v vanemmerik.ai / SUPPLY-CHAIN
vanemmerik.ai / supply-chain / 2026-09-08
Supply Chain · Watch Tuesday · 08 September 2026 End-of-day synthesis 4 watches · 15 items

From the watchtower — what crossed the wire today.

A four-times-a-day standing watch on the open-source supply chain. Each pass pulls newly disclosed CVEs, freshly catalogued KEV adds, and active attacks reported in the wild — then ranks them by severity for the day.

The story of the day — Next.js and Astro's shared libheif AVIF RCE anchored the day, but CISA's evening KEV add of a pre-auth RCE in N-able N-central — MSP tooling with Kaseya-class blast radius — is the story that matters most before you log off.

The day started with yesterday's Magento zero-day finally getting a patch, and closed with a reminder that shared dependencies mean shared blast radius: Next.js and Astro both shipped unauthenticated RCE advisories for the exact same libheif-via-sharp AVIF decode bug within the same hour, because both frameworks hand untrusted image bytes to the same native decoder underneath sharp. sharp itself, Predis, CakePHP, and a CVSS-10 zero-click sanitizer bypass in MapLibre GL JS rounded out an unusually heavy critical batch from GHSA this evening.

The other thread worth naming is repetition: xmldom shipped 11 same-day advisories built on the identical shape as this morning's NLTK batch, where a guard exists in the code but doesn't enforce what its name promises. Aikido's catch of XCSSET live inside a compromised Flutter package on pub.dev is today's bright spot only in the sense that it was caught fast. Late escalation at 21:00 ET: CISA added three fresh KEV entries after First Watch locked the day's shape, and the one that matters is a pre-authentication remote-code-execution bug in N-able's N-central RMM platform (CVE-2026-86218) — the same MSP-tooling blast-radius class as Kaseya VSA — carrying a three-day federal remediation deadline. Two Windows local-privilege-escalation KEV adds (Update Stack link-following, ALPC heap overflow) round out the late batch on the standard 14-day clock.

→ Operational priority for the night patch N-able N-central to 2026.3 hotfix 4 immediately if you run it anywhere in your MSP or monitoring stack — CISA's deadline is September 11 — then patch sharp to 0.35.4 across every service that touches it directly or through Next.js/Astro, and audit any pub.dev-sourced Flutter dependency pulled in the last month before trusting your next iOS/macOS CI build.

21:00 ET · Last Watch
Critical · CISA KEV ·added 21:00 ET

CISA adds pre-auth RCE in N-able N-central to KEV with a 3-day remediation deadline

CVE-2026-86218 is a static code injection vulnerability in N-able's N-central RMM/monitoring platform that CISA confirms is being exploited for pre-authentication remote code execution. N-central sits in the same MSP-tooling blast-radius class as Kaseya VSA — a single compromised instance can pivot into every downstream client it manages. CISA's federal deadline is September 11 (three days out); apply the vendor's 2026.3 hotfix 4 now regardless of your BOD 26-04 exposure.

Critical · CISA KEV ·added 21:00 ET

CISA adds two Windows local-privilege-escalation bugs to KEV: Update Stack link-following and an ALPC heap overflow

CVE-2026-81963 (Windows Update Stack link-following) and CVE-2026-85880 (Advanced Local Procedure Call heap overflow) both let a local attacker escalate to SYSTEM and are now confirmed exploited per CISA. Neither needs network access, so they matter most as the second stage after any initial foothold — including a supply-chain-delivered payload. Standard 14-day BOD 26-04 clock (due September 22); prioritize shared-tenancy and internet-facing Windows hosts first.

18:00 ET · First Watch
Critical · Aikido ·added 18:00 ET

Aikido finds XCSSET malware bundled inside a compromised Flutter package live on pub.dev

Aikido caught a Flutter package on pub.dev shipping XCSSET, the macOS/Xcode-project-infecting malware family that's been circulating since 2020, complete with its usual stealer and propagation modules. This is the same playbook as every registry-poisoning campaign this year: pub.dev has far less scrutiny than npm or PyPI, and a Flutter/Dart shop pulling this package into a CI box with Xcode installed hands the malware a path onto every other project that box touches. If you build for iOS/macOS with Flutter, audit pub.dev dependencies pulled in the last month and check build machines for XCSSET's known indicators before trusting a green CI run.

Critical · GHSA ·added 18:00 ET

Next.js discloses two same-day unauthenticated RCEs: AVIF image optimization and a Windows-filesystem path

Next.js shipped two unauthenticated RCE advisories at once: GHSA-2xp9 is the same libheif-via-sharp AVIF decode flaw hitting every framework that delegates image optimization to sharp, reachable by anyone who can get Next.js to optimize an untrusted AVIF; GHSA-p293 (CVSS 9.0) is a separate Pages/App Router bug that only fires on Windows-hosted servers, with no workaround short of upgrading. Any Next.js deployment that accepts user-supplied images for optimization is exposed until patched, and Windows-hosted instances have no mitigation to fall back on in the meantime. Upgrade to Next.js 15.5.24 / 16.3.3 now; if you can't patch immediately, disable AVIF optimization and treat any Windows-hosted server as unshielded.

Critical · GHSA ·added 18:00 ET

Astro ships the same libheif AVIF RCE that hit Next.js the same afternoon

Astro's default Sharp-backed image service inherits the identical libheif AVIF decode vulnerability (CVSS 9.8) disclosed against Next.js within the same hour — both frameworks hand untrusted AVIF bytes to the same vulnerable native decoder underneath sharp. This is a supply-chain-shaped bug wearing a framework's clothes: the real fix lives in libheif/sharp 0.35.4, and every downstream framework that didn't pin a patched sharp was exposed the moment the upstream advisory went public. Upgrade to Astro 7.2.8 (which pulls Sharp 0.35.4), and if you run any other Node image-processing stack on sharp directly, check its libheif version rather than waiting for a framework-specific advisory.

Critical · GHSA ·added 18:00 ET

Predis: unauthenticated CRLF smuggling into pipelined Redis commands on cluster/replication connections

Predis fails to neutralize CRLF in pipelined command arguments on aggregate (cluster/replication) connections, so any value or key an attacker can influence — including something as ordinary as a URL slug used as a cache key — can smuggle arbitrary Redis commands into the stream. On cluster connections that's shard-wide FLUSHDB, targeted DEL/SET, and same-slot key theft; CVSS 9.8, unauthenticated, no user interaction. Audit anywhere user input reaches a Predis pipelined call with cluster or replication connections configured, and upgrade past 3.3.0 before assuming your cache layer is trusted.

Critical · GHSA ·added 18:00 ET

CakePHP ships two same-day advisories: Postgres JSON-path SQL injection and SMTP header CRLF injection

CakePHP disclosed FunctionsBuilder::jsonValue() as SQL-injectable when user data reaches the $jsonPath parameter under PostgresDriver, and separately found SmtpTransport never strips CRLF from headers set via setHeaders()/addHeaders(), opening header injection into outbound mail. Neither requires anything exotic — just user-controlled data reaching a JSON-path query builder or a mail header, both common patterns in CRUD apps and notification code. Grep for jsonValue() calls with request-derived paths and any addHeaders()/setHeaders() call fed from user input; patch to 5.3.7/5.2.15/5.1.10 (SQLi) and 5.3.7/5.2.14/5.1.9/4.6.5/4.5.12 (CRLF).

Critical · GHSA ·added 18:00 ET

MapLibre GL JS: zero-click XSS sanitizer bypass via a live-NamedNodeMap iteration bug (CVSS 10.0)

MapLibre's DOM.sanitize() iterates elem.attributes — a live NamedNodeMap — while calling removeAttribute() in the same loop, so removing one attribute shifts the next one down an index and the iterator skips it; a payload like <details open onload="1" ontoggle="..."> has its first dangerous attribute stripped but the second survives and fires on insertion, no click required. CVSS 10.0, unauthenticated, zero user interaction — any app rendering attacker-influenced HTML through MapLibre popups or markers (a common pattern for map annotations, tooltips, geocoded place names) is exposed. Upgrade past 6.4.0 and treat any previously 'sanitized' marker/popup content as unsanitized until you do.

High · GHSA ·added 18:00 ET

xmldom ships 11 same-day advisories — the same 'sanitization theater' shape as this morning's NLTK batch

xmldom disclosed 11 advisories at once: five are requireWellFormed() bypasses where an embedded line terminator slips an injection past validation on the default serialization path (processing instructions, DocType name/publicId/systemId, element/attribute names), and the rest are ReDoS and quadratic-memory/parsing bugs in the malformed-input recovery and end-tag paths. It's the identical pattern this morning's NLTK batch showed — a guard that exists in the code but doesn't actually enforce what its name promises — just in an XML parser instead of a corpus loader. Anywhere xmldom parses untrusted XML (SAML, SOAP, RSS ingestion, config files), an embedded line terminator can now bypass validation you thought was there; upgrade and don't rely on requireWellFormed() as a security boundary in the vulnerable range.

High · GHSA ·added 18:00 ET

multer ships three unauthenticated DoS advisories in one batch: process crash, fd leak, and array-index exhaustion

Three separate ways to take down a multer-based upload endpoint with a single request: two crafted field names trigger an uncaught RangeError that isn't routed to the app's error handler and kills the process; aborting an upload mid-stream leaks an open file descriptor and disk blocks under diskStorage until the process exits; and a field name like items[4294967294] forces allocation of a maximum-length sparse array via the append-field dependency. All three are remote, unauthenticated, and need nothing but a crafted multipart/form-data request. If you accept file uploads with multer, patch now and add a process supervisor that restarts on crash as a stopgap — none of these have an application-level workaround.

High · GHSA ·added 18:00 ET

Composer: malicious package's Perforce source URL executes arbitrary commands via the p4 CLI

If the p4 Perforce client is installed, Composer passes a dependency's Perforce source address straight to the p4 CLI without validating it — and p4 accepts addresses that mean 'run this local command' rather than 'connect to this server.' A malicious package hosted on a repository that allows arbitrary Perforce source URLs (packagist.org itself is safe) gets arbitrary command execution with the privileges of whoever runs composer install or update, including CI accounts. If your build pipeline has p4 installed and pulls from any non-packagist repository, audit for Perforce-sourced dependencies before your next CI run; upgrade past the vulnerable range (< 2.10.3 / < 2.2.30).

High · GHSA ·added 18:00 ET

sharp inherits the same libheif RCE chain now hitting Next.js and Astro

sharp itself carries the upstream libheif vulnerabilities (two rated critical upstream, down-rated to high here since sharp has no networking surface of its own) behind today's Next.js and Astro AVIF advisories — this is the shared root cause, not a third unrelated bug. Anyone processing untrusted AVIF input through sharp directly, not just through a framework's image pipeline, is exposed on versions before 0.35.4. Upgrade sharp to 0.35.4 regardless of which framework advisory you already patched; it's the same fix underneath all three.

12:00 ET · Forenoon Watch
High · GHSA ·added 12:00 ET

NLTK ships four same-day advisories: two dead sandbox checks and a symlink escape make its "trusted" file access trust nothing

NLTK disclosed four advisories at once, all the same shape: file-access guards that look like sandboxing but never actually run. FileSystemPathPointer.open() compares a normalized path against itself and can never fail (CVE-2026-65915), StreamBackedCorpusView calls builtins.open() directly and skips pathsec.ENFORCE entirely (CVE-2026-63312, GHSA-x5ph-mj9p-rfr8), CorpusReader's root check is lexical and falls to a symlink placed inside the corpus root (CVE-2026-70626), and separately, downloaded packages are never hash-verified between os.replace() and extraction (CVE-2026-12259, GHSA-5wp5-5229-5g6q) — an MITM or DNS-poisoned mirror can swap the payload. Any service that lets user input reach nltk.data.load(), a corpus fileid, or nltk.download() inherited a false sandboxing guarantee; grep for user-controlled strings hitting those APIs and treat pathsec.ENFORCE as decorative until patched. Upgrade past nltk 3.9.4 to pick up all four fixes.

Context · The Hacker News ·added 12:00 ET

Researchers weaponize an incoming WeChat call into a zero-click, self-propagating account takeover

Security firm Calif built a worm that hijacks a WeChat account from a single incoming call — the callee never answers or touches the phone, the caller just needs to already be a contact — and demonstrated it spreading across three test phones on both iOS and Android. Tencent patched after Calif's July report, so this is retrospective, but it's the same class of risk as call- or notification-triggered zero-click bugs on iMessage/WhatsApp: a single unauthenticated signal turning a messaging app into a self-propagating worm, worth remembering next time a "no user interaction" bug shows up in anything with a contact graph.

06:00 ET · Morning Watch
Critical · The Hacker News ·added 06:00 ET

Adobe ships the StyleSmuggler patch and assigns CVE-2026-75650 (CVSS 10.0) to the Magento/Adobe Commerce zero-day

Adobe released an out-of-band fix for the Magento/Adobe Commerce flaw Sansec named StyleSmuggler, now tracked as CVE-2026-75650 with a maximum CVSS of 10.0 — three days after Sansec first caught it being exploited to drop a Rust backdoor and PHP web shell on live stores. This closes the gap from yesterday's item, where the same bug was under active exploitation with no CVE and no vendor fix; it's the same campaign, same install base, now with a patch to apply instead of just indicators to hunt for. Patch Adobe Commerce / Magento Open Source immediately, then hunt for the previously-disclosed Rust backdoor and PHP web shell on any instance that was internet-facing between September 4 and today, since patching alone won't evict an implant already dropped.