Archived issue·10-16-2026

verified 1w ago

The Perimeter · Issue 10-16-2026

Session revocation is failing at the edges: KEV adds Zammad, FortiMail, and legacy CVEs

The week's loudest signal is that revocation paths and auth boundaries keep failing at the seams between components. CISA added Zammad session fixation (chainable to root) and FortiMail arbitrary file write to KEV, while Drupal shipped a Wave 2 batch led by a PHP object injection in Block AJAX and Contao disclosed a 9.3 unauthenticated stored XSS that executes in the admin origin.

Published: Friday, October 16, 2026
Entries: 12
Cadence: Weekly · Sundays
Curator: Brad Anderson

Wire

cisa.govNew addition to the Known Exploited Vulnerabilities catalog·

github.comGHSA: critical npm package compromise affecting CI pipelines·

wordfence.comWordPress plugin vulnerability with active exploitation·

drupal.orgHighly critical core security advisory published·

aws.amazon.comAWS security bulletin: IAM policy evaluation update·

unit42.paloaltonetworks.comThreat actor expands toolkit targeting public-facing PHP apps·

krebsonsecurity.comBreach disclosure with named victim and confirmed initial vector·

snyk.ioComposer dependency advisory affecting production framework versions·

cisa.govNew addition to the Known Exploited Vulnerabilities catalog·

github.comGHSA: critical npm package compromise affecting CI pipelines·

wordfence.comWordPress plugin vulnerability with active exploitation·

drupal.orgHighly critical core security advisory published·

aws.amazon.comAWS security bulletin: IAM policy evaluation update·

unit42.paloaltonetworks.comThreat actor expands toolkit targeting public-facing PHP apps·

krebsonsecurity.comBreach disclosure with named victim and confirmed initial vector·

snyk.ioComposer dependency advisory affecting production framework versions·

Web Application

frameworks · browsers · authentication flows

2 entries

github.com1wCVSS 8.1

▲ headline

Vikunja audit: revoked sessions keep receiving live WebSocket pushes

A batch of Vikunja advisories dropped October 9 covering a session-revocation gap: the WebSocket endpoint accepts any valid user JWT without resolving its sid against the sessions table, so revoked sessions keep receiving live pushes indefinitely, and new connections are accepted with tokens from deleted sessions. The release also disclosed CORS trusting any localhost origin with credentials, OAuth token escalation, and DoS vectors.

CVE-2026-62376 CVE-2026-57458 CVE-2026-68581+1 moreVikunja

Fruition take

The transferable lesson for client portals: revocation features must cover every transport, not just HTTP. If your stack pushes over WebSockets, verify a deleted session cannot open a new connection.

github.com1w

Vikunja assignee endpoint leaks emails to read-only members

GHSA-8wvg-r2j4-3737: the task assignees endpoint returns user objects without blanking the email field, disclosing addresses to any read-only project member. Every sibling path in the codebase obfuscates email; this one passes the raw query through. Low severity, high embarrassment in multi-team deployments.

Vikunja

Fruition take

When your API serializes user objects, audit every endpoint that touches them. One missed obfuscation layer leaks PII; data minimization at the serializer beats at the endpoint.

Supply Chain

packages · build systems · dependency attacks

2 entries

github.com1wCVSS 8.2

▲ headline

TinaCMS CLI injects raw Git branch names into generated client code

CVE-2026-108259 (CVSS 8.2): @tinacms/cli interpolates the unescaped Git branch name into generated client.ts, so a crafted branch name closes the string literal and executes arbitrary JavaScript when the consumer build imports the generated module. CVSS 7.6 rides alongside: tina-markdown renders javascript: URLs into live anchors.

CVE-2026-108259 CVE-2026-108260@tinacms/cli@tinacms/web-components

Fruition take

If a client's Next.js site runs Tina, restrict branch-name characters in CI and treat generated client code as an injection sink. Both CVEs need patching, not just the codegen one.

github.com1wCVSS 7.5

Nginx UI writes attacker bodies to disk before validating signatures

CVE-2026-107805 (CVSS 7.5): Nginx UI 2.5.0 through 2.5.x stages unauthenticated request bodies to temp files and syncs them before digest and signature validation. Concurrent requests exhaust tmpfs and disk I/O, taking down the panel and anything sharing the filesystem. Availability only, no auth bypass.

CVE-2026-107805Nginx UI

Fruition take

If you run Nginx UI panels, this pairs with the bundled-proxy advisory from the same day (CVE-2026-107804) that lets forwarded requests slip past IP allowlists. Patch both and put a reverse-proxy body limit in front.

Infrastructure

kubernetes · cloud · network · ingress

1 entry

drupal.org2w

▲ headline

Drupal module meant to restrict routes by IP fails open on dynamic routes

CVE-2026-107255: Restrict route by IP 2.0.0 doesn't reliably restrict dynamic routes, defeating its entire purpose. Access bypass in a module used as an IP allowlist for admin paths means sites relying on it have no actual restriction on those routes.

