit, so any Windows host still missing the August 2026 or later cumulative update should be patched this week.
- [Metabase CVE-2026-72898: Exploited Pre-Auth SQL Injection](https://erroneo.us/security/briefs/metabase-cve-2026-72898-reset-password-sqli/index.md) — 2026-08-06 · Act now · Self-hosted Metabase 58 through 63 below the fixed point releases can be taken over without a login and was attacked as a zero-day; upgrade now, and if the reset endpoint was reachable, assume your connected database credentials are burned.
- [macOS Screen Sharing CVE-2026-65400: Exploited Auth Bypass](https://erroneo.us/security/briefs/macos-screen-sharing-auth-bypass-cve-2026-65400/index.md) — 2026-08-06 · Check exposure · Any Mac with Screen Sharing or Remote Management reachable from an untrusted network needs the update today and a compromise check; Macs with the service off should still update, but they were not reachable by this attack.
- [Gemini CLI and Claude Code Flaws Expose CI Secrets](https://erroneo.us/security/briefs/gemini-cli-claude-code-ci-agent-flaws/index.md) — 2026-08-05 · Check exposure · If an AI coding agent runs in your CI on content outsiders can write (issues, PRs, comments), check versions and workflow permissions this week; laptop users on auto-update already have the fixes.
- [Langflow CVE-2026-9198: Exploited Unauthenticated RCE](https://erroneo.us/security/briefs/langflow-cve-2026-9198-kev-unauthenticated-rce/index.md) — 2026-08-04 · Act now · Langflow is now the most repeatedly exploited AI-agent builder on CISA's list; any network-reachable instance below 1.10.1 should be patched today and checked for compromise.
- [ChainDrop: npm Worm Trojanizes keyv and cacheable Packages](https://erroneo.us/security/briefs/chaindrop-keyv-npm-worm/index.md) — 2026-08-04 · Check exposure · These are deep transitive dependencies of ESLint-style tooling and HTTP stacks, so many projects resolved them without choosing them; if a lockfile picked up a flagged version in August 2026, treat that host as compromised.
- [Open VSX: 77 Evil-Twin Extensions Leak Developer Data](https://erroneo.us/security/briefs/open-vsx-evil-twin-extensions-mangorbit/index.md) — 2026-08-04 · Check exposure · Check whether any of the 77 extension IDs are installed or recommended in your workspaces and remove them; this was reconnaissance, not credential theft, so blanket secret rotation is not needed.
- [MLflow CVE-2026-64849: Exploited Unauthenticated SSRF](https://erroneo.us/security/briefs/mlflow-cve-2026-64849-webhook-ssrf-cloud-metadata/index.md) — 2026-08-02 · Act now · If an MLflow tracking server below 3.15.0 is reachable by anyone you do not fully trust, assume attackers can read your cloud instance credentials through it: upgrade today, then check webhooks and cloud audit logs.
- [N-able N-central: Exploited Auth Bypass and Pre-Auth RCE](https://erroneo.us/security/briefs/n-able-n-central-auth-bypass-pre-auth-rce-kev/index.md) — 2026-08-01 · Act now · Any self-hosted N-central server below 2026.3.1.14 should be treated as exposed and patched today, and any server that was patched late needs a compromise review, because one stolen RMM console reaches every managed endpoint.
- [Claude Evals Reached 3 Real Orgs, Published a PyPI Stealer](https://erroneo.us/security/briefs/anthropic-claude-evals-real-systems-pypi-package/index.md) — 2026-07-30 · Most can relax · Unless Anthropic has contacted you, there is nothing to patch or rotate; the lesson is how one unvetted install of a brand-new package handed a security vendor's credentials to an agent.
- [VMware vCenter CVE-2026-59310: Exploited Syslog RCE](https://erroneo.us/security/briefs/vmware-vcenter-syslog-rce-cve-2026-59310/index.md) — 2026-07-29 · Act now · If you run vCenter and have not installed Broadcom's July 29 fix, patch today and hunt for persistence; this is unauthenticated root code execution with hundreds of victims and ransomware use.
- [Cisco FMC CVE-2026-20316: Exploited Hard-Coded Password](https://erroneo.us/security/briefs/cisco-fmc-cve-2026-20316-hard-coded-password/index.md) — 2026-07-29 · Act now · If you run on-premises Cisco FMC and have not installed the July hot fix or a September hardening release, upgrade now and check for the published indicator; the login needs no guessing and CISA ties the bug to ransomware.
- [Node.js July 2026 Security Releases: HTTP/2 and 11 CVEs](https://erroneo.us/security/briefs/nodejs-july-2026-security-releases/index.md) — 2026-07-29 · Patch this week · Routine but real: upgrade every supported Node.js line this week, sooner if you terminate HTTP/2 in Node or rely on the Permission Model as a sandbox.
- [Arista VeloCloud Orchestrator: Two Exploited CVSS 10 Flaws](https://erroneo.us/security/briefs/arista-velocloud-orchestrator-cve-2026-16812-93952-exploited-rce/index.md) — 2026-07-27 · Act now · On-prem VCO operators should move to 5.2.3.16 or 6.4.2.8 now, lock the web interface down and hunt for the published backdoor files; both flaws are exploited, and the July fixes do not cover the September bug.
- [Gitea CVE-2026-60004: Exploited RCE via diffpatch API](https://erroneo.us/security/briefs/gitea-cve-2026-60004-diffpatch-git-hook-rce/index.md) — 2026-07-27 · Act now · Upgrade every self-hosted Gitea below 1.27.1 today and close open registration; automated attacks sign up, create a repo and get a shell in seconds, and a proof of concept is public.
- [TeamCity CVE-2026-63077: Unauthenticated RCE, Exploited](https://erroneo.us/security/briefs/teamcity-cve-2026-63077-unauthenticated-rce/index.md) — 2026-07-27 · Act now · Any self-hosted TeamCity server below 2025.11.7 or 2026.1.3 that an attacker can reach over HTTP(S) can be taken over without credentials, and ransomware crews are using it; patch or apply the security patch plugin today, then check for intrusions.
- [Check Point CVE-2026-16232: Exploited Management Auth Bypass](https://erroneo.us/security/briefs/check-point-smartconsole-cve-2026-16232-auth-bypass/index.md) — 2026-07-22 · Patch this week · Install the July 2026 Jumbo Hotfix on every Check Point management server this week, and today if the server is reachable from the internet with unrestricted Trusted Clients; that is the setup attackers used to take full admin control.
- [Zimbra CVE-2026-73570: Exploited SNMP Command Injection](https://erroneo.us/security/briefs/zimbra-snmp-command-injection-cve-2026-73570/index.md) — 2026-07-20 · Check exposure · If you run Zimbra below 10.1.20, check today whether the optional zimbra-snmp package is installed with SNMP notifications on; if it is, patch and hunt for web shells, because hundreds of such servers have been compromised.
