The day was supposed to be locked at First Watch: XWiki criticals, the LiteSpeed cPanel KEV add, the Drupal Core SQLi deadline ticking down. Then between 19:00 and 20:30 ET the GHSA feed opened up — 24 fresh advisories in three hours, including a critical Yamcs RCE, three pre-auth RCEs in FUXA, a path traversal in the npm `tmp` transitive dep, and a Kirby CMS triple.
Three patterns to notice. First, Yamcs (CVE-2026-44632) joins a recent run of disclosures in aerospace open-source — the Janino-based algorithm engine compiles user-controlled text with no sandbox, so any user with the `ChangeMissionDatabase` privilege gets host RCE. Second, the FUXA chain (CVE-2026-43945/43946/43947) is what URL-substring authentication buys you: appending `?x=/socket.io` to any admin path bypasses the entire auth middleware and reaches Node-RED command nodes, even in Secure Mode. Third, the `tmp` npm advisory (CVE-2026-44705, fixed in 0.2.6) is the kind of transitive-dependency bug that hides in two-thirds of Node tooling — anything that passes user input into `prefix`, `postfix`, or `dir` is now writing files outside the tempdir. yeoman-environment 6.0.1 closed a sibling install-on-demand hole (CVE-2026-42089), and Fedify 2.2.3 patched a JSON-LD signature bypass that lets an attacker restructure a signed ActivityPub activity into a different one without invalidating its Linked Data Signature.
→ Operational priority for the night the XWiki and LiteSpeed criticals from First Watch are still the top items before sleep — the Drupal SA-CORE-2026-004 KEV deadline crosses at midnight UTC. Add Yamcs to the upgrade list if you run any aerospace stack on it, and run `npm ls tmp` across your build pipelines to map which transitive deps will pick up 0.2.6. The FUXA chain is severe but its install base is narrow; the Kirby triple matters mainly to Composer-managed PHP sites on 5.3.0–5.4.0.