Skip to content
TrustList

TrustList daily digest · Tech and security

Friday, 2 October 2026

Tech and security: the stories TrustList published on this day, each in a line of our own. Open a story for the whole piece and its sources.

Tech and security13

  1. 1Security advisories

    GitLab AI Gateway flaw CVE-2026-90970 lets Duo Agent Platform users escape the sandbox and run commands: update self-hosted gateways

    GitLab fixed CVE-2026-90970, rated 9.9, in its self-hosted AI Gateway: a user with Duo Agent Platform access could escape the sandbox through a custom flow prompt template and run commands. Fixed in 19.2.4, 19.3.2 and 19.4.1.

  2. 2Security advisories

    ModSecurity web application firewall: bypass and crash flaws fixed in 3.0.17 and 2.9.15, one filename bypass still unpatched

    The ModSecurity project published seven advisories on 30 September 2026: response-body and rule bypasses, an XML crash and an unpatched multipart filename bypass (CVE-2026-104269). Update libmodsecurity to 3.0.17 or ModSecurity 2 to 2.9.15.

  3. 3Security advisories

    SharePoint Server CVE-2026-65660 and WordPress CVE-2026-87902 are now exploited: check the August SharePoint update and WordPress 7.1.2

    On 25 September 2026 CISA listed two more flaws as exploited: a SharePoint Server code-injection flaw fixed in Microsoft’s August 2026 updates, and a WordPress core file-inclusion flaw fixed in 7.1.2 on 22 September. Confirm both updates are installed.

  4. 4Security advisories

    HPE OneView before 11.40 has a cross-site scripting flaw that allows session hijacking: update to 11.40

    HPE published CVE-2026-76719 (rated 8.2) and CVE-2026-76720 (4.3) on 29 September 2026: a cross-site scripting flaw that can lead to session hijacking and an open redirect in HPE OneView before 11.40. Update the appliance to 11.40.

  5. 5Security advisories

    FortiMail flaw CVE-2026-104286 is exploited and fixes are still upcoming: disable IBE or close the management interface now

    Fortinet says CVE-2026-104286, an unauthenticated file-write flaw in FortiMail rated 9.8, is exploited in the wild. Fixed builds 8.0.2, 7.6.7 and 7.4.9 are listed as upcoming. Disable IBE or restrict the management interface, and check for the indicators.

  6. 6Security advisories

    Security tools need patching too: Tenable Nessus 10.12.5 fixes nine flaws, and Fortra’s BoKS privileged-access manager has critical fixes

    Tenable fixed nine flaws in Nessus 10.12.4 and earlier on 1 October 2026, the worst rated 9.1, in 10.12.5. Fortra fixed six flaws, three critical, in its BoKS privileged-access manager (8.1.0.30, 9.0.0.7, 10.1.1.0). No exploitation reported.

  7. 7Security advisories

    Poland orders its national cybersecurity entities to update MikroTik RouterOS now, as attackers exploit the flaws

    Poland’s Government Plenipotentiary for Cybersecurity recommended on 2 October 2026 that entities in the national cybersecurity system update MikroTik RouterOS without delay (7.24.2, 7.23.4, 6.49.21), check for compromise and close management services.

  8. 8Security advisories

    WatchGuard Endpoint Security flaw CVE-2026-13043 gives unauthenticated access to kernel memory: update agents to 8.00.26.0012

    WatchGuard published CVE-2026-13043, rated 9.3, on 1 October 2026: a kernel-memory driver in WatchGuard Endpoint Security lacks authentication, allowing arbitrary kernel memory access. Every version before 8.00.26.0012 is affected.

  9. 9Security advisories

    Dell Container Storage Modules: maximum-severity flaws give attackers storage admin credentials and control; update to 1.18.0

    Dell has fixed two maximum-severity flaws in the Authorization module of Container Storage Modules, CVE-2026-63688 and CVE-2026-63692, plus four critical ones, which can expose storage-array admin credentials and Kubernetes secrets. Update to 1.18.0.

  10. 10Security advisories

    n8n fixes a batch of high-severity flaws, including SQL injection, code execution and an approval bypass: update to 2.42.1 or 2.41.4

    n8n published ten security advisories on 30 September 2026, eight rated high, for its workflow-automation platform: SQL injection, code execution in the Git node, an HMAC bypass on waiting executions and owner account takeover. Update to 2.42.1 or 2.41.4.

  11. 11Security advisories

    Apache HTTP Server 2.4.69 fixes 23 vulnerabilities, including memory-safety flaws in mod_http2 and mod_dav: update web servers

    Apache released HTTP Server 2.4.69 on 1 October 2026 with fixes for 23 vulnerabilities: five rated moderate by the project, such as a mod_http2 use-after-free and mod_dav overflows, and 18 low. National CERTs rate several higher. Update 2.4.x.

  12. 12Security advisories

    AWS: Powertools for AWS Lambda (Python) data masking could fail open, and three more AWS libraries need updates

    AWS bulletins of 29 September and 1 October 2026: Powertools for AWS Lambda (Python) 3.6.0 to 3.34.0 could return unmasked values on error (fixed in 3.35.0, no workaround), plus fixes for Amazon Ion Python, security-agent-mcp-server and GluonTS.

  13. 13Security advisories

    Epic pauses most product development for about six weeks to fix MyChart security flaws: what hospitals and clinics should ask

    Epic, whose MyChart patient portal is used across US hospitals, has paused most product development for about six weeks to fix security flaws that, its security chief says, could let outsiders reach patient records without leaving a trace in the logs.

TrustList Weekly

The week in software and IT, in one email

The news that matters to buyers, new rankings and our own research. Every Thursday, free, and easy to leave.

We will email you to confirm. Unsubscribe with one click in any issue. Privacy policy