CTIPilot
AI-generated · no human review · verify critical claims against the linked source. how it works →
‹Sun · 25 Oct 2026
All daily briefs →
Daily brief · UTC day

Sunday, 25 October 2026

3 verified findings from 2 runs · 14 updates to prior coverage · the settled record for this UTC day, in the classic brief order.

Criticality
Kind
Topic
Region
TL;DR · the day in one read
  1. 01PHP2Shell hits QNAP NAS before login: QTS and QuTS hero builds of 23 October fix it, other QNAP products still unfixed. QNAP's advisory QSA-26-18 says the PHP2Shell flaws CVE-2026-109618 and CVE-2026-109619 (CVSS 4.0 9.2) affect the PHP in the web components of QTS, QuTS hero, QuTScloud and several QNAP applications and can be triggered before any application-level authentication. Fixed QTS, QuTS hero and QuTScloud builds dated 2026-10-23 are out; Note Station 3, QNE (ADRA), QVR Surveillance (ARM32) and TVR OS have no fix yet, QuMagie is listed as affected without a fix row, and QNAP says to keep devices off the internet until fixes ship. QNAP has seen scanning and exploitation attempts against the flaws in the wild but no reports of exploitation targeting its products. Synology's advisory fixes its PHP packages (except the end-of-life PHP 7.3), Mail Station and Calendar and rates the PHP built into DSM as not exposed. →
  2. 02Public root exploit for a Linux page-cache write that gets past the Dirty Frag fix; no CVE and no merged fix yet. Trend Micro's Zero Day Initiative copied public Linux kernel lists on five kernel reports on 2026-10-21 before any fix was merged, and Sysdig ranks ZDI-CAN-33367 as the one to act on: a local privilege escalation through skb_zerocopy() that gets past the Dirty Frag fix, with a public exploit that TuxCare reproduced as root on AlmaLinux 8 to 10, CloudLinux 9 and 10, Debian 12 and 13 and Ubuntu 24.04 and 26.04. A reviewed patch is on netdev but not merged, none of the six reports has a CVE, and two ksmbd reports that ZDI scores CVSS 9.0 matter only where the in-kernel SMB server runs; no exploitation in the wild is reported. →
  3. 03Required LDAP and SMB signing did not stop NTLM relay: a re-authenticated session kept the attacker's key. SpecterOps (LDAP, 2026-10-23) and Blackfield (SMB, 2026-10-21) independently show that a domain controller or file server that requires signing still accepts a relayed NTLM authentication when the attacker first opens a signed session of its own and then re-authenticates it as the victim, so the session keeps a signing key the attacker knows. Microsoft fixed the SMB variant in September 2026 and the LDAP variant in the 2026-10-13 cumulative update; SpecterOps reports no reply to its report and Blackfield found no CVE for the SMB change; public tooling exists and neither researcher reports use in attacks. →
NOTABLECVE-2026-109618 +1NATOA2

CVE-2026-109618 / CVE-2026-109619, QNAP QTS, QuTS hero and QuTScloud: the PHP2Shell flaws reach the NAS web components before authentication; fixed builds of 2026-10-23, other QNAP products still unfixed

QNAP's advisory QSA-26-18 says the PHP2Shell flaws CVE-2026-109618 and CVE-2026-109619 (CVSS 4.0 9.2) affect the PHP used in the web components of its operating systems and several of its applications, can be triggered before any application-level authentication, and could let an unauthenticated remote attacker execute code on the device (QNAP, 2026-10-24). Its revision of 2026-10-24 lists fixed builds dated 2026-10-23 for QTS (6.1.0.3656 and 5.2.11.3661), QuTS hero (h6.1.0.3656, h6.0.2.3656 and h5.2.11.3661) and QuTScloud (c5.2.9.3661), while Note Station 3 3.9.14 and earlier, QNE (ADRA) 1.0.7 and earlier, QVR Surveillance 3.0.3 and earlier on ARM32 models and TVR OS 1.0.4 and earlier are still being fixed with no date announced, and QuMagie 2.10.1 and earlier is named as affected without a row in the fix table (QNAP, 2026-10-24). QNAP's PSIRT says it has observed scanning and exploitation attempts against the flaws in the wild and blocked attempts against its own website, online store and cloud services (QNAP, 2026-10-22), and its advisory says it has received no reports of exploitation targeting QNAP products (QNAP, 2026-10-24). PHP inside Container Station containers or third-party applications is not covered by QNAP's updates (QNAP, 2026-10-24).

Synology's advisory Synology-SA-26:14 rates its PHP 7.3 to 8.4 packages, Mail Station and Synology Calendar critical and lists fixed releases for each except the end-of-life PHP 7.3 package, which gets no fix; Synology says the PHP built into DSM is not exposed to external attack surfaces and considers the risk of exploitation very low (Synology, 2026-10-22).

Both vulnerabilities can be triggered before any application-level authentication takes place.

QNAP PSIRT (QSA-26-18, revision V1.1) 2026-10-24

QNAP PSIRT has observed scanning activity and exploitation attempts targeting these vulnerabilities in the wild.

QNAP (statement on PHP2Shell) 2026-10-22

QNAP has not received reports of exploitation targeting QNAP products.

Until fixed versions are available, the most effective protection is to keep the device off the internet.

QNAP PSIRT (QSA-26-18, revision V1.1) 2026-10-24

The built-in PHP in OS is not exposed to external attack surfaces, and the risk of exploitation is considered very low.

Synology PSIRT (Synology-SA-26:14) 2026-10-22

Builds on: PHP2Shell: fixed PHP builds are out and attack traffic hits unpatched servers; update the… · Palo Alto: PHP2Shell affects PAN-OS and Panorama; first PAN-OS hotfixes out, the rest due by 30… · NetScaler management GUI is affected by PHP2Shell on all supported versions; fixes 2026-10-27…

vulnerability25 Oct 14:10Zsingle-sourceOpen finding →
Sources: QNAP PSIRT (QSA-26-18, revision V1.1) · QNAP (statement on PHP2Shell) · Synology PSIRT (Synology-SA-26:14)
NOTABLENATOB2

Linux kernel ZDI-CAN-33367: a public local root exploit for an skb_zerocopy page-cache write that gets past the Dirty Frag fix, with no CVE and no merged fix, among six reports Trend Micro's ZDI copied to public lists, two of them ksmbd flaws scored CVSS 9.0

On 2026-10-21 Trend Micro's Zero Day Initiative sent five Linux kernel reports and copied public mailing lists on every one, several with no fix in any released kernel; none of the six reports, a ConnMan one included, has a CVE (Sysdig, 2026-10-24). ZDI-CAN-33367 matters most: skb_zerocopy() moves shared page-cache pages into a new socket buffer without the marker the Dirty Frag fix added, so IPsec ESP decrypts in place and an unprivileged local user writes attacker bytes into the cached copy of a read-only file, which gives root through a setuid binary or /etc/passwd; the public exploit needs unprivileged user namespaces and networking modules such as nlmon and act_pedit (Sysdig, 2026-10-24). TuxCare reproduced a root shell on AlmaLinux 8 to 10 (Dirty Frag fix installed), CloudLinux 9 and 10, Debian 12 and 13 and Ubuntu 24.04 and 26.04 (AppArmor user-namespace restriction bypassed) (Sysdig, 2026-10-24). A reviewed patch is on netdev but not merged, TuxCare says no fix has been merged upstream or shipped in a distribution kernel, and a kernel with only the fix for CVE-2026-90049, a bug in the same function, is not covered (Sysdig, 2026-10-24; TuxCare, 2026-10-22). TuxCare's rebootless KernelCare patch is out for EL10, with EL9 in review, EL8 in progress and Debian and Ubuntu not started (TuxCare, 2026-10-22).

