Supply Chain · Watch Monday · 14 September 2026 End-of-day synthesis 4 watches · 10 items

From the watchtower — what crossed the wire today.

A four-times-a-day standing watch on the open-source supply chain. Each pass pulls newly disclosed CVEs, freshly catalogued KEV adds, and active attacks reported in the wild — then ranks them by severity for the day.

The story of the day — Authentication, not package registries, was today's weak link: CISA gave Cisco's Secure Email Gateway a three-day patch deadline while ESPHome's dashboard silently lost its login on upgrade and ZITADEL shipped two identity-platform fixes of its own.

Today's disclosures cluster on identity and authentication rather than the registries. CISA added a new KEV entry, two more GHSA advisories landed on ZITADEL's identity platform, and a silent regression reopened an already-fixed hole in ESPHome's device dashboard.

CVE-2026-76461 carries the sharpest edge: an unauthenticated SQL injection in Cisco Secure Email Gateway's AsyncOS hands a remote attacker root on the underlying OS, and CISA's three-day BOD 26-04 deadline is itself a signal this is being actively exploited. ESPHome's dashboard container tells a quieter but equally serious story — a well-intentioned env-var rename (CVE-2026-59178, CVSS 9.8) dropped the old $USERNAME/$PASSWORD fallback with no changelog warning, so any operator who set a password the old way silently lost authentication on their next upgrade. ZITADEL adds two more identity-platform bugs to the pile — an OAuth2 token-exchange flaw that lets a low-privilege client trade up to an admin-scoped token (CVE-2026-56668), and a role-cleanup race that can leave revoked permissions in place on shared projects (CVE-2026-76081) — while October CMS fully closed out its Safe Mode-gated patch batch in a single release.

→ Operational priority for the night patch internet-facing Cisco Secure Email Gateway appliances before Thursday's KEV deadline, and check any ESPHome dashboard container you haven't touched since the 2026.6.0 upgrade for the "WITHOUT AUTHENTICATION" startup banner.

18:00 ET · First Watch

Critical · CISA KEV ·added 18:00 ET

CISA adds Cisco Secure Email Gateway SQL injection to KEV with a three-day fix window

Cisco added CVE-2026-76461 to the KEV catalog today: an unauthenticated SQL injection in Secure Email Gateway's AsyncOS lets a remote attacker execute commands as root on the underlying OS. CISA set the BOD 26-04 remediation deadline at just three days out (due 2026-09-17), a compressed window that is itself a signal this is being actively exploited. Patch every internet-facing SEG appliance now and check mail-gateway logs for anomalous SQL-error responses or unexpected shell activity.

Critical · GHSA ·added 18:00 ET

ESPHome Device Builder: renamed auth env vars silently disabled dashboard authentication on upgrade

ESPHome's dashboard renamed its auth env vars from bare $USERNAME/$PASSWORD to $ESPHOME_USERNAME/$ESPHOME_PASSWORD without keeping a fallback or flagging it as breaking in the changelog, so any operator who had protected the dashboard the old way silently lost authentication on upgrade (CVE-2026-59178, CVSS 9.8) — a client past that boundary can flash arbitrary firmware or run code at compile time. It's a textbook silent-regression: the fix ships in 2026.6.2 / esphome-device-builder 1.0.12 and restores the legacy fallback with a loud deprecation warning. Check startup logs on any detached ESPHome dashboard container for the "WITHOUT AUTHENTICATION" banner if you haven't audited it since the 2026.6.0 upgrade.

High · GHSA ·added 18:00 ET

ZITADEL OAuth2 token exchange lets a low-privilege client trade up to an admin-scoped token

ZITADEL's Token Exchange endpoint never verifies that an incoming access token belongs to the client requesting the swap, and doesn't constrain requested scopes to the original token's bounds, so an authenticated low-privilege client can exchange for an admin-scoped token at a completely different application (CVE-2026-56668, CVSS 8.1). Public clients that skip client-secret auth make this trivially reachable. Upgrade to 4.15.3+, or in the interim disable the Token Exchange feature flag and strip the grant type from high-privilege apps.

Medium · GHSA ·added 18:00 ET

ZITADEL role-deletion race can leave revoked permissions in place on shared projects

A race in ZITADEL's cross-org cleanup can skip stripping some roles when multiple project roles are deleted at once on a Granted Project, leaving a user with access that was supposed to be fully revoked (CVE-2026-76081, CVSS 5.5). Scope is narrow — only User Grants on Granted Projects, not direct or org-level roles — but the actual risk depends entirely on what the skipped role allowed. Upgrade to 4.16.0, which runs an automatic migration to correct any already-orphaned grants.

Context · GHSA ·added 18:00 ET

October CMS closes a PHP object-injection sink in backend widget session storage

October CMS's widget session storage serialized state as base64(serialize(...)) and read it back with unserialize() and no allowed_classes restriction, opening a PHP object-injection path (CVE-2026-49400) — but the sink only takes attacker-controlled bytes when cms.safe_mode is enabled, the same narrow opt-in gating today's other October CMS Safe Mode item. Fixed in the same v3.7.17/v4.2.21 release as the sandbox bypass; no separate action needed if you already patched for that.

Context · GHSA ·added 18:00 ET

October CMS image resizer accepted phar:// and other stream-wrapper sources

October's image resizer classified sources as external by checking only for a bare "http" substring, so phar://, file://, and ftp:// stream-wrapper paths could slip into the resize cache and reach PHP metadata deserialization on a later file operation (no CVE assigned yet, fixed in v4.3.5). Same defense-in-depth theme as the rest of today's October CMS batch: exploitation requires a template-authoring primitive that's already trusted with code execution, so this closes a hardening gap rather than a new unauthenticated path.

Context · The Hacker News ·added 18:00 ET

Intruder inside Thai broadband provider 3BB used MeshCentral as a persistent root backdoor

An attacker operating inside Thai broadband provider 3BB used the legitimate remote-management tool MeshCentral to maintain root access and target subscriber credentials, discovered only because the attacker left a staging server exposed on the internet. Living-off-legitimate-tooling for C2 keeps recurring in ISP and MSP compromises this year; if you run MeshCentral or similar RMM tooling internally, audit for unexpected server enrollments and outbound agent check-ins to infrastructure you don't manage.

Context · The Hacker News ·added 18:00 ET

Telegram Desktop lets a chat message plant hidden JavaScript that runs when the chat is exported to HTML

A crafted Telegram message can embed hidden JavaScript that looks like an ordinary link button, survives into HTML exports of that chat, and executes silently — copying every message in the export back to the attacker — when the export file is later opened in a browser. Not a supply-chain bug, but a reminder that "export to HTML" is rendering untrusted content: treat exported chat archives as executable, not inert, and don't open them in a browser profile that holds anything sensitive.

12:00 ET · Forenoon Watch

Context · GHSA ·added 12:00 ET

October CMS patches a Twig-sandbox Safe Mode bypass that lets a markup editor impersonate a superuser

October CMS fixes a chained Safe Mode sandbox bypass (CVE-2026-46696, CVSS 3.3): the Laravel session store was exposed to Twig templates with unrestricted method access, and raw SQL builder methods weren't blocked across the full Eloquent __call forwarding chain, letting a markup editor read arbitrary database values and forge a backend session to impersonate an existing superuser. Impact is narrow by design — it only bites when cms.safe_mode is deliberately enabled for untrusted-editor scenarios like demos or multi-tenant installs, since standard production deployments already restrict markup editing to trusted admins. If you run Safe Mode for a shared-editor or demo instance, upgrade to v3.7.17/v4.2.21; disabling Safe Mode is not a workaround, since Safe Mode is the only sandbox boundary that existed.

Context · The Hacker News ·added 12:00 ET

The Hacker News' weekly recap bundles rogue AI agents, a WeChat worm, and continued PaperCut exploitation

The Hacker News' weekly digest rolls up rogue-AI-agent abuse, a WeChat worm, continued PaperCut exploitation, AI-enabled espionage, and rootkit activity into one link. This feed already triaged the PaperCut KEV entries and the JFrog/Artifactory campaign in higher resolution as they broke; the WeChat worm and rootkit threads named here haven't crossed this watch independently, so treat those two as pointers worth checking rather than confirmed detail. Useful as a single link to send the team for the week's shape, not a substitute for today's other items.