- [WordPress 7.0.2: REST Batch + SQL Injection Chain to RCE](https://erroneo.us/security/briefs/wordpress-7-0-2-rest-batch-sqli-rce-cve-2026-63030/index.md) — 2026-07-17 · Act now · Core WordPress 6.9 and 7.0 sites were exposed to unauthenticated remote code execution that is now exploited; most sites got a forced update, so your job is to confirm every one actually did.
- [Hugging Face Breached by Escaped OpenAI Evaluation Agents](https://erroneo.us/security/briefs/hugging-face-breach-openai-evaluation-agents/index.md) — 2026-07-16 · Check exposure · Hugging Face found no tampering with public models, datasets, Spaces or packages, so most users only need the token rotation it recommended; anyone who ever exposed a write token publicly should assume it was found and used.
- [SonicWall SMA1000: Two Rounds of Exploited Zero-Days](https://erroneo.us/security/briefs/sonicwall-sma1000-zero-days-cve-2026-15409-83548/index.md) — 2026-07-14 · Act now · If you run an SMA1000 appliance, install the September hotfix and check it for compromise today; the July fix alone does not cover the second pair of exploited bugs.
- [SharePoint: Four July-August 2026 Flaws Now Exploited](https://erroneo.us/security/briefs/sharepoint-cve-2026-58644-50522-55040-65660-exploited/index.md) — 2026-07-14 · Act now · Any on-premises SharePoint farm not yet on the August 2026 builds is exposed to exploited bugs with public exploit code; patch, rotate machine keys and check for compromise now.
- [Sangoma Switchvox CVE-2026-9586: Pre-Auth SQLi to RCE](https://erroneo.us/security/briefs/sangoma-switchvox-cve-2026-9586-pre-auth-sqli-rce/index.md) — 2026-07-14 · Act now · A single unauthenticated request turns an unpatched Switchvox PBX into a shell; if yours is below 8.4.0.2 and reachable from the internet, upgrade today and check it for compromise.
- [SharePoint CVE-2026-56164: Exploited Unauthenticated 0-Day](https://erroneo.us/security/briefs/sharepoint-cve-2026-56164-zero-day/index.md) — 2026-07-14 · Act now · Ignore the modest vendor score: this was exploited as a zero-day against on-prem SharePoint, so internet-facing farms need the July 2026 updates, a machine-key rotation and a compromise check now.
- [AD FS CVE-2026-56155: Exploited EoP via Weak DKM Key ACLs](https://erroneo.us/security/briefs/microsoft-ad-fs-cve-2026-56155-dkm-acl-privilege-escalation/index.md) — 2026-07-14 · Patch this week · If you run AD FS, install the October 2026 or later Windows update on every farm server this week and confirm the DKM container ACL was fixed; unless you opted in, the July patch only flagged the weak permissions.
- [AsyncAPI npm Packages Backdoored via pull_request_target](https://erroneo.us/security/briefs/asyncapi-npm-pwn-request-miasma-rat/index.md) — 2026-07-14 · Check exposure · If any build resolved @asyncapi/specs 6.11.2 or the July 14 generator releases, treat that machine as backdoored; everyone else should still fix their own pull_request_target workflows.
- [ServiceNow CVE-2026-6875: Pre-Auth Sandbox Escape RCE](https://erroneo.us/security/briefs/servicenow-cve-2026-6875-sandbox-escape-rce/index.md) — 2026-07-13 · Check exposure · ServiceNow-hosted customers were protected in April; the real risk is self-hosted and partner-hosted instances that have not taken the July 13, 2026 patches.
- [Cisco IOS CVE-2008-4128: 18-Year-Old CSRF in CISA KEV](https://erroneo.us/security/briefs/cisco-ios-12-4-csrf-cve-2008-4128-fsb-kev/index.md) — 2026-07-13 · Check exposure · Only organizations still running retired IOS 12.4 routers are exposed, but a Russian state unit is using this bug; find those boxes, turn off their web server today and replace them.
- [jscrambler npm Compromise: Infostealer in CLI Releases](https://erroneo.us/security/briefs/jscrambler-npm-compromise-infostealer/index.md) — 2026-07-11 · Check exposure · Only builds that installed one of the poisoned versions during a roughly three-hour window on July 11 are at risk, but any machine that did should be treated as compromised.
- [Balbooa Forms CVE-2026-56291: Exploited Joomla Upload RCE](https://erroneo.us/security/briefs/balbooa-forms-joomla-file-upload-cve-2026-56291/index.md) — 2026-07-09 · Check exposure · Only Joomla sites running Balbooa Forms are at risk, but for them this is an emergency: an unauthenticated web-shell upload exploited before the patch, followed by more pre-auth bugs, so update to 2.4.3.4 or later and hunt for shells.
- [NetScaler CVE-2026-8452: DoS Bug Exploited as Pre-Auth RCE](https://erroneo.us/security/briefs/netscaler-gateway-saml-rce-cve-2026-8452/index.md) — 2026-06-30 · Act now · Any NetScaler configured as a Gateway or AAA server that is still below the June 30 builds needs patching today and a check for web shells; the bug the vendor called DoS is a public pre-auth RCE under attack.
- [ColdFusion CVE-2026-48282: Exploited RDS Path Traversal](https://erroneo.us/security/briefs/adobe-coldfusion-cve-2026-48282-rds-path-traversal/index.md) — 2026-06-30 · Check exposure · Every ColdFusion 2023/2025 server should already be on the June updates; if RDS was enabled without authentication and reachable, assume the box may be compromised and hunt.
- [Page Builder CK CVE-2026-56290: Exploited Joomla Upload RCE](https://erroneo.us/security/briefs/joomlack-page-builder-ck-cve-2026-56290-file-upload-rce/index.md) — 2026-06-27 · Check exposure · Only Joomla sites running Page Builder CK are at risk, but for them this is an emergency: an unauthenticated web-shell upload exploited within hours of the patch, with an incomplete first fix, so update to 3.6.5 or later and hunt for shells.
- [TrueConf Server: Exploited Pre-Auth RCE Chain on Port 4307](https://erroneo.us/security/briefs/trueconf-server-cve-2026-72529-72530-head-mare/index.md) — 2026-06-18 · Check exposure · Only organizations that run TrueConf Server, or whose staff join meetings on other companies' TrueConf servers, are exposed; for them an unpatched, reachable server should be treated as compromised, because the chain is unauthenticated, yields SYSTEM and was used to infect the server's own users.
- [Zyxel GS1900 Switches: Exploited CGI Overflow (KEV)](https://erroneo.us/security/briefs/zyxel-gs1900-cve-2026-7273-cgi-buffer-overflow/index.md) — 2026-06-16 · Check exposure · Patch every GS1900 to the June firmware, but the urgency depends on reach: if the switch's web interface is exposed to the internet, a guest network or a flat LAN, treat it as compromised until checked; if only a locked-down admin VLAN can reach it, patch on a normal cycle this month.
