Overview
Description
Statistics
- 38 Posts
- 129 Interactions
Fediverse
C'mon.. we seriously cannot catch a break
Ich hab mir das hier angeschaut und finde erstaunlich wenig handfeste Information dazu (die Seite hat auch kein Datum?): https://security-tracker.debian.org/tracker/CVE-2026-98432
Severity Score 9,8 (lt. #Ubuntu Security jedenfalls) ist ja schon heftig. Weiß jemand, wie es diesbezüglich um #Proxmox bestellt ist? Ist das mit dem
7.0.14-24 erledigt, braucht es dafür 7.0.14-26, oder gibt es da noch nichts, was es fixen würde?
Is there any actual info on CVE-2026-98432 that's not slop? What configurations are affected, how to mitigate, etc.?
A critical Linux kernel CVE-2026-98432 flaw enables remote root execution via MPTCP race conditions, impacting multiple distributions including Ubuntu.
🚨 Critical Linux kernel TCP flaw enables remote root code execution; CVE-2026-98432
A race condition in the Linux kernel’s IPv4 TCP implementation can trigger a use-after-free before application authentication, potentially allowing an unauthenticated remote attacker to leak kernel memory, corrupt memory or crash the system.
Anthropic says Claude developed a working exploit that executed attacker-chosen commands as root against Linux servers with a Multipath TCP listener. The exploit took approximately 53 minutes to complete during testing and has not been publicly released.
⠀
• CVSS: 9.8 Critical, according to the Linux kernel CVE team
• Affected: Linux kernels beginning with version 4.4
• Fixed: 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.56, 7.2.10 and 7.3
• Attack requirements: Network access, no credentials and no user interaction
• Exploitation status: No known attacks in the wild
⠀
Ubuntu and Red Hat Enterprise Linux had not released corrected kernel packages as of October 29. Debian, Oracle Linux, Amazon Linux and SUSE have released fixes for at least some affected branches.
Distribution severity ratings differ substantially. Red Hat rates the flaw 5.9 because it considers the race difficult to win and describes denial of service as the most likely practical impact.
Source: https://lists.openwall.net/linux-cve-announce/2026/10/15/1
Es ist Freitag und mir ist bisher erst eine Kernel-CVE übern Weg gelaufen [1].
Erstens: ich kann so nicht arbeiten, nehmt mich vom Plakat - ich reise ab! (Sorry, Theatervergangenheit...)
Zweitens: was'n los? Schon alle Tokens verbrannt gür diese Woche? Eigener Kopf kapott?
so, about CVE-2026-98432... iiuc the attacker needs an exposed MPTCP listener, right? sooo nothingburger? who runs MPTCP these days?
CVE-2026-98432: fallo crítico UAF en TCP/IPv4 del kernel de Linux
CVE-2026-98432 es una vulnerabilidad de uso de memoria liberada (use-after-free, UAF) en el manejo de conexiones TCP sobre IPv4 del kernel de Linux, explotable a través de la red y sin autenticación, que el equipo de seguridad del kernel puntúa con un 9,8 sobre 10 en CVSS 3.1. Afecta a todos los kernels desde la versión 4.4 y ya está corregida en las ramas estables...
https://www.opensecurity.es/cve-2026-98432-kernel-linux-uaf-tcp-ipv4/
A high-severity race condition in Linux kernel TCP connection setup (CVE-2026-98432) allows unauthenticated remote code execution as root on servers running a multipath TCP listener.
The kernel CVE team rated it 9.8, while vendors like Red Hat and Amazon scored it between 5.9 and 8.1.
Anthropic reported that its AI model successfully authored an exploit using the flaw.
As of October 29, Ubuntu and RHEL had not released fixed kernels, w…
https://en.hacks.gr/sovaro-keno-asfaleias-se-systimata-linux-epitrepei-ton-elegcho-apo-agnostoys/
Уязавимость в TCP стеке ядра Linux: CVE-2026-98432:
https://thehackernews.com/2026/10/linux-kernel-tcp-flaw-with-98-cvss.html
В дебяне пофиксили в linux 6.12.113-1 . Проверьте ваши сервера.
Wir sind schon fast 12 Stunden nicht mehr panisch durcheinandergerannt und haben vom Ende der menschlichen Zivilisation schwadroniert. Diesmal ist es CVE-2026-98432, ein von Anthropic gefundener, von NIST mit 9.8 eingestufter Fehler im TCP-Stack des Linux-Kernels, der remote code execution ermöglicht. Uneins sind sich die Fachleute allerdings bei der Frage der Kritikalität.
https://www.cve.org/CVERecord?id=CVE-2026-98432
https://www.cyberkendra.com/2026/10/cve-2026-98432-linux-kernel-tcp-flaw-ubuntu-rhel.html
https://thehackernews.com/2026/10/linux-kernel-tcp-flaw-with-98-cvss.html
https://ivanivanov.de/blog/linux-kernel-tcp-luecke-cve-2026-98432-use-after-free/
https://www.golem.de/news/linux-luecke-claude-schreibt-root-exploit-ubuntu-und-rhel-ohne-patch-2610-214664.html
CVE-2026-98432: Linux Kernel TCP Use-After-Free and the AI-Built Root Exploit
What is CVE-2026-98432? CVE-2026-98432 is a use-after-free in the IPv4 TCP implementation of the Linux kernel, disclosed in October 2026 with a critical CVSS 3.1 score of 9.8. A race condition in how the kernel manages socket options during connection establishment lets one CPU free a buffer while another CPU is still reading it. Anthropic's Frontier Red Team then reported that an unreleased AI model had built a working zero-click remote root exploit chain for the bug, targeting systems with […]https://thecybersecguru.com/exploits/cve-2026-98432-linux-kernel-tcp-use-after-free/
https://www.cve.org/CVERecord?id=CVE-2026-98432
This is bad, right, like *real* bad?
