The sound you are currently experiencing is the sound of a million script kiddies humming “time to do some sketchy shit, doo dah doodah, hope I get away with it, oh doodah day”

So, today’s entry in how #ai is destroying the internet, I give you a bug that affects most servers on earth, so that’s fun! It doesn’t affect home and small office users, or any other users who boot their devices solely from disk drives.

The vulnerability, tracked as #CVE-2026-97631, is a Sev 9.5 memory-corruption flaw in an #ICMP component that attackers can exploit to execute malicious code that runs before the operating system and firmware can implement defenses.

Discovered by teams at #anthropic and #google, it was surfaced by #AMI publishing a pull request with a fix for some of their hardware. Because the bug had been “embargoed“ while manufacturers worked on fixes, this is an unpatched bug in many cases, that has just been announced publicly.

#infosec #sysops #netops

https://arstechnica.com/security/2026/10/code-execution-flaw-in-uefi-firmware-threatens-most-servers-on-planet-earth/

Faille UEFI CVE-2026-97631 : un paquet ICMP suffit pour exécuter du code avant le Secure Boot https://www.it-connect.fr/faille-uefi-edk-ii-pxe-icmp-cve-2026-97631/ #ActuCybersécurité #Cybersécurité #Vulnérabilité

A 16-year-old buffer overflow vulnerability, tracked as CVE-2026-97631, affects EDK II open-source code used for UEFI firmware up to edk2-stable202608.

The flaw stems from incorrect size checks in IPv4 and IPv6 network-boot code when copying error messages, allowing code execution during network boot before the operating system and Secure Boot load.

Affected packages include distributions from Red Hat, SUSE, and Debian.

https://en.hacks.gr/sfalma-sto-edk-ii-mporei-na-epitrepsei-ektelesi-kodika-prin-fortothei-to-leitoyrgiko-systima/

#UEFI #Firmware #EDKII #Debian

CVE-2026-97631

pls stop

🚨🇺🇸 Critical 16-year-old EDK II flaw enables code execution before Secure Boot

A critical buffer overflow in TianoCore EDK II, the open-source foundation used to build much of the world’s UEFI firmware, can allow an unauthenticated attacker to run code before the operating system loads.

Tracked as CVE-2026-97631, the vulnerability carries a CVSS score of 9.5 and has existed in the code since November 2010.
⠀
The flaw resides in the PXE network-boot driver, which copies incoming ICMP error messages into a fixed 504-byte buffer without properly limiting their size.
⠀
An attacker who can reach a machine while it is booting over the network can send a crafted ICMP message that:

• Crashes the firmware and prevents the operating system from loading
• Executes attacker-controlled code in the pre-boot environment
• Runs before Secure Boot and measured-boot protections evaluate the operating system
⠀
Reliable code execution requires knowledge of the target’s firmware build. Systems that boot exclusively from local storage are not exposed through this attack path.
⠀
An upstream fix was merged into EDK II on October 15, but no stable EDK II release currently includes it. Server and motherboard vendors must integrate the patch and distribute BIOS or UEFI updates to customers.

Source: https://github.com/tianocore/edk2/security/advisories/GHSA-99cj-7hg9-mp4m

CVE-2026-97631 has a severity rating of 9.5/10. The memory-corruption flaw is in the ICMP component of TianoCore EDK II’s PXE-Base Code driver. It affects servers, storage equipment and devices using EDK II with PXE enabled to boot from a local network.

The flaw can allow malicious code to run early in the boot process, before Secure Boot and TPM defenses load. Exploitation requires low-level local-network or insider access;…

https://en.hacks.gr/sovaro-provlima-asfaleias-se-logismiko-ekkinisis-epaggelmatikon-systimaton-pagkosmios/

#EDKII #PXE #UEFIFirmware #MemoryCorruption

Yet another forever day

CVE-2026-97631 joins a long list of previously discovered vulnerabilities in UEFI or code that works closely with it.

Know now that laughing because all my devices have been on BIOS Boot for years is appropriate.

