Daily Brief

The Brotli bug we flagged is now under attack. Finish the Node.js and Python updates this week

The Brotli bug we flagged is now under attack. Finish the Node.js and Python updates this week

ELLIO saw Brotli CVE-2026-111497 exploit traffic aimed at Node.js 24.22.0 on Oct 26, and CISA added it to KEV Oct 27. Update Node.js to 22.23.4, 24.22.1 or 26.12.1 and rebuild.
A rogue Android app could take over work accounts through Microsoft Authenticator. Check the version on every phone

A rogue Android app could take over work accounts through Microsoft Authenticator. Check the version on every phone

CVE-2026-80097 let any Android app impersonate Teams and get Microsoft Authenticator tokens for mail, files and passkeys. Update Authenticator for Android to 6.2606.4246 or later.
Apple fixed 286 flaws and an exploited bug on older iPhones. Push the updates to every phone and Mac

Apple fixed 286 flaws and an exploited bug on older iPhones. Push the updates to every phone and Mac

Apple backported the exploited CoreGraphics fix CVE-2026-86950 to iOS 18.7.11 and shipped iOS 27.2, macOS Golden Gate 27.2, Tahoe 26.7.2 and Sequoia 15.8.2 with 286 fixes.
Attackers are uploading web shells to Magento stores through the shopping cart. Install Adobe’s July fix and check for intruders

Attackers are uploading web shells to Magento stores through the shopping cart. Install Adobe’s July fix and check for intruders

CISA added Magento and Adobe Commerce PolyShell CVE-2026-48356 to KEV on Oct 27, due Nov 10. Install APSB26-73 July 2026 releases, block pub/media/custom_options and hunt for shells.
Tuesday’s brief: PHP2Shell attacks now work, then GitHub secret dumps, a Linux root exploit and .NET Brotli fixes

Tuesday’s brief: PHP2Shell attacks now work, then GitHub secret dumps, a Linux root exploit and .NET Brotli fixes

PHP2Shell CVE-2026-109618 exploited and on CISA KEV, Gheist GitHub secret dumps, a Linux skb_zerocopy root exploit and .NET fixes for Brotli CVE-2026-111497, with first steps.
Microsoft rushed out .NET and PowerShell fixes for the Brotli bug. Rebuild the apps that carry their own copy

Microsoft rushed out .NET and PowerShell fixes for the Brotli bug. Rebuild the apps that carry their own copy

Microsoft released out-of-band .NET 8.0.33, 9.0.22 and 10.0.14, plus PowerShell and Visual Studio fixes, for Brotli CVE-2026-111497. PHP rebuilt its Windows packages too.
A public Linux exploit turns any local user into root on Ubuntu, Debian and AlmaLinux. Close the path now

A public Linux exploit turns any local user into root on Ubuntu, Debian and AlmaLinux. Close the path now

A public exploit for Linux kernel bug ZDI-CAN-33367 in skb_zerocopy gets root on Ubuntu 24.04, Debian 12 and AlmaLinux 8-10. Patched AlmaLinux kernels, user namespace mitigation.
Stolen GitHub tokens are dumping secrets from private repositories. Search for ci-sync branches today

Stolen GitHub tokens are dumping secrets from private repositories. Search for ci-sync branches today

Wiz found 13,500+ Gheist ci-sync branches from 850+ stolen GitHub accounts dumping Actions secrets in private repos and GitHub Enterprise Server. Indicators, hunts and fixes.
PHP2Shell attacks now open working shells. Patch every PHP server and check it for intruders by Thursday

PHP2Shell attacks now open working shells. Patch every PHP server and check it for intruders by Thursday

CISA added PHP2Shell CVE-2026-109618 and CVE-2026-109619 to KEV on Oct 26, due Oct 29, after honeypots logged working shells. Update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, then hunt.
Monday’s brief: ConnectWise Cloud Backup comes back, then Aruba Wi-Fi fixes, a Brotli update and Nextcloud’s KEV deadline

Monday’s brief: ConnectWise Cloud Backup comes back, then Aruba Wi-Fi fixes, a Brotli update and Nextcloud’s KEV deadline

ConnectWise Cloud Backup restores, Aruba AOS CVE-2026-79844, Brotli CVE-2026-111497 in Node.js and Python, and Collabora CVE-2026-110447 on CISA KEV, with first steps.
CISA confirms attacks on Nextcloud’s Collabora CODE app. The federal fix date is today

CISA confirms attacks on Nextcloud’s Collabora CODE app. The federal fix date is today

CISA added CVE-2026-110447 in Nextcloud’s Collabora Built-in CODE Server app to KEV on Oct 23, due Oct 26. Update richdocumentscode to 26.4.303 or remove it, then hunt for web shells.
A Brotli decoder bug sits inside Node.js, Python and Envoy. Update each one, then restart

A Brotli decoder bug sits inside Node.js, Python and Envoy. Update each one, then restart

CVE-2026-111497 in Google Brotli 1.0.3-1.2.0 reaches Node.js, Bun, Envoy and Python Brotli packages. Update to Node.js 22.23.4, 24.22.1 or 26.12.1, Brotli 1.2.1, then restart.
Aruba wireless controllers and access points have eight 10.0 flaws. Plan the AOS upgrades this week

Aruba wireless controllers and access points have eight 10.0 flaws. Plan the AOS upgrades this week

HPE advisory HPESBNW05162 fixes 72 AOS-8 and AOS-10 flaws, eight rated 10.0 (CVE-2026-79844 to 79851). Upgrade to 10.8.1.2, 10.7.2.7, 10.4.1.14, 8.13.3.1 or 8.10.0.24.