Is there an exploit for it in use yet?
CVE-2026-98432 is apparently a remote code execution in the Linux kernel triggerable via network (rather IPv4).
According to Anthropic [1]:
> In our proof of concept, it takes 48 minutes to leak a kernel pointer and another five minutes to reach the shell command execution.
Well, here is your "remediation" then:
echo '*/30 * * * * root /sbin/reboot' > /etc/cron.d/nice-try-NSA
[1] https://www.anthropic.com/research/discovering-vulnerabilities-with-claude
スクショメモ 2026/10/30 06:53 am.
X/TwitterのGrokニューストレンド
別アカウント
https://x.com/i/trending/2115922180936462742
「サンデー毎日」来年4月で105年史に幕 休刊発表
https://x.com/i/trending/2115691058839568890
Xのリンクコピー時に追跡パラメータが自動付与される仕組み
https://x.com/i/trending/2115819604299960635
Linux カーネルに深刻なCVE-2026-98432脆弱性、root権限奪取のリスク
🚨🚨 𝗕𝗘𝗟𝗔𝗡𝗚𝗥𝗜𝗝𝗞: 𝗻𝗶𝗲𝘂𝘄𝗲 𝗸𝗿𝗶𝘁𝗶𝘀𝗰𝗵𝗲 𝗸𝗹𝗼𝘁𝗲𝗯𝘂𝗴 𝗶𝗻 𝗟𝗶𝗻𝘂𝘅 (𝗖𝗩𝗘-𝟮𝟬𝟮𝟲-𝟵𝟴𝟰𝟯𝟮) 🚨🚨
Ondertussen heeft een nieuwe bug in de Linux-kernel, CVE-2026-98432, een score van 9.8 gekregen, dus superkritisch.
Karen IT Security Response Center (KSRC) Advisory
Advisory ID: KSRC-2026-10301
A #critical use-after-free #vulnerability has been identified in the Linux kernel’s IPv4 #TCP implementation. The flaw, tracked as CVE-2026-98432, has been assigned a CVSS v3.1 score of 9.8 (Critical) by the #Linux #kernel CNA.
An unauthenticated remote attacker can trigger a race condition during TCP connection establishment by sending crafted SYN packets containing IPv4 options. Successful exploitation may lead to kernel memory corruption, information disclosure, denial of service, or in certain configurations, remote code execution with root privileges.
Bluesky
Overview
Description
Statistics
- 17 Posts
- 38 Interactions
Fediverse
We have now seen enough evidence to say that the Brotli decoder vulnerabilities affecting NodeJS and other platforms has kindasortamaybesometimes been exploited in the wild. At the very least, it should be treated as such.
https://ifin.network/t/cve-2026-111497-brotli-out-of-bounds-write-impacts-node-python/929
Brotli bug is now exploited in the wild after a PoC was released on Monday
https://ellio.tech/en/blog/node2shell-cve-2026-111497-rce-on-stock-nodejs-builds/
https://previdian.com/CVE-2026-111497
Can we please have one week without a major security #vulnerability? I am exhausted :( https://strobes.co/blog/http2shell-brotli-rce-cve-2026-111497/ #nodejs #python
#hackers have begun exploiting a critical #Brotli #vulnerability known as #Node2Shell, #Broccoli2Shell, and #HTTP2Shell.
⚠️ CRITICAL: CISA warns of hackers now exploiting critical Node2Shell flaw
Hackers are actively exploiting CVE-2026-111497, a critical flaw in the Brotli compression algorithm tracked as Node2Shell. The vulnerability enables remote code execution, memory leaks, and application crashes. Any system running affected Brotli implementations is at immediate risk.
🤖 AI generated summary
Bluesky
Overview
Description
Statistics
- 21 Posts
- 4 Interactions
Fediverse
Cisco Patches Actively Exploited SSL VPN Vulnerability Affecting ASA and FTD Firewalls
Cisco has released security updates for a critical vulnerability in the Remote Access SSL VPN service of its Secure Firewall ASA and FTD software, tracked as CVE-2026-76418. The flaw lets unauthenticated attackers trigger unexpected device reloads, causing denial of service, and Cisco says it has been actively exploited. https://gbhackers.com/cisco-patches-actively-exploited-ssl-vpn-vulnerability/
🚨🇺🇸 Cisco firewall zero-day actively exploited to crash SSL VPN devices; CVE-2026-76418
Cisco has patched a high-severity vulnerability in Secure Firewall ASA and FTD software that allows an unauthenticated remote attacker to force affected devices to reload, causing a denial-of-service condition.