CVE-2026-107255Drupal Restrict route by IP module

Fruition take

If any client site uses restrict_route_by_ip as a defense layer for admin routes, treat that layer as absent until upgraded to 2.0.1 or 1.3.1. Verify actual restrictions with an out-of-range source IP.

PHP & CMS

wordpress · drupal · plugins · php frameworks

3 entries

drupal.org2w

▲ headline

Drupal Wave 2: Block AJAX PHP object injection is the one to patch first

SA-CONTRIB-2026-192 rates Block AJAX highly critical (20/25): unvalidated user data used to construct blocks can yield PHP object injection and RCE where Layout Builder is enabled. Fix ships in 3.0.2. The same drop includes critical XSS in MathJax, access bypass in Entity Reference Manager and Actstream, and Twig SSTI in Linked Field.

CVE-2026-107249Drupal Block AJAX moduleDrupal

Fruition take

Audit every Drupal 10/11 client for block_ajax and Layout Builder together; that combination is the RCE case. While in composer.lock, check for linked_field, entity_reference_manager, gutenberg, and mathjax in the same pass.

github.com1wCVSS 9.3

Contao comments stored XSS guarantees admin-session compromise on moderation

CVE-2026-107845 (CVSS 9.3): an unauthenticated visitor posts a comment with script that executes in the back end origin when any admin opens the Comments module. Contao ships no CSP on the back end, so moderation ensures exposure, and template editing turns back end write into code execution.

CVE-2026-107845Contao

Fruition take

The pattern generalizes to WordPress comment moderation: untrusted front-end input rendered in a privileged admin context is a takeover path. Verify comment sanitization and put CSP on admin screens.

github.com1wCVSS 4.3

Contao preview-link voter silently never runs, exposing signed share URLs

CVE-2026-107850: a class-name mismatch between the registered service and the on-disk PreviewVoter class made Symfony silently drop the security voter at container compile. Any non-admin with the preview_link module reads every preview link and its signed share URL, which grants access to unpublished or protected pages.

CVE-2026-107850Contao

Fruition take

Audit your Symfony and Drupal sites for security voters and access checks that failed to register; silent container removal is invisible in logs. A quick test: attempt cross-ownership access as a low-priv user.

Identity & Auth

oauth · saml · iam · session attacks

1 entry

github.com1wCVSS 3.5

Contao backend GET actions have no CSRF token

CVE-2026-107848 (CVSS 3.5): Contao's RequestTokenListener only validates POST requests. Any backend action dispatched via GET parameters other than act= can be triggered cross-site without a token, letting an attacker perform state-changing actions as a logged-in admin who loads a crafted URL. Every key= action inherits the gap.

CVE-2026-107848Contao

Fruition take

SameSite=Strict or Lax on session cookies is the cheap mitigation for GET-based CSRF across every PHP app you manage. Verify Drupal and WordPress admin routes are not doing state changes on GET.

Threat Intel

active exploitation · breaches · ransomware

3 entries

nvd.nist.gov3wKEV

▲ headline

Zammad session fixation and privilege escalation chain land on CISA KEV

CISA added CVE-2026-102489 (Zammad session fixation leading to RCE as the zammad user) and CVE-2026-102490 (local zammad user to root) to the KEV catalog on October 2. The two chain: a remote attacker fixes a session, gains code execution, then escalates to root on the host. Both are actively exploited per the KEV listing.

CVE-2026-102489 CVE-2026-102490Zammad

Fruition take

If you self-host Zammad for support portals, patch and rotate immediately; KEV listing means observed exploitation. Government-adjacent clients should assume BOD 22-01-style timelines apply.

nvd.nist.gov3wKEV

▲ headline

FortiMail unauthenticated path traversal to arbitrary file write is now KEV

CVE-2026-104286 lets an unauthenticated attacker write arbitrary files on FortiMail via crafted HTTP requests, exploiting path traversal plus NULL-byte neutralization. CISA added it to KEV October 1. Mail gateways sit at the network edge with stored credentials, making file write a foothold primitive.

CVE-2026-104286FortiMail

Fruition take

FortiMail is common in enterprise stacks Fruition inherited. Inventory for exposed instances this week, patch per vendor guidance, and check for unexpected files in web-writable paths.

nvd.nist.gov2wKEV

KEV sweep pulls in ancient Strapi, Struts, BIND, ProFTPD, and ONLYOFFICE flaws

Alongside modern additions, CISA added a batch of legacy CVEs: Strapi CVE-2023-22894 (chainable with CVE-2023-22621 for RCE), Struts CVE-2016-3081, BIND CVE-2015-5477, ProFTPD CVE-2015-3306, and ONLYOFFICE CVE-2021-3199. All isKev=true with mandatory action, and the Strapi entry flags that affected products may be EoL/EoS with discontinue-use guidance.

CVE-2023-22894 CVE-2016-3081 CVE-2015-5477+2 moreStrapiApache StrutsISC BINDProFTPD

Fruition take

Run a KEV diff against client asset inventories this week. A 2015 ProFTPD or 2016 Struts hit usually means an unmanaged box; decommission beats patching for EoL software.