- [SP Page Builder CVE-2026-48908: Exploited Joomla RCE](https://erroneo.us/security/briefs/sp-page-builder-cve-2026-48908-unauthenticated-upload-rce/index.md) — 2026-06-15 · Act now · Any Joomla site still on SP Page Builder 6.6.1 or older should be updated today and treated as compromised, because automated attacks have been planting web shells and admin accounts since June.
- [iCagenda CVE-2026-48939: Exploited Joomla Upload-to-RCE](https://erroneo.us/security/briefs/icagenda-joomla-cve-2026-48939-file-upload-rce/index.md) — 2026-06-15 · Check exposure · Only Joomla 6.0.0-6.1.1 sites running iCagenda before 4.0.8 were open to web shells; those sites need a web-shell hunt, while everyone else on iCagenda simply updates.
- [Oracle PeopleSoft CVE-2026-35273: ShinyHunters Zero-Day](https://erroneo.us/security/briefs/oracle-peoplesoft-cve-2026-35273-shinyhunters/index.md) — 2026-06-10 · Act now · If you run PeopleTools 8.61 or 8.62 with PIA reachable from the internet, apply Oracle's fix and lock down the EMHub/PSIGW paths today, then hunt back to May 27, 2026.
- [Progress LoadMaster CVE-2026-8037: Exploited Pre-Auth RCE](https://erroneo.us/security/briefs/progress-loadmaster-cve-2026-8037-pre-auth-rce/index.md) — 2026-06-04 · Check exposure · Only LoadMaster-based appliances with the API enabled are exposed, but for those this is unauthenticated root RCE with a public exploit; if that's you and you're below 7.2.63.2 or 7.2.54.18, patch today.
- [Kestra CVE-2026-49869: Exploited Unauthenticated RCE](https://erroneo.us/security/briefs/kestra-cve-2026-49869-auth-bypass-rce/index.md) — 2026-06-03 · Act now · If you run Kestra OSS below 1.0.45 or 1.3.21 and anyone untrusted can reach its API, assume it is compromised: upgrade, then rotate every secret the workers could see.
- [Oracle EBS Payments CVE-2026-46817: Exploited Takeover](https://erroneo.us/security/briefs/oracle-ebs-payments-cve-2026-46817-kev/index.md) — 2026-05-28 · Act now · If you run Oracle E-Business Suite 12.2 without the May 2026 Critical Security Patch Update, patch now; this is an unauthenticated, low-complexity takeover of the payments module and it has been exploited since late June.
- [Starlette BadHost: Host Header Auth Bypass in CISA KEV](https://erroneo.us/security/briefs/starlette-badhost-host-header-bypass-cve-2026-48710/index.md) — 2026-05-21 · Patch this week · Bump starlette to 1.0.1 or later in every Python service this week; it is urgent where an ASGI server faces untrusted clients directly and middleware makes security decisions from request.url.
- [Mini Shai-Hulud: TanStack npm Worm With Valid Provenance](https://erroneo.us/security/briefs/mini-shai-hulud-tanstack-npm-worm/index.md) — 2026-05-11 · Check exposure · If a lockfile picked up one of the bad TanStack Router/Start, Mistral or OpenSearch versions in mid-May 2026, treat that host as fully compromised and disable the dead-man's switch before rotating anything; everyone else can confirm and move on.
- [WSO2 API Manager CVE-2026-5430: Exploited JWT Auth Bypass](https://erroneo.us/security/briefs/wso2-api-manager-cve-2026-5430-jwt-auth-bypass/index.md) — 2026-05-03 · Act now · Any self-managed WSO2 API Manager 4.1-4.6, API Control Plane, Traffic Manager or Universal Gateway below the fixed update level should be patched now and checked for forged-token use; attackers have been sending forged admin JWTs since mid-September.
- [Bleeding Llama: Unauthenticated Memory Leak in Ollama](https://erroneo.us/security/briefs/bleeding-llama-ollama-memory-leak-cve-2026-7482/index.md) — 2026-05-02 · Check exposure · A laptop running Ollama on its default localhost binding is not reachable; a server you exposed with OLLAMA_HOST=0.0.0.0 or a published Docker port is, and it should be updated and its secrets rotated.
- [Copy Fail: Exploited Linux Kernel Root Exploit Since 2017](https://erroneo.us/security/briefs/copy-fail-linux-kernel-lpe-cve-2026-31431/index.md) — 2026-04-29 · Act now · Any Linux box that runs code from more than one trust level (CI runners, container hosts, shared servers) needs a patched kernel and reboot now; single-user machines can patch on a short cycle.
- [FortiSandbox: Two Exploited Pre-Auth Command Injections](https://erroneo.us/security/briefs/fortinet-fortisandbox-cve-2026-39808-25089-unauth-command-injection/index.md) — 2026-04-14 · Act now · If any FortiSandbox runs 4.2, 4.4 below 4.4.9 or 5.0 below 5.0.6, upgrade now and check it for compromise: both bugs need no login, one has a public exploit, and attacks began in June.
- [Windows IKE CVE-2026-33824: Exploited Pre-Auth RCE](https://erroneo.us/security/briefs/windows-ike-cve-2026-33824-pre-auth-rce/index.md) — 2026-04-14 · Check exposure · The fix shipped in April, so most fleets are already covered; the real risk is any unpatched Windows host that answers IKE on UDP 500 or 4500 from untrusted networks, and those need patching or blocking today.
- [Tomcat CVE-2026-34486: Cluster EncryptInterceptor Bypass](https://erroneo.us/security/briefs/apache-tomcat-cve-2026-34486-encryptinterceptor-bypass/index.md) — 2026-04-09 · Check exposure · Exploited, but only against three specific Tomcat releases running session-replication clustering with the EncryptInterceptor and a reachable cluster port; check those three things today, and most Tomcat users will find they are not exposed.
- [axios 1.14.1 and 0.30.4: npm Hijack Drops North Korean RAT](https://erroneo.us/security/briefs/axios-npm-compromise-plain-crypto-js-rat/index.md) — 2026-03-31 · Check exposure · axios is everywhere, but the bad versions lived only about three hours on March 31, 2026; if nothing resolved a fresh axios in that window you are fine, and if something did, that machine ran a remote-access trojan.
- [Trivy Supply-Chain Hijack: trivy-action Steals CI Secrets](https://erroneo.us/security/briefs/trivy-action-teampcp-supply-chain-compromise/index.md) — 2026-03-19 · Check exposure · If any pipeline ran trivy-action by tag, setup-trivy, or Trivy 0.69.4 to 0.69.6 during the March 19-23, 2026 windows, every secret that job could see is burned; if you pinned SHAs, digests or 0.69.3, you were fine.
- [Cisco FMC CVE-2026-20079: Exploited Pre-Auth Root Bypass](https://erroneo.us/security/briefs/cisco-fmc-cve-2026-20079-auth-bypass-root/index.md) — 2026-03-04 · Act now · If you run an on-prem Cisco Secure FMC that is not on a September 2026 hardening release, upgrade now and check it for compromise; state and ransomware actors are using this bug to take root on the box that controls your firewalls.