🧐😱🫣
Critical UEFI Firmware Flaw
CVE-2026-97631

CVE-2026-97631: How a 16-Year-Old EDK II PXE Bug Exposes UEFI Firmware Before the OS Loads

https://thecybersecguru.com/news/cve-2026-97631-edk2-pxe-uefi-vulnerability/

POV: you just finished patching PHP2Shell

then node and python get one too

broccoli2shell, CVE-2026-111497, CVSS 9.2, an out-of-bounds write in google's brotli decoder. reported by openai's codex security

node 22.23.4 / 24.22.1 / 26.12.1
python Brotli 1.2.1, brotlicffi 1.2.1.0
then restart and rebuild images

https://github.com/advisories/GHSA-9v8h-qqgm-4m35

#InfoSec #NodeJS #Python #CVE

Broccoli2shell: Everything You Need To Know About The Critical Brotli Decoder Vulnerability | Wiz Blog #devopsish https://www.wiz.io/blog/cve-2026-111497-brotli-rce-node-js

Microsoft released emergency updates for a severe Microsoft .NET Brotli vulnerability. Learn how to patch CVE-2026-111497 and secure your applications now.

#Microsoft #DotNet #Brotli #Cybersecurity #Imperva

https://dailytechnow.com/microsoft-dotnet-brotli-vulnerability/

Broadcom warns of a VMware SDDC Manager vulnerability, CVE-2026-111497 (CVSS 9.8), from the Node.js Brotli vulnerability. Patches pending.

#VMware #Broadcom #SDDCManager #VMwareCloudFoundation #Brotli #CVE2026111497 #NodeJS #RCE

https://securityonline.info/vmware-sddc-manager-vulnerability-cve-2026-111497/?utm_source=mastodon&utm_medium=jetpack_social

We've built a scanner to detect the exposure of your website to Node2Shell (CVE-2026-111497). We have emergency remediation measures ready if you need help - just reach out and our team can help.
https://nodejsguard.io/

I built a free, open source scanner for CVE-2026-111497 (Node2Shell / HTTP2Shell / Broccoli2Shell).

It checks the Brotli code inside binaries instead of trusting version numbers, so it finds copies hidden in Node.js, Python, .NET and Bun, and sees fixes that distros backported.

Read-only. For Kubernetes, container images and Linux hosts.

https://github.com/depuschm/brotli-k8s-scan

#Node2Shell #HTTP2Shell #Broccoli2Shell #InfoSec #CyberSecurity #NodeJS #Python #Kubernetes #OpenSource

Más actualizaciones para Broccoli 2Shell (HTTP2Shell - CVE-2026-111497), revisa TODOS tus dispositivos y aplicaciones

Vía: @seguinfo

https://blog.segu-info.com.ar/2026/10/mas-actualizaciones-para-broccoli.html

CISA KEV catalog adds actively exploited Magento flaw CVE-2026-48356 and Brotli vulnerability CVE-2026-111497. Patch before November 10.

#CISA #KEV #Magento #AdobeCommerce #Brotli #CVE202648356 #CVE2026111497 #ActiveExploitation

https://securityonline.info/cisa-kev-magento-brotli-vulnerability/?utm_source=mastodon&utm_medium=jetpack_social

CISA added two vulnerabilities to its KEV catalog: CVE-2026-48356 (Adobe Commerce/Magento unrestricted file upload, CVSS 9.3) and CVE-2026-111497 (Google Brotli memory corruption, CVSS 9.2).

Sansec noted hundreds of online stores infected via PolyShell, while Wiz warns that 91% of cloud environments have resources exposed to the Brotli issue.

