Critical CVEs (2 of 3) — June 25, 2026

koto surf, prog dream pop · 4:37

Listen on 93

Lyrics

[Verse 1]
Three CVEs hit the wire on June twenty-five
Patch your systems fast if you want to survive the breach
UniFi OS from Ubiquiti, CVE-2026-34908
Improper access control, someone walks right through the gate
No credentials needed, just a foothold on your LAN
A malicious actor rewrites your config, that's the plan
Your network settings shifted while your dashboards looked just fine
A silent hand rearranging everything behind the line

[Chorus]
Check your CVEs, thirty-four-nine-oh-eight
UniFi's got a gap and the attacker won't wait
Twenty-two-fifty-three in Splunk Enterprise today
Missing authentication, truncate files away
Eight-oh-two-four is the one that scores nine-point-eight
Deserialization opens up the gate
Patch the stack, log the track, catalog the flaw
Three critical vulnerabilities, none above the law

[Verse 2]
Splunk Enterprise next — CVE-2026-20253
A PostgreSQL sidecar process running quietly
No authentication guarding its most critical calls
An unauthenticated stranger strolls directly through the halls
They can spawn or truncate any file the system holds
Arbitrary writes mean your data infrastructure folds
Your log analytics platform becomes the attacker's tool
Weaponized observability — that's a bitter school

[Chorus]
Check your CVEs, thirty-four-nine-oh-eight
UniFi's got a gap and the attacker won't wait
Twenty-two-fifty-three in Splunk Enterprise today
Missing authentication, truncate files away
Eight-oh-two-four is the one that scores nine-point-eight
Deserialization opens up the gate
Patch the stack, log the track, catalog the flaw
Three critical vulnerabilities, none above the law

[Bridge]
Now ibaPDA, ibaDatCoordinator — CVE-2026-8024
CVSS nine-point-eight, that denominator is full access, total compromise, remote and unauthenticated
Deserialized untrusted data executes, unsedated
No username, no password, just a packet shaped just right
The attacker owns the process, owns the data, owns the write
Industrial process software bleeding out across the wire
Operational technology is not immune to fire — the technical kind

[Verse 3]
So what's the pattern threaded through these three alerts today?
Authentication missing, access checks that rot away
Trust assumptions baked in deep where verification skipped
Systems handed to the network with the guardrails quietly stripped
UniFi lets you pivot, Splunk lets you forge and delete
ibaPDA hands complete control to anyone you meet
Deserialization, missing auth, improper gates —
Three different wounds, one common lesson: never trust blind states

[Outro]
June twenty-five, twenty-twenty-six — three CVEs demand your time
Thirty-four-nine-oh-eight, twenty-two-fifty-three, eight-oh-two-four in their prime
Inventory your exposure, apply the vendor fix
Before an unauthenticated stranger gets their kicks

← Critical CVEs (1 of 3) — June 25, 2026 | Critical CVEs (3 of 3) — June 25, 2026 →