- [Cisco SD-WAN CVE-2026-20127: CVSS 10 Bypass, ED 26-03](https://erroneo.us/security/briefs/cisco-catalyst-sd-wan-cve-2026-20127-auth-bypass/index.md) — 2026-02-25 · Act now · If you run on-prem Catalyst SD-WAN control components, upgrade and hunt now: a sophisticated actor has used this bypass for years, and the follow-on SD-WAN bugs CISA keeps adding to KEV show the platform is still being targeted.
- [FortiOS CVE-2025-68686: SSL-VPN Symlink Patch Bypass in KEV](https://erroneo.us/security/briefs/fortios-ssl-vpn-symlink-patch-bypass-cve-2025-68686/index.md) — 2026-02-10 · Check exposure · This is not a way in, only a way to stay in on FortiGates that ran SSL-VPN and were already breached; the real problem is that FortiOS 7.2, 7.0 and 6.4 will never get a fix, so plan the move to 7.4.7+ or 7.6.2+.
- [Notepad++ Updater Hijack: State Actor Served Bad Updates](https://erroneo.us/security/briefs/notepad-plus-plus-updater-hijack-cve-2025-15556/index.md) — 2026-02-02 · Check exposure · Targeting was narrow (about a dozen machines in Kaspersky's telemetry), but any fleet that auto-updated Notepad++ between June and December 2025 should update to v8.9.1+ and check the published IoCs.
- [OpenClaw CVE-2026-25253: One-Click RCE via Token Leak](https://erroneo.us/security/briefs/openclaw-one-click-rce-gatewayurl-token/index.md) — 2026-01-31 · Patch this week · Fixed since January, but any OpenClaw install that missed updates can be taken over by its owner clicking one link, and a loopback-only setup does not save it.
- [Ivanti EPMM Zero-Day RCE: CVE-2026-1281 and CVE-2026-1340](https://erroneo.us/security/briefs/ivanti-epmm-cve-2026-1281-1340-zero-day-rce/index.md) — 2026-01-29 · Act now · On-premises Ivanti EPMM was open to unauthenticated remote command execution, exploited before disclosure and with a public PoC a day later; patch, confirm the RPM survived any later upgrade, and hunt for compromise.
- [FortiCloud SSO Cross-Account Login: CVE-2026-24858](https://erroneo.us/security/briefs/forticloud-sso-cross-account-bypass-cve-2026-24858/index.md) — 2026-01-27 · Act now · Any Fortinet device that relies on FortiCloud SSO needs the January 2026 builds (FortiCloud now refuses SSO from vulnerable versions anyway), and any device with SSO enabled before then should be checked for rogue admins.
- [Oracle HTTP Server CVE-2026-21962: CVSS 10 Flaw in KEV](https://erroneo.us/security/briefs/oracle-http-server-weblogic-proxy-cve-2026-21962/index.md) — 2026-01-20 · Act now · If an Oracle HTTP Server, Apache or IIS front end with the WebLogic proxy plug-in still lacks the January 2026 CPU, patch it now; exploit code has been public since January and the bug is now confirmed exploited.
- [FortiOS CVE-2025-25249 and CVE-2025-61624 Now Exploited](https://erroneo.us/security/briefs/fortios-cve-2025-25249-capwap-rce-cve-2025-61624/index.md) — 2026-01-13 · Act now · If you run FortiGates, get to FortiOS 7.4.10+ or 7.6.5+ now and hunt for implants: one bug gives unauthenticated attackers code execution over CAPWAP and is being exploited at scale, and the other turns stolen admin logins into root implants.
- [Ni8mare: n8n Unauthenticated Takeover, Plus a KEV RCE](https://erroneo.us/security/briefs/ni8mare-n8n-unauthenticated-file-read-rce/index.md) — 2026-01-07 · Act now · If you self-host n8n and anything about it is reachable from the internet, upgrade today: one bug lets strangers in through public forms, and its companion RCE is on CISA's exploited list.
- [LangGrinch: LangChain Core Serialization Injection](https://erroneo.us/security/briefs/langgrinch-langchain-core-serialization-injection/index.md) — 2025-12-23 · Patch this week · A real design flaw in a library almost every Python agent stack pulls in, but it needs a serialize-then-deserialize path over attacker-influenced data; bump langchain-core in your next routine dependency update.
- [MongoBleed: Pre-Auth Memory Leak in MongoDB Server](https://erroneo.us/security/briefs/mongobleed-mongodb-zlib-memory-leak/index.md) — 2025-12-19 · Patch this week · Atlas users are already patched; self-hosted MongoDB that untrusted networks can reach must be upgraded (or have zlib disabled) now, and internet-exposed instances should rotate credentials.
- [FortiCloud SSO SAML Bypass: CVE-2025-59718/59719](https://erroneo.us/security/briefs/forticloud-sso-saml-bypass-cve-2025-59718/index.md) — 2025-12-09 · Act now · If any Fortinet device has FortiCloud SSO admin login turned on, it was open to unauthenticated admin takeover; upgrade, then also apply the January 2026 fix for CVE-2026-24858, which bypassed this patch.
- [React2Shell: Unauthenticated RCE in React Server Components](https://erroneo.us/security/briefs/react2shell-react-server-components-rce/index.md) — 2025-12-03 · Act now · If any server you run renders React Server Components and was not patched in December 2025, treat it as compromised until shown otherwise: patch, redeploy, and rotate its secrets.
- [Ray CVE-2025-62593: Browser-Driven RCE Against Ray Devs](https://erroneo.us/security/briefs/ray-cve-2025-62593-browser-dns-rebinding-rce/index.md) — 2025-11-26 · Patch this week · Upgrade Ray to 2.52.0 or later on developer machines and internal clusters this week; the attack needs a Firefox or Safari user to load a hostile page while a pre-2.52 dashboard is running, and the public evidence of real-world use is thin.
- [Shai-Hulud 2.0: npm Worm Hits PostHog, Zapier, Postman](https://erroneo.us/security/briefs/shai-hulud-2-npm-worm/index.md) — 2025-11-24 · Check exposure · The worm is long dead on npm, but any machine or CI runner that installed a trojanized version between Nov 21 and Nov 27, 2025 should be treated as having leaked every secret it could reach.
- [FortiWeb CVE-2025-64446: Exploited Unauthenticated Takeover](https://erroneo.us/security/briefs/fortiweb-cve-2025-64446-path-traversal/index.md) — 2025-11-14 · Act now · Any FortiWeb still below the fixed builds with its web GUI reachable from the internet should be presumed compromised and rebuilt, not just patched.
- [runc Container Escapes: Three Mount-Race CVEs Fixed](https://erroneo.us/security/briefs/runc-container-escape-cve-2025-31133/index.md) — 2025-11-05 · Patch this week · Not remotely exploitable and not seen in attacks, but anyone who runs or builds images they do not fully trust (CI runners, multi-tenant clusters) should roll out patched runc this week.
