--- title: "Security Digest" url: https://erroneo.us/security/ description: "The daily vulnerability digest for developers and security teams: new CISA KEV entries, critical advisories, and honest verdicts on who must act." type: security-hub section: "Security Digest" date_modified: 2026-10-21 publisher: erroneo.us author: erroneo.us Security Desk license: All rights reserved. Quote with attribution and a link. --- # Security Digest Latest digest: https://erroneo.us/security/2026-10-21/index.md (3 editorial briefs and 3 critical advisories) ## Lead briefs - **Act now** [PHP2Shell: Critical Unauthenticated RCE in PHP](https://erroneo.us/security/briefs/php2shell-php-rce/index.md): If PHP answers HTTP requests anywhere you run it, patch or apply a vendor fix today; this is pre-application, unauthenticated, and attack traffic started before the patch shipped. - **Patch this week** [Node.js October 2026 Security Releases: 10 CVEs Fixed](https://erroneo.us/security/briefs/nodejs-october-2026-security-releases/index.md): Four high-severity fixes, including a Brotli decoder memory-corruption bug the project says permits remote code execution, make this a routine-but-real upgrade: roll every supported line forward this week. - **Act now** [LiteLLM 1.107.0: Malicious PyPI and Docker Release](https://erroneo.us/security/briefs/litellm-1-107-0-supply-chain-compromise/index.md): Check right now whether anything installed litellm 1.107.0 or pulled a LiteLLM image by a floating tag on October 21; if it did, assume every secret that host could read is stolen. ## Take stock - Know what you run. Keep an inventory of internet-facing products (VPNs, firewalls, file-transfer, mail, CMS) and a lockfile or SBOM for every app. You can only act on a digest if you can answer “do we use this?” in minutes. - KEV first. A CVE in CISA’s Known Exploited Vulnerabilities catalog has confirmed exploitation in the wild. If you run the product, it outranks any higher-CVSS bug that nobody is exploiting. - Exposure second. Network-reachable, no-login bugs on internet-facing systems come before local or authenticated ones. A critical CVE behind a VPN you already patched is a scheduled task, not an emergency. - Run the audit command for your stack. npm audit , pip-audit , govulncheck ./... , composer audit , cargo audit , bundle audit , dotnet list package --vulnerable . - Supply-chain incident? Rotate, don’t just upgrade. If a malicious package version ran in your CI or on a laptop, treat every secret it could read as stolen. - Nothing applies? You are done. Most days most teams need to do nothing. The point of reading is knowing that for sure. ## Recent briefs - [PHP2Shell: Critical Unauthenticated RCE in PHP](https://erroneo.us/security/briefs/php2shell-php-rce/index.md) — 2026-10-21 · Act now - [Node.js October 2026 Security Releases: 10 CVEs Fixed](https://erroneo.us/security/briefs/nodejs-october-2026-security-releases/index.md) — 2026-10-21 · Patch this week - [LiteLLM 1.107.0: Malicious PyPI and Docker Release](https://erroneo.us/security/briefs/litellm-1-107-0-supply-chain-compromise/index.md) — 2026-10-21 · Act now - [Plex2Shell: Exploited RCE Chain in Plex Media Server](https://erroneo.us/security/briefs/plex2shell-plex-media-server-rce-chain/index.md) — 2026-10-20 · Act now - [eMudhra CA Key Compromise: Update Non-Browser TLS Clients](https://erroneo.us/security/briefs/emudhra-emsign-intermediate-ca-key-compromise/index.md) — 2026-10-20 · Patch this week - [ConnectWise Cloud Backup: App Credential Abused in M365](https://erroneo.us/security/briefs/connectwise-cloud-backup-skykick-m365-oauth-compromise/index.md) — 2026-10-16 · Act now - [Pillow 13.0.0: Critical Image-Parsing Memory Bugs Fixed](https://erroneo.us/security/briefs/pillow-13-0-0-security-release-image-parsing-rce/index.md) — 2026-10-16 · Patch this week - [BeyondTrust Remote Support CVE-2026-102764 Zero-Day](https://erroneo.us/security/briefs/beyondtrust-remote-support-cve-2026-102764-zero-day/index.md) — 2026-10-15 · Act now - [Siemens Software Center DLL Flaw