Multiple vendors including Node.js, PHP, have released patches.

https://en.hacks.gr/synagermos-stis-ipa-gia-dyo-sovara-provlimata-asfaleias-poy-axiopoioyntai-se-epitheseis/

#CISA #Magento #Brotli #NodeJS

📰 CISA Adds Exploited Google Brotli and Adobe Commerce Flaws to KEV

📢 CISA adds two actively exploited vulns to its KEV catalog: Node2Shell (CVE-2026-111497) in Google Brotli & a file upload flaw (CVE-2026-48356) in Adobe Commerce. Federal agencies must patch by Nov 10. #PatchNow #CISA #KEV

🔗 https://cyber.netsecops.io/articles/cisa-adds-exploited-google-brotli-and-adobe-commerce-flaws-to-kev-catalog/?utm_source=mastodon&utm_medium=social&utm_campaign=daily

Latest cybersecurity reports highlight critical PHP vulnerabilities being actively exploited globally, necessitating emergency patching. CISA confirmed exploitation of the Node2Shell/Brotli flaw (CVE-2026-111497). China-linked groups leveraged a BeyondTrust zero-day (CVE-2026-102764), and AI agents reportedly compromised live websites during testing (Oct 27-28, 2026). In technology, Amazon Business introduced new agentic AI tools. Geopolitically, Israel's elections are heading towards a coalition deadlock.

#Cybersecurity #AnonNews_irc #News

PHP2Shell: CISA ha aggiunto CVE-2026-109618 e CVE-2026-109619 (RCE non autenticate, CVSS 9.2) al catalogo KEV, con scadenza per le agenzie FCEB giovedì 29/10. È la conferma ufficiale dello sfruttamento, dopo le 35 shell ottenute su honeypot Apache mod_php il 24/10 (Adel Karimi, Perplexity). Patch del 21/10: 8.5.12, 8.4.27, 8.3.36, 8.2.35. Su Windows verificare anche il rebuild per Brotli (CVE-2026-111497). https://www.bleepingcomputer.com/news/security/cisa-confirms-php2shell-vulnerabilities-now-exploited-in-attacks/ #infosec #PHP #threatintel

https://dreamgroup.com/blog/chained-php2shell-exploit-roots-25-servers

The affected devices run specific versions of a large vendor’s firewall software. For security purposes, we are not disclosing the vendor or the affected versions, and the vendor has been notified.

https://security.paloaltonetworks.com/CVE-2026-109618

Active exploitation has been observed targeting the Palo Alto Networks management interface exposed to the internet.

:brdThink:

We have finally listed #PHP2Shell as exploited in the wild with the release of a report detailing the compromise of multiple firewall devices, including some used by the US government.

https://ifin.network/t/cve-2026-109618-cve-2026-109619-remote-code-execution-in-php/914

#ThreatIntel

GreyNoise is monitoring exploitation attempts against #php2shell (CVE-2026-109618 and CVE-2026-109619).

On 28 Oct 2026, 05:14:01 UTC we observed the first successful exploitation of php2shell against a vulnerable GreyNoise sensor.

"We’re seeing successful exploitation of these CVEs, but the conditions make it difficult for a threat actor to scale. Fifty different servers in various configurations can be vulnerable to these CVEs, but the same exploit may not work universally against all of them. Actors need to tailor their exploit for each respective configuration which makes mass exploitation challenging."
- Andrew Thompson, SVP of Adversary Operations at GreyNoise

This live activity report is derived from GreyNoise data and updates as we observe new activity: https://php.events.greynoise.io/

“The PHP panic has not turned to patching: And that’s bad news, capital B, as PHP2Shell attacks ramp up.

We know the paired PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, aka PHP2Shell, have a Common Vulnerability Scoring System (CVSS) score of 9.2, which is scary bad. After all, about 70% of websites with an identifiable server-side language run on PHP-based systems like WordPress.

But does that mean people are patching their servers as fast as they can?

To quote Moshe Siman Tov Bustan of Ox security: “The panic hasn’t turned into patching.” Ox reports in a new blog post that of October 26, five days after disclosure, the picture has barely shifted – 93.6% still exposed.“”

https://thenewstack.io/php2shell-unpatched-php-servers/

#CyberSecurity #PHP #PHP2Shell #Programming #SoftwareDevelopment

🚨🇱🇰 Barista Sri Lanka allegedly breached through PHP vulnerabilities, customer information exposed

Barista, one of Sri Lanka's largest café chains with more than 100 outlets, has been targeted by an actor using the handle "secret_solder".

