Security Roundup: 12 Oct 2026

A deadline that has just passed, two AWS fixes from Friday, and two open-source patches.

• CISA’s due date for BIND, Apache Struts, Strapi, ONLYOFFICE Docs, and ProFTPD bugs was Sunday 11 October.
• AWS says AWS Tools for PowerShell before 5.0.306 can leave an IAM user’s console password in command output and logs.
• AWS says Amplify GraphQL resolvers for SQL-backed models can show one user another user’s records.
• Apache says DataSketches C++ before 5.3.0 has memory-safety bugs in how it reads serialized sketches.
• GitHub says Nginx UI lets an unauthenticated caller fill the disk before any signature is checked.

Security

The federal due date for five exploited bugs passed on Sunday

CISA Known Exploited Vulnerabilities catalog

CISA’s catalog, version 2026.10.08, lists five additions dated 8 October, each due 11 October: CVE-2015-5477 (ISC BIND), CVE-2016-3081 (Apache Struts, command injection when Dynamic Method Invocation is enabled), CVE-2023-22894 (Strapi, cleartext storage of sensitive information), CVE-2021-3199 (ONLYOFFICE Docs, path traversal when JWT is used), and CVE-2015-3306 (ProFTPD, improper access control via site cpfr and site cpto). The catalog’s required action is to apply vendor mitigations under BOD 26-04, or stop using the product. For Strapi, the catalog says the product may be end of life and that the bug can be chained with CVE-2023-22621 for remote code execution. The date binds federal agencies, but it is a useful deadline for anyone running these services.

This week. If you ran any of these on an internet-facing host, confirm it was patched or switched off, and if it was not, do that today. For copies that were exposed, review access and system logs from 8 October onward, and move Strapi off any end-of-life build.

AWS Tools for PowerShell can leave an IAM console password in logs

AWS

AWS Security Bulletin 2026-132-AWS, published 9 October and rated Important, covers CVE-2026-107783. AWS says AWS Tools for PowerShell V5 up to 5.0.305 could let a local user recover an IAM user’s cleartext console password from command output and log files. The fix is 5.0.306. It hits admin machines and automation runners that create or reset console passwords with these cmdlets.

This week. Upgrade AWS Tools for PowerShell to 5.0.306 or later. Search PowerShell transcripts and CI logs for console passwords set with the older module, and reset any you find.

Amplify GraphQL resolvers can expose other users’ records

AWS

AWS Security Bulletin 2026-133-AWS, published 9 October and rated Important, covers CVE-2026-108096. AWS says the query resolvers generated by @aws-amplify/graphql-index-transformer for SQL-backed models could let an authenticated user read records owned by other users through crafted queries. The fix is @aws-amplify/graphql-index-transformer 3.1.2, included in @aws-amplify/data-construct 1.17.4 and @aws-amplify/graphql-api-construct 1.21.4. AWS says to redeploy the backend after upgrading. It hits Amplify apps that use SQL-backed data models.

This week. Upgrade to those versions and redeploy the backend, because the fix only takes effect once the resolvers are regenerated. Then test with two ordinary user accounts that neither can read the other’s records.

Apache DataSketches C++ has five memory-safety fixes in 5.3.0

Openwall oss-security

Lee Rhodes posted five CVEs for datasketches-cpp to oss-security on 9 October: CVE-2026-103501, CVE-2026-103513, CVE-2026-103634, CVE-2026-103635, and CVE-2026-103636. They cover how the library reads serialized sketches, including a heap overflow in HLL sketches that can write up to 988 bytes past an internal buffer. The notice for CVE-2026-103501 says only applications that deserialize sketches from untrusted sources are affected and that 5.3.0 fixes it. It hits services that accept sketches from clients or from other systems you do not control.

This week. Upgrade datasketches-cpp to 5.3.0. Until then, do not deserialize sketches that came from untrusted sources.

Nginx UI can be filled to the brim without logging in

GitHub Advisory Database

GitHub rates this advisory (CVE-2026-107805) high. It says Nginx UI’s node-signature authentication wrote an attacker-supplied request body to a temporary file and synced it to disk before checking the body digest and signature, so an unauthenticated caller who can reach the API can use up storage and disk I/O. It hits anyone who exposes Nginx UI beyond a trusted network.

This week. Upgrade to the patched build the advisory names. Until you can, put the Nginx UI port behind a VPN or firewall rule so only your own hosts can reach it.