v vanemmerik.ai / SUPPLY-CHAIN
Supply Chain · Watch Tuesday · 18 August 2026 End-of-day synthesis 4 watches · 13 items

From the watchtower — what crossed the wire today.

A four-times-a-day standing watch on the open-source supply chain. Each pass pulls newly disclosed CVEs, freshly catalogued KEV adds, and active attacks reported in the wild — then ranks them by severity for the day.

The story of the day — A four-vendor CISA KEV cluster — Microsoft twice, VMware, and Apple — lands the same day RubyGems' StubMaker typosquat campaign resurfaces, capped by a late LibreNMS SSRF-to-stored-XSS disclosure batch.

Registries stayed relatively quiet today — the only active poisoning story is RubyGems' StubMaker campaign, which resurfaced with sixteen new typosquats after RubyGems pulled its first two accounts within hours, a genuinely fast takedown worth noting.

The bigger signal came from CISA: four unrelated products — Windows' IKE service, VMware vCenter, SharePoint, and macOS Screen Sharing — all landed on the Known Exploited Vulnerabilities catalog the same day, spanning Microsoft twice, Broadcom, and Apple. That's an unusually wide vendor spread for one KEV batch and reads as four separate active-exploitation events rather than one campaign; vCenter and SharePoint carry the highest stakes since both sit at the center of enterprise infrastructure. Composer also had a rough disclosure day — jmespath.php's compiler-mode code injection sits under aws-sdk-php's dependency tree, and Froxlor's credential-disclosure bug is a real account-takeover primitive for anyone self-hosting it.

Late escalation at 21:00 ET: LibreNMS shipped a same-release disclosure batch after First Watch locked. The sharpest is an SSRF-driven stored XSS — an admin pointing the Oxidized integration URL at an attacker's server gets persistent script execution against every user who opens a device's config tab — alongside a config-gated shell_exec RCE and a second stored XSS in the same 26.7.0 release. All three need an existing admin session to trigger, so this reads as disclosure volume rather than a new active-exploitation event; it doesn't displace vCenter/SharePoint as tonight's priority.

→ Operational priority for the night patch vCenter and SharePoint first — both are internet-facing management planes with a 2026-08-21 CISA due date — then work down the rest of the KEV list. LibreNMS admins should grab 26.7.0 before the weekend; the RubyGems and Composer items can wait for the morning pass.

21:00 ET · Last Watch

LibreNMS: SSRF-driven stored XSS via Oxidized API response fields in device showconfig page

LibreNMS renders JSON fields — device name, model, commit author, commit message — fetched from its admin-configurable Oxidized integration URL straight into the showconfig page without escaping, so an admin pointing oxidized.url at an attacker-controlled server gets persistent XSS against every user who opens that device's config tab. It's SSRF and stored XSS in one primitive: the untrusted response never touches disk, it just gets fetched and echoed. Patch to 26.7.0, and if oxidized.url is externally reachable, audit who has rights to change it.

Same LibreNMS release also patches an admin-gated stored XSS and a config-parameter RCE

The 26.7.0 release covering tonight's Oxidized SSRF-XSS also fixes two more admin-gated findings: a stored XSS in graph_descr settings that any admin can plant against every authenticated viewer, and an AboutController RCE where the snmpget config path is passed to shell_exec() without verifying it still points at the real binary rather than an attacker-planted script. Both need an existing admin session to trigger, so neither is a standalone emergency, but they're cleared by the same 26.7.0 upgrade.

linuxfabrik-lib: Arbitrary root file read via live --test argument across sudoers-whitelisted Nagios/Icinga plugins

Every Linuxfabrik check plugin that accepts the --test argument reads its first CSV element as a filesystem path and returns the contents as simulated stdout — running as root when invoked through the shipped nagios/icinga sudoers allowlist, so the low-privilege monitoring account can read /etc/shadow or SSH keys via deb-updates and get a fleet-wide root file-existence oracle from roughly 22 other whitelisted plugins. It's the same shape as prior monitoring-agent LPEs: a plugin trusted to run under sudo accepts an argument it shouldn't. Upgrade to 6.1.0, or strip --test from the sudoers allowlist in the meantime.

18:00 ET · First Watch

CISA KEV adds VMware vCenter path traversal — arbitrary code execution

CISA added CVE-2026-59310 to the Known Exploited Vulnerabilities catalog: a path traversal in VMware vCenter that lets a threat actor with network access to vCenter execute arbitrary code. vCenter is the management plane for most enterprise VMware estates, so code execution there means full blast radius across every hypervisor it manages. Patch per Broadcom's advisory before the 2026-08-21 CISA due date, and restrict vCenter management-plane network access in the meantime.

CISA KEV adds Microsoft SharePoint weak authentication — security-feature bypass

CISA added CVE-2026-55040: a weak-authentication flaw in SharePoint that lets an unauthorized attacker bypass a security feature over the network. SharePoint auth bypasses have a track record of chaining into full RCE (see this year's ToolShell family), so treat this as a precursor even without a public exploit chain yet. Patch by the 2026-08-21 due date and check SharePoint edge logs for anomalous auth attempts in the interim.

CISA KEV adds Microsoft IKE Service Extensions double-free — remote code execution

CISA added CVE-2026-33824: a double-free in Windows' IKE Service Extensions that enables remote code execution. If you're terminating IPsec/IKE VPNs on Windows Server, this is edge-of-network and plausibly reachable pre-auth. Patch before the 2026-08-21 due date — don't wait for the next maintenance window.

CISA KEV adds Apple macOS Screen Sharing authentication bypass

CISA added CVE-2026-65400: an improper-authentication bug that lets an attacker on the network authenticate to macOS Screen Sharing without valid credentials. Screen Sharing is off by default but common in managed-fleet and remote-support setups; anyone who enabled it is exposing full desktop control to the local network. Patch via Apple's macOS updates or disable Screen Sharing until patched.

jmespath.php: CompilerRuntime code injection via unescaped function names

jmespath.php's CompilerRuntime writes parsed JMESPath function names straight into generated PHP source without escaping them as string literals, so a crafted expression evaluated with JP_PHP_COMPILE enabled turns into arbitrary PHP executing out of the compiled-cache loader. mtdowling/jmespath.php sits under aws-sdk-php and a long tail of Composer packages that expose JMESPath filtering to user input, so the real blast radius is anyone letting attacker-controlled query strings reach CompilerRuntime rather than the default AstRuntime interpreter. Audit for jmespath.php < 2.9.1 in composer.lock and confirm JP_PHP_COMPILE isn't set before trusting external expressions.

MONAI: incomplete fix — algo_from_pickle() pickle.loads() RCE still present in 1.5.2

MONAI's algo_from_pickle() still calls pickle.loads() on attacker-supplied bundles in 1.5.2, despite an earlier advisory (GHSA-89gg-p5r5-q6r4) claiming the path was patched — the same sink surviving a second fix attempt. Anyone loading MONAI Bundle model archives from an untrusted source — shared training pipelines, third-party model mirrors — runs arbitrary code on load. Pin to 1.6.0+, and don't trust a "patched" changelog on a deserialization CVE without checking the diff yourself.

moby/go-archive: crafted tar archive can write outside the extraction directory

A crafted tar archive fed to moby/go-archive's extractor can write files outside the target directory — the classic zip-slip path-traversal shape, in a tar-handling library container build and registry tooling lean on. Anything that extracts tarballs pulled from an untrusted source — image layers, plugin bundles, CI artifact unpacking — inherits the bug until it pins go-archive >= 0.3.0. Grep go.sum for github.com/moby/go-archive and bump; treat any service extracting third-party tar input as exposed until then.

Froxlor: credential and 2FA secret disclosure via API endpoints

Several Froxlor API command classes — Customers, Admins, FTP users — run SELECT * and hand the full row back through the JSON API response, including password hashes and TOTP 2FA seed material. The CVSS vector requires an already-privileged API caller, but that caller can pull enough to defeat both auth factors on any account whose hash it later cracks — a real account-takeover primitive on the multi-tenant hosting boxes Froxlor is built for. Upgrade to 2.3.8+, and treat any TOTP seed that transited an older API response as burned — rotate it.

12:00 ET · Forenoon Watch

StubMaker: 16 typosquatted RubyGems packages steal browser credentials and crypto wallets

StubMaker abuses RubyGems' extconf.rb native-extension install hook — code that runs automatically during `gem install` — to execute a loader; it started with brumdler and brundlef spoofing bundler, and after RubyGems pulled those, resurfaced as sixteen packages (ubnuler, ubnlder, ri18nr, reaker, rakier, orakw, joxn, and others) across two new publisher accounts. The payload is a Windows infostealer that harvests browser-stored credentials, crypto-wallet seed phrases, and Telegram desktop data — same install-hook-as-dropper shape as this year's npm and PyPI campaigns, just ported to RubyGems. Grep Gemfile.lock and CI logs for the listed package names; anyone who installed a near-miss-named gem this week should treat browser and wallet credentials as burned and rotate.

Copyparty: file/dirkey confusion lets a filekey be upgraded into a dirkey

Copyparty (pip) can convert a valid filekey into a dirkey, granting read access to the whole containing folder instead of the single shared file. Blast radius is narrow: it only fires on volumes that enable both filekeys and dirkeys together (volflag `fk`/`fka` plus `dk`/`dks`), and both are default-disabled. If you run Copyparty with both share-key mechanisms turned on, upgrade to 1.20.17+; otherwise this one's a non-event.