The flaw is triggered by a crafted request sent to the SSL VPN service when secondary authentication is configured on an affected tunnel group. A successful VPN login is not required.
⠀
• CVSS: 8.6
• Affected: Cisco Secure Firewall ASA and FTD with reachable SSL VPN services and secondary authentication
• Fixed ASA: 9.16.4.104, 9.18.4.96, 9.20.4.50, 9.22.3.200, 9.23.1.48, 9.24.1.27 and 9.24.10.1
• Fixed FTD: 7.0.11, 7.2.13, 7.4.9, 7.6.7, 7.7.14, 10.0.3 and 10.1.1
⠀
Cisco confirmed active exploitation in October but did not identify the attackers, targets or scale of the activity. No complete workaround is available, and administrators are urged to install a fixed release.
Cisco confirms exploitation of CVE-2026-76418 in ASA/FTD SSL VPN. An unauthenticated request can reboot vulnerable firewalls when secondary authentication is configured.
For admins: check tunnel groups, assess VPN exposure, and install fixed builds. Disabling secondary auth is listed as a mitigation, but it weakens protection. This is an availability risk, not a data breach.
Cisco has released patches for CVE-2026-76418, a high-severity flaw (CVSS 8.6) in Secure Firewall ASA and FTD. Cisco confirmed active exploitation. A successful unauthenticated remote attacker can trigger unexpected device reloads, causing denial of service.
Exposure requires a vulnerable release, a reachable SSL remote-access VPN login service, and secondary authentication configured in the tunnel group. Cisco also recomme…
https://en.hacks.gr/h-cisco-diorthonei-sovaro-keno-asfaleias-poy-chrisimopoieitai-idi-se-epitheseis/
📰 Cisco Patches Actively Exploited Zero-Day Crashing Firewalls
Cisco patches actively exploited zero-day (CVE-2026-76418) in ASA & FTD firewalls. Unauthenticated remote attackers can cause a DoS condition by crashing devices. Patches are available now. #Cisco #ZeroDay #CyberSecurity #CVE
CVE-2026-76418: Cisco ASA and FTD SSL VPN zero-day explained (affected versions, fixes, mitigation)
CVE-2026-76418 lets an unauthenticated attacker reboot Cisco ASA and FTD firewalls. See affected versions, fixed releases, mitigation and an audit scripthttps://thecybersecguru.com/exploits/cve-2026-76418-cisco-asa-ftd-ssl-vpn-zero-day/
Cisco ASA/FTD CVE-2026-76418 (CVSS 8.6): errore logico nella secondary authentication del Remote Access SSL VPN. Un attaccante non autenticato può forzare il reload del firewall (DoS). Cisco conferma lo sfruttamento in the wild; attori e scala non noti.
Solo con SSL VPN attiva e secondary auth su un tunnel group (anche DefaultWEBVPNGroup). Fix: ASA 9.20.4.50, 9.22.3.200; FTD 7.4.9, 7.6.7. Mitigazione: disattivare la secondary auth.
Here's a summary of recent geopolitical, technology, and cybersecurity news:
Geopolitical: The US has reportedly warned Gulf states to prepare for a "short, intense military campaign" against Iran following the upcoming midterm elections (Oct 28).
Technology: Google DeepMind unveiled Genie 4, an advanced AI model capable of creating interactive virtual worlds from text prompts (Oct 28).
Cybersecurity: Cisco issued warnings regarding the active exploitation of a Secure Firewall 0-day vulnerability (CVE-2026-76418) causing Denial of Service, and an SD-WAN flaw (CVE-2026-20127) utilized to deploy KeyDrift malware (Oct 28-29). Japan Airlines also disclosed a data breach affecting 92,000 customers (Oct 28).
The U.S.
Cybersecurity and Infrastructure Security Agency (CISA) added two security flaws impacting Cisco and GitLab software to its Known Exploited Vulnerabilities (KEV) catalog.
CVE-2026-97229 affects GitLab Community and Enterprise Editions, while CVE-2026-76418 impacts Cisco Secure Firewall ASA and FTD Software.
Both vulnerabilities are confirmed to be under active exploitation.
Bluesky
Overview
Description
Statistics
- 10 Posts
- 20 Interactions
Fediverse
Alpine Linux says it was almost hacked using a recent GitLab bug
https://alpinelinux.org/posts/GitLab-security-incident-CVE-2026-97229.html
.. forsøgte at hacke GitLab-serveren af Alpine #Linux -distroen i sidste uge
Angrebene lykkedes ikke, fordi hackeren undlod at failed to convert the authentication bypass into remote code execution
Alpine Linux opdagede og lappede serveren, før angriberen vendte tilbage med angreb
https://alpinelinux.org/posts/GitLab-security-incident-CVE-2026-97229.html
🔒 Alpine Linux rebuilt its GitLab server and reset all passwords after a CVE-2026-97229 (CVSS 10.0) exploit attempt crashed workers 8 times.
