Cyber News

Daily coverage of exploited vulnerabilities, breaches and patches, with what to do first.

Inside the Daily Brief

A real sample of the weekday read

WordPress 7.1.4 fixes 22 security flaws, most open to anyone with a writer account. Check every site’s version

WordPress 7.1.4 fixes 22 security flaws, most open to anyone with a writer account. Check every site’s version

WordPress 7.1.4 (Oct 28, 2026) fixes 22 vulnerabilities, including an upgrade-window RCE and stored XSS in the Interactivity API and core blocks. Backports 7.0.8 and 6.9.11.
Attackers turned PHP2Shell break-ins into root on 24 firewalls with an old Linux bug. Boot a fixed kernel by Saturday

Attackers turned PHP2Shell break-ins into root on 24 firewalls with an old Linux bug. Boot a fixed kernel by Saturday

CISA added Linux kernel Fragnesia CVE-2026-46300 to KEV on Oct 28, due Oct 31, after Dream showed it chained with PHP2Shell to root 24 firewalls. Fixed kernels, memory checks and hunting steps.
Wednesday’s brief: Magento stores hit through the shopping cart, then Apple updates, Microsoft Authenticator and Brotli exploits

Wednesday’s brief: Magento stores hit through the shopping cart, then Apple updates, Microsoft Authenticator and Brotli exploits

Magento PolyShell CVE-2026-48356 and Brotli CVE-2026-111497 added to CISA KEV, Apple 27.2 and iOS 18.7.11 updates, and a Microsoft Authenticator Android token flaw, with first steps.

The CyberExperts Daily Brief

Keep up with the cyber news that changes the day

Get the weekday brief for people scanning the news: the developments worth a closer look, explained in about five minutes.

The Brotli bug we flagged is now under attack. Finish the Node.js and Python updates this week

The Brotli bug we flagged is now under attack. Finish the Node.js and Python updates this week

ELLIO saw Brotli CVE-2026-111497 exploit traffic aimed at Node.js 24.22.0 on Oct 26, and CISA added it to KEV Oct 27. Update Node.js to 22.23.4, 24.22.1 or 26.12.1 and rebuild.
A rogue Android app could take over work accounts through Microsoft Authenticator. Check the version on every phone

A rogue Android app could take over work accounts through Microsoft Authenticator. Check the version on every phone

CVE-2026-80097 let any Android app impersonate Teams and get Microsoft Authenticator tokens for mail, files and passkeys. Update Authenticator for Android to 6.2606.4246 or later.
Apple fixed 286 flaws and an exploited bug on older iPhones. Push the updates to every phone and Mac

Apple fixed 286 flaws and an exploited bug on older iPhones. Push the updates to every phone and Mac

Apple backported the exploited CoreGraphics fix CVE-2026-86950 to iOS 18.7.11 and shipped iOS 27.2, macOS Golden Gate 27.2, Tahoe 26.7.2 and Sequoia 15.8.2 with 286 fixes.
Attackers are uploading web shells to Magento stores through the shopping cart. Install Adobe’s July fix and check for intruders

Attackers are uploading web shells to Magento stores through the shopping cart. Install Adobe’s July fix and check for intruders

CISA added Magento and Adobe Commerce PolyShell CVE-2026-48356 to KEV on Oct 27, due Nov 10. Install APSB26-73 July 2026 releases, block pub/media/custom_options and hunt for shells.
Tuesday’s brief: PHP2Shell attacks now work, then GitHub secret dumps, a Linux root exploit and .NET Brotli fixes

Tuesday’s brief: PHP2Shell attacks now work, then GitHub secret dumps, a Linux root exploit and .NET Brotli fixes

PHP2Shell CVE-2026-109618 exploited and on CISA KEV, Gheist GitHub secret dumps, a Linux skb_zerocopy root exploit and .NET fixes for Brotli CVE-2026-111497, with first steps.
Microsoft rushed out .NET and PowerShell fixes for the Brotli bug. Rebuild the apps that carry their own copy

Microsoft rushed out .NET and PowerShell fixes for the Brotli bug. Rebuild the apps that carry their own copy

Microsoft released out-of-band .NET 8.0.33, 9.0.22 and 10.0.14, plus PowerShell and Visual Studio fixes, for Brotli CVE-2026-111497. PHP rebuilt its Windows packages too.
A public Linux exploit turns any local user into root on Ubuntu, Debian and AlmaLinux. Close the path now

A public Linux exploit turns any local user into root on Ubuntu, Debian and AlmaLinux. Close the path now

A public exploit for Linux kernel bug ZDI-CAN-33367 in skb_zerocopy gets root on Ubuntu 24.04, Debian 12 and AlmaLinux 8-10. Patched AlmaLinux kernels, user namespace mitigation.
Stolen GitHub tokens are dumping secrets from private repositories. Search for ci-sync branches today

Stolen GitHub tokens are dumping secrets from private repositories. Search for ci-sync branches today

Wiz found 13,500+ Gheist ci-sync branches from 850+ stolen GitHub accounts dumping Actions secrets in private repos and GitHub Enterprise Server. Indicators, hunts and fixes.
PHP2Shell attacks now open working shells. Patch every PHP server and check it for intruders by Thursday

PHP2Shell attacks now open working shells. Patch every PHP server and check it for intruders by Thursday

CISA added PHP2Shell CVE-2026-109618 and CVE-2026-109619 to KEV on Oct 26, due Oct 29, after honeypots logged working shells. Update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, then hunt.
Monday’s brief: ConnectWise Cloud Backup comes back, then Aruba Wi-Fi fixes, a Brotli update and Nextcloud’s KEV deadline

Monday’s brief: ConnectWise Cloud Backup comes back, then Aruba Wi-Fi fixes, a Brotli update and Nextcloud’s KEV deadline

ConnectWise Cloud Backup restores, Aruba AOS CVE-2026-79844, Brotli CVE-2026-111497 in Node.js and Python, and Collabora CVE-2026-110447 on CISA KEV, with first steps.