Abused in ClickFix Attacks](https://erroneo.us/security/briefs/siemens-software-center-dll-sideloading-cve-2026-110936/index.md) — 2026-10-15 · Check exposure - [Next.js: Two Critical Unauthenticated RCEs (Oct 14)](https://erroneo.us/security/briefs/nextjs-use-cache-image-optimizer-rce/index.md) — 2026-10-14 · Patch this week - [PAN-OS CVE-2026-0322: Exploited Management-Interface RCE](https://erroneo.us/security/briefs/pan-os-cve-2026-0322-management-interface-rce/index.md) — 2026-10-14 · Patch this week - [SiteGuard WAF CVE-2026-106931: Exploited Command Injection](https://erroneo.us/security/briefs/siteguard-server-edition-cve-2026-106931-zero-day/index.md) — 2026-10-14 · Patch this week - [Ivanti Connect Secure CVE-2026-104935: Exploited Zero-Day](https://erroneo.us/security/briefs/ivanti-connect-secure-cve-2026-104935-zero-day/index.md) — 2026-10-13 · Act now - [Visual Studio Copilot CVE-2026-103572: Trailing-Dot RCE](https://erroneo.us/security/briefs/visual-studio-copilot-cve-2026-103572-rce/index.md) — 2026-10-13 · Patch this week - [Windows Shell CVE-2026-96951: Exploited MOTW Bypass](https://erroneo.us/security/briefs/windows-shell-motw-bypass-cve-2026-96951/index.md) — 2026-10-13 · Patch this week - [Podman CVE-2026-94603: Images Can Disable the Sandbox](https://erroneo.us/security/briefs/podman-checkpoint-image-sandbox-bypass-cve-2026-94603/index.md) — 2026-10-13 · Check exposure - [SlugFest: npm Trusted Publishing Repo-Name Hijack](https://erroneo.us/security/briefs/slugfest-npm-trusted-publishing-slug-hijack/index.md) — 2026-10-13 · Most can relax - [Go October 2026 Security Releases: 16 Stdlib Fixes](https://erroneo.us/security/briefs/go-october-2026-security-releases/index.md) — 2026-10-08 · Patch this week - [ProFTPD mod_copy CVE-2015-3306: 2015 Bug Added to KEV](https://erroneo.us/security/briefs/proftpd-mod-copy-cve-2015-3306-kev/index.md) — 2026-10-08 · Check exposure - [Argo CD: Repo-Server RCE and AppProject Bypass (Oct 2026)](https://erroneo.us/security/briefs/argo-cd-october-2026-repo-server-rce-appproject-bypass/index.md) — 2026-10-07 · Patch this week ## Latest known exploited - 2026-10-20 [CVE-2026-96656](https://erroneo.us/security/cve/CVE-2026-96656/index.md) Plex Media Server: Plex Media Server External Control of File Name or Path Vulnerability (due 2026-10-23; ransomware: Unknown) - 2026-10-20 [CVE-2026-96655](https://erroneo.us/security/cve/CVE-2026-96655/index.md) Plex Media Server: Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability (due 2026-11-03; ransomware: Unknown) - 2026-10-20 [CVE-2026-96654](https://erroneo.us/security/cve/CVE-2026-96654/index.md) Plex Media Server: Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page Vulnerability (due 2026-10-23; ransomware: Unknown) - 2026-10-20 [CVE-2026-96652](https://erroneo.us/security/cve/CVE-2026-96652/index.md) Plex Media Server: Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability (due 2026-11-03; ransomware: Unknown) - 2026-10-20 [CVE-2026-110936](https://erroneo.us/security/cve/CVE-2026-110936/index.md) Siemens Software Center: Siemens Software Center Uncontrolled Search Path Element Vulnerability (due 2026-11-03; ransomware: Unknown) - 2026-10-20 [CVE-2026-106931](https://erroneo.us/security/cve/CVE-2026-106931/index.md) EG Secure Solutions SiteGuard Server Edition: EG Secure Solutions SiteGuard Server Edition OS Command Injection Vulnerability (due 2026-10-23; ransomware: Unknown) - 2026-10-16 [CVE-2026-102764](https://erroneo.us/security/cve/CVE-2026-102764/index.md) BeyondTrust Remote Support: BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability (due 2026-10-19; ransomware: Unknown) - 2026-10-16 [CVE-2025-61624](https://erroneo.us/security/cve/CVE-2025-61624/index.md) Fortinet Multiple Products: Fortinet Multiple Products Path Traversal Vulnerability (due 2026-10-19; ransomware: Unknown) - 2026-10-15 [CVE-2026-21589](https://erroneo.us/security/cve/CVE-2026-21589/index.md) Atlassian Multiple Products: Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability (due 