Supply Chain · Watch Thursday · 06 August 2026 End-of-day synthesis 4 watches · 10 items

From the watchtower — what crossed the wire today.

A four-times-a-day standing watch on the open-source supply chain. Each pass pulls newly disclosed CVEs, freshly catalogued KEV adds, and active attacks reported in the wild — then ranks them by severity for the day.

The story of the day — Traefik's auth-bypass batch and Craft CMS's password-reset-to-RCE chain anchored the day, then a late PHP_CodeSniffer CI command injection and a pdf.js scripting bug closed it out.

The day opened with a factory-shipped router backdoor and a quiet defensive win, then turned into two multi-CVE disclosure batches by evening. VulnCheck's ENDLESSDOORS finding and Bundler's cooldown extension were the morning's story; by afternoon, Traefik and Craft CMS each shipped clustered advisories that chain into full authentication bypass.

Traefik's is its third disclosure round in three days: a new unauthenticated bypass in ReplacePathRegex repeats the same unnormalized-path gap that StripPrefix had before CVE-2026-48020, and three sibling advisories add header-spoofing, a Kubernetes Ingress rewrite bypass, and a Gateway API route-identity collision — four bugs from what reads like one audit pass. Craft CMS's batch chains worse: a mass-assignment bug lets any authenticated session reset another user's password without the elevated-session check normally required, and that takeover connects directly to two separate authenticated RCEs — a Twig sandbox escape and a condition.config smuggling bug — so a single low-privilege login is one exploit chain from shell. The same release quietly clears five more findings, including a stored XSS that forges admin sessions, so one upgrade closes the whole batch.

Late escalation at 21:00 ET: two more high-severity disclosures landed in the final hours of the day. PHP_CodeSniffer's Gitblame/Hgblame/Svnblame reports pass an attacker-controlled filename straight into a shell command, so any CI pipeline or pre-commit hook that lints third-party or forked-PR code is exposed to command injection. Separately, pdf.js's default-on scripting lets a malicious PDF execute JavaScript in the hosting page, and ngx-extended-pdf-viewer forks pdf.js internally, so it carries the same hole invisibly to scanners that key off package.json.

→ Operational priority for the night patch Traefik to v3.7.10 / v3.6.25 / v2.11.53 and Craft CMS to its latest release before Monday, drop Gitblame/Hgblame/Svnblame from any CI job scanning untrusted repos until PHP_CodeSniffer is on 3.13.6 / 4.0.2, and if you serve user-uploaded PDFs through pdf.js or ngx-extended-pdf-viewer, patch or add a script-src CSP tonight.

21:00 ET · Last Watch

High · GHSA · high · CVE-2026-67434 · Composer · PHP_CodeSniffer: gitblame report command injection via crafted filename ·added 21:00 ET

PHP_CodeSniffer's Gitblame/Hgblame/Svnblame reports pass an attacker-controlled filename into a shell command

PHP_CodeSniffer's Gitblame, Hgblame, and Svnblame report generators build a shell command from the filename being scanned without sanitizing shell metacharacters, so linting a repository containing a maliciously-named file executes arbitrary commands on the scanning host. This bites any CI pipeline, pre-commit hook, or reviewer workstation that runs PHP_CodeSniffer over forked-PR or third-party code — the tool is doing exactly what it's supposed to when it triggers. Upgrade to 3.13.6 / 4.0.2, or drop the *blame reports from any job scanning untrusted repositories until you do.

High · GHSA · high · CVE-2026-16633 · npm · pdf.js / ngx-extended-pdf-viewer: arbitrary JavaScript execution on malicious PDF ·added 21:00 ET

pdf.js executes attacker JavaScript on a malicious PDF by default; ngx-extended-pdf-viewer forks the engine so the fix is invisible to scanners

Mozilla's pdf.js runs attacker-controlled JavaScript in the hosting page's context when it opens a malicious PDF, since enableScripting defaults to true and most deployments carry no restrictive CSP. ngx-extended-pdf-viewer bundles a forked copy of pdf.js instead of depending on pdfjs-dist, so dependency scanners keyed off package.json won't flag it even after upgrading everything else. Patch pdfjs-dist to >= 6.2.108 or ngx-extended-pdf-viewer to 29.0.0-rc.3, and add a script-src CSP as defense in depth for anywhere user-uploaded PDFs get rendered.

Medium · GHSA · medium · Composer · Craft CMS (5 more advisories in the same release) ·added 21:00 ET

Same Craft CMS release also patches an admin-session-forging stored XSS, an env-var leak, and three lower-severity findings

The same Craft CMS release covering tonight's password-reset-to-RCE chain also fixes five more findings: a stored XSS via unescaped draft names that a low-privilege author can use to forge an administrator's session and create a new admin account, an authenticated Twig-sandbox leak of environment variables and secrets via blind exfiltration, a missing-permission check exposing user registration metrics, a theoretical local-filesystem path traversal, and an admin-only arbitrary file read via an unblocked SplFileObject instantiation. None needs standalone emergency response, but they're all cleared by the same 5.10.8 / 4.18.2 upgrade — patch once, close the whole batch.

Context · BleepingComputer ·added 21:00 ET

ClickFix social-engineering lure now delivers a Go-based macOS infostealer targeting crypto wallets and Keychain data

A Go-based infostealer delivered through ClickFix — the fake-CAPTCHA, paste-this-command lure — is now targeting macOS, pulling cryptocurrency wallet files, browser-saved passwords, and Apple Keychain data. It's the same delivery mechanism behind a year of Windows ClickFix campaigns that have fed credential and supply-chain-adjacent theft, just ported to Mac. If endpoint tooling only flags ClickFix's clipboard-paste pattern on Windows, that's a detection gap worth closing before it shows up in an incident.