- [Microsoft WSUS CVE-2025-59287: Unauthenticated SYSTEM RCE](https://erroneo.us/security/briefs/microsoft-wsus-cve-2025-59287-rce/index.md) — 2025-10-23 · Patch this week · Only servers with the WSUS role are at risk, but on those it is unauthenticated SYSTEM code execution: patch them now, and treat any WSUS server exposed on 8530/8531 to the internet as a likely incident.
- [GlassWorm: Invisible-Unicode Malware in Open VSX Extensions](https://erroneo.us/security/briefs/glassworm-open-vsx-extension-malware/index.md) — 2025-10-17 · Check exposure · This is a recurring campaign rather than a single event; developers on VS Code forks that pull from Open VSX should audit installed extensions and auto-updates, while most stock VS Code users with mainstream extensions were not affected.
- [F5 Breach: Nation-State Stole BIG-IP Source Code](https://erroneo.us/security/briefs/f5-big-ip-source-code-breach/index.md) — 2025-10-15 · Patch this week · The breach itself needs no new action a year on, but its aftermath does: two unauthenticated BIG-IP APM RCEs are now on CISA's exploited list, so every BIG-IP owner should be on current fixed builds with management interfaces off the internet.
- [Oracle EBS CVE-2025-61882: Cl0p Zero-Day Data Theft](https://erroneo.us/security/briefs/oracle-ebs-cve-2025-61882-cl0p-zero-day/index.md) — 2025-10-04 · Act now · Any internet-reachable Oracle EBS 12.2.x server that missed the October 2025 alerts should be treated as compromised until a hunt proves otherwise.
- [RediShell: 13-Year-Old Lua Use-After-Free RCE in Redis](https://erroneo.us/security/briefs/redishell-redis-lua-rce-cve-2025-49844/index.md) — 2025-10-03 · Patch this week · Exploitation needs an authenticated session, so properly locked-down Redis can be patched in a normal urgent window; instances reachable without a password are effectively unauthenticated RCE and should be fixed today.
- [Cisco ASA/FTD VPN Zero-Days Tied to ArcaneDoor](https://erroneo.us/security/briefs/cisco-asa-ftd-vpn-cve-2025-20333-20362-arcanedoor/index.md) — 2025-09-25 · Patch this week · Still live in October 2026: the actor added a persistence mechanism in April 2026 that survives the September 2025 fixes, so ASA/FTD owners with VPN web services need the latest updates and a physical power cycle, not just last year's patch.
- [Shai-Hulud: Self-Replicating Worm Hits 500+ npm Packages](https://erroneo.us/security/briefs/shai-hulud-self-replicating-npm-worm/index.md) — 2025-09-15 · Check exposure · The worm's packages were removed in September 2025, but every machine that installed one handed over its npm, GitHub and cloud credentials, so the open question is whether you rotated them and removed the backdoor workflow.
- [chalk, debug and 16+ npm Packages Hijacked via Phishing](https://erroneo.us/security/briefs/chalk-debug-npm-qix-phishing-hijack/index.md) — 2025-09-08 · Most can relax · Despite billions of weekly downloads, the bad versions were live for about two hours and the payload only swapped crypto addresses inside browsers, so most teams just need to confirm no lockfile or bundle captured them.
- [Nx s1ngularity: Malicious npm Releases Hijack AI CLIs](https://erroneo.us/security/briefs/nx-s1ngularity-malicious-npm-releases/index.md) — 2025-08-26 · Check exposure · The packages were live for about four hours in August 2025, but anything they stole (GitHub and npm tokens, SSH keys, .env files, wallets) stays useful until rotated, so confirm you were not hit rather than assume.
- [Salesloft Drift OAuth Token Theft Hits Salesforce Orgs](https://erroneo.us/security/briefs/salesloft-drift-oauth-salesforce-data-theft/index.md) — 2025-08-26 · Check exposure · Contained since September 2025, but if your org ever connected Drift, verify that every token and every secret sitting in your CRM or support cases was rotated, because the theft was aimed at exactly those secrets.
- [GitHub Copilot "YOLO Mode" Prompt Injection RCE](https://erroneo.us/security/briefs/github-copilot-yolo-mode-prompt-injection-rce/index.md) — 2025-08-12 · Check exposure · Patched in August 2025 and not known to be exploited, but enterprise Visual Studio installs lag and the autoApprove setting can still be turned on by hand, so verify both.
- [WinRAR CVE-2025-8088: ADS Path Traversal Exploited by RomCom](https://erroneo.us/security/briefs/winrar-cve-2025-8088-ads-path-traversal/index.md) — 2025-08-11 · Check exposure · Fixed since July 2025 but still heavily exploited, and WinRAR does not update itself, so hunt down every copy at 7.12 or older and update it today.
- [Exchange Hybrid CVE-2025-53786: On-Prem to Cloud Escalation](https://erroneo.us/security/briefs/exchange-hybrid-cve-2025-53786-privilege-escalation/index.md) — 2025-08-06 · Check exposure · Not known to be exploited and requires on-prem Exchange admin first, but it turns any on-prem compromise into a quiet cloud takeover, so verify the dedicated hybrid app is in place and the old shared credential is gone.
- [Cursor CurXecute: Prompt Injection to RCE via mcp.json](https://erroneo.us/security/briefs/cursor-curxecute-mcp-prompt-injection-rce/index.md) — 2025-08-01 · Most can relax · Cursor auto-updates and both bugs were fixed by mid-2025; the lasting takeaway is to treat any agent that can write its own tool config as a code-execution path.
- [Amazon Q VS Code Extension 1.84.0 Shipped a Wiper Prompt](https://erroneo.us/security/briefs/amazon-q-vscode-extension-wiper-prompt/index.md) — 2025-07-23 · Most can relax · A real supply-chain compromise with a payload that AWS says could not run; if nothing in your fleet still has 1.84.0, there is nothing left to do.
- [ToolShell: SharePoint On-Prem Unauthenticated RCE Chain](https://erroneo.us/security/briefs/toolshell-sharepoint-cve-2025-53770/index.md) — 2025-07-19 · Check exposure · Fixes shipped in July 2025, but ToolShell stole ASP.NET machine keys that survive patching, so any on-prem SharePoint that was internet-facing then needs proof that keys were rotated and no backdoor remains.
- [mcp-remote: OS Command Injection via OAuth Endpoint](https://erroneo.us/security/briefs/mcp-remote-oauth-command-injection/index.md) — 2025-07-09 · Check exposure · The fix is more than a year old, but version-pinned MCP client configs and stale npx caches can keep a vulnerable mcp-remote alive, so confirm the version and move on.
- [sudo --chroot Local Root Escalation (CVE-2025-32463)](https://erroneo.us/security/briefs/sudo-chroot-privilege-escalation-cve-2025-32463/index.md) — 2025-06-30 · Check exposure · Distros patched this in mid-2025 and it is now known-exploited; any multi-user or shared Linux host still on sudo 1.9.14-1.9.17 without the vendor fix hands root to every local account.
