Changes.Watch~ upgrade verdicts ~
Free digest
CriticalPHP2Shell: is your PHP patched?

critical vulnerability

Mercury: Unauthenticated Remote Code Execution via /api/kernels

Fix availableCritical · CVSS 9.8EPSS 0.44%

Published Oct 19, 2026 · updated Oct 19, 2026

What to do

  1. Upgrade to a fixed version: mercury 3.2.6.
  2. Redeploy and restart long-running processes so they load the fixed code.

Affected packages

PyPImercury

Vulnerable versions
<= 3.2.5
Fixed in
3.2.6

Check your project: pip show mercury

What changed

  1. Oct 19, 2026

    Published in the GitHub Advisory Database as critical.

Sources

CWE-862 Missing Authorization

← All critical vulnerabilities