Upgrading GitLab to 19.3.6 didn't fix it for Alpine. The bug is in Ruby's Onigmo regex engine, and GitLab only patches its bundled Ruby. Custom container builds and source installs also need Ruby 3.3.13, 3.4.12, or 4.0.9+.
https://alpinelinux.org/posts/GitLab-security-incident-CVE-2026-97229.html
Alpine Linux says attackers tried CVE-2026-97229 against its GitLab server. No successful code execution was found, but it couldn't be ruled out; Alpine rebuilt the instance.
The operational lesson: its custom image was still vulnerable after a GitLab upgrade because the bundled Ruby lacked the fix. If you run GitLab from source or a custom image, check the Ruby version as well as GitLab's release.
https://alpinelinux.org/posts/GitLab-security-incident-CVE-2026-97229.html
The U.S.
Cybersecurity and Infrastructure Security Agency (CISA) added two security flaws impacting Cisco and GitLab software to its Known Exploited Vulnerabilities (KEV) catalog.
CVE-2026-97229 affects GitLab Community and Enterprise Editions, while CVE-2026-76418 impacts Cisco Secure Firewall ASA and FTD Software.
Both vulnerabilities are confirmed to be under active exploitation.
Bluesky
Overview
Description
Statistics
- 11 Posts
- 8 Interactions
Fediverse
CrowdStrike reported Oct 28 that a China-linked group used ESXi flaw CVE-2026-41709 to evade logging. It requires admin access.
Broadcom rates it low severity (2.7), yet observed use changes the priority. Check your ESXi builds against its patch matrix and consider how you'd detect activity with incomplete host logs.
https://www.crowdstrike.com/en-us/blog/crowdstrike-2026-legal-threat-landscape-report/
China-Linked Hackers Exploited VMware ESX Zero-Day to Reduce Audit Trail Visibility
CISA on Wednesday added a Broadcom VMware ESX flaw, CVE-2026-41709, to its Known Exploited Vulnerabilities catalog after CrowdStrike revealed a China-nexus actor known as Warp Panda had weaponised it in attacks targeting the U.S. legal sector. The flaw reduces audit-trail visibility, allowing certain operations to be performed without being logged. https://thehackernews.com/2026/10/china-linked-hackers-exploited-vmware.html
The vulnerability in question is CVE-2026-41709 (CVSS score: 2.7), an insufficient logging vulnerability that could permit a malicious actor with admin access to perform certain operations without being logged. https://thehackernews.com/2026/10/china-linked-hackers-exploited-vmware.html
📰 Chinese APT Exploited Low-Severity VMware Flaw for Stealth
CISA warns of exploited VMware ESXi flaw (CVE-2026-41709). Despite a low CVSS, Chinese APT Warp Panda used it as a zero-day to evade detection. #ThreatIntel #APT #VMware #CISA #KEV
Hat tip to The Hacker News for finding the exploitation evidence for CVE-2026-41709, which was added to CISA's KEV Catalog:
WARP PANDA: Multiple intrusions at U.S.-based entities included targets in the legal sector. WARP PANDA deployed several forms of malware in victims’ VMware vCenter environments. In several of these cases, and as late as early 2026, the adversary exploited ESXi command logging bypass vulnerability CVE-2026-41709 as a zero-day.
https://www.crowdstrike.com/en-us/blog/crowdstrike-2026-legal-threat-landscape-report/
https://thehackernews.com/2026/10/china-linked-hackers-exploited-vmware.html
https://www.cisa.gov/news-events/alerts/2026/10/28/cisa-adds-two-known-exploited-vulnerabilities-catalog
CISA warnt vor aktiv ausgenutzter Sicherheitslücke im Linux-Kernel
Die US-amerikanische Cybersicherheitsbehörde CISA hat zwei weitere Sicherheitslücken in ihren Katalog bekanntermaßen ausgenutzter Schwachstellen (Known Exploited Vulnerabilities, KEV)…
#linux #opensource #LinuxKernel #CVE202641709 #CVE202646300 #CISA
⚠️ CRITICAL: CISA Adds Two Known Exploited Vulnerabilities to Catalog
CISA added two vulnerabilities to the Known Exploited Vulnerabilities catalog: CVE-2026-41709 (Broadcom VMware ESX insufficient logging) and CVE-2026-46300 (Linux kernel missing variable initialization). Both are actively exploited in the wild. Federal agencies must prioritize patching these on int…
🤖 AI generated summary
Bluesky
Overview
Description
Statistics
- 15 Posts
- 12 Interactions
Fediverse
CVE-2026-109618: Welotec SMART EMS ≤3.5.3 has CRITICAL PHP2Shell vulnerabilities — unauthenticated RCE possible. Exploit code is public. No patch yet — restrict EMS PHP interface access & monitor for threats. https://radar.offseq.com/threat/welotec-php2shell-vulnerabilities-in-smart-ems-6ac1f974a6cecc60 #OffSeq #Vulnerability #RCE #Welotec
SO-CRATES 5.1 is out 🧅
SO-CRATES is a free, open source web app from Security Onion Solutions for analyzing PCAPs, logs, emails and binaries in one offline container.
New in 5.1:
- php2shell (CVE-2026-109618/109619): the image ships this week's ET Open rules, which catch it
- eMudhra's eight compromised CAs: no IDS rule existed, so a new Finding flags any certificate they issued, which can only be a forgery
- Right-click any value to pivot
- Tighter stat cards
ICYMI, the patched PHP packages for CVE-2026-109618 and CVE-2026-109619 have been rolled out to the production repositories for every PHP stream on AlmaLinux 8, 9, and 10.
Learn more about the CVEs and get the patched packages!
https://almalinux.org/blog/2026-10-21-php2shell-cve-2026-109618-cve-2026-109619/
Malcolm v26.10.0
Malcolm v26.10.0 moves Zeek to 9.0.1 LTS, expands threat intelligence enrichment with MITRE ATT&CK context, aligns Zeek OT protocol fields with Arkime, and fixes nine Malcolm security issues. Uploaded PCAP processing gets two important correctness fixes, and nearly every external artifact used in the build is now pinned and verified.
Upgrading: if you are upgrading an existing install, run ./scripts/status first so Malcolm can migrate settings before you run ./scripts/configure, ./scripts/start, or other control scripts.
- Full release notes v26.10.0
- Full changelog: v26.09.0...v26.10.0
✨ Features and enhancements
- Zeek 9.0.1 LTS.
multicast_participants.logis parsed and shown in a new Multicast dashboard.ntp_control.logandntp_private.logare parsed and indexed. (#1119) - OT field normalization. Zeek fields for BACnet, C12.22, DNP3, ENIP/CIP, Modbus, OPC UA, S7comm, and Synchrophasor are copied to Arkime's field names, so filters and drill-downs carry between Dashboards and Arkime. Original
zeek.*fields are kept. (#1257) - Threat intel in ECS
threat.*fields. Zeek intel kill chain phases, MISP MITRE galaxy tags, Mandiant and Google Threat Intelligence actors, Suricata ETmitre_*metadata, and capa results all map to normalized tactic, technique, subtechnique, and group fields. ATT&CK for ICS is told apart from Enterprise. (#695) - Richer indicator metadata. Mandiant categories, campaigns, reports, and threat score, plus STIX 2.1
confidence, now reach Zeek intel. Google Threat Intelligence collections acceptioc_typesandinclude_autogenerated_tagsto cut memory use. - Community ID in Logstash for Zeek logs that arrive without one, controlled by
LOGSTASH_ZEEK_COMPUTE_COMMUNITY_ID(on by default). (#400) - API document lookup gains
sort,offset,track_total_hits, and atotalhit count. It and field aggregations now returnshardsandtimed_out, so a partial or timed-out search no longer looks like an empty result. Bad arguments return HTTP 400. (#1130, #1131) - Custom ports for 13 ICSNPP analyzers through new
ZEEK_PORTS_*variables. Three older variables are renamed to match, with values migrated on upgrade. (#1272) - NetBox skips the device-type library import once it has completed for a revision.
NETBOX_DEVICETYPE_IMPORT_VENDORScan limit the first import, which also limits MAC OUI matching. - Smaller items: a low-RAM warning during configuration, a Hedgehog ISO prompt for the status kiosk, restyled account management pages, and Biomes dashboard docs in Analytics.
- New Corelight Zeek detections: php2shell-detect and emudhra-weak-keys.
🛡️ Security remediation and hardening
- Stored XSS in the
file-uploadcontainer let a user with upload access run JavaScript in another user's session. The patch route also allowed writes to arbitrary directories. The read side is gone, the vulnerable handlers are stripped at build time, and responses carrynosniffand a strict CSP. (GHSA-qv8w-m37v-6c7j) - Credential disclosure in the
hh-extracted-filesproxy, which forwarded the caller's auth headers and cookies to a caller-chosen destination. Those headers are now cleared. (GHSA-325g-72fr-vj2x) - The published default Arkime WISE PIN and viewer password secret are removed. (GHSA-w2jh-h3pq-273j)
- MaxMind and GitHub tokens are passed as BuildKit secrets instead of build arguments. Exposed MaxMind credentials were rotated. (GHSA-3293-9mf2-qf68)
- Logstash's Beats input requires a client certificate when
BEATS_SSL=true. (GHSA-f2gq-m4v3-2383) - The root-run PCAP upload watcher no longer follows symlinks. (GHSA-98jw-5wq7-6qjv)
- Every outbound API request now has a timeout, and the API runs multiple workers, so one hung dependency can't take it down. (GHSA-x9f2-h2rj-vp63)
nginx/htpasswdandhtadmin/metadataare tightened to 0640. (GHSA-rxpm-f8cm-2m5m)- The ISO install hook uses a private temp directory. (GHSA-wmrp-jr97-8xf4)
- Nginx logs a warning when remote Keycloak runs without TLS verification. (GHSA-5wxm-fqf2-r23g)
/mapi/opensearch/has role-based access control, with a read-only query tier and an admin tier./mapi/eventrecords the submitter and namespaces caller IDs so they can't overwrite pipeline records. Config import is confined to the config directory (thanks @zaara2004). (#1147)- Supply chain: release binaries, source archives, web assets, Zeek packages, images, and GitHub Actions are pinned and checksum-verified. For hardened builds today, see the Iron Bank images. (#1138)
- OpenResty 1.31.8.1 brings 12 nginx CVE fixes.
lua-resty-openidcgoes to 1.9.3 with a rewritten session config and a persistedNGINX_SESSION_SECRET. - PHP 8.4.27 in
file-uploadandhtadminaddresses the php2shell vulnerabilities (CVE-2026-109618, CVE-2026-109619).
🐛 Bug fixes
- Zeek intel on uploaded PCAP: packet processing now waits for intel files to load, so early packets and small captures get
intel.loghits. (#1260) - Suricata rule metadata on uploaded PCAP: none of 33,303 sampled alerts carried it before. Instances are now warmed up and reloaded, so ET MITRE and CVE metadata map into
threat.*andvulnerability.*. Scheduled rule updates now reload every socket. (#1262) - Workaround for an upstream OpenSearch Dashboards connection leak that crashed the container.
- PCAP watchers no longer mistake read-only opens for activity, which had stalled or skipped files. (#1265)
- STIX, TAXII, and MISP conversion: TAXII 2.1 feeds load, one bad object no longer drops a whole bundle,
sinceis honored, and compound patterns are handled clause by clause. - Threat intel and API timestamps no longer shift with the host timezone. The
/fieldscatalogue includes nested fields. - OpenSearch index retention no longer double-counts indices or rounds small ones to zero.
- Other fixes cover PCAP upload duplicate detection, file scanning, Filebeat cleanup, NetBox enrichment, DTLS and MQTT transport labels,
prune_files.sh, and the build and control scripts.
✅ Component versions
Zeek 9.0.1 LTS (some log fields changed, such as files.log dropping ftime), OpenSearch and Dashboards 3.9.0, OpenResty 1.31.8.1, Arkime 6.9.1, Keycloak 26.8, Logstash and Filebeat 9.5.5, NetBox Python dependencies, lua-resty-openidc 1.9.3, and several smaller tools.
Malcolm is an easily deployable network traffic analysis tool suite for network security monitoring. It runs as a cluster of containers under Docker, Podman, or Kubernetes. Start with the Quick Start guide, or grab the Malcolm and Hedgehog Linux ISO installers from the releases page. Join the discussions board or watch a video.
I wrote up the php2shell RCE (CVE-2026-109618 and CVE-2026-109619): the root cause, the signed-integer primitive, and the paths to a shell on both mod_php and FPM. Reliable exploitation is a lot harder than the headlines made it sound: every chain is pinned to one exact build, so the public PoCs mostly crash on a different one.
https://ilia.ws/blog/php2shell-two-ways-php-corrupts-its-own-memory
🔒 New CSAF advisory published
VDE-2026-127
Welotec: PHP2Shell Vulnerabilities in SMART EMS
CVE-2026-109618, CVE-2026-109619
Two memory-safety vulnerabilities in the PHP runtime bundled with SMART EMS allow an unauthenticated remote attacker to execute arbitrary code in the context of the PHP web worker. All SMART EMS versions up to a…
HTML: https://certvde.com/en/advisories/VDE-2026-127
CSAF JSON: https://welotec.csaf-tp.certvde.com/.well-known/csaf/white/2026/vde-2026-127.json
The vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619 (CVSS scores: 9.2), allow attackers to achieve unauthenticated remote code execution on systems running affected versions of PHP. https://thehackernews.com/2026/10/attackers-exploit-php2shell-flaws-in.html
Bluesky
Overview
Description
Statistics
- 8 Posts
- 8 Interactions
Fediverse
Cybersecurity firm Dream said it found an alleged Chinese attack where PHP2Shell was chained with a Linux bug to breach a US government server
CISA wouldn't confirm or deny but added the chained bug - CVE-2026-46300 - to the exploited vulnerabilities catalog yesterday
https://therecord.media/php2shell-successful-exploitation-reports-emerge
CISA warnt vor aktiv ausgenutzter Sicherheitslücke im Linux-Kernel
Die US-amerikanische Cybersicherheitsbehörde CISA hat zwei weitere Sicherheitslücken in ihren Katalog bekanntermaßen ausgenutzter Schwachstellen (Known Exploited Vulnerabilities, KEV)…
#linux #opensource #LinuxKernel #CVE202641709 #CVE202646300 #CISA
⚠️ CRITICAL: CISA Adds Two Known Exploited Vulnerabilities to Catalog
CISA added two vulnerabilities to the Known Exploited Vulnerabilities catalog: CVE-2026-41709 (Broadcom VMware ESX insufficient logging) and CVE-2026-46300 (Linux kernel missing variable initialization). Both are actively exploited in the wild. Federal agencies must prioritize patching these on int…
🤖 AI generated summary
Bluesky
Overview
Description
Statistics
- 12 Posts
- 11 Interactions
Fediverse
ICYMI, the patched PHP packages for CVE-2026-109618 and CVE-2026-109619 have been rolled out to the production repositories for every PHP stream on AlmaLinux 8, 9, and 10.
