01JPCERT/CC and NICT: attackers decompile the public app, then call internal APIs; AI platforms scan exposed web apps. JPCERT/CC (alert AT-2026-0030, updated 2026-10-23) and NICT describe a wave of personal-data leaks from Japanese web systems in which attackers analyse the published Android app to find API endpoints and keys and then call internal management APIs the app screens never use, place JSP web shells as .war files on application servers behind the public web server, and, per the latest update, run AI penetration-testing platforms (Cairn, CyberStrikeAI, ARTEX) against internet-facing web applications, WSUS servers included. No actor is named, JPCERT/CC says it confirmed AI used to scan for known vulnerabilities and attack through APIs, and Macnica could not confirm AI use. →
02Microsoft ships out-of-band .NET fixes: hosts updated on 13 October still carry the Windows sockets flaw. Microsoft released .NET 8.0.33, 9.0.22, 10.0.14 and 11 Release Candidate 3 out of band on 2026-10-25 to fix the Brotli decoder flaw CVE-2026-111497 (CVSS 3.1 8.1, publicly disclosed, not exploited, rated Exploitation More Likely) and to deliver the corrected fixes for CVE-2026-70197 (Windows sockets memory corruption, CVSS 3.1 8.1) and CVE-2026-102870 (Blazor debugger), which the 2026-10-13 release did not fully address. Brotli exposure needs an application that decompresses attacker-controlled Brotli data, which ASP.NET Core and HttpClient do not do by default. →
JPCERT/CC's alert of 2026-10-08, updated on 2026-10-23, says that around September 2026 Japanese organisations disclosed a run of personal-data leaks through unauthorised access, and singles out an attack type that may be increasing: systems the operator never expected strangers to reach, such as business-intelligence tools and staff-management systems, were hit alongside public apps (JPCERT/CC, 2026-10-23). It does not tie them to one method and groups them in five: per-target scanning for known flaws and exposed configuration and backup files; unauthorised calls to application management APIs; the Metabase SQL injection CVE-2026-72898; .war files carrying a JSP web shell that runs commands passed in query parameters, placed on application servers reachable from the public web server; and, added on 2026-10-23, attempts through AI penetration-testing platforms it names as Cairn, CyberStrikeAI and ARTEX, including against exposed WSUS servers (JPCERT/CC, 2026-10-23).
In the API case the attackers analyse the published smartphone app to find endpoints and keys, then attack internal APIs the app screens cannot reach: changing user rights, creating accounts, toggling a header or sending malformed tokens to compare responses, and blind NoSQL injection to find account data; some use API keys stolen elsewhere (JPCERT/CC, 2026-10-23). NICT calls this an app-to-backend attack: the app need not be vulnerable, and backend authentication, authorisation or input-validation faults leak data (NICT, 2026-10-13). On attack servers JPCERT/CC found Android packages, reverse-engineering tools and a Python script that answers requests with HTTP 302 redirects and appears to have been used to test for server-side request forgery (JPCERT/CC Eyes, 2026-10-21).
No source names an actor. JPCERT/CC says it confirmed that the attackers used AI to scan for known vulnerabilities and attack through APIs (JPCERT/CC Eyes, 2026-10-21), while Macnica could not confirm AI use (Recorded Future, 2026-10-22). API-attack access also arrives through Tor exit nodes and residential proxies (JPCERT/CC, 2026-10-23).
Triage: the app's own User-Agent proves nothing, because JPCERT/CC saw attack requests carrying it; the endpoints called and the sequence (header toggling, malformed tokens, role changes) discriminate, and a TLS fingerprint that matches a generic Python client does not identify the attacker alone (JPCERT/CC, 2026-10-23).
We confirmed that the attackers had used AI to scan for known vulnerabilities and carry out attacks via APIs.
One notable characteristic of these attacks was that the attackers analyzed Android application packages (APK files) to identify APIs and exploit them
JPCERT/CC Eyes
Macnica could not confirm the use of AI in these attacks.
Microsoft released out-of-band security updates for .NET 8, .NET 9 and .NET 10, with .NET 11 Release Candidate 3, on 2026-10-25 (.NET Blog, 2026-10-25). The fixed runtimes are 8.0.33, 9.0.22 and 10.0.14; .NET Framework is not affected (.NET Blog, 2026-10-25). CVE-2026-111497 is a buffer overflow in the Brotli decoder that .NET uses and may let an unauthenticated attacker read or corrupt process memory, leading to information disclosure, denial of service or elevation of privilege (.NET Blog, 2026-10-25); Microsoft scores it CVSS 3.1 8.1 with high attack complexity, marks it publicly disclosed and not exploited, and rates it Exploitation More Likely (MSRC, 2026-10-25). The CVE is the one Node.js fixed on 2026-10-21 (Node.js project, 2026-10-21). Microsoft says an application is exposed only when it decompresses attacker-controlled Brotli data through ASP.NET Core request decompression, HttpClient automatic response decompression that includes Brotli, or the BrotliStream and BrotliDecoder APIs, and that ASP.NET Core and HttpClient do not decompress Brotli by default (dotnet/announcements #494, 2026-10-25).
The release also corrects two fixes of 2026-10-13: Microsoft says that release did not fully address CVE-2026-70197 and CVE-2026-102870 (.NET Blog, 2026-10-25). CVE-2026-70197 is a Windows-only out-of-bounds write: reusing one SocketAsyncEventArgs instance across IPv4 and IPv6 datagram sockets can keep an undersized cached native address buffer, and an unauthenticated attacker can then write out of bounds during ReceiveFromAsync (CVSS 3.1 8.1, high attack complexity) (dotnet/runtime #136445, 2026-10-25); the Security Update Guide rates it not exploited, not publicly disclosed and Exploitation Less Likely, and had said on 2026-10-19 that the vulnerability had not been addressed (MSRC, 2026-10-25). CVE-2026-102870 is code execution in the Blazor WebAssembly debugger when a developer evaluates an expression that involves attacker-controlled application data (CVSS 3.1 8.8, user interaction required); it needs the standalone Server and DevServer package references updated, because updating only the shared runtime is not a substitute (dotnet/announcements #492, 2026-10-25). CVE-2026-114148 is incorrect file ownership in Linux ASP.NET Core runtime and targeting-pack tarballs of .NET 8 and 9 and in source-built tarballs, a local privilege escalation (CVSS 3.1 7.8) (dotnet/announcements #495, 2026-10-25). No source reports exploitation of any of the four.
Today, we are releasing out-of-band (OOB) security updates for .NET 8, .NET 9, and .NET 10, along with .NET 11 Release Candidate 3.
because the October 13, 2026 release did not fully address these issues
The entry said Unit 42 had seen a proof of concept of the PHP flaws; Unit 42's brief, revised on 2026-10-25, no longer says so, and the statement is removed.
Unit 42's brief, revised on 2026-10-25, no longer says that it has seen a proof of concept of the PHP flaws (Unit 42, 2026-10-25).
Envoy and Microsoft have shipped fixes for the same Brotli decoder flaw: Envoy's advisory of 2026-10-23 lists v1.40.0, v1.39.3, v1.38.6, v1.37.8 and v1.36.12 for deployments with the Brotli decompressor configured, and Microsoft's out-of-band .NET release of 2026-10-25 (8.0.33, 9.0.22, 10.0.14) covers applications that decompress attacker-controlled Brotli data. Still no source reports exploitation outside Imperva's laboratory demonstration.
Two more vendors have shipped fixes for the same decoder flaw. Envoy's advisory of 2026-10-23 says a buffer overflow in its Brotli decompressor allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service or potentially execute arbitrary code with a crafted Brotli-compressed stream; it names v1.39.2, v1.38.5, v1.37.7 and v1.36.11 as vulnerable, v1.40.0, v1.39.3, v1.38.6, v1.37.8 and v1.36.12 as fixed, and limits the impact to deployments that have the Brotli decompressor configured (Envoy, 2026-10-23). Microsoft's out-of-band .NET release of 2026-10-25 (8.0.33, 9.0.22, 10.0.14 and 11 Release Candidate 3) fixes the same CVE, and an application is exposed only when it decompresses attacker-controlled Brotli data through ASP.NET Core request decompression, HttpClient automatic decompression or the Brotli APIs (dotnet/announcements #494, 2026-10-25); .NET Blog, 2026-10-25 lists the fixed releases. No source reports exploitation outside Imperva's laboratory demonstration against Node.js.
Palo Alto Networks' Unit 42 retracted on 2026-10-25 its update that linked an attack on a European government agency to these flaws and says it cannot confirm that the initial access is associated with them; the summary, the detection guidance and the 2026-10-24 section no longer carry that account. Priority stays critical: the scanning, attack attempts, public proofs of concept and VulnCheck's working exploit do not rest on the retracted report, and no source ties a confirmed compromise to these flaws.
Palo Alto Networks' Unit 42 retracted on 2026-10-25 the update of 2026-10-23 in which it had reported post-exploitation by agentic attack platforms at a European government entity. Its brief now says that what its researchers saw was an attack against a European government agency executed in the context of a vulnerable PHP application, that this led them to believe it was exploitation of these flaws, and that it is unable to confirm that the initial access is associated with the specific PHP2Shell CVEs (Unit 42, 2026-10-25). The observations of the retracted update, including the command-batch markers and the Active Directory activity, are no longer part of the brief. The brief still recommends assessing exposure and patching immediately (Unit 42, 2026-10-25).
What remains documented is scanning and attack attempts, reported by Cloudflare, watchTowr, VulnCheck and others, and VulnCheck's working exploit for specific PHP builds; CrowdStrike, Sophos and Wordfence report no successful exploitation, and no source tied a named CVE to a production compromise. The Hacker News article of 2026-10-25 relays the retracted account and carries no correction (The Hacker News, 2026-10-25).
Update the PHP runtime, not the CMS or its plugins, on every internet-facing server and container image to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 or to your distribution's patched package, restart PHP-FPM, Apache and every long-running worker, rebuild images, and confirm the running version, because a distribution backport can keep the old version string; isolate any application that cannot be updated from public networks until it is.
After updating, set session.upload_progress.enabled=0 on every PHP host and keep it there until PHP's next regular bugfix release: CVE-2026-115560, which the October releases do not fix, needs session upload progress to be enabled.
Install .NET 8.0.33, 9.0.22 or 10.0.14 (11 Release Candidate 3 for the preview) on every host that runs .NET applications, including Windows hosts already updated on 2026-10-13, which still carry CVE-2026-70197; rebuild and republish self-contained applications and rebuild container images from the updated .NET images, because a runtime update on the host does not change a bundled runtime.
Update every Node.js 22.x, 24.x and 26.x runtime to 22.23.4, 24.22.1 or 26.12.1, including the Node binary inside container images, which a package inventory misses, and upgrade the PyPI Brotli package to 1.2.1 and brotlicffi to 1.2.1.0 wherever either is installed; move any application on an end-of-life Node.js line to a supported release.
Update every Envoy proxy that has the Brotli decompressor configured to v1.40.0, v1.39.3, v1.38.6, v1.37.8 or v1.36.12; the advisory names v1.39.2, v1.38.5, v1.37.7 and v1.36.11 as vulnerable.
On every PA-Series and VM-Series firewall on PAN-OS 12.2, 12.1 or 11.2 that has TLS decryption enabled, run show system setting brotli and, where it returns Enabled: yes, run set system setting brotli-encoding disable until the hotfix for the release is installed, due 2026-10-27 to 2026-10-30.
2026-10-26T0256Z-intel· Sonnet 5.5 · window 26 h · 2 entries published
Verification & coverage notes
Quiet window over Sunday and early Monday (gap 24.0 h, window 26 h starting 2026-10-25T00:56Z). The four sub-agents returned 14 items; two were published as new entries, three existing entries received a changelog record and the rest were dropped or held. The container clock agreed with the network date (skew 0 s) and the previous fire (2026-10-25T0256Z-intel, publish ok) and the 2026-10-25 audit were both on origin/main.
Published (new): the out-of-band .NET security release of 2026-10-25 (the Brotli decoder CVE-2026-111497 plus corrected fixes for CVE-2026-70197 and CVE-2026-102870) at notable, because Microsoft says the 2026-10-13 release did not fully address two of its flaws and hosts patched that day stay exposed (PD-11(b), out-of-band limb); and the JPCERT/CC and NICT account of app-to-backend API attacks, web shells and AI-platform scanning in Japan at notable, first coverage from the jpcert-eyes rotational lookback (PD-7(d)), cleared under PD-11(d) as A-reliability primary technical analysis with behaviours a responder can check in API logs.
Updated: php-critical-release-pre-announced-cve-2026-109618-109619 (update: Unit 42 retracted on 2026-10-25 its update that linked an attack on a European government agency to these flaws; S1 and S3 both found it, no other lane and no press outlet did). Priority stays critical: the 2026-10-22 record that set critical rested on attack traffic, public proofs of concept and VulnCheck's working exploit, none of which depends on the retracted report. The retracted claim was removed from the summary, immediate action wording, sourcing note, Detection paragraph, the 2026-10-24 section, the evidence quote and the techniques T1003 and T1557, which only that account supported. cve-2026-111497-node2shell-brotli-decoder-rce-nodejs-pypi (update: Envoy's own advisory of 2026-10-23 and the .NET release; Bun and Istio rest on The Hacker News alone and were not carried). pan-os-panorama-php2shell-mgmt-interface-no-fixed-release (correction: the statement that Unit 42 had seen a proof of concept is no longer on Unit 42's page, so statement, quote and citation were removed; S3 and S1 disagreed on whether this entry needed a change, the page grep settled it).
KEV sweep: tools/kev_window_diff.py found 0 additions with dateAdded in the window and no ransomware-flag change on a store-covered CVE; S1 confirmed independently against catalogue 2026.10.23 (newest dateAdded 2026-10-23, CVE-2026-114625 and CVE-2026-110447, both covered). PHP2Shell is not in KEV.
Backlog: the ARX Group SA row stays held, unchanged and unappended. S2 and S4 re-checked it today: the ransomware.live record is unchanged since 2026-10-23, there is no ARX, SBB or ASTRA statement and no Swiss press report; the hold condition is unmet and the 2026-11-07 expiry stands.
Single-source: cve-2026-111497-microsoft-net-oob-update-brotli-sockets-fix, vendor advisory for its own product (Microsoft's blog, four dotnet advisories and the Security Update Guide are one assessor), A2.
borderline-drop: Tailworm (Cyberdione Labs, 11 claimed Tailscale and headscale flaws, 2026-10-25); single uncoordinated report, proof of concept withheld, no independent reproduction, no CVE or fix, constituency use not established.
borderline-drop: OpenAI frontier-training containment disclosure (2026-10-25), own-environment account with no defender decision beyond fixes already shipped.
borderline-drop: Semperis on Prince of Persia (2026-10-22), single vendor, indicator-led, no European victim, no new endpoint behaviour.
borderline-drop: OPNsense PHP2Shell hotfixes 26.7.7, 26.1.11 and 26.4.2p4 (2026-10-21), out of window by five days and not a rotational lookback, no exploitation against OPNsense; the PHP entry already says to update the runtime on every host and image.
borderline-drop: CSIRT Italia alert AL01/261025 (2026-10-25), 81.9 % of Italian PHP services potentially vulnerable; a national exposure statistic that ACN says can include backported fixes; no new action.
borderline-drop: EDÖB head Lobsiger interview in the Blick (2026-10-24), possible widening of the PK Softech proceeding to the federal bodies; the Publica entry already carries the 2026-10-22 formal investigation and the widening is conditional.
borderline-drop: CYFIRMA PHP2Shell early warning v3 (24 October), single vendor, closed I2P channel nobody else can check, confidence inconsistent between narrative and evaluation, names the EU but not Switzerland.
borderline-drop: Chrome 156 stable (2026-10-20), about 6 h outside the record's lookback, no exploited flag, no store coverage.
borderline-drop: Drupal SA-CONTRIB-2026-253 (Monster Menus), needs an authenticated role, exploit maturity theoretical; PaperCut September bulletin additions, administrator-only; Atlassian October third-party bulletin, Atlassian rates the criticals lower risk.
borderline-drop: Medienwerkstatt Sulgen TG (Akira claim, 2026-10-23), private sector, out of window; ECOM and White & Case Qilin listings (2026-10-25), leak-site claims without a victim statement (PD-6), no public-sector nexus.
borderline-drop: French party and company leak wave of 23 to 25 October (PCF, La France insoumise, Renaissance, FSU, Alliance Police Nationale, Orange, Engie, ADMR, DEKRA), no shared vector or actor named, no Swiss nexus.
borderline-drop: ABC wipes devices after AdFection ad exposure (2026-10-23) (victim-side corroboration of a covered entry, no new behaviour; Quest Diagnostics, Capcom, Railway, Parkview, Yamato, Bathurst RSL and the Oberspreewald-Lausitz district administration) out of nexus, out of window or impact-only.
Candidate sources added: dotnet-blog (first-party .NET servicing channel; surfaced the out-of-band release that no slice source did), nict-cynex-lettice (named the app-to-backend attack, cited by JPCERT/CC) and datadog-security-labs (dated RSS, primary cloud-identity and supply-chain research); the S3 candidates macnica-security-research and S4's cyfirma-research were not added (Macnica is context for an entry that did not cite it; CYFIRMA's item was dropped). Twenty-one recipe notes from the source ledgers were appended to sources/sources.json. The transluce record is a single report, not a feed, and is a candidate for the next lifecycle review.
Jina reader credit: extract fell through to the reader on the two MSRC per-CVE pages in this run and, in S2, on three European Commission and Council of Europe pages.
Contradiction: S1 and S3 reported the PHP2Shell retraction as a correction; it was recorded as an update because it is an exploitation-status change in the world (Unit 42 withdrew its own claim on 2026-10-25), not an error in the entry as written.
Coverage gaps: connectwise-trust-center (403 on every transport, seventh consecutive failing run; status page read instead); ox-security (article bodies 403, feed only); schneier (feed 403); digital-strategy.ec.europa.eu (403 on every transport, not in slice); arx-group.ch and arxgroup.ch (no readable victim site); community.citrix.com Tech Zone NetScaler post (403, its 2026-10-27 fixed builds are not out yet); news.admin.ch /de/nsb (403).
Verification: three iterations of the single cti-verification definition, each covering every claim in scope (152, 152 and 151 claims checked). Iteration 1 found two truth findings (the retraction worded as an intrusion withdrawal; an unsupported "independently" about NICT), one missing citation, one Visual Studio gap and a priority question on the PHP entry; iteration 2 found four low-confidence wording findings; iteration 3 found two low-confidence unsupported-citation findings. All truth and editorial findings were fixed in the same iteration's remediation; the PHP priority challenge (F16) was declined with a recorded rebuttal and the verifier accepted it as a judgement call in iteration 2. The first spawn of iteration 3 was lost to a container restart at about 04:30Z (the working tree survived) and the iteration was re-spawned clean. The final verdict is NEEDS_FIXES with two truth findings, both fixed afterwards, so the fire published on the low-residual early exit (decision rule 5) and no confirmation pass followed; verification_residual_count is 2, the two F3 findings applied after the last pass and not re-checked by a fresh verifier. The next audit should give the PHP, Japan and .NET entries an independent pass.
Essential-coverage: all 21 essential records of S1 and S2 were attempted; none missed.