- [Citrix Bleed 2: NetScaler Gateway Memory Leak](https://erroneo.us/security/briefs/citrix-bleed-2-netscaler-cve-2025-5777/index.md) — 2025-06-17 · Check exposure · A pre-auth memory leak on internet-facing VPN gateways that was exploited within weeks; patched since June 2025, so the job now is proving you patched, killed sessions and were not session-hijacked.
- [MCP Inspector: Unauthenticated RCE via Browser CSRF](https://erroneo.us/security/briefs/mcp-inspector-unauthenticated-rce/index.md) — 2025-06-13 · Check exposure · Fixed since June 2025, but Inspector sits in project devDependencies and npx caches, so old copies survive; confirm 0.14.1+ and never run it with auth disabled.
- [EchoLeak: Zero-Click Data Leak in Microsoft 365 Copilot](https://erroneo.us/security/briefs/echoleak-m365-copilot-cve-2025-32711/index.md) — 2025-06-11 · Most can relax · Nothing to patch: Microsoft fixed it in its cloud service before disclosure and saw no exploitation, but it is the reference case for why AI assistants that read untrusted content need guardrails.
- [SAP NetWeaver Visual Composer: Unauthenticated Upload RCE](https://erroneo.us/security/briefs/sap-netweaver-visual-composer-cve-2025-31324/index.md) — 2025-04-24 · Check exposure · Patches have existed since April and May 2025, but this was a mass-exploited zero-day used by ransomware crews, so every SAP Java shop should confirm the fix and hunt for leftover webshells.
- [Erlang/OTP SSH: Unauthenticated RCE (CVE-2025-32433)](https://erroneo.us/security/briefs/erlang-otp-ssh-unauthenticated-rce-cve-2025-32433/index.md) — 2025-04-16 · Check exposure · The OTP fix is 18 months old, but the bug hides inside appliances and OT gear that patch slowly; inventory anything exposing an Erlang SSH daemon rather than assuming your servers' OpenSSH covers you.
- [Langflow Unauthenticated Code Execution (CVE-2025-3248)](https://erroneo.us/security/briefs/langflow-unauthenticated-rce-cve-2025-3248/index.md) — 2025-04-07 · Check exposure · Fixed in March 2025 and exploited in the wild since; if any Langflow below 1.3.0 is reachable from the internet, treat it as compromised, not merely unpatched.
- [Chrome CVE-2025-2783: Mojo Sandbox Escape Zero-Day](https://erroneo.us/security/briefs/chrome-cve-2025-2783-mojo-sandbox-escape/index.md) — 2025-03-25 · Most can relax · A real zero-day used for espionage in early 2025, long since fixed by Chrome's automatic updates; the lasting lesson is to make sure auto-update actually works on your fleet.
- [IngressNightmare: ingress-nginx Cluster Takeover RCE](https://erroneo.us/security/briefs/ingressnightmare-ingress-nginx-cve-2025-1974/index.md) — 2025-03-24 · Check exposure · Patched since March 2025. If any cluster still runs ingress-nginx below 1.11.5 or 1.12.1, that is a cluster-takeover risk, and the controller itself is now retired, so plan the migration while you check.
- [CrushFTP Auth Bypass CVE-2025-31161 Exploited in the Wild](https://erroneo.us/security/briefs/crushftp-auth-bypass-cve-2025-31161/index.md) — 2025-03-21 · Check exposure · Fixed since March 2025 and widely exploited from early April; if you run CrushFTP, make sure you are on a current build (later CrushFTP flaws raised the minimum) and audit for backdoor admin accounts.
- [Next.js Middleware Authorization Bypass (CVE-2025-29927)](https://erroneo.us/security/briefs/nextjs-middleware-bypass-cve-2025-29927/index.md) — 2025-03-21 · Check exposure · Patched since March 2025 and easy to fix; if you self-host Next.js and lean on middleware for auth, confirm you are on a fixed release and that the header is stripped at your edge.
- [tj-actions/changed-files: GitHub Action Leaked CI Secrets](https://erroneo.us/security/briefs/tj-actions-changed-files-compromise/index.md) — 2025-03-14 · Check exposure · The malicious tags were cleaned up within about a day in March 2025; today the job is confirming you rotated any secret that a March 14-15, 2025 workflow run could have printed, and that you pin Actions by SHA.
- [Apache Tomcat Partial PUT RCE (CVE-2025-24813)](https://erroneo.us/security/briefs/apache-tomcat-partial-put-cve-2025-24813/index.md) — 2025-03-10 · Most can relax · It is in KEV and attacks were seen within days, but exploitation needs the default servlet's write support turned on, which is off by default and rare; upgrade on your normal cycle and check that one setting.
- [rsync: Six Flaws Incl. Daemon Heap Overflow (CVE-2024-12084)](https://erroneo.us/security/briefs/rsync-heap-overflow-cve-2024-12084/index.md) — 2025-01-14 · Check exposure · Distros shipped fixes in January 2025 and there is no known exploitation, but internet-facing rsync daemons have since needed two more security releases, so verify you run a current rsync rather than just 3.4.0.
- [FortiOS 7.0 Websocket Auth Bypass to Super-Admin](https://erroneo.us/security/briefs/fortios-websocket-auth-bypass-cve-2024-55591/index.md) — 2025-01-14 · Check exposure · Exploited as a zero-day in late 2024 and patched in January 2025; anyone whose FortiOS 7.0 admin interface was internet-facing back then should audit admin and VPN accounts, not just the firmware version.
- [Ivanti Connect Secure Zero-Day RCE (CVE-2025-0282)](https://erroneo.us/security/briefs/ivanti-connect-secure-cve-2025-0282/index.md) — 2025-01-08 · Check exposure · A real zero-day used for espionage and patched in January 2025; if you ran Connect Secure below 22.7R2.5 last winter, a clean patch level today does not prove you were never backdoored.
- [Ultralytics PyPI Releases Shipped a Crypto Miner](https://erroneo.us/security/briefs/ultralytics-pypi-cache-poisoning-compromise/index.md) — 2024-12-04 · Most can relax · The four bad versions were pulled from PyPI within hours to about half a day in December 2024 and carried a coin miner, not a credential stealer; unless something still pins one of them, there is nothing to do but learn the CI lessons.
- [PAN-OS Management Auth Bypass Chain (Lunar Peek)](https://erroneo.us/security/briefs/pan-os-cve-2024-0012-9474-lunar-peek/index.md) — 2024-11-18 · Check exposure · Exploited at scale in late 2024 and patched for almost two years; if your management interface was ever internet-reachable, verify the fix and hunt for leftovers rather than assume you are clean.
- [CUPS cups-browsed RCE Chain: Real, but Needs a Print Job](https://erroneo.us/security/briefs/cups-browsed-rce-chain-cve-2024-47176/index.md) — 2024-09-26 · Check exposure · Not the internet-ending bug the pre-disclosure hype suggested: code runs only when someone prints to the rogue printer, as the unprivileged lp user; but nothing should expose UDP 631 to the internet, and exposed hosts can be abused for DDoS.