Learn more about the CVEs and get the patched packages!
https://almalinux.org/blog/2026-10-21-php2shell-cve-2026-109618-cve-2026-109619/
Malcolm v26.10.0
Malcolm v26.10.0 moves Zeek to 9.0.1 LTS, expands threat intelligence enrichment with MITRE ATT&CK context, aligns Zeek OT protocol fields with Arkime, and fixes nine Malcolm security issues. Uploaded PCAP processing gets two important correctness fixes, and nearly every external artifact used in the build is now pinned and verified.
Upgrading: if you are upgrading an existing install, run ./scripts/status first so Malcolm can migrate settings before you run ./scripts/configure, ./scripts/start, or other control scripts.
- Full release notes v26.10.0
- Full changelog: v26.09.0...v26.10.0
✨ Features and enhancements
- Zeek 9.0.1 LTS.
multicast_participants.logis parsed and shown in a new Multicast dashboard.ntp_control.logandntp_private.logare parsed and indexed. (#1119) - OT field normalization. Zeek fields for BACnet, C12.22, DNP3, ENIP/CIP, Modbus, OPC UA, S7comm, and Synchrophasor are copied to Arkime's field names, so filters and drill-downs carry between Dashboards and Arkime. Original
zeek.*fields are kept. (#1257) - Threat intel in ECS
threat.*fields. Zeek intel kill chain phases, MISP MITRE galaxy tags, Mandiant and Google Threat Intelligence actors, Suricata ETmitre_*metadata, and capa results all map to normalized tactic, technique, subtechnique, and group fields. ATT&CK for ICS is told apart from Enterprise. (#695) - Richer indicator metadata. Mandiant categories, campaigns, reports, and threat score, plus STIX 2.1
confidence, now reach Zeek intel. Google Threat Intelligence collections acceptioc_typesandinclude_autogenerated_tagsto cut memory use. - Community ID in Logstash for Zeek logs that arrive without one, controlled by
LOGSTASH_ZEEK_COMPUTE_COMMUNITY_ID(on by default). (#400) - API document lookup gains
sort,offset,track_total_hits, and atotalhit count. It and field aggregations now returnshardsandtimed_out, so a partial or timed-out search no longer looks like an empty result. Bad arguments return HTTP 400. (#1130, #1131) - Custom ports for 13 ICSNPP analyzers through new
ZEEK_PORTS_*variables. Three older variables are renamed to match, with values migrated on upgrade. (#1272) - NetBox skips the device-type library import once it has completed for a revision.
NETBOX_DEVICETYPE_IMPORT_VENDORScan limit the first import, which also limits MAC OUI matching. - Smaller items: a low-RAM warning during configuration, a Hedgehog ISO prompt for the status kiosk, restyled account management pages, and Biomes dashboard docs in Analytics.
- New Corelight Zeek detections: php2shell-detect and emudhra-weak-keys.
🛡️ Security remediation and hardening
- Stored XSS in the
file-uploadcontainer let a user with upload access run JavaScript in another user's session. The patch route also allowed writes to arbitrary directories. The read side is gone, the vulnerable handlers are stripped at build time, and responses carrynosniffand a strict CSP. (GHSA-qv8w-m37v-6c7j) - Credential disclosure in the
hh-extracted-filesproxy, which forwarded the caller's auth headers and cookies to a caller-chosen destination. Those headers are now cleared. (GHSA-325g-72fr-vj2x) - The published default Arkime WISE PIN and viewer password secret are removed. (GHSA-w2jh-h3pq-273j)
- MaxMind and GitHub tokens are passed as BuildKit secrets instead of build arguments. Exposed MaxMind credentials were rotated. (GHSA-3293-9mf2-qf68)
- Logstash's Beats input requires a client certificate when
BEATS_SSL=true. (GHSA-f2gq-m4v3-2383) - The root-run PCAP upload watcher no longer follows symlinks. (GHSA-98jw-5wq7-6qjv)
- Every outbound API request now has a timeout, and the API runs multiple workers, so one hung dependency can't take it down. (GHSA-x9f2-h2rj-vp63)
nginx/htpasswdandhtadmin/metadataare tightened to 0640. (GHSA-rxpm-f8cm-2m5m)- The ISO install hook uses a private temp directory. (GHSA-wmrp-jr97-8xf4)
- Nginx logs a warning when remote Keycloak runs without TLS verification. (GHSA-5wxm-fqf2-r23g)
/mapi/opensearch/has role-based access control, with a read-only query tier and an admin tier./mapi/eventrecords the submitter and namespaces caller IDs so they can't overwrite pipeline records. Config import is confined to the config directory (thanks @zaara2004). (#1147)- Supply chain: release binaries, source archives, web assets, Zeek packages, images, and GitHub Actions are pinned and checksum-verified. For hardened builds today, see the Iron Bank images. (#1138)
- OpenResty 1.31.8.1 brings 12 nginx CVE fixes.
lua-resty-openidcgoes to 1.9.3 with a rewritten session config and a persistedNGINX_SESSION_SECRET. - PHP 8.4.27 in
file-uploadandhtadminaddresses the php2shell vulnerabilities (CVE-2026-109618, CVE-2026-109619).