The actor claims to have gained unauthorized server access by exploiting PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619, allegedly achieving remote code execution without authentication.

According to the post, the server was running an outdated PHP 8.1.34 installation with exposed configuration details.

The actor also claims to have extracted customer names, email addresses, phone numbers, and delivery addresses from server memory.

A sample containing customer names and phone numbers was published. The intrusion and vulnerability claims remain independently unverified.

💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing

"Responder Guidance for PHP2Shell (CVE-2026-109618 and CVE-2026-109619)":

https://bishopfox.com/blog/responder-guidance-for-php2shell

🔒 New CSAF advisory published

VDE-2026-137
METTLER TOLEDO: PHP2Shell in Octo Image Server
CVE-2026-109618, CVE-2026-109619

OCTO Image Server contains a vulnerable version of PHP affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619). We strongly recommend to upgrade PHP to version 8.2.35.

HTML: https://certvde.com/en/advisories/VDE-2026-137/
CSAF JSON: https://mettler-toledo.csaf-tp.certvde.com/.well-known/csaf/white/2026/vde-2026-137.json

#OT #Advisory

PHP "php2shell" (CVE-2026-109618/109619) is in CISA KEV and under attack: no-login code execution on PHP web servers. That includes the web UI on OPNsense, pfSense and Unraid, and PHP apps on Synology and QNAP. Update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 (or the vendor update), then restart PHP.

Also: Nextcloud's built-in Collabora CODE app (CVE-2026-110447), update to 26.4.303.

This week's issue:
https://patchorpass.beehiiv.com/p/patchorpass-2-php-php2shell-exploit-patch-now-plus-nextcloud-collabora?utm_source=mastodon&utm_medium=social&utm_campaign=issue-2

#infosec #homelab #selfhosted #nextcloud

PHP2Shell: The 'End of the World' Vulnerability in PHP and How Major Companies Moved to Contain the Disaster

On October 21, 2026, the PHP project disclosed PHP2Shell (CVE-2026-109618 and CVE-2026-109619), two critical flaws in the PHP core affecting every version since 5.4 and allowing unauthenticated rem...

🔗 https://salehgnutux.github.io/GT-NEWSTECH/en/foss/php2shell-critical-vulnerability-response/

#PHP2Shell #Cybersecurity #PHP #Critical_Vulnerabilities #RCE #Linux #Red_Hat #Ubuntu #Cloudflare #gnutux

PHP2Shell Update: Still No Confirmed WordPress Compromises - What we've seen across over 5 million WordPress sites we protect.

As of Oct 28, 2026, Wordfence is not aware of any WordPress site compromised through PHP2Shell (CVE-2026-109618, CVE-2026-109619).

Here's what we've seen so far:

https://www.wordfence.com/blog/2026/10/php2shell-update-still-no-confirmed-wordpress-compromises-and-answers-to-the-questions-were-hearing-most/

PHP2Shell: CISA ha aggiunto CVE-2026-109618 e CVE-2026-109619 (RCE non autenticate, CVSS 9.2) al catalogo KEV, con scadenza per le agenzie FCEB giovedì 29/10. È la conferma ufficiale dello sfruttamento, dopo le 35 shell ottenute su honeypot Apache mod_php il 24/10 (Adel Karimi, Perplexity). Patch del 21/10: 8.5.12, 8.4.27, 8.3.36, 8.2.35. Su Windows verificare anche il rebuild per Brotli (CVE-2026-111497). https://www.bleepingcomputer.com/news/security/cisa-confirms-php2shell-vulnerabilities-now-exploited-in-attacks/ #infosec #PHP #threatintel

We have finally listed #PHP2Shell as exploited in the wild with the release of a report detailing the compromise of multiple firewall devices, including some used by the US government.

https://ifin.network/t/cve-2026-109618-cve-2026-109619-remote-code-execution-in-php/914

#ThreatIntel

GreyNoise is monitoring exploitation attempts against #php2shell (CVE-2026-109618 and CVE-2026-109619).