2026-10-18; ransomware: Unknown) - 2026-10-14 [CVE-2026-76519](https://erroneo.us/security/cve/CVE-2026-76519/index.md) Cisco Secure Email Gateway: Cisco Secure Email Gateway Relative Path Traversal Vulnerability (due 2026-10-17; ransomware: Unknown) - 2026-10-14 [CVE-2026-105134](https://erroneo.us/security/cve/CVE-2026-105134/index.md) Ahsay AhsayCBS: Ahsay AhsayCBS Command Injection Vulnerability (due 2026-10-17; ransomware: Unknown) - 2026-10-14 [CVE-2026-105133](https://erroneo.us/security/cve/CVE-2026-105133/index.md) Ahsay AhsayCBS: Ahsay AhsayCBS Improper Authentication Vulnerability (due 2026-10-17; ransomware: Unknown) - 2026-10-14 [CVE-2026-0322](https://erroneo.us/security/cve/CVE-2026-0322/index.md) Palo Alto Networks PAN-OS: Palo Alto Networks PAN-OS Code Injection Vulnerability (due 2026-10-17; ransomware: Unknown) - 2026-10-13 [CVE-2026-96951](https://erroneo.us/security/cve/CVE-2026-96951/index.md) Microsoft Windows: Microsoft Windows Command Injection Vulnerability (due 2026-10-16; ransomware: Unknown) - 2026-10-13 [CVE-2026-104935](https://erroneo.us/security/cve/CVE-2026-104935/index.md) Ivanti Connect Secure: Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability (due 2026-10-16; ransomware: Unknown) ## Indexes - https://erroneo.us/security/briefs/index.md - https://erroneo.us/security/kev/index.md - https://erroneo.us/security/vendor/index.md - https://erroneo.us/security/ecosystem/index.md ## Archive - https://erroneo.us/security/archive/2026-10/index.md - https://erroneo.us/security/archive/2026-09/index.md - https://erroneo.us/security/archive/2026-08/index.md - https://erroneo.us/security/archive/2026-07/index.md - https://erroneo.us/security/archive/2026-06/index.md - https://erroneo.us/security/archive/2026-05/index.md - https://erroneo.us/security/archive/2026-04/index.md - https://erroneo.us/security/archive/2026-03/index.md - https://erroneo.us/security/archive/2026-02/index.md - https://erroneo.us/security/archive/2026-01/index.md - https://erroneo.us/security/archive/2025-12/index.md - https://erroneo.us/security/archive/2025-11/index.md - https://erroneo.us/security/archive/2025-10/index.md - https://erroneo.us/security/archive/2025-09/index.md - https://erroneo.us/security/archive/2025-08/index.md - https://erroneo.us/security/archive/2025-07/index.md - https://erroneo.us/security/archive/2025-06/index.md - https://erroneo.us/security/archive/2025-05/index.md - https://erroneo.us/security/archive/2025-04/index.md - https://erroneo.us/security/archive/2025-03/index.md - https://erroneo.us/security/archive/2025-02/index.md - https://erroneo.us/security/archive/2025-01/index.md - https://erroneo.us/security/archive/2024-12/index.md - https://erroneo.us/security/archive/2024-11/index.md - https://erroneo.us/security/archive/2024-10/index.md - https://erroneo.us/security/archive/2024-09/index.md - https://erroneo.us/security/archive/2024-08/index.md - https://erroneo.us/security/archive/2024-07/index.md - https://erroneo.us/security/archive/2024-06/index.md - https://erroneo.us/security/archive/2024-05/index.md - https://erroneo.us/security/archive/2024-04/index.md - https://erroneo.us/security/archive/2024-03/index.md - https://erroneo.us/security/archive/2024-02/index.md - https://erroneo.us/security/archive/2024-01/index.md - https://erroneo.us/security/archive/2023-12/index.md - https://erroneo.us/security/archive/2023-11/index.md - https://erroneo.us/security/archive/2023-10/index.md - https://erroneo.us/security/archive/2023-08/index.md - https://erroneo.us/security/archive/2023-04/index.md - https://erroneo.us/security/archive/2021-12/index.md - https://erroneo.us/security/archive/2021-03/index.md - https://erroneo.us/security/archive/2021-01/index.md - https://erroneo.us/security/archive/2019-07/index.md - https://erroneo.us/security/archive/2016-04/index.md - https://erroneo.us/security/archive/2015-11/index.md - https://erroneo.us/security/archive/2015-07/index.md --- Source page: https://erroneo.us/security/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt