Mmastodon TechnologyCybersecurity first seen 5 d ago, last 5 d ago, peak #7
Critical unpatched flaw reported in open-source server tool Spug
Original: CVE-2026-108540 — OpenSpug Spug, CVSS 9.9 OS command injection in /exec/transfer. Public PoC available. Vendor unrespons
Security researchers are warning about CVE-2026-108540, a critical OS command injection vulnerability in the open-source server management tool OpenSpug Spug, rated CVSS 9.9. A public proof-of-concept exploit is circulating and the vendor has reportedly not responded, leaving no patch available. Because Spug stores SSH keys and host credentials, experts warn exploitation could enable lateral movement across entire infrastructures, and are urging administrators to block the affected endpoint.
Why now: A public exploit exists for a critical, unpatched vulnerability in a widely used infrastructure tool, prompting urgent warnings to defenders.
Evidence
- CVE-2026-108540 — OpenSpug Spug, CVSS 9.9 OS command injection in /exec/transfer. Public PoC available. Vendor unresponsive. No patch. Spug manages SSH keys + host credentials for your infra fleet. Exploitation = lateral movement to everything it touches. Block the endpoint at… · threataft@infosec.exchange · 1
API: https://socialmediatrends-api.osmike.com/v1/trends/1849015