Supply Chain · Watch Monday · 31 August 2026 End-of-day synthesis 4 watches · 10 items

From the watchtower — what crossed the wire today.

A four-times-a-day standing watch on the open-source supply chain. Each pass pulls newly disclosed CVEs, freshly catalogued KEV adds, and active attacks reported in the wild — then ranks them by severity for the day.

The story of the day — A pre-auth PaperCut RCE chain still owns tonight's operational priority, but a Kirby CMS security release landing after First Watch — two high-severity fixes for an auth'd storage-exhaustion bug and an encoded-slash path traversal — escalated the day's disclosure count late.

CISA's PaperCut NG/MF KEV entry, added this morning, remains the day's most consequential story — a complete pre-auth chain (missing-auth admin action plus unsafe reflection into arbitrary bytecode) against a print-server product that's a well-worn ransomware entry point, and PaperCut shipping a second emergency patch this week signals the first fix didn't fully hold.

The afternoon brought a cluster of four unrelated GHSA disclosures rather than any active-campaign signal — Socket, Phylum, and Aikido all came back empty, a genuinely quiet registry day. The standout was an elFinder SSRF that beats its own DNS-rebinding guard via the cURL-less fsockopen fallback, non-blind and capable of reading internal secrets back through the upload; a Socket.IO/Engine.IO WebTransport DoS and a TYPO3 upload-filter bug rounded out the disclosed-CVE side, while a Hono OAuth library shipped with a state check that silently no-ops on state-less callbacks. Reporting on the DPRK IT-worker fraud scheme also showed it broadening past engineering roles into healthcare and sales.

Late escalation at 21:00 ET: Kirby CMS shipped 5.5.2 (with a 4.9.5 backport) closing two high-severity issues that landed after First Watch. An authenticated user with API access but no upload permission can flood the chunked-upload temp directory for 24 hours, and a path-traversal bug in the media/thumbnail handler lets encoded-slash-tolerant servers — nginx, PHP's built-in server, misconfigured Apache — probe for arbitrary .json files and pull thumbnails from outside the intended media root. Neither is under active exploitation and both need authentication or a non-default server config, but two high-severity disclosures in one package in one release is worth a same-week upgrade rather than the normal cadence. A medium-severity decode-uri-component ReDoS rounded out the late batch — low urgency alone, but the package sits transitively under enough URL-parsing dependencies to be worth a lockfile grep.

→ Operational priority for the night confirm PaperCut NG/MF is patched to the release that closes both CVE-2026-81578 and CVE-2026-82078 before end of shift; queue the Kirby 5.5.2 upgrade for tomorrow's first patch window if you run getkirby/cms, and treat elFinder, Hono OAuth, and decode-uri-component as normal-cadence items.

21:00 ET · Last Watch

High · GHSA ·added 21:00 ET

Kirby CMS chunked-upload handler skips the caller's upload permission check, letting any authenticated API user exhaust temp storage (CVE-2026-71415)

Kirby's REST API stores incomplete chunked-upload data in a temp directory before the final permission check runs, so any authenticated user with panel access — even one explicitly denied files.create, files.replace, and users.update — can flood that directory with unfinished large-file chunks and hold the storage for 24 hours until cleanup. It's resource exhaustion, not content disclosure or RCE, but it defeats the assumption that revoking upload permissions actually blocks upload-adjacent abuse. Update to Kirby 5.5.2, which adds the preflight permission check before any chunk touches disk.

High · GHSA ·added 21:00 ET

Kirby CMS media/thumbnail handler is path-traversable via encoded slashes, exposing arbitrary .json files and out-of-scope media (CVE-2026-75594)

Kirby's media handler doesn't reject `../` sequences in filenames it looks up inside a page's media directory, and on servers that accept encoded slashes (%2f) in request paths — nginx, PHP's built-in server, or Apache with AllowEncodedSlashes — that gap lets an attacker traverse outside the intended media root, both probing for the existence of arbitrary .json files anywhere on the server and generating/reading thumbnails of media outside the page's own directory. It shipped in the same release as the chunk-upload permission bug above, so it's one upgrade for both. Update to Kirby 4.9.5 or 5.5.2; Apache's hardened default config isn't affected, but don't rely on that alone if you don't control the server.

Medium · GHSA ·added 21:00 ET

decode-uri-component: malformed percent-encoded input triggers exponential-decoding CPU exhaustion (CVE-2026-45822)

A crafted malformed percent-encoded string drives decodeUriComponent() into exponential re-decoding, burning CPU until the process stalls — availability-only, no data exposure or code execution. The package sits transitively under query-string and a long tail of URL/query parsers, so exposure is broader than the direct dependency graph suggests; grep your lockfile rather than assuming you're clear. Upgrade to [email protected], or cap input length at the edge if you can't upgrade immediately.

18:00 ET · First Watch

High · GHSA ·added 18:00 ET

Socket.IO Engine.IO WebTransport session-ID lookup crashes Node via a prototype-pollution edge case (CVE-2026-59724)

A crafted WebTransport upgrade request carrying a session ID like `__proto__` walks the client lookup onto the Object prototype instead of failing closed, throwing an unhandled TypeError that kills the Node process — unauthenticated, remotely triggerable, and repeatable into a crash loop under a supervisor. The blast radius is narrow: WebTransport is opt-in and off by default, so most Socket.IO deployments are unaffected. If you enabled WebTransport, upgrade engine.io to 6.6.7+ or drop `webtransport` from your transports list today.

High · GHSA ·added 18:00 ET

elFinder's URL-upload SSRF guard is beatable by DNS rebinding when the socket fallback is in play (CVE-2026-81889)

validate_address() resolves and allowlists the first IP a hostname returns, but the fsockopen() fallback (used whenever PHP's cURL extension isn't available) re-resolves the same hostname at connect time — a rebinding DNS server that flips from a public IP to loopback after the check lets an attacker reach internal-only services and read the response back through the uploaded file. It's a textbook TOCTOU/no-IP-pinning bug and non-blind: the published PoC exfiltrates a secret straight out of a loopback service. If you run elFinder without the cURL extension, enable it (the cURL path already pins the validated IP) or block URL uploads via urlUploadFilter until a patched release ships.

Medium · GHSA ·added 18:00 ET

@hono/oauth-providers accepts OAuth callbacks with no state on either side, opening login CSRF and forced account linking (CVE-2026-81888)

The state check treats two absent values as a match, so an attacker can drive a victim's browser through a state-less OAuth callback and bind the attacker's own Google/GitHub/Discord/etc. identity into the victim's session; Hono's built-in csrf() middleware doesn't help because it only inspects form posts, not the callback's top-level GET. Affects the google, github, facebook, discord, twitch, linkedin, and msentra providers on @hono/oauth-providers <= 0.8.5 (x/Twitter is safe via PKCE). Upgrade to 0.8.6, and if you rolled your own OAuth callback handler on any framework, check it rejects a callback whose state doesn't match a value your server actually issued.

Medium · GHSA ·added 18:00 ET

TYPO3 Form Framework's MIME-type validator for uploads was registered too early to ever run (CVE-2026-15305)

The MimeTypeValidator for FileUpload/ImageUpload form elements is wired up before the form definition's allowedMimeTypes property is applied, so it never lands in the processing pipeline — the allowlist you configured was silently not enforced server-side. PHP uploads specifically weren't reachable per the advisory, but any other MIME type you meant to block was accepted. Update to TYPO3 14.3.5 LTS and re-check any forms relying on allowedMimeTypes as their only upload filter.

Context · The Hacker News ·added 18:00 ET

DPRK IT-worker fraud scheme expands recruiting fronts into healthcare and sales roles

The North Korea-linked fraudulent-employment scheme — previously concentrated in software/IT contracting — is now placing operatives in sales, marketing, and medical roles at Western companies, per ongoing investigations. It's the same insider-access playbook that has previously delivered npm/PyPI supply-chain footholds when the fronts landed developer jobs; expanding past engineering suggests the identity-verification gaps it exploits (remote-first hiring, contractor vetting) run wider than engineering orgs alone. Worth flagging to HR/recruiting that this isn't only an engineering hiring problem.

12:00 ET · Forenoon Watch

Critical · CISA KEV ·added 12:00 ET

CISA KEV: PaperCut NG/MF auth-bypass and unsafe-reflection bugs chained for unauthenticated RCE (CVE-2026-81578, CVE-2026-82078)

CISA added both halves of the PaperCut NG/MF exploit chain to KEV today: CVE-2026-81578 (CVSS 8.8) lets an unauthenticated request trigger admin backend actions before access validation completes, and CVE-2026-82078 (CVSS 9.4) loads database driver classes by name with no allowlist, turning that config write into arbitrary Java bytecode execution under the PaperCut server account. Attackers are actively chaining them for pre-auth RCE against NG/MF, and PaperCut has already shipped a second emergency patch after researchers broke the first fix. Patch now — print servers are a well-worn ransomware entry point, and this is a complete pre-auth chain, not a partial bypass.

Context · The Hacker News ·added 12:00 ET

ValleyRAT backdoor rides inside a modified, still-validly-signed Chinese adware installer to dodge AV allowlisting

Silver Fox is shipping the ValleyRAT backdoor inside a trojanized build of QN Wallpaper, a real Chinese adware tool — the installer disables Windows Defender via the DisableAntiSpyware key, then runs QnWallpaper.exe's legitimately signed binary to side-load a malicious libcef.dll planted in the same directory, so the backdoor executes inside a process AV already trusts. Same shape as every signed-process/malicious-sibling-DLL technique this watch tracks: the signature check passes because it's checking the wrong file, not because the file is safe. Currently concentrated in China/India consumer traffic, but worth a memory-resident-DLL sweep if your endpoint policy allows adware-adjacent installs at all.