Two reports concern ksmbd, the kernel's own SMB server, not Samba. ZDI-CAN-33774 is a pre-authentication race in the SMB1 or SMB2 handler choice: its public proof of concept leaks 28 bytes of kernel heap per attempt and can crash the kernel, ZDI labels it remote code execution, nothing public shows code execution, and a fix is queued in ksmbd-for-next (Sysdig, 2026-10-24; Phoronix, 2026-10-22). ZDI-CAN-33549 is an SMB Direct integer underflow that needs an RDMA interface, a writable share and an SMB Direct client, and its proof of concept crashes the kernel (Sysdig, 2026-10-24). ZDI scores both 9.0, and Red Hat Enterprise Linux does not include ksmbd by default (The Hacker News, 2026-10-22). The other two reports, a vmwgfx and an nvmet flaw, have only titles public.

A working root exploit for a Linux kernel bug is now public, before it has a CVE or a merged fix.

None of the six bugs has been assigned a CVE ID yet, and no in-the-wild exploitation has been reported as of the publication of this blog.

Nothing legitimate does all of that from a single unprivileged process.

Sysdig Threat Research Team 2026-10-24

it gets around May’s fix for Dirty Frag (CVE-2026-43284), and no fix has been merged upstream or shipped in a distro kernel.

The public PoCs show a kernel heap leak and crashes rather than code execution, though that doesn’t rule out worse.

TuxCare 2026-10-22

Builds on: Dirty Frag: two kernel page-cache write flaws give local root; Microsoft saw su escalation that…

vulnerability25 Oct 03:35Zmulti-sourceOpen finding →
Sources: Sysdig Threat Research Team · TuxCare · The Hacker News · Phoronix

02Research, reports & policy1 item

NOTABLENATOB2

NTLM relay past required signing: SpecterOps and Blackfield re-authenticate a signed LDAP or SMB session with a relayed victim identity, and Microsoft fixed it in the September and October 2026 updates

SpecterOps and Blackfield show that NTLM relay to a server that requires signing works again when the attacker first owns a signed session and then re-authenticates it with the victim's identity, so the session keeps the attacker's signing key. For LDAP, the attacker signs a session to a domain controller with valid credentials or, where accepted, an anonymous NTLM context, coerces a victim over SMB, and sends the victim's relayed authentication with a malicious LDAP modification in one SASL record signed with the attacker's key; the controller checks the signature once, switches to the victim's identity and runs the modification with the victim's rights (SpecterOps, 2026-10-23). The tested controller enforced LDAP signing and channel binding and the attack still worked over 389/TCP; the demonstration writes the resource-based constrained delegation attribute, and relaying a domain controller's machine account to another controller leads to DCSync and domain compromise (SpecterOps, 2026-10-23). Blackfield shows the SMB counterpart: a server keeps the original signing key on re-authentication without checking that the identity matches, so on any host that requires SMB signing, domain controllers included, a relayed privileged authentication yields a privileged session still signed with the low-privilege key, provided the attacker can capture or coerce that authentication (Blackfield, 2026-10-21).

SpecterOps reported the LDAP flaw to Microsoft on 2026-10-06, received no response, and says the fix shipped in the 2026-10-13 cumulative update, KB5126646, while the SMB variant was patched quietly in September 2026 (KB5122882) (SpecterOps, 2026-10-23). KB5126646 is the October update for Windows Server 2025 and KB5122882 the September update for Windows Server 2022 (Microsoft, 2026-10-13; Microsoft, 2026-09-08), so each release needs its own cumulative update of the month. Blackfield found no CVE or KB note for the SMB change, says similar changes seem to have reached the other supported versions in the following weeks without having traced every build, and warns that one or two end-of-life versions may never receive it (Blackfield, 2026-10-21). Both publish tooling; neither reports use in attacks (SpecterOps, 2026-10-23; Blackfield, 2026-10-21).

The domain controller we tested against had both LDAP signing and channel binding enforced, and the attack still worked over 389/TCP.

We independently identified a similar vulnerability in SMB, and Microsoft patched it quietly in September 2026.

SpecterOps 2026-10-23

On any host that requires SMB signing, Domain Controllers included, a relayed privileged authentication yields a privileged session that is still signed with the low-privilege key.

I could not find a CVE for this specific change, in Microsoft’s update guide, the KB notes, or public trackers; it reads as silent hardening rather than a tracked fix.

Blackfield 2026-10-21
research25 Oct 03:34Zmulti-sourceOpen finding →
Sources: SpecterOps · Blackfield · Microsoft (KB5126646, Windows Server 2025) · Microsoft (KB5122882, Windows Server 2022)

03Updates to prior coverage14 items

NOTABLECVE-2026-87337 +11updatedNATOA2

Oracle October 2026 Critical Patch Update: six unauthenticated network CVSS 10.0 rows in Access Manager, SOA Suite, E-Business Suite and JD Edwards, and WebLogic CVSS 9.8 flaws reachable over HTTP and T3/IIOP

First published 2026-10-21 · open finding →

Improvementrun 2026-10-25T1308Z-auditcvestechniquessourcessourcing_notebody

Adds the E-Business Suite flaw CVE-2026-101767 (CVSS 9.8, unauthenticated over HTTP), whose discoverer Horizon3 described the SQL-injection-to-command-execution chain, the default-configuration exposure, an interim mitigation and behavioural indicators on the release day, without exploit code; the Exposure, Detection and takeaway lines carry them.

Horizon3, which reported CVE-2026-101767 to Oracle on 2026-07-24, described the chain on release day, without publishing exploit code. An unauthenticated SQL injection in the Thin Client Framework servlet of E-Business Suite 12.2.3 to 12.2.15 (Application Object Library, Core component, CVSS 3.1 9.8), which the default EBS URL firewall configuration permits, gives SQL execution as the APPS database user and then operating-system commands as the EBS application account (Horizon3.ai, 2026-10-20). Until the update is in, Horizon3 advises removing the servlet from the URL firewall allowlist and restricting the web tier to trusted networks, measures that reduce exposure but do not replace patching (Horizon3.ai, 2026-10-20). Oracle scores the row 9.8, unauthenticated over HTTP (Oracle, 2026-10-20).

Sources: Oracle (Critical Patch Update Advisory, October 2026) · Horizon3.ai (CVE-2026-101767 write-up)
HIGHCVE-2026-72898exploitedupdatedNATOA1

Metabase CVE-2026-72898: an unauthenticated SQL-injection zero-day gave attackers administrator access to BI instances, exploited since at least 2 August, with VenariX counting fifteen downstream victims

First published 2026-08-09 · open finding →

Correctionrun 2026-10-25T1308Z-auditsummarytechniquessourcesbodytitle

Corrects statements beyond their sources: Framework and Tally are no longer called the first victims, Kilo Code dates its incident to 2 August (the title now says exploited since at least 2 August), Shipup's access window is stated as possible rather than confirmed, the statement about Carrefour's own systems is attributed to the outlet that made it, and Bits of Gold's disclosure is dated 2026-08-16.

