Changes.Watch~ upgrade verdicts ~
Free digest
CriticalPHP2Shell: is your PHP patched?

critical vulnerability

Mercury: Unauthenticated Remote Code Execution in /api/terminals - access control bypass

Fix availableCritical · CVSS 10EPSS 0.44%

Published Oct 19, 2026 · updated Oct 19, 2026

What to do

  1. Upgrade to a fixed version: mercury 3.2.4.
  2. Redeploy and restart long-running processes so they load the fixed code.

Affected packages

PyPImercury

Vulnerable versions
>= 3.0.0, <= 3.2.3
Fixed in
3.2.4

Check your project: pip show mercury

What changed

  1. Oct 19, 2026

    Published in the GitHub Advisory Database as critical.

Sources

CWE-185 Incorrect Regular Expression · CWE-284 Improper Access Control

← All critical vulnerabilities