18:00 ET · First Watch

Critical · GHSA · critical · CVSS 9.1 · Go · Traefik: Authentication bypass via path traversal in ReplacePathRegex middleware ·added 18:00 ET

Traefik's ReplacePathRegex middleware forwards an unnormalized path to the backend, letting an unauthenticated request bypass auth middleware entirely

Traefik's ReplacePathRegex middleware forwards a regex-captured path replacement to the backend without normalizing it first, so a request like /api../admin becomes /../admin and a backend that does normalize paths resolves it straight into a route sitting behind auth middleware — no credentials required. It's the same unauthenticated-bypass shape as the fix applied to StripPrefix for CVE-2026-48020, just left unpatched in the sibling middleware, and it's the fourth Traefik advisory in three days after yesterday's Kubernetes CRD/Gateway API namespace-isolation bypasses. Patch to v2.11.52 / v3.6.23 / v3.7.7; if you use ReplacePathRegex with an unanchored capture group, treat every route behind it as unauthenticated until you do.

High · GHSA · high · Go · Traefik (3 more advisories) ·added 18:00 ET

Same Traefik batch also covers header-spoofing, a Kubernetes Ingress NGINX rewrite bypass, and a Gateway API route-identity collision

The same batch adds three more: an incomplete fix for the BasicAuth/DigestAuth/ForwardAuth identity-spoofing bug (the CVE-2026-33433 fix stripped canonical X-Auth-User headers but missed the underscore variant X_Auth_User, which many backends still normalize identically); a Kubernetes Ingress NGINX RewriteTarget path traversal that produces the same route-level auth bypass shape as the ReplacePathRegex bug above; and a Gateway API identity collision where two Routes with hyphenated names can hash to the same internal identity, letting a tenant hijack another namespace's traffic. Four coordinated advisories in one afternoon reads like the output of a single audit pass — assume it found more than got disclosed today. Upgrade to v3.7.10 (or v3.6.25 on the LTS line) to pick up all three fixes at once; Traefik v3 minors older than v3.6 are past end-of-life and won't get patches.

High · GHSA · high · Composer · Craft CMS (3 advisories): password-reset takeover chains into two authenticated RCEs ·added 18:00 ET

Craft CMS ships a password-reset-to-RCE chain: a mass-assignment bug lets any authenticated session reset another user's password, which then unlocks two separate authenticated RCE bugs

Craft CMS shipped three advisories together: a mass-assignment bug in the user-save action lets any authenticated session — including a low-privileged one — set newPassword without verifying the current password, and an account with only edit-users permission (not the higher administrate-users permission) can use it to reset an administrator's password outright. Chained with either of the other two, that takeover becomes RCE: a Twig sandbox escape lets an authenticated template author call unsandboxed methods on allow-listed classes, and a separate condition.config bug smuggles Yii behavior/event keys past Craft's config-cleanse step for a semi-blind authenticated RCE confirmed to execute OS commands as the web user. If Craft manages any authenticated self-registration or low-trust accounts, patch immediately — this is a full path from any logged-in user to command execution.

12:00 ET · Forenoon Watch

High · GHSA · high · Go · Traefik: Cross-user response poisoning via proxied CONNECT on Traefik's shared backend keep-alive pool ·added 12:00 ET

Traefik's default reverse proxy lets an unauthenticated HTTP/2 or HTTP/3 client poison another client's response via CONNECT-pool desync

Traefik's default reverse proxy forwards HTTP/2 and HTTP/3 CONNECT bodies to HTTP/1.1 backends over a shared connection pool; if the backend answers with a keep-alive non-2xx and doesn't drain the body, the desynchronized socket goes back into the pool and a later client can read another client's smuggled response — a bounded-pool test showed 7 of 8 sequential victims received someone else's data. It's the same root-cause class as the Caddy reverse_proxy CONNECT-pool-poisoning bug (shared net/http.Transport pooling a socket after an undrained non-2xx); Traefik's sanitizePath option is not a reliable mitigation since Go and gunicorn/Flask backends still answer CONNECT / with a keep-alive response. Patch to v2.11.53 / v3.6.24 / v3.7.9; if you can't patch immediately, set maxIdleConnsPerHost: -1 to disable backend pooling as a stopgap.

06:00 ET · Morning Watch

Critical · The Hacker News · VulnCheck ·added 06:00 ET

Factory-shipped ENDLESSDOORS backdoor found across all current Zbtlink/Wiflyer router firmware

VulnCheck disclosed ENDLESSDOORS, a factory-shipped backdoor present in all 21 currently-available firmware images across at least 20 Zbtlink/Wiflyer-branded router models spanning more than two years. The implant runs as root, masquerades as a kernel thread, and beacons unauthenticated to Chinese C2 infrastructure every 35 seconds — a bare "hello" plus the LAN MAC address is enough to get a live interactive root shell via a reserved "rctlbash" command; VulnCheck estimates roughly 100,000 affected devices sold through Amazon and Alibaba. If Zbtlink or Wiflyer hardware turns up in an asset inventory, pull it offline or block outbound C2 egress now — there's no patch yet, and the vendor is denying the backdoor while quietly pausing firmware downloads.

Medium · Socket ·added 06:00 ET

Ruby's Bundler 4.0.18 extends the gem-publish cooldown to bundle lock and bundle cache

Bundler 4.0.18 extends its opt-in cooldown control — which delays dependency resolution on newly-published gem versions — to bundle lock and bundle cache, closing a gap where lockfile generation and vendoring could still pull a gem before its cooldown window expired. Same defensive shape as npm's post-publish holds: it buys time for scanners and community reports to catch a bad release before it's baked into a lockfile or vendored into a repo. If you've already enabled Bundler cooldown, upgrade to 4.0.18 to get the same protection on lock/cache, not just install.