Several statements went beyond their sources and are corrected where they stand. No source says Framework and Tally were the first victims: 2026-08-03 is when Framework's instance was accessed (BleepingComputer, 2026-08-07), n8n disclosed in the same days (n8n, 2026-08-08), and so did Kilo Code, which dates the incident at its Metabase instance to 2 August, a day earlier (Anaconda, 2026-08-07). For Shipup, Cyberattaque.org links the compromise to the campaign against Metabase and says unauthorized access was possible, not confirmed, between 31 July and 17 August 2026 (Cyberattaque.org, 2026-09-26). The statement that Carrefour's own site, accounts and systems were not compromised is that outlet's reading of Carrefour's notice, not Carrefour's words (Cyberattaque.org, 2026-09-26). Bits of Gold disclosed its breach on Sunday 2026-08-16, the day before DataBreaches.net reported it (DataBreaches.net, 2026-08-17).

Sources: Metabase · BleepingComputer · Metabase (GitHub Security Advisory) · CISA · VenariX · n8n · Anaconda (Kilo Code) · DataBreaches.net · Dodo Payments · MediaNama · Cyberattaque.org · French Breaches · swissinfo.ch (Keystone-SDA) · Netzwoche
CRITICALCVE-2026-88771 +7exploitedupdatedNATOA1

CVE-2026-88771 / CVE-2026-88772, Citrix NetScaler ADC and Gateway: unauthenticated pre-auth RCE zero-days exploited before a patch existed (CVSS 4.0 9.5)

First published 2026-09-28 · open finding →

Improvementrun 2026-10-25T1308Z-auditcvessourcesbody

Adds Mandiant's characterisation of the initial CVE-2026-88772 intrusions as likely state-sponsored (no group named) and its expectation of broad opportunistic exploitation of both flaws; the analysis now says no actor has been named rather than that no attribution exists.

Mandiant's CTO Charles Carmakal said, as Help Net Security reported on 2026-09-30, that advanced and suspected state-sponsored threat actors are likely behind the initial targeted intrusions that used CVE-2026-88772, without naming a group, and that broad, opportunistic exploitation of CVE-2026-88772 and CVE-2026-88771 by various threat actors is expected (Help Net Security, 2026-09-30).

Sources: Citrix (Cloud Software Group) · CERT-EU · CISA Known Exploited Vulnerabilities Catalog · NCSC-NL · CERT.at · watchTowr · BleepingComputer · watchTowr Labs · NCSC Switzerland CSH · NCSC UK · CERT-FR (ANSSI) · Google Threat Intelligence Group / Mandiant · eSentire TRU · GreyNoise · Tenable · Censys · Help Net Security · Help Net Security (Mandiant CTO on CVE-2026-88772) · ZIDKOR press release, as reprinted by AK-Kurier · Rhein-Zeitung (dpa) · heise online · Palo Alto Networks Unit 42 · Centre for Cybersecurity Belgium (CCB) · Zscaler ThreatLabz · Rapid7
NOTABLECVE-2026-79844 +18updatedNATOA2

HPESBNW05162, HPE Networking (Aruba) AOS-8 and AOS-10 wireless: 72 CVEs fixed in one bulletin, 19 of them unauthenticated and network-reachable at CVSS 9.0 or above, across controllers, gateways and access points

First published 2026-10-23 · open finding →

Correctionrun 2026-10-25T1308Z-auditsummarycvessourcesbody

Corrects the affected ranges: HPE's CSAF matches its bulletin (AOS-10 10.8, 10.7, 10.4; AOS-8 8.13, 8.10) and has no wider 10.6, 10.3 or 8.12 range, which the entry had stated; HPE presumes end-of-maintenance versions affected. Also corrects the counts (33 at CVSS 9.0 or higher, ten at 9.6, 14 adjacent-network).

HPE's CSAF does not list wider affected ranges than the bulletin text: both name AOS-10 10.8, 10.7 and 10.4 and AOS-8 8.13 and 8.10 up to the stated builds, and neither carries a 10.6, 10.3 or 8.12 range (HPE Networking CSAF, 2026-10-22). What HPE adds instead is that versions past end of maintenance are presumed affected and installations past end of support should be considered potentially impacted (HPE Networking, 2026-10-22). The CSAF scores 33 of the 72 flaws at CVSS 9.0 or higher, ten of them at 9.6, and 14 of the 33 are reachable from the adjacent network, not 34, eleven and 15 (HPE Networking CSAF, 2026-10-22).

Sources: HPE Networking (security bulletin HPESBNW05162 rev. 1) · HPE Networking (CSAF for HPESBNW05162) · HPE Networking (HPESBNW05162 text advisory)
NOTABLECVE-2026-15176 +4updatedNATOA2

CVE-2026-15176 / CVE-2026-93479 / CVE-2026-97205, NGINX Open Source and NGINX Plus: three unauthenticated heap-corruption flaws rated CVSS 4.0 9.2, reachable only in specific configurations and fixed in 1.30.6 and 1.31.7

First published 2026-10-20 · open finding →

Updaterun 2026-10-25T1308Z-auditheadlinesummarysourcessourcing_noteactionsbody

Debian fixed the five NGINX flaws in trixie with DSA-6575-1 (1.26.3-3+deb13u10); only bookworm is still marked vulnerable. Trixie users install the update; bookworm keeps the configuration workaround.

Debian fixed the five flaws in trixie with DSA-6575-1, which ships nginx 1.26.3-3+deb13u10 in trixie-security (Debian Security Tracker, 2026-10-25). Bookworm's package, 1.22.1-9+deb12u10, is still marked vulnerable, so Debian has not shipped a bookworm fix (Debian Security Tracker, 2026-10-20).

Sources: nginx.org (change log for nginx 1.30.6) · nginx.org (security advisories) · Centre for Cybersecurity Belgium (CCB) · Debian Security Tracker · Debian Security Tracker (DSA-6575-1, nginx security update) · Daily CyberSecurity · Help Net Security
HIGHupdatedNATOB1

TeamUpdraft breach: stolen UpdraftCentral connection keys are used to push backdoor plugins to connected WordPress sites, with no flaw in UpdraftPlus and no CVE; deleting the keys is the fix

First published 2026-10-21 · open finding →

Improvementrun 2026-10-25T1308Z-auditbody

States the basis TeamUpdraft gives for suspecting that AI accelerated the attack (exploit speed, initially faulty backdoor plugins) instead of calling the suspicion unsupported, and cites TeamUpdraft's own guidance for the must-use plugin check.

TeamUpdraft bases its suspicion that AI accelerated the attack on the speed of the exploits after the breach and the initially faulty backdoor plugins, and publishes no technical evidence beyond that; its own guidance includes checking the plugins list, the Must-Use tab included, for anything not recognised (TeamUpdraft, 2026-10-19).

Sources: TeamUpdraft (post updated 2026-10-23) · Patchstack · Nethemba (living post, updated to 2026-10-23) · BleepingComputer
NOTABLECVE-2026-109618 +1updatedNATOA2

CVE-2026-109618 / CVE-2026-109619, Palo Alto Networks PAN-OS and Panorama: the PHP2Shell flaws affect every release, reaching PAN-OS through its management web interface; the first PAN-OS hotfixes are out and the rest are due by 2026-10-30

First published 2026-10-22 · open finding →

Updaterun 2026-10-25T1308Z-audittitleheadlinesummarycvessourcesevidencebodytagssourcing_note

Palo Alto's revision of 2026-10-25 lists the first three PAN-OS hotfixes (10.2.18-h13, 11.1.16-h4, 11.2.10-h16) as released, although its solution text still speaks of upcoming releases; the remaining hotfixes are due 2026-10-27 to 2026-10-30, and Palo Alto's current analysis finds no impact of CVE-2026-115560 on PAN-OS.

Palo Alto Networks' revision of 2026-10-25 removed the estimated dates of 10.2.18-h13, 11.1.16-h4 and 11.2.10-h16 "as these versions are released" (Palo Alto Networks, 2026-10-25); the advisory's solution text, unrevised, still says the issue will be fixed in upcoming releases of PAN-OS, and every other hotfix carries an estimated date from 2026-10-27 to 2026-10-30 (Palo Alto Networks, 2026-10-25). The FAQ adds that Palo Alto's current analysis shows no impact on PAN-OS firewalls or Panorama of CVE-2026-115560, the new vulnerability PHP announced, and Palo Alto still knows of no malicious exploitation against its products (Palo Alto Networks, 2026-10-25).

Sources: Palo Alto Networks PSIRT (advisory, Impact of Critical Vulnerabilities in PHP on Palo Alto Networks Products) · Palo Alto Networks PSIRT (advisory, revised 2026-10-23) · Palo Alto Networks PSIRT (advisory, revised 2026-10-24) · Palo Alto Networks PSIRT (advisory, revised 2026-10-25) · Palo Alto Networks PSIRT (advisory record with revision history) · Palo Alto Networks Unit 42 (threat brief, revised 2026-10-25) · PHP (security advisory)
HIGHexploitedupdatedNATOA1

ConnectWise Cloud Backup (formerly SkyKick): the vendor's Microsoft 365 application credential was used to sign in to customer tenants, with directory-role self-assignments in about 50 tenants and, Huntress reports, added credentials in two

First published 2026-10-18 · open finding →

Correctionrun 2026-10-25T1308Z-auditbodyevidence

Corrects the 2026-10-22 update: Microsoft's 2,900-a-minute figure is the peak of failed logons in the separate 10 to 14 October password spray, not the rate of the ARTEX sign-ins to more than 2,250 tenants.

The update of 2026-10-22 attached a rate of 2,900 attempts a minute to the ARTEX sign-ins against more than 2,250 tenants. Microsoft gives no rate for those sign-ins: 2,900 a minute is the peak of failed logons in the separate password spray of 10 to 14 October, reached on 11 October (Microsoft, 2026-10-21). The figure now sits with the spray.

Sources: ConnectWise Trust Center (advisory) · Huntress · Todyl · BleepingComputer · SpecterOps · Sophos X-Ops · Microsoft Threat Intelligence · Expel · heise online
NOTABLEupdatedNATOB1

LiteLLM 1.107.0: the PyPI wheels and the official Docker images carried a credential stealer and a dormant remote-code loader that Python starts at every launch, published through the maintainers' own release workflow with stolen developer tokens

First published 2026-10-22 · open finding →

Improvementrun 2026-10-25T1308Z-auditevidencesourcesbody

Adds Microsoft Threat Intelligence's analysis of 2026-10-23: the collector ran on Windows and macOS endpoints too, a routine Python call activated it, and responders should investigate without starting Python in the affected environment.

Microsoft Threat Intelligence's analysis of 2026-10-23 adds that endpoint observations on Windows and macOS matched the collector's discovery, encryption and outbound-connection behaviour, and that in one Windows case a routine Python invocation to install an unrelated dependency activated it, so developer workstations on Windows and macOS are in scope as well, not only gateways, CI runners and containers (Microsoft Threat Intelligence, 2026-10-23). Microsoft advises isolating affected hosts and investigating them from a known-clean system without running python, pip or other commands that invoke the affected interpreter, confirming that the malicious startup files are gone from the library path rather than assuming that deleting the litellm directory removed them, and it treats Python-launched OpenSSL public-key encryption of files staged in a temporary directory as a behavioural lead (Microsoft Threat Intelligence, 2026-10-23).

Sources: Socket Research Team · LiteLLM maintainers (security incident post) · LiteLLM maintainers (root-cause post, attack chain) · Socket Research Team (attack timeline) · GitHub issue BerriAI/litellm #47826 (Upwind report, with maintainer replies) · Wiz Research · Aikido Security · Microsoft Threat Intelligence
HIGHCVE-2026-0257exploitedupdatedNATOA1

CVE-2026-0257, Palo Alto PAN-OS GlobalProtect: pre-auth authentication bypass via certificate reuse, marked by CISA as used in ransomware campaigns

First published 2026-05-30 · open finding →

Correctionrun 2026-10-25T1308Z-auditbodyevidence

The 2026-06-10 section cited Rapid7 for the CWE-565 classification, which is Palo Alto's; the classification now cites Palo Alto's advisory and the mechanism follows Rapid7's wording, and a quoted Unit 42 sentence follows Unit 42's copyedit of 2026-10-23.

The CWE-565 classification (reliance on cookies without validation and integrity checking) is Palo Alto Networks' (Palo Alto Networks PSIRT, 2026-05-13). Rapid7 describes the attacker discovering the public key of a certificate shared with another function and forging authentication-override cookies with it, and its proof of concept takes the key from the certificate chain the HTTPS service presents (Rapid7, 2026-05-29).

Sources: Palo Alto Networks PSIRT · Rapid7 ETR · Unit 42, 2026-06-09 (threat brief, updated 2026-10-19 and 2026-10-20) · Arctic Wolf, 2026-06-11 · NCSC-CH Security Hub, 2026-06-16 · CISA Known Exploited Vulnerabilities catalog · Arctic Wolf Labs
CRITICALCVE-2026-109618 +1updatedNATOA1

CVE-2026-109618 / CVE-2026-109619, PHP (PHP2Shell): two unauthenticated remote-code-execution flaws in the runtime, fixed on 2026-10-21 in 8.5.12, 8.4.27, 8.3.36 and 8.2.35, with attack traffic already observed and no upstream release for 8.1 and older (CVSS 4.0 9.2)

First published 2026-10-21 · open finding →

Updaterun 2026-10-25T0256Z-intelaffected_productsentitiessourcesevidencebody

Tenable's patch SC-202610.2 updates the PHP bundled in Security Center and Enclave Security to 8.2.35, and Siemens lists RUGGEDCOM APE1808 devices running PAN-OS as affected with patch information only through customer support. ReliaQuest's lab reproduction gives a log sequence for detection (a POST returning HTTP 500, PHP memory exhaustion in Unknown on line 0, heap corruption, an Apache worker abort within seconds) and it has not seen successful exploitation in customer environments.

Tenable's Security Center (versions 6.6.0, 6.7.2, 6.8.0 and 6.9.1) and Enclave Security (1.7.0, 1.8.0 and 1.9.1) bundle PHP, and patch SC-202610.2 updates the bundled PHP to 8.2.35 (Tenable, 2026-10-23; Tenable, 2026-10-23). Siemens lists RUGGEDCOM APE1808 application-hosting devices running Palo Alto Networks PAN-OS 10.2, 11.1, 11.2, 12.1 and 12.2 as affected by the two flaws and gives patch and update information only through customer support (Siemens ProductCERT, 2026-10-23).

ReliaQuest says it independently reproduced exploitation of CVE-2026-109618 in controlled labs, with code execution only where the exploit's prerequisites were already present, and that it has not observed successful exploitation in customer environments (ReliaQuest, 2026-10-22). The sequence it saw in its logs is a POST that returns HTTP 500, PHP memory exhaustion reported "in Unknown on line 0", heap corruption and an abort of the Apache worker that handled the request within seconds, which it reads as a stronger indication when the events involve the same process (ReliaQuest, 2026-10-22).

Sources: PHP (php.net news archive, Upcoming Critical PHP Security Release) · CERT-EU (Security Advisory 2026-018) · Sansec · Wordfence · PHP (php.net news archive, Security advisory: Critical remote code execution vulnerabilities, update now) · PHP (GitHub security advisory, CVE-2026-109618) · PHP (GitHub security advisory, CVE-2026-109619) · PHP Foundation · Cloudflare · watchTowr (vulnerability FAQ) · VulnCheck · Security.nl · CISA Known Exploited Vulnerabilities catalog (version 2026.10.23) · Palo Alto Networks PSIRT (advisory) · Palo Alto Networks Unit 42 (threat brief, retraction of 2026-10-25) · The Hacker News (PHP2Shell exploitation report relaying the retracted account) · PHP (php.net news archive, Informational advisory: Session upload progress) · The Hacker News · CrowdStrike · Sophos (PHP2Shell advisory, correction of 2026-10-22) · Wordfence (attacks continue, no known compromises) · SANS Internet Storm Center (diary 33452) · BACS (Federal Office for Cybersecurity, warning) · ENISA (joint statement with the European Commission, CERT-EU, Europol EC3 and the CSIRTs network) · Canton of Basel-Stadt (communiqué, via nau.ch) · nau.ch (Keystone-SDA) · RTS · Publica (status page) · Inside IT · SRF · watson.ch (Keystone-SDA) · UKAuthority · The Register · Red Hat (CVE page) · Fortinet PSIRT (FG-IR-26-186) · Splunk (SVD-2026-1013) · WatchGuard PSIRT (WGSA-2026-0032) · NetScaler Product Security (Citrix Tech Zone) · Cisco PSIRT (cisco-sa-php-october26-Jj384Daq) · Tenable (TNS-2026-30, Security Center patch SC-202610.2) · Tenable (TNS-2026-31, Enclave Security patch SC-202610.2) · Siemens ProductCERT (SSA-566512) · ReliaQuest Threat Research
HIGHupdatedNATOA2

PK Softech, software supplier of Swiss pension funds: malware and a data outflow at Publica, with the City of Zurich fund PKZH saying its insured persons' test data was stolen, the Bernese funds BPK and BLVK and Pensionskasse Post also reporting the supplier incident, and the Federal Prosecutor's Office investigating

First published 2026-10-09 · open finding →

Updaterun 2026-10-25T0256Z-intelsummarysourcesevidencesourcing_notebody

The Federal Data Protection and Information Commissioner (EDÖB) opened a formal investigation against PK Softech on 2026-10-22, after an informal inquiry at Publica on 2026-10-14, and states that data of several pension funds, Publica among them, was exfiltrated; the investigation is to establish which personal data the funds handed to the supplier, on what legal basis, and how much left.

The Federal Data Protection and Information Commissioner (EDÖB) says PK Softech notified it of the cyberattack on its IT infrastructure on 2026-10-08, that the affected pension funds also reported to it, that it started an informal preliminary inquiry at Publica on 2026-10-14 and that on 2026-10-22 it opened a formal investigation against PK Softech AG on suspicion of data-protection violations (EDÖB, 2026-10-23). Its release states that data of several important occupational pension institutions, Publica among them, was exfiltrated in the attack; the investigation is to give an overall picture of the personal data the funds handed to the software supplier and to clarify the legal framework of those transfers, how they were actually implemented and the scope of the data that left, and the EDÖB gives no further information on pending proceedings (EDÖB, 2026-10-23). Der Bund relays the step and adds that besides Publica the pension funds of Migros, Post and the City of Zurich obtain software from PK Softech (Der Bund, 2026-10-23). The release names neither the actor nor the number of insured persons.

Sources: Swiss Federal Administration (admin.ch) · PK Softech AG · watson.ch · Netzwoche · Netzwoche (running story, update of 2026-10-21) · Bernische Pensionskasse (BPK) · Bernische Lehrerversicherungskasse (BLVK) · Pensionskasse Post · Inside IT (AWP) · Publica (Pensionskasse des Bundes) · cash.ch (AWP) · Pensionskasse Stadt Zürich (PKZH) · Publica (Pensionskasse des Bundes), page updated through 2026-10-21 · Cybercrimepolice (cantonal police platform) · SwissCybersecurity.net · Inside IT · NZZ · Blick (SonntagsBlick) · Tages-Anzeiger (Tamedia, paywalled) · Tages-Anzeiger (Tamedia, paywalled; summary lines readable) · 20 Minuten · Ticinonline (relaying Corriere del Ticino) · Istituto di previdenza del Cantone Ticino (IPCT, letter to its insured) · Ticinonline · TicinoNews · EDÖB (Federal Data Protection and Information Commissioner), press release · Der Bund (Tamedia)
HIGHexploitedupdatedNATOA2

Danfoss AK-SM and AK-SC, Copeland xweb and Dixell xweb refrigeration controllers compromised, with forced defrost reported at hundreds of French supermarkets; CERT-FR and NCSC Switzerland say to remove internet exposure

First published 2026-10-13 · open finding →

Updaterun 2026-10-25T0256Z-intelheadlinesummarytechniquessourcesevidencesourcing_noteactionsbody

ANSSI's director general told the French Senate on 2026-10-21 that elementary flaws were exploited, starting with controllers directly on the internet, administered without particular protection, and weak passwords, not vulnerabilities researchers had published, so a firmware update alone does not close the exposure. Forescout, on 2026-10-22, counts 12,976 exposed service observations in 99 countries, 3,762 exposed Danfoss StoreView observations on AK-SM 800A units, 80 percent of the 4,697 StoreView observations, on firmware older than 4.3.1, and over 20 hacktivist-claimed refrigeration attacks since January 2026, and says the French access vector remains unconfirmed.

ANSSI's director general, Vincent Strubel, told the French Senate foreign-affairs committee on 2026-10-21 that the attack rested on elementary security flaws, starting with refrigeration equipment directly on the internet and administered without particular protection, and weak passwords, and he dismissed analyses that tied it to vulnerabilities researchers had published over the previous two years (Public Sénat, 2026-10-21). Le Monde Informatique reports the same hearing and adds that the systems were reachable without a firewall or network segmentation and that the management interface was protected only by weak passwords (Le Monde Informatique, 2026-10-22). Neither outlet reports evidence beyond the testimony, and ANSSI names no actor; the account sits against Copeland's acknowledgment of a vulnerability in its end-of-life XWEB EVO controllers and the earlier report that ANSSI had identified a vulnerability in a Danish company's software, and no source reconciles them; the two outlets also differ on the date and the count, Public Sénat giving the night of 12 to 13 October and more than 700 supermarkets, Le Monde Informatique the night of 11 to 12 October and at least 300 Intermarché and Netto shops. Le Monde Informatique adds that ANSSI can alert and advise but has no means to impose connection rules on retailers (Le Monde Informatique, 2026-10-22), and Public Sénat reports that ANSSI ran a rapid check with health-sector players because laboratories and pharmacies that store vaccines use the same kind of refrigeration equipment (Public Sénat, 2026-10-21).

Forescout's Vedere Labs says on 2026-10-22 that the access vector, exploited vulnerabilities, attacker infrastructure, persistence and responsible actors in the French incidents remain unconfirmed, and that the reported changes, made in rapid succession, used ordinary supervisory functions (Forescout, 2026-10-22). Its tracking of hacktivist groups counts over 20 claimed attacks on refrigeration systems since January 2026, the most active being the pro-Russian groups Z-Pentest Alliance and NoName057(16) through internet-exposed human-machine interfaces, and its count of exposed services is 12,976 observations on 6,017 public addresses in 99 countries, with 3,762 exposed Danfoss StoreView observations on AK-SM 800A units, 80 percent of the 4,697 StoreView observations, on firmware older than 4.3.1 (Forescout, 2026-10-22). Forescout adds that the manufacturers' documentation presents internet remote maintenance through port forwarding as a supported option, so the exposure is not only an accident of configuration (Forescout, 2026-10-22).

Sources: CERT-FR (alert CERTFR-2026-ALE-012) · AFP · BFMTV · Infosecurity Magazine · BleepingComputer · CERT-FR (alert CERTFR-2026-ALE-012, revised version) · NCSC Switzerland (Security Hub advisory 13054) · Cooling Post · Blick · Censys · CERT-FR (alert CERTFR-2026-ALE-012, third version) · Dixell France (Copeland) · Le Monde · SecurityWeek · Cybersecurity Dive · Public Sénat · Le Monde Informatique · Forescout Research (Vedere Labs)
NOTABLECVE-2026-91403 +2updatedNATOA1

eMudhra: the private keys of eight intermediate CA certificates were trivially recoverable, so anyone could forge trusted HTTPS certificates; browsers block them, clients with their own trust store or no revocation checking need an update (CVE-2026-111943 in Go)

First published 2026-10-21 · open finding →

Updaterun 2026-10-25T0256Z-intelheadlinesummarycvesaffected_productsentitiessourcesevidenceactionsbody

Oracle's second Security Alert of 2026-10-24, CVE-2026-114820 (CVSS 3.1 9.1), removes four root CAs and lists Java SE builds such as 27.0.1.0.2 as affected, and OpenJDK says even a runtime updated in the past few days needs it, so a standalone Java runtime updated on 2026-10-21 needs the new update or the same stop-gap again; OpenJDK now says Debian, Devuan and Ubuntu packages need the keystore recreated by hand. Python announces a built-in ssl denylist (CVE-2026-115557) without naming a release, so pip 26.2.2 is the Python fix to apply now; Cisco lists the products it has fixes for; and eMudhra is leaving the global TLS business, and standard ACME clients do not replace the affected certificates outside their renewal window unless they support ACME Renewal Information.

Oracle's second Security Alert of 2026-10-24, CVE-2026-114820 (CVSS 3.1 9.1, component JSSE, remotely exploitable without authentication through the component's APIs), provides Java updates that remove the impacted root CA certificates related to eMudhra (Oracle, 2026-10-24). Its affected list names Oracle Java SE 8u511-b32, 11.0.33.0.2, 17.0.21.0.2, 21.0.13.0.2, 25.0.5.0.2 and 27.0.1.0.2, and the OpenJDK advisory of the same day lists 27.0.1.0.2, 25.0.5.0.2, 21.0.13.0.2, 17.0.21.0.2, 11.0.32.1 and 8u504 and earlier as affected (Oracle, 2026-10-24; OpenJDK, 2026-10-24). OpenJDK tells users of a standalone runtime to act immediately even if they updated in the past few days, by installing an update whose release note names JDK-8395690 and CVE-2026-114820 or, failing that, by deleting the cacerts aliases emsignrootcag1, emsignrootcag2, emsigneccrootcag3 and comodoaaaca or enabling revocation checking (OpenJDK, 2026-10-24). The same page now says Debian, Devuan and Ubuntu OpenJDK packages need the keystore recreated by hand, because updating ca-certificates and ca-certificates-java does not refresh it, which replaces the earlier statement that updating the operating system's certificates suffices there (OpenJDK, 2026-10-24).

The Python Software Foundation announced CVE-2026-115557 on 2026-10-24: the ssl module now carries a denylist of known compromised certificates that is rejected whatever the SSLContext policy, so it works without revocation checking (Python Software Foundation, 2026-10-24). ENISA's record scores it 9.4 (CVSS 4.0) and lists CPython before 3.16.0 as affected, and the announcement names no release that carries the denylist (ENISA EUVD, 2026-10-24). The incident tracker lists Python 3.15.1, 3.14.9 and 3.13.17 and pip 26.2.2 as patched, and Christian Heimes stresses in the announcement thread that pip before 26.2.2 keeps trusting the compromised intermediates whatever the system trust store holds, because it always loads its own vendored certifi (Dennis Jackson, 2026-10-20; Python Discourse, 2026-10-20).

Cisco's informational advisory, version 1.1 of 2026-10-24, lists as impacted with remediation a TLS policy that blocks the known eMudhra issuers on Secure Firewall Management Center, Duo Access Gateway 3.2.0, Duo Network Gateway 3.4.1, Duo Agentic Authorization Connector 1.0.1, ThousandEyes Enterprise Agent (Application-hosting Agent 5.2.2, 2026-10-23), Meraki MV Smart Camera Firmware (2026-11-18), IOS XR 26.4.1 (2026-11-30) and Ultra Cloud Core Subscriber Microservices Infrastructure 2026.04.1 (November 2026), keeps further products under investigation, and says Cisco PSIRT is not aware of malicious use (Cisco PSIRT, 2026-10-24).

eMudhra's board decided on 2026-10-22 to leave the global SSL/TLS certificate business, and its G1 RSA roots keep serving customers during the transition (eMudhra, 2026-10-22). The Hacker News relays Chrome's count of about 30,800 unexpired certificates under the emSign ECC Root CA - G3, which Chrome stops trusting on 2026-10-27, as of 2026-10-21, 99.9 percent of them issued through InCommon, and relays Chrome's point that standard ACME clients do not replace a certificate outside its renewal window unless they support ACME Renewal Information or someone steps in by hand (The Hacker News, 2026-10-22).

Sources: Google (Chrome Root Program and Android Security) · Dennis Jackson (eMudhra intermediate CA compromise incident tracker) · Mozilla Security Blog · Go team (golang-announce) · BleepingComputer · Oracle (Security Alert CVE-2026-91403) · OpenJDK (Vulnerability Advisory 2026/10/21) · NCSC.ch Security Hub (advisory 13091) · Oracle (Security Alert CVE-2026-114820) · OpenJDK (Vulnerability Advisory 2026/10/24) · OpenJDK (Compromised Certificates and OpenJDK Java Runtimes) · Python Software Foundation (security-announce, CVE-2026-115557) · ENISA EUVD (EUVD-2026-109299) · Cisco PSIRT (cisco-sa-emudhra-info, version 1.1) · Python Discourse (eMudhra information for Python users) · The Hacker News · eMudhra (press release)

04Action items8 items

Verification & coverage notes2 runs

2026-10-25T1308Z-audit · audit · Opus 5.5 · window 168 h · 1 entry published

Scope and outcome

Scheduled weekly audit of 2026-10-18T13:07Z to 2026-10-25T13:08Z (anchor: the 2026-10-18 audit, the last with re-sweeps). Thirty-six entries with activity from the week's seven intel fires were truth-checked whole in four passes. Three narrow carry-forward checks covered the fixes the 2026-10-18 audit applied after its only verifier pass. 187 entries whose only in-window activity is records of the cleanup waves 01 to 04 or of the 2026-10-18 and 2026-10-11 audits were left out (v4.22). Result: 14 of 36 clean, 17 with imprecisions, 5 with factual errors. Two of the factual errors went stale after vendor or distribution revisions (Palo Alto's 2026-10-25 advisory change, Debian's DSA-6575-1), and three are composition errors (HPE ranges and counts, the ConnectWise rate figure, a non-verbatim Aikido quote). The narrow checks found one more spliced quote (Bricksforge). One coverage gap was recovered: QNAP's and Synology's PHP2Shell advisories, published as entries/2026-10-25/qnap-synology-php2shell-qts-quts-hero-fixed-others-unfixed.md. Twenty-one existing entries carry one record each from this fire. Details: docs/audits/2026-10-25-quality-audit.md.

Verification & coverage notes

  • Claims: an open partial claim from cleanup wave 05 (2026-10-21T1147Z-audit, partial 2026-10-21T11:47:42Z wave=05) stands on main with no later push. The scheduled audit ignores a partial claim (Phase 0 step 2), and this one is more than 48 h old.
  • Budget: 13 of 20 spawns (four truth passes, G1 to G3, six verifier passes), 7,271,740 sub-agent tokens (work/2026-10-25T1308Z-audit/budget.tsv).
  • Verification: six passes over this fire's changed claims, the recovered entry, this record and the report. Iterations 1 to 4 returned NEEDS_FIXES with 13, 7, 5 and 2 truth findings, all remediated; iteration 5 returned CLEAN and iteration 6, a cold pass over all 146 claims, confirmed it. Three report-wording advisories from iteration 6 were applied after it (report text only).
  • Guard #9 deviation: while the Phase 1/2 sub-agents ran, the main agent ran tools/kev_window_diff.py twice (one KEV catalogue read each) to test its --since fix. That is structured catalogue JSON, not raw article content.
  • The truth-pass brief named ledgers truth-T<X>.ledger.yaml while the ledger script wrote truth-<X>.ledger.yaml; every pass found and walked its file.
  • KEV: all five uncovered additions of the window (four Plex Media Server CVEs, SiteGuard CVE-2026-106931) carry borderline-drop lines in the 2026-10-21 and 2026-10-22 fires; G1 concurs.
  • borderline-drop: Sophos X-Ops SSPR-vishing intrusion (2026-10-19), dropped by three fires and recommended by G3: SSPR abuse is already covered by three entries (Storm-2949, ResetSpy, Storm-3068) and the case adds no new lever.
  • borderline-drop: Acronis on The Gentlemen locker (BYOVD drivers), Zscaler on the ARTEX operator environment, Microsoft's CVE-2026-70197 revision text, Kroll and Nord Security periodic statistics, Loxone, Medienwerkstatt, the AfD leak, Ircantec, Alliance Police Nationale, GoDaddy revocations, the Cyberhebdo municipal incidents: below the inclusion gate (reasons in findings.G1.yaml, findings.G2.yaml, findings.G3.yaml).
  • Coverage gaps: connectwise-trust-center (403 on every transport; status.connectwise.com is the working substitute); manageengine-metal and greynoise listings undated; apa-ots and prodaft listings client-rendered.
  • Reader pool (context): 7 of 10 jina keys live, balance about 62.3 M.

2026-10-25T0256Z-intel · Sonnet 5.5 · window 26 h · 2 entries published

Verification & coverage notes

Window: gap 24.0 h from 2026-10-24T0255Z-intel, window 26 h, developing-story window 72 h. The container clock agreed with the network date (skew 0 s) and the first fetch of origin/main was current. A Sunday-morning fire after a Saturday with no new KEV listing and no Swiss item inside the window: the national-CERT and vendor-advisory feeds carried nothing new and relevant after 2026-10-23 apart from a Palo Alto revision, Cisco's eMudhra advisory revision and the EUVD rows behind the eMudhra update, all dated 2026-10-24 (the 46 Microsoft rows of that date were Linux-kernel and third-party library CVEs below the bar), so the new signal comes from a Saturday research publication (Sysdig), two lookback research posts (SpecterOps, and Blackfield, found through it) and developments in four covered findings.

KEV sweep (work/2026-10-25T0256Z-intel/kev-window.txt, catalogue 2026.10.23): no addition inside the window, so no NOT COVERED, MENTION-ONLY or COVERED-STALE row and no RANSOMWARE row; S1 re-read the live catalogue and found the same newest dateAdded (2026-10-23).

Backlog (state/coverage_backlog.md): one open row, ARX Group SA (Aurora leak-site claim against a Swiss engineering consultancy for federal infrastructure projects). S2 and S4 re-checked it on today's facts in German, French, Italian and English and on the trade feeds: the Ransomware.live record is unchanged since 2026-10-23 17:57 UTC and no statement from ARX (formerly Pini Group), SBB, ASTRA/USTRA, BACS or the Swiss press exists, so the hold condition is unmet; the row stays held to its expiry of 2026-11-07, with no new note appended because nothing changed.

Published (2 new): ntlm-relay-signing-bypass-reauthentication-ldap-smb (research, notable; two independent researcher write-ups, SpecterOps and Blackfield, with Microsoft's release notes only for the KB-to-release mapping; it clears PD-11(a) and (d): a primary technical analysis of a bypass of the mitigation every Windows estate relies on against NTLM relay, with public tooling and a patch-verification and compromise-check decision for domain controllers) and zdi-linux-kernel-reports-public-skb-zerocopy-root-exploit (vulnerability, notable; Sysdig's analysis with TuxCare's independent root reproduction; no CVE and no merged fix, a public local root exploit for a bypass of the Dirty Frag fix on the distributions TuxCare tested; clears PD-11(b) on its own mechanics: the exploit is public, the fix is unmerged and the interim mitigation is a decision for hosts that run untrusted code). The NTLM entry carries one actions[] task; the ZDI entry carries none, because its interim mitigations are body guidance (the Defender takeaway); priority: high was considered for the Linux entry and declined because the flaw is local-only and unexploited.

Updated (4, through the changelog, all type update): the eMudhra entry (Oracle's second alert CVE-2026-114820 lists the builds the incident tracker named as fixed for the first alert as affected, so a Java runtime updated on 2026-10-21 needs a second update; OpenJDK now says Debian, Devuan and Ubuntu packages need the keystore recreated by hand, which replaced the entry's earlier statement that updating the operating system's certificates suffices there; Python's ssl denylist CVE-2026-115557; Cisco's product list; main text, actions, CVE records and the earlier update section's tracker-build sentence were rewritten where they stood), the Danfoss and Copeland refrigeration entry (ANSSI's director general told the Senate on 2026-10-21 that elementary flaws were exploited, exposure plus weak passwords, which replaced the headline and summary statement that no source named how the attackers got in; Forescout's exposure counts and hacktivist context; one action reworded; mapping gained T1133 and T1078), the PK Softech and Publica entry (the federal data protection commissioner's formal investigation of 2026-10-22 and its statement that data of several funds was exfiltrated; the entry now carries twelve changelog records, eleven with a dated section because one earlier record is internal, see the audit note below) and the PHP2Shell entry (Tenable's patch for the PHP bundled in Security Center and Enclave Security, Siemens RUGGEDCOM APE1808 on PAN-OS affected with patch information only through support, and ReliaQuest's lab log sequence for detection; priority stays critical).

Borderline drops:

  • borderline-drop: Juniper Junos OS and Junos OS Evolved October 2026 bundle (S1; nine unauthenticated or peer-reachable CVSS 9.8 rows: J-Web authentication bypasses, httpd and rpd overflows), the 2026-10-15 and 2026-10-16 fires already dropped it for the same reasons and nothing new exists: no exploitation reported, J-Web needs web management enabled, the BGP rows need a configured peer, the vendor bulletin is eleven days old and outside the window and the CCB lookback; S1 reported "no store coverage" without knowing of those drops.
  • borderline-drop: Next.js out-of-band update (S1; two unauthenticated RCEs, one conditional on Cache Components use cache, one on SVG image optimisation), dropped by the 2026-10-17 and 2026-10-19 fires for the same reasons: no exploitation reported, conditional paths, vendor post of 2026-10-14; nothing new since.
  • borderline-drop: EFK audit of Microsoft 365 in the federal administration (S2), an oversight finding with no patch, hunt, block or detect decision, accepted by the federal IT provider and binding no other body; the 2026-10-22 fire made the same call.
  • borderline-drop: Swiss PHP2Shell exposure measurement from risikomonitor's tracker (S2), single commercial scanner, header-based counts that BACS says overstate where distributions backport the fix, daily totals not like for like; it adds scale but changes no decision on a critical entry that already says to update everything.
  • borderline-drop: ConnectWise Cloud Backup restoration timetable from the vendor status page (S1 and S4), the covered entry's action already says to keep the applications disabled until ConnectWise instructs; the new facts (credential reset completed 2026-10-19, backup-restore access expected early in the week of 2026-10-26) change no tenant decision.
  • borderline-drop: IDC Frontier sixth report of 2026-10-18 (S4), resumption of the backup service on a routine entry with no Swiss nexus and no decision change.
  • borderline-drop: AdFection, the Australian Broadcasting Corporation's and ANSTO's statements (S4), no Swiss or constituency nexus, no new technique, impressions are not infections.
  • borderline-drop: Medienwerkstatt (Sulgen TG, Mattenbach group) data copy with Akira's 130 GB claim (S4 and S2), private media-production SME, no access vector or behaviour in any source, the incident floor applies; Akira's Swiss listing pattern is already in the PK Softech entry.
  • borderline-drop: Alliance Police Nationale union letter (S4), no scope, no technique.
  • borderline-drop: Talos platform-as-proxy mail abuse (S3; order-notification templates, list bombing, bounce messages), original telemetry but about 1,400 messages from two campaigns, single source, awareness-grade for this constituency.
  • borderline-drop: CrowdStrike agentic-AI intrusion campaigns (S3); blog summary of a gated report dated 2026-10-23, outside the window and from a non-slice source; the ARTEX thread is already covered.
  • borderline-drop: Atlassian October 2026 bulletin (third-party dependency rows rated non-critical), Apache Camel 38 advisories (2026-10-15, config-dependent, 35 on an end-of-life line), Laravel TokenGuard CVE-2026-114509, Pillow image-plugin flaws, ISC BIND 2026-10-21 (CVSS 8.1 with high attack complexity, DoS), PaperCut September bulletin relays (authenticated, no exploitation), Searchlight AEM cloud-only chain (patched), Rapid7 Archibus write-up, Postiz and other low-prevalence EUVD 9+ rows of 2026-10-24, and the 2026-10-20 KEV additions Plex and SiteGuard (before the window, a prior fire's decision) (S1); each fails PD-11 on its own facts; none is exploited in a constituency-relevant product.
  • borderline-drop: S2 leads (Microsoft DCU phishing-kit seizure of 2026-10-14, dcod law-enforcement roundup, St. Gallen SKIPD strategy, Swiss e-ID timeline, Quad9 France exit, PostFinance voiceprint ruling, Check Point monthly statistics, Swiss Government Cloud tender, Bundesrat cyber-law mandate of 2026-09-25), no obligation change or defender decision inside the window; details in findings.S2.yaml.
  • Previously dropped ksmbd pair: the 2026-10-24 fire dropped the two ksmbd ZDI reports as niche; they are now carried inside the Linux entry because Sysdig's analysis of 2026-10-24 and TuxCare's reproduction put a public root exploit for the sibling report ZDI-CAN-33367 in the same disclosure.

Contradiction: the Danfoss update's ANSSI testimony (exposure and weak passwords, not published flaws) sits against Copeland's acknowledgment of a vulnerability in its end-of-life XWEB EVO controllers and the earlier report that ANSSI had identified a vulnerability in a Danish company's software; no source reconciles them, the entry says so and attributes the cause to ANSSI's testimony, and the verification value stays multi-source.

Single-source items and carve-outs: the Danfoss update's ANSSI account is testimony reported by two outlets (Public Sénat and Le Monde Informatique), no transcript was reachable, and the entry says so; the PHP update's Tenable and Siemens statements are first-party vendor advisories for their own products; the EDÖB's account of its proceeding is its own release, relayed by Der Bund; ReliaQuest's sequence is one vendor's lab result and is reported as such. No contradiction between sources needed a verification: contradicted entry.

Coverage gaps: connectwise-trust-center (403 on every transport including WebFetch, sixth consecutive failing run counting from 2026-10-20; the status page is the working route), apa-ots (Angular shell, no recipe), resecurity (JS shell), lore.kernel.org (proof-of-work challenge on every message page, so the ZDI postings were read through Sysdig, TuxCare, The Hacker News and Phoronix), consilium.europa.eu (403 everywhere, sanctions watch rested on WebSearch), rapid7-research feed (malformed XML, per-post extract works), edoeb-ch-press listing (stale cache, the release page reads), ahnlab-asec (listing via the reader is stale, WebFetch lists it), schneier (reader fallback only, two keys answered HTTP 402 before a third served). S2 and S3 each reached the metered reader through extract fallbacks on pages the direct transports could not read.

Candidate sources: two added (openjdk-vulnerability-advisories, the first-party advisory of record that published the second Java alert before any outlet; blackfield-ch, the Swiss researcher blog behind the independent SMB finding). Proposed and not added: csa-sg-alerts (a relay of vendor facts that surfaced items already dispositioned), publicsenat-fr (carried the ANSSI testimony; a general political outlet, revisit if it surfaces a second primary), pwn-watch (discovery lead only), status-connectwise (a per-incident pivot, not a rotation source). imperva-threat-research and opensourcemalware were promoted to active from sources.promotion_due. trendmicro-research got its feed back as rss_url and fetch_method: rss; 24 recipe notes from the sub-agent ledgers were appended.

Source health: tools/source_health.py probed 266 records; the first sweep flagged one, the new candidate blackfield-ch (its feed carries a single short item, below the content check's minimum, so the record was switched to the bridge method with the listing as the probed route), and the second sweep ended with no unsolved record.

Self-identification: this fire's main agent is Sonnet 5.5 (claude-sonnet-5-5) per the harness model line; the four research sub-agents reported Sonnet 5.5 (claude-sonnet-5-5) in their own return headers.

Audit note: the PK Softech and Publica entry now carries twelve changelog records and is the longest entry in the store; the previous fire's verifier already suggested consolidating its per-fund statements and splitting its first action, which stays audit work.

Verification loop: seven iterations of the single cti-verification definition, each a cold spawn that answered a claim ledger. Iteration 1 (226 claims) found 7 truth and 6 editorial defects and iteration 2 (159) found 3 and 4; iterations 3 to 6 (58 to 160 claims, post-fix scope) found 1, 1, 3 and 5 truth defects, mostly in the run record's own notes, and no iteration returned CLEAN. Every finding was fixed in the entries or the run record before the next pass. Iteration 7 (128 claims, 126 ok) found one low-confidence F3 (the Danfoss Forescout figure's denominator), fixed with the denominator named; with truth plus editorial at 1 and no F1 or F4, the fire takes the low-residual early exit (verification_residual_count: 1). The carried-forward F11 note on the summary length of the PK Softech, Danfoss and PHP2Shell entries was declined in every pass and stays audit work.