Security Digest: February 19, 2026 - 7 Critical Vulnerabilities

Today's security alert highlights seven critical vulnerabilities that require immediate attention. These vulnerabilities span a variety of platforms and could lead to unauthorized access, remote code execution, and data exfiltration.

· 5 min read

Critical Security Alert: February 19, 2026

Executive Summary

Today's security alert highlights seven critical vulnerabilities that require immediate attention. These vulnerabilities span a variety of platforms and could lead to unauthorized access, remote code execution, and data exfiltration. Immediate patching and implementation of workarounds are crucial to mitigate these threats.

Critical Vulnerabilities

  • CVE-2026-27198: Role-Based Authorization Flaw in Formwork CMS
    • Impact: Allows full administrative control over the CMS.
    • Affected Systems: composer getformwork/formwork
    • Immediate Action: Upgrade to Formwork 2.3.4 immediately.
    • Mitigation: Ensure proper role validation during account creation.
  • CVE-2026-27203: Environment Variable Injection in ebay-mcp
    • Impact: Configuration overwrites, potential RCE.
    • Affected Systems: npm ebay-mcp
    • Immediate Action: Validate and sanitize inputs to updateEnvFile.
    • Mitigation: Monitor for unusual environment changes.
  • CVE-2026-27206: PHP Object Injection in zumba/json-serializer
    • Impact: Arbitrary code execution, data exfiltration.
    • Affected Systems: composer zumba/json-serializer
    • Immediate Action: Upgrade to version 3.2.3 and configure class allowlist.
    • Mitigation: Avoid deserializing untrusted JSON.
  • CVE-2026-25755: PDF JavaScript Injection in jsPDF
    • Impact: Malicious actions upon opening PDFs.
    • Affected Systems: npm jspdf
    • Immediate Action: Upgrade to jspdf@4.2.0.
    • Mitigation: Escape parentheses in user-supplied JavaScript.
  • CVE-2026-27190: Command Injection in Deno
    • Impact: Arbitrary command execution.
    • Affected Systems: rust deno
    • Immediate Action: Upgrade to Deno v2.6.8.
    • Mitigation: Review and sanitize input to spawnSync.
  • CVE-2026-27196: Stored XSS in Statamic CMS
    • Impact: Malicious JavaScript execution.
    • Affected Systems: composer statamic/cms
    • Immediate Action: Upgrade to versions 6.3.2 or 5.73.9.
    • Mitigation: Restrict field management permissions.
  • CVE-2026-25940: PDF Object Injection in jsPDF
    • Impact: Arbitrary JavaScript actions upon interaction.
    • Affected Systems: npm jspdf
    • Immediate Action: Upgrade to jsPDF@4.2.0.
    • Mitigation: Sanitize input before API usage.

Previously Alerted

What to Do Now

  1. Review and apply patches for all affected systems immediately.
  2. Sanitize and validate all user inputs to prevent exploitation.
  3. Monitor systems for unusual activities and unauthorized access attempts.

Related Resources

  • Upcoming internal blog post on recent vulnerabilities (TBA)
  • Vendor advisories for patches and updates

Keep reading