- [Veeam Backup & Replication RCE (CVE-2024-40711)](https://erroneo.us/security/briefs/veeam-backup-replication-rce-cve-2024-40711/index.md) — 2024-09-04 · Act now · Ransomware crews have used this to take over backup servers; any Veeam Backup & Replication v12 server below 12.2 is an emergency, and backup servers should never be reachable from user or internet networks.
- [Windows TCP/IP IPv6 Remote Code Execution (CVE-2024-38063)](https://erroneo.us/security/briefs/windows-tcpip-ipv6-rce-cve-2024-38063/index.md) — 2024-08-13 · Patch this week · Serious on paper and worth patching promptly, but there is no known in-the-wild exploitation, public code is a flaky crash-oriented proof of concept, and any machine on August 2024 or later cumulative updates is already fixed.
- [Apache OFBiz: Unauthenticated RCE (CVE-2024-38856)](https://erroneo.us/security/briefs/apache-ofbiz-pre-auth-rce-cve-2024-38856/index.md) — 2024-08-05 · Act now · Any internet-reachable OFBiz older than 18.12.16 should be treated as compromised-until-proven-otherwise and upgraded immediately; this bug class has been exploited repeatedly.
- [regreSSHion: OpenSSH sshd Signal Race RCE (CVE-2024-6387)](https://erroneo.us/security/briefs/regresshion-openssh-signal-race-cve-2024-6387/index.md) — 2024-07-01 · Patch this week · Serious on paper (unauthenticated root RCE in sshd), but the only demonstrated exploit needed a 32-bit glibc target and 6-8 hours of continuous connections in a lab, so patch promptly through your distro instead of panicking.
- [MOVEit Transfer: SFTP Authentication Bypass (CVE-2024-5806)](https://erroneo.us/security/briefs/moveit-transfer-sftp-auth-bypass-cve-2024-5806/index.md) — 2024-06-25 · Act now · If you run MOVEit Transfer with SFTP exposed and are not on a fixed build, treat it as urgent: exploit details went public on disclosure day and attempts followed within hours.
- [polyfill.io CDN Supply-Chain Compromise Hits 100K+ Sites](https://erroneo.us/security/briefs/polyfill-io-cdn-supply-chain-compromise/index.md) — 2024-06-25 · Check exposure · The malicious domain has been suspended since June 27, 2024, but any page that still loads a script from polyfill.io or its sister domains is trusting an attacker-linked host and should be cleaned up.
- [Probllama: Ollama Path Traversal to RCE (CVE-2024-37032)](https://erroneo.us/security/briefs/ollama-probllama-path-traversal-rce-cve-2024-37032/index.md) — 2024-06-24 · Check exposure · The bug was fixed in May 2024, so anything current is patched; the lasting risk is Ollama servers left reachable from the internet with no authentication, which is still very common.
- [CVE-2024-4577: PHP-CGI Argument Injection RCE on Windows](https://erroneo.us/security/briefs/php-cgi-windows-argument-injection-cve-2024-4577/index.md) — 2024-06-06 · Act now · If you run PHP on Windows behind Apache in CGI mode (including any default XAMPP install), treat it as compromised-until-proven-otherwise and patch or remove CGI today; everyone else can relax.
- [Snowflake UNC5537: Customer Accounts Hit With Stolen Logins](https://erroneo.us/security/briefs/snowflake-unc5537-customer-account-breaches/index.md) — 2024-06-02 · Check exposure · There was no Snowflake bug to patch; the lesson is that any cloud data platform reachable with a password alone will eventually be logged into by someone holding an infostealer log.
- [PAN-OS GlobalProtect Zero-Day RCE (CVE-2024-3400)](https://erroneo.us/security/briefs/pan-os-globalprotect-cve-2024-3400/index.md) — 2024-04-12 · Act now · Any PAN-OS 10.2, 11.0 or 11.1 firewall with a GlobalProtect gateway or portal that is not on a fixed hotfix is exposed to unauthenticated root code execution and should be patched and checked immediately.
- [xz-utils Backdoor in liblzma 5.6.0/5.6.1 (CVE-2024-3094)](https://erroneo.us/security/briefs/xz-utils-backdoor/index.md) — 2024-03-29 · Check exposure · The backdoor only reached rolling and pre-release distributions for a few weeks before discovery; stable enterprise releases never shipped it, but any machine that ran xz 5.6.0 or 5.6.1 should be checked.
- [ShadowRay: Exposed Ray Clusters Hijacked (CVE-2023-48022)](https://erroneo.us/security/briefs/shadowray-ray-jobs-api-cve-2023-48022/index.md) — 2024-03-26 · Check exposure · There is no patch to install: if any Ray dashboard, Jobs or Client port is reachable from an untrusted network, anyone who can reach it can run code on your cluster.
- [Malicious Hugging Face Models: Pickle Code Execution](https://erroneo.us/security/briefs/hugging-face-malicious-pickle-models/index.md) — 2024-02-27 · Check exposure · This is a standing risk, not a one-off bug: loading a pickle-based model from an untrusted repo is running that author's code, so check how your pipelines load third-party weights.
- [ScreenConnect Auth Bypass CVE-2024-1709 (CVSS 10)](https://erroneo.us/security/briefs/connectwise-screenconnect-auth-bypass-cve-2024-1709/index.md) — 2024-02-19 · Act now · Any on-premises ScreenConnect server still below 23.9.8 should be treated as compromised until proven otherwise; cloud-hosted customers were patched by ConnectWise.
- [FortiOS SSL VPN Pre-Auth RCE (CVE-2024-21762)](https://erroneo.us/security/briefs/fortios-ssl-vpn-out-of-bounds-write-rce/index.md) — 2024-02-08 · Act now · Any FortiGate or FortiProxy with SSL VPN enabled on an unfixed build is exposed to unauthenticated remote code execution that has been exploited; upgrade or disable SSL VPN today.
- [Leaky Vessels: runc Container Escape (CVE-2024-21626)](https://erroneo.us/security/briefs/runc-leaky-vessels-container-escape/index.md) — 2024-01-31 · Patch this week · A real container escape, but it needs you to run an attacker-controlled image or a crafted exec; patch runc everywhere promptly, urgently where untrusted images or multi-tenant builds run.
- [Jenkins CLI Arbitrary File Read (CVE-2024-23897)](https://erroneo.us/security/briefs/jenkins-cli-args4j-arbitrary-file-read/index.md) — 2024-01-24 · Act now · An unpatched Jenkins controller reachable by untrusted users leaks files and secrets that can lead to full takeover; upgrade now or disable the CLI.
- [GitLab Password Reset Flaw Enables Account Takeover](https://erroneo.us/security/briefs/gitlab-password-reset-account-takeover/index.md) — 2024-01-11 · Act now · Any self-managed GitLab still on 16.1 through 16.7.1 lets anyone take over accounts without 2FA by email alone; upgrade immediately and turn on 2FA.