On 28 Oct 2026, 05:14:01 UTC we observed the first successful exploitation of php2shell against a vulnerable GreyNoise sensor.

"We’re seeing successful exploitation of these CVEs, but the conditions make it difficult for a threat actor to scale. Fifty different servers in various configurations can be vulnerable to these CVEs, but the same exploit may not work universally against all of them. Actors need to tailor their exploit for each respective configuration which makes mass exploitation challenging."
- Andrew Thompson, SVP of Adversary Operations at GreyNoise

This live activity report is derived from GreyNoise data and updates as we observe new activity: https://php.events.greynoise.io/

“The PHP panic has not turned to patching: And that’s bad news, capital B, as PHP2Shell attacks ramp up.

We know the paired PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, aka PHP2Shell, have a Common Vulnerability Scoring System (CVSS) score of 9.2, which is scary bad. After all, about 70% of websites with an identifiable server-side language run on PHP-based systems like WordPress.

But does that mean people are patching their servers as fast as they can?

To quote Moshe Siman Tov Bustan of Ox security: “The panic hasn’t turned into patching.” Ox reports in a new blog post that of October 26, five days after disclosure, the picture has barely shifted – 93.6% still exposed.“”

https://thenewstack.io/php2shell-unpatched-php-servers/

#CyberSecurity #PHP #PHP2Shell #Programming #SoftwareDevelopment

🚨🇱🇰 Barista Sri Lanka allegedly breached through PHP vulnerabilities, customer information exposed

Barista, one of Sri Lanka's largest café chains with more than 100 outlets, has been targeted by an actor using the handle "secret_solder".

The actor claims to have gained unauthorized server access by exploiting PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619, allegedly achieving remote code execution without authentication.

According to the post, the server was running an outdated PHP 8.1.34 installation with exposed configuration details.

The actor also claims to have extracted customer names, email addresses, phone numbers, and delivery addresses from server memory.

A sample containing customer names and phone numbers was published. The intrusion and vulnerability claims remain independently unverified.

💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing

"Responder Guidance for PHP2Shell (CVE-2026-109618 and CVE-2026-109619)":

https://bishopfox.com/blog/responder-guidance-for-php2shell

🔒 New CSAF advisory published

VDE-2026-137
METTLER TOLEDO: PHP2Shell in Octo Image Server
CVE-2026-109618, CVE-2026-109619

OCTO Image Server contains a vulnerable version of PHP affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619). We strongly recommend to upgrade PHP to version 8.2.35.

HTML: https://certvde.com/en/advisories/VDE-2026-137/
CSAF JSON: https://mettler-toledo.csaf-tp.certvde.com/.well-known/csaf/white/2026/vde-2026-137.json

#OT #Advisory

PHP2Shell: The 'End of the World' Vulnerability in PHP and How Major Companies Moved to Contain the Disaster

On October 21, 2026, the PHP project disclosed PHP2Shell (CVE-2026-109618 and CVE-2026-109619), two critical flaws in the PHP core affecting every version since 5.4 and allowing unauthenticated rem...

🔗 https://salehgnutux.github.io/GT-NEWSTECH/en/foss/php2shell-critical-vulnerability-response/

#PHP2Shell #Cybersecurity #PHP #Critical_Vulnerabilities #RCE #Linux #Red_Hat #Ubuntu #Cloudflare #gnutux

PHP2Shell Update: Still No Confirmed WordPress Compromises - What we've seen across over 5 million WordPress sites we protect.

As of Oct 28, 2026, Wordfence is not aware of any WordPress site compromised through PHP2Shell (CVE-2026-109618, CVE-2026-109619).