🐛 Bug fixes
- Zeek intel on uploaded PCAP: packet processing now waits for intel files to load, so early packets and small captures get
intel.loghits. (#1260) - Suricata rule metadata on uploaded PCAP: none of 33,303 sampled alerts carried it before. Instances are now warmed up and reloaded, so ET MITRE and CVE metadata map into
threat.*andvulnerability.*. Scheduled rule updates now reload every socket. (#1262) - Workaround for an upstream OpenSearch Dashboards connection leak that crashed the container.
- PCAP watchers no longer mistake read-only opens for activity, which had stalled or skipped files. (#1265)
- STIX, TAXII, and MISP conversion: TAXII 2.1 feeds load, one bad object no longer drops a whole bundle,
sinceis honored, and compound patterns are handled clause by clause. - Threat intel and API timestamps no longer shift with the host timezone. The
/fieldscatalogue includes nested fields. - OpenSearch index retention no longer double-counts indices or rounds small ones to zero.
- Other fixes cover PCAP upload duplicate detection, file scanning, Filebeat cleanup, NetBox enrichment, DTLS and MQTT transport labels,
prune_files.sh, and the build and control scripts.
✅ Component versions
Zeek 9.0.1 LTS (some log fields changed, such as files.log dropping ftime), OpenSearch and Dashboards 3.9.0, OpenResty 1.31.8.1, Arkime 6.9.1, Keycloak 26.8, Logstash and Filebeat 9.5.5, NetBox Python dependencies, lua-resty-openidc 1.9.3, and several smaller tools.
Malcolm is an easily deployable network traffic analysis tool suite for network security monitoring. It runs as a cluster of containers under Docker, Podman, or Kubernetes. Start with the Quick Start guide, or grab the Malcolm and Hedgehog Linux ISO installers from the releases page. Join the discussions board or watch a video.
I wrote up the php2shell RCE (CVE-2026-109618 and CVE-2026-109619): the root cause, the signed-integer primitive, and the paths to a shell on both mod_php and FPM. Reliable exploitation is a lot harder than the headlines made it sound: every chain is pinned to one exact build, so the public PoCs mostly crash on a different one.
https://ilia.ws/blog/php2shell-two-ways-php-corrupts-its-own-memory
🔒 New CSAF advisory published
VDE-2026-127
Welotec: PHP2Shell Vulnerabilities in SMART EMS
CVE-2026-109618, CVE-2026-109619
Two memory-safety vulnerabilities in the PHP runtime bundled with SMART EMS allow an unauthenticated remote attacker to execute arbitrary code in the context of the PHP web worker. All SMART EMS versions up to a…
HTML: https://certvde.com/en/advisories/VDE-2026-127
CSAF JSON: https://welotec.csaf-tp.certvde.com/.well-known/csaf/white/2026/vde-2026-127.json
The vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619 (CVSS scores: 9.2), allow attackers to achieve unauthenticated remote code execution on systems running affected versions of PHP. https://thehackernews.com/2026/10/attackers-exploit-php2shell-flaws-in.html
Bluesky
Overview
- Oracle Corporation
- Oracle Application Object Library
Description
Statistics
- 6 Posts
- 1 Interaction
Fediverse
Oracle EBS: Exploit-Versuche gegen CVE-2026-101767 - Die Lücke (CVSS 9,8) erlaubt eine nicht authentifizierte SQL-Injection, die bis zur Ausführung von Remote-Code führen kann. Betreiber sollten den Patch einspielen und den Zugriff auf den betroffenen Endpunkt prüfen.
https://www.all-about-security.de/oracle-ebs-exploit-versuche-gegen-cve-2026-101767/
Threat actors began probing the critical Oracle EBS vulnerability CVE-2026-101767 on honeypots within a week of Oracle releasing emergency security patches.
Bluesky
Overview
Description
Statistics
- 5 Posts
- 1 Interaction
Fediverse
Security researchers reported attacks exploiting CVE-2026-20127, a CVSS 10.0 authentication bypass vulnerability affecting Cisco Catalyst SD-WAN Controller, Manager, and Validator deployments.
The deployed KeyDrift malware uses components like LittleFilch to extract AES-256 key material and PolyFlame for in-memory backdoor access.
Cisco released fixed versions and hardening guidelines, warning that prior compromises may persist…
https://en.hacks.gr/chakers-chtypisan-systimata-tis-cisco-gia-na-klepsoyn-kleidia-kryptografisis/
Here's a summary of recent geopolitical, technology, and cybersecurity news:
Geopolitical: The US has reportedly warned Gulf states to prepare for a "short, intense military campaign" against Iran following the upcoming midterm elections (Oct 28).
Technology: Google DeepMind unveiled Genie 4, an advanced AI model capable of creating interactive virtual worlds from text prompts (Oct 28).
Cybersecurity: Cisco issued warnings regarding the active exploitation of a Secure Firewall 0-day vulnerability (CVE-2026-76418) causing Denial of Service, and an SD-WAN flaw (CVE-2026-20127) utilized to deploy KeyDrift malware (Oct 28-29). Japan Airlines also disclosed a data breach affecting 92,000 customers (Oct 28).