Vendor Security Advisory
AWS Updates Amazon Ion Python for Recursion Denial of Service
Amazon Web Services (AWS) issued 2026-122-AWS. Match affected deployments, apply supported fixes, validate operations, and retain evidence.
AWS Fixes Diff-Scan Argument Injection in security-agent-mcp-server
AWS security-agent-mcp-server can interpret crafted Git references as command options, modifying files outside the repository. Update the server actually launched by the MCP client to 0.2.0 or later; trusted repositories and isolation do not replace the fix.
AWS EFS CSI Driver 3.5.0 Fixes Mount Option Injection
Amazon Web Services (AWS) issued 2026-120-AWS. Match affected deployments, apply supported fixes, validate operations, and retain evidence.
Johnson Controls Releases EasyIO Neo Firmware and Hardware Fixes
EasyIO Neo remediation requires both model-specific firmware and, for debug-interface findings, revised hardware. Confirm replacement hardware with the vendor and coordinate facilities maintenance; installing a matching firmware number on old hardware does not remove physical debug pins.
Fortinet Warns of Exploited FortiMail Path Traversal
Fortinet lists fixed FortiMail releases for exploited CVE-2026-104286. Preserve evidence, update each branch, validate mail flow, and retain records.
Johnson Controls Warns of High-Severity EasyIO FG Vulnerabilities
End-of-life EasyIO FG controllers have hard-coded-credential and privilege-management weaknesses with no firmware patch planned. Restrict network and physical access, preserve configuration, and coordinate supported replacement with building operations rather than attempting an unavailable upgrade.
Tenable Nessus 10.12.5 Fixes Nine Vulnerabilities
Nessus 10.12.5 fixes nine vulnerabilities requiring authenticated users or privileged attackers. Update the scanner application, preserve configuration and scan history, and coordinate running jobs; current scan plugins alone do not establish fixed scanner software.
Mozilla MFSA 2026-101 Fixes Security Vulnerabilities in Thunderbird 157
Thunderbird 157 fixes multiple component flaws, including an oversized-email overflow not covered by the usual mail-scripting caveat. Update through the supported channel and restart; ordinary mail delivery does not validate every listed security boundary.
Mozilla MFSA 2026-102 Fixes Security Vulnerabilities in Thunderbird 140.17
Thunderbird's 140 branch receives these fixes in 140.17; this notice does not require migration to 157. Preserve profiles, update through the supported channel, restart, and retain the oversized-email exception to the general scripting caveat.
Mozilla MFSA 2026-103 Fixes Security Vulnerabilities in Thunderbird 153.4
Thunderbird 153.4 fixes the listed 153-branch vulnerabilities, including an oversized-email overflow. Update and restart through the approved channel; disabled mail scripting limits many issues but is not a blanket exemption for every mail-related flaw.