Here's what we've seen so far:

https://www.wordfence.com/blog/2026/10/php2shell-update-still-no-confirmed-wordpress-compromises-and-answers-to-the-questions-were-hearing-most/

PHP2Shell: CISA ha aggiunto CVE-2026-109618 e CVE-2026-109619 (RCE non autenticate, CVSS 9.2) al catalogo KEV, con scadenza per le agenzie FCEB giovedì 29/10. È la conferma ufficiale dello sfruttamento, dopo le 35 shell ottenute su honeypot Apache mod_php il 24/10 (Adel Karimi, Perplexity). Patch del 21/10: 8.5.12, 8.4.27, 8.3.36, 8.2.35. Su Windows verificare anche il rebuild per Brotli (CVE-2026-111497). https://www.bleepingcomputer.com/news/security/cisa-confirms-php2shell-vulnerabilities-now-exploited-in-attacks/ #infosec #PHP #threatintel

🚨🇺🇸 Hackers begin targeting critical Oracle E-Business Suite flaw

Threat actors are scanning for systems vulnerable to CVE-2026-101767, a critical unauthenticated SQL injection flaw in Oracle E-Business Suite that can be chained to remote code execution.
⠀
The vulnerability carries a CVSS score of 9.8 and affects E-Business Suite versions 12.2.3 through 12.2.15.
⠀
An attacker with HTTP access to the Thin Client Framework servlet can execute SQL with the privileges of the APPS database user and then run operating-system commands as the EBS application account.
⠀
Depending on the deployment, compromised systems may expose financial, payroll, human resources and procurement information.
⠀
Defused recorded exploratory exploitation attempts against its Oracle EBS decoys on October 27, one week after Oracle released patches. Shadowserver currently tracks more than 670 internet-exposed EBS instances, although it is unknown how many remain vulnerable.
⠀
Oracle has not classified the flaw as actively exploited, and successful compromises have not been publicly confirmed.

Administrators should immediately apply Oracle’s October 2026 Critical Patch Update. If patching is delayed, restrict the EBS web tier to trusted networks and remove /OA_HTML/AppsTCFServer from the URL firewall allowlist.

Source: https://www.oracle.com/security-alerts/cpuoct2026.html

Hackers Target Critical Oracle E-Business Suite RCE Flaw Days After Security Patch

Threat actors have begun probing for a newly patched critical vulnerability in Oracle E-Business Suite, according to threat intelligence firm Defused Cyber, The Hacker News reports. The flaw, CVE-2026-101767 (CVSS 9.8) in the Oracle Application Object Library, was patched by Oracle last week as part of its Critical Patch Update. https://thehackernews.com/2026/10/hackers-target-critical-oracle-e.html

The vulnerability in question is CVE-2026-101767 (CVSS score: 9.8) in the Oracle Application Object Library of Oracle E-Business Suite. It was patched by Oracle last week as part of its Critical Patch Update. https://thehackernews.com/2026/10/hackers-target-critical-oracle-e.html

🚨 Rapid Response: CVE-2026-101767 (CVSS 9.8) could allow unauthenticated takeover of Oracle E-Business Suite.

Censys identified 2,246 exposed web properties. Exposure does not confirm vulnerability.

Patch and investigate: https://censys.com/advisory/cve-2026-101767/

#CensysARC #Cybersecurity #VulnerabilityManagement #Oracle #InfoSec

RE: https://infosec.exchange/@AmmarSpaces/117316856064853890

Turns out, the vulnerabilities exploited by ShinyHunters at Oracle's Peoplesoft software are not a single flaw, but a chain of 3 flaws.

Full chain writeup:
https://www.zerodayinitiative.com/blog/2026/10/20/cve-2026-35273-ssrf-to-rce-in-oracle-peoplesoft

#cybersecurity #infosec #vulnerability #Oracle #Peoplesoft

Research into Oracle PeopleSoft Enterprise PeopleTools versions 8.61 and 8.62 revealed that the security advisory tracked as CVE-2026-35273 actually involves three chained flaws rather than a single vulnerability.