- [Ivanti Connect Secure Zero-Day Chain: Unauthenticated RCE](https://erroneo.us/security/briefs/ivanti-connect-secure-auth-bypass-command-injection/index.md) — 2024-01-10 · Act now · This chain was exploited as a zero-day by a suspected nation-state actor and then mass-exploited; any unpatched appliance should be assumed compromised, not just patched.
- [Confluence CVE-2023-22518: Unauthenticated Reset to Admin](https://erroneo.us/security/briefs/confluence-improper-authorization-cve-2023-22518/index.md) — 2023-10-31 · Act now · Any self-hosted Confluence that is reachable from the internet and not on a fixed release can be wiped and taken over by an unauthenticated request; patch or pull it offline, and Atlassian Cloud users have nothing to do.
- [Cisco IOS XE Web UI Zero-Day Chain Implants Devices](https://erroneo.us/security/briefs/cisco-ios-xe-web-ui-cve-2023-20198/index.md) — 2023-10-16 · Act now · If any IOS XE device has its HTTP or HTTPS server reachable from an untrusted network and is not on a fixed release, treat it as compromised until proven otherwise; devices with the web UI disabled were never exposed.
- [curl SOCKS5 Heap Overflow: Hyped, but Narrow in Practice](https://erroneo.us/security/briefs/curl-socks5-heap-overflow-cve-2023-38545/index.md) — 2023-10-11 · Most can relax · Pre-announced as the worst curl flaw in a long time, the bug only bites when libcurl uses a SOCKS5 proxy with remote name resolution and an attacker can supply a very long hostname; take 8.4.0 or later in normal patching, and hurry only if that proxy setup applies to you.
- [Citrix Bleed: NetScaler Gateway Leaks Session Tokens](https://erroneo.us/security/briefs/citrix-bleed-netscaler-cve-2023-4966/index.md) — 2023-10-10 · Act now · If a NetScaler configured as a Gateway or AAA server is still on a vulnerable build, assume it is being probed and patch, kill every session, and hunt; patching alone does not evict an attacker holding a stolen session.
- [HTTP/2 Rapid Reset: Record DDoS Flaw in HTTP/2 Servers](https://erroneo.us/security/briefs/http2-rapid-reset-ddos-cve-2023-44487/index.md) — 2023-10-10 · Check exposure · This is availability-only and was exploited at record scale, but if your HTTP/2 traffic terminates at a major CDN or cloud load balancer the provider already absorbed it; check what terminates HTTP/2 on your own servers.
- [LangChain PALChain: Prompt Injection to RCE (CVE-2023-44467)](https://erroneo.us/security/briefs/langchain-palchain-prompt-injection-rce-cve-2023-44467/index.md) — 2023-10-09 · Check exposure · Only apps that feed untrusted text into PALChain (or similar LLM-to-Python chains) are at risk, but for them it is full code execution, and blocklist fixes kept getting bypassed, so remove the pattern rather than trust the patch.
- [KNX CVE-2023-4346: Building Automation BCU Key Lockout](https://erroneo.us/security/briefs/knx-bcu-key-lockout-cve-2023-4346/index.md) — 2023-08-24 · Check exposure · Only buildings with KNX devices that have no BCU key set and a network path to the KNX bus are at risk, but there is no patch and a lockout can mean physically replacing devices.
- [Strapi CVE-2023-22894: 2023 Password-Hash Leak Now in KEV](https://erroneo.us/security/briefs/strapi-cve-2023-22894-private-field-leak-kev/index.md) — 2023-04-17 · Check exposure · Only Strapi builds older than 4.8.0 (March 2023) are affected, but on those an unauthenticated attacker can take over the super admin, so any you find should be upgraded or taken offline today.
- [AjaxPro CVE-2021-23758: Old ASP.NET RCE Now in CISA KEV](https://erroneo.us/security/briefs/ajaxpro-deserialization-rce-cve-2021-23758/index.md) — 2021-12-03 · Check exposure · If an ASP.NET app you run still ships AjaxPro, treat it as an unauthenticated RCE and upgrade or remove the library now; if you never used AjaxPro, there is nothing to do.
- [DD-WRT CVE-2021-27137: UPnP Overflow Used by C0XMO Botnet](https://erroneo.us/security/briefs/dd-wrt-upnp-ssdp-overflow-cve-2021-27137/index.md) — 2021-03-24 · Check exposure · Only routers running an old DD-WRT build with UPnP turned on are at risk; find any you own, update or retire them, and switch UPnP off where nobody needs it.
- [ONLYOFFICE Docs CVE-2021-3199: Old Upload RCE Now in KEV](https://erroneo.us/security/briefs/onlyoffice-document-server-path-traversal-cve-2021-3199/index.md) — 2021-01-22 · Check exposure · Only Document Server installs older than 5.6.3, a release from August 2020, are at risk, but any you find should be treated as exposed and upgraded or pulled offline today.
- [SQL Server CVE-2019-1068: 2019 RCE Added to CISA KEV](https://erroneo.us/security/briefs/microsoft-sql-server-cve-2019-1068-authenticated-rce-kev/index.md) — 2019-07-09 · Check exposure · Any SQL Server 2014, 2016 or 2017 instance updated since July 2019 already has the fix; the real work is finding the instances that never got it, now that CISA says attackers are exploiting the bug, and patching or retiring them.
- [Apache Struts S2-032 (CVE-2016-3081): 2016 RCE Now in KEV](https://erroneo.us/security/briefs/apache-struts-s2-032-cve-2016-3081-dmi-rce/index.md) — 2016-04-19 · Check exposure · Only Struts 2.3.20 to 2.3.28 apps with Dynamic Method Invocation turned on are exposed, but any Struts 2.3.x you find is end-of-life, open to worse KEV-listed bugs, and should be fixed or pulled now.
- [ABRT CVE-2015-5287: 2015 RHEL 7 Local Root Bug Now in KEV](https://erroneo.us/security/briefs/abrt-symlink-privilege-escalation-cve-2015-5287/index.md) — 2015-11-23 · Most can relax · This is a ten-year-old local root bug that any RHEL 7 or CentOS 7 host updated since late 2015 already has fixed; the KEV listing matters only for forgotten, never-patched machines, and those have bigger problems.
- [BIND CVE-2015-5477: 2015 TKEY DNS Crash Bug Now in KEV](https://erroneo.us/security/briefs/bind-tkey-assertion-dos-cve-2015-5477/index.md) — 2015-07-28 · Check exposure · Any BIND release from the past decade is fixed, so most teams have nothing to do; the real risk is forgotten DNS servers and appliances still running pre-mid-2015 BIND, which one packet can knock offline.
- [libuser CVE-2015-3246: 2015 Linux Root Bug Lands in KEV](https://erroneo.us/security/briefs/libuser-userhelper-passwd-race-cve-2015-3246/index.md) — 2015-07-23 · Most can relax · Any RHEL or CentOS 6 or 7 host that has taken updates since July 2015 is already fixed; the real risk is forgotten legacy Linux servers, where this is one of several old root exploits attackers now chain after a web compromise.

---
Source page: https://erroneo.us/security/briefs/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt