PatchDayAlert
Subscribe →

A sample of the latest issue

JUL 23 · Nº060
Patch this week From JUL 23 · Nº060
CVE-2026-44191 7.8 Visual Studio Code

An attacker can inject shell commands through the Ansible Lightspeed VS Code extension's container and volume mount settings.

The call: Update the Ansible Lightspeed VS Code extension to the latest patched version from the VS Code marketplace.

Sources: NVD Read the full call

Plus 4 more calls in the latest issue. See the whole thing

01

Source-linked

Every verdict links to a primary source.

NVD, CISA KEV, MSRC, GHSA, or a vendor PSIRT. Skeptical readers can click through to verify in place.

02

Human-reviewed

A working sysadmin edits before it ships.

Issues are reviewed and edited before they go out, not auto-published from a feed. CVEs that aren’t actionable before standup don’t make the cut.

03

Editorial verdicts

One call per CVE. Four minutes total.

Patch now, patch this week, track, or doesn’t apply. These reviews are editorial and unpaid.

Today's digest, in full

The other 4 calls for Thursday, July 23.

Read the issue
01 Patch this week CVE-2026-44190 Visual Studio Code The Ansible Lightspeed extension doesn't validate the ansible.python.activationScript setting as a proper file path. The call: Update the Ansible Lightspeed VS Code extension to the latest patched version and audit workspace-level settings for ansible.python.activationScript. CVSS 7.8 02 Patch this week CVE-2026-44189 Visual Studio Code A specially crafted playbook filename with shell metacharacters can trick the Ansible Lightspeed extension into running arbitrary code when you execute the playbook. The call: Update the Ansible Lightspeed VS Code extension to the latest patched version. CVSS 7.8 03 Patch this week CVE-2026-13072 MongoDB When compute mode is explicitly enabled on a standalone mongod instance, crafted BSON data in an aggregation pipeline can corrupt memory and crash the process or worse. The call: Upgrade MongoDB to the latest patched version. CVSS 8.1 04 Patch now CVE-2026-13059 MongoDB A low-privilege authenticated user can bypass role-based access controls and read or write data they shouldn't have access to. The call: Upgrade MongoDB to the latest patched version. CVSS 8.1

The four-verdict model

Every CVE gets one of these four calls.

No CVSS-jargon dump, no “threat actor postulated to leverage” sentences. You read the verdict, then the one-line action, then move on.

  1. Patch now

    Exploited in the wild, or exposed and trivially exploitable. Today’s change window.

  2. Patch this week

    Real risk, no active exploitation yet. Slot it into your next maintenance window.

  3. Track

    Worth knowing about. No action needed today; check back if the advisory changes.

  4. Doesn't apply

    Affected versions you don’t run, or a vendor branch you’ll never see. Skip with confidence.

Who reads this

Built for IT teams who do their own patching.

For sysadmins

The lone admin running fifty servers.

You don’t have time to read three feeds and a Discord. One email, one verdict per CVE, before standup.

Built for this

For MSPs

Twenty clients, twenty stacks.

Each CVE is tagged by vendor and product, so a quick scan picks out what matters to your fleet. Forward the digest to whoever’s on rotation.

Built for this

For IT managers

Brief leadership in one paragraph.

The intro summarizes what shipped, what’s on fire, and what to ignore. Forwardable in one click to whoever signs off on the change window.

Built for this

For lean IT teams

No Tenable, no Qualys, no full-time analyst.

The digest is the triage layer you don’t have to staff.

Built for this

The archive

Recent digests.

Full archive
Nº060 JUL 23

Three command injections in Ansible Lightspeed, plus MongoDB RBAC bypass

CVE-2026-44189/44190/44191 all hit CVSS 7.8: opening a malicious project in VS Code gives an attacker shell access. MongoDB also has an 8.1 RBAC bypass (CVE-2026-13059) that lets low-privilege users read and write across tenant boundaries.

5 CVEs
0 Crit
0 KEV
4 min
Nº059 JUL 22
Exploited

FortiSandbox, SharePoint, and WordPress RCE all exploited in the wild

Five actively exploited bugs today. Unauthenticated command execution on FortiSandbox (EPSS 0.84), a CVSS 9.8 WordPress REST API chain hitting 6.9.x and 7.0.x, unauth deserialization RCE in on-prem SharePoint, a DD-WRT UPnP overflow, and remote code execution in Langflow.

5 CVEs
1 Crit
5 KEV
4 min
Nº058 JUL 10

Langroid scores a perfect 10 RCE, plus two Juniper DoS bugs that crash your firewall

Langroid's broken eval() sandbox gives attackers full code execution (CVE-2026-54769, CVSS 10.0). A guardrails-detectors SSRF can steal cloud credentials (CVSS 9.3). Two Juniper SRX/MX flaws let a single packet crash flowd if SIP ALG or TCP proxy is active.

5 CVEs
2 Crit
0 KEV
4 min
Nº057 JUL 9

CoreWCF auth bypass scores a perfect 10, Chrome sandbox escape close behind

A broken SAML token check in CoreWCF (CVE-2026-54782, CVSS 10.0) lets anyone forge tokens and impersonate users. Chrome on Android has a 9.6 use-after-free sandbox escape via Autofill, plus a NATS Server auth skip (8.8), a GStreamer DTLS stack overflow (7.5), and a Dynamics 365 XSS (9.3).

5 CVEs
3 Crit
0 KEV
4 min

From the blog

Playbooks the digest can't fit.

Visit the blog
JUL 18 · Field Note · Colten Anderson

Close the gap between your declared policy and what the box is actually running

A one-off registry edit closes a ticket and never makes it back into the GPO. Here's the three-surface audit that catches the drift, plus the one decision that actually closes the loop.

Read JUL 18 · Field Note · Colten Anderson

Audit your suppression graveyard before a live page dies in it

Silences, downtimes, and maintenance windows get created for good reasons and never revisited. Here are the enumeration commands and three cleanup flags that find the ones that have quietly gone bad.

Read JUL 13 · Field Note · Colten Anderson

Five checks for Intune driver update policy coverage

Windows Autopatch manages your OS updates. Your kernel-level drivers are on their own unless you built a separate driver update policy. Here is how to tell if yours is missing and how to fix it.

Read

Start here

The ones worth reading first.

All posts

Get the cheat sheet and the digest

CVE triage for sysadmins in five minutes.

What to patch now. What can wait. What you can ignore.

  1. 01 The CVE triage cheat sheet, a one-page printable decision tree, in the welcome email.
  2. 02 The weekly digest, one email every Wednesday, around four minutes to read.

Free. Unsubscribe anytime.