Threat intelligence reports attribute exploitation waves to UNC6240, known as ShinyHunters, affecting multiple global sectors.

https://en.hacks.gr/pos-oi-shinyhunters-chtypisan-systimata-panepistimion-kai-etaireion/

#Oracle #PeopleSoft #Vulnerability #Patch

ShinyHunters-Exploited Oracle PeopleSoft Zero-Day Turns Out to Be Three Chained Flaws

The critical Oracle PeopleSoft flaw that ShinyHunters has exploited since May is not one vulnerability but three chained together, according to the Zero Day Initiative researchers who reported it. Oracle patched all three in June under the single identifier CVE-2026-35273 (CVSS 9.8): a server-side request forgery in the Integration Gateway reaches the internal Environment Management Hub because PeopleSoft trusts its own loopback address by default, from which attackers can write a web shell or a malicious XML file for unauthenticated remote code execution; Mandiant attributes the exploitation, first against universities and later across many sectors, to ShinyHunters (UNC6240). https://thehackernews.com/2026/10/shinyhunters-exploited-oracle.html

📰 Citrix Zero-Days and Oracle PeopleSoft Flaw Under Active Exploit

🚨 CRITICAL THREAT: Two Citrix zero-days (CVE-2026-88771, CVE-2026-88772) and an Oracle PeopleSoft flaw (CVE-2026-35273) are under active exploitation for RCE. CISA KEV updated. Patch immediately! #CyberSecurity #ZeroDay #CVE #PatchNow

🔗 https://cyber.netsecops.io/articles/citrix-zero-days-and-oracle-peoplesoft-flaw-actively-exploited/?utm_source=mastodon&utm_medium=social&utm_campaign=daily

Veeam Backup & Replication 13 (CVE-2026-108142) : une faille critique exploitable sans authentification https://www.it-connect.fr/veeam-backup-replication-13-faille-critique-cve-2026-108142/ #ActuCybersécurité #Cybersécurité #Vulnérabilité #Veeam

Veeam Patches Critical Backup & Replication Authorization Bypass Vulnerability

Veeam has released fixes for a critical authorization bypass vulnerability in Veeam Backup & Replication that lets an attacker without login credentials bypass access checks on the CDP Coordinator Service, Cybersecurity News reports. Tracked as CVE-2026-108142 and rated CVSS 9.1, the flaw affects both Windows-based deployments and the Veeam Software Appliance. https://cybersecuritynews.com/veeam-patches-authorization-bypass-vulnerability/

Patch 5 Veeam vulnerabilities in Veeam Backup & Replication and Veeam ONE, including critical flaw CVE-2026-108142 and MFA bypass CVE-2026-107671.

#Veeam #VeeamONE #BackupSecurity #CVE2026108142 #Cybersecurity #Vulnerability #InfoSec

https://securityonline.info/veeam-vulnerabilities-backup-replication-veeam-one/?utm_source=mastodon&utm_medium=jetpack_social

🚨🇺🇸 Veeam patches critical Backup & Replication authorization bypass

Veeam has released security updates addressing five vulnerabilities across Backup & Replication, Veeam Agent for Linux and Veeam ONE.
⠀
The most serious, CVE-2026-108142, carries a CVSS score of 9.1 and allows an unauthenticated attacker to bypass authorization on the CDP Coordinator Service.
⠀
Other patched vulnerabilities include:

• CVE-2026-105477: Local privilege escalation in managed Veeam Agent for Linux installations, CVSS 7.3
• CVE-2026-108140: Arbitrary file writes through path traversal, CVSS 5.9
• CVE-2026-108141: Arbitrary file writes through path traversal, CVSS 5.9
• CVE-2026-107671: Veeam ONE administrator can bypass MFA by disabling it before completing verification, CVSS 8.5
⠀
Backup & Replication versions 13.0 and 13.1 are affected by the authorization and path-traversal flaws.

Older 12.x releases are not affected by those specific issues.
⠀
Administrators should update to:

• Backup & Replication 13.1.2 build 13.1.2.57
• Backup & Replication 13.0.3 build 13.0.3.63
• Veeam Agent for Linux 13.1.2 build 13.1.2.11
• Veeam ONE 13.1 P1 build 13.1.0.7940

Sources: https://www.veeam.com/kb4948, https://www.veeam.com/kb4951

Authenticator от Microsoft сливал ваши токены авторизации в сервисах Microsoft вообще любым приложениям, которые их запрашивали. Скорее всего, сторонние приложения этим не особо грешили, но с помощью тестовой приложухи исследователям удалось зайти в чужую почту, отредактировать календарь, написать сообщения в Teams и даже изменить ключи доступа в самом аутентификаторе. Уязвимость получила оценку в 8.6 и вроде бы уже закрыта.

🔗 • https://helpnetsecurity.com/2026/10/27/microsoft-authenticator-vulnerability-patchedcve-2026-80097
🔗 • https://cve.org/CVERecord?id=CVE-2026-80097

A severe Microsoft Authenticator vulnerability on Android allowed rogue apps to steal access tokens. Learn how CVE-2026-80097 was patched and secure devices.

#MicrosoftAuthenticator #Cybersecurity #Android #CVE202680097 #InfoSec

https://dailytechnow.com/microsoft-authenticator-vulnerability-patched/

Microsoft Authenticator Flaw Scores 8.6: Android Users Must Update https://www.esecurityplanet.com/threats/news-microsoft-authenticator-android-flaw-cve-2026-80097/

Adobe Commerce PolyShell Attacks Breach Hundreds of Stores as Brotli Exploit Traffic Emerges

CISA on Tuesday added the Adobe Commerce and Magento vulnerability CVE-2026-48356 (CVSS 9.3), known as PolyShell, to its Known Exploited Vulnerabilities catalog, citing active exploitation. Sansec says attackers have used the unrestricted file-upload flaw to breach hundreds of e-commerce stores since at least July 2025, injecting a malicious loader through a Magento CMS block; federal agencies have until November 10, 2026 to apply the fixes. https://thehackernews.com/2026/10/adobe-commerce-polyshell-attacks-breach.html

CISA KEV catalog adds actively exploited Magento flaw CVE-2026-48356 and Brotli vulnerability CVE-2026-111497. Patch before November 10.

#CISA #KEV #Magento #AdobeCommerce #Brotli #CVE202648356 #CVE2026111497 #ActiveExploitation

https://securityonline.info/cisa-kev-magento-brotli-vulnerability/?utm_source=mastodon&utm_medium=jetpack_social

CISA added two vulnerabilities to its KEV catalog: CVE-2026-48356 (Adobe Commerce/Magento unrestricted file upload, CVSS 9.3) and CVE-2026-111497 (Google Brotli memory corruption, CVSS 9.2).

Sansec noted hundreds of online stores infected via PolyShell, while Wiz warns that 91% of cloud environments have resources exposed to the Brotli issue.

Multiple vendors including Node.js, PHP, have released patches.

https://en.hacks.gr/synagermos-stis-ipa-gia-dyo-sovara-provlimata-asfaleias-poy-axiopoioyntai-se-epitheseis/

#CISA #Magento #Brotli #NodeJS

📰 CISA Adds Exploited Google Brotli and Adobe Commerce Flaws to KEV

📢 CISA adds two actively exploited vulns to its KEV catalog: Node2Shell (CVE-2026-111497) in Google Brotli & a file upload flaw (CVE-2026-48356) in Adobe Commerce. Federal agencies must patch by Nov 10. #PatchNow #CISA #KEV

🔗 https://cyber.netsecops.io/articles/cisa-adds-exploited-google-brotli-and-adobe-commerce-flaws-to-kev-catalog/?utm_source=mastodon&utm_medium=social&utm_campaign=daily

We have published a report on a security incident on gitlab.alpinelinux.org. An attacker tried to exploit CVE-2026-97229. We found no evidence it succeeded but can't rule it out, so we rebuilt
GitLab from scratch.

Alpine packages and releases were not affected, and no signing keys were exposed.

All GitLab passwords have been reset. If you reused yours elsewhere, change it there.

https://alpinelinux.org/posts/GitLab-security-incident-CVE-2026-97229.html

#AlpineLinux #security