Wednesday, 28 October 2026

Balbooa released Gridbox 2.20.4.2 on 2026-10-27, fixing two unauthenticated read-side SQL injections, CVE-2026-102788 (the sort-by parameter of store and category post lists) and CVE-2026-102789 (an editor task without a permission check), both scored CVSS 4.0 9.3 by the Joomla CNA and affecting every release up to 2.20.4.1. No exploitation is reported, Joomla 3 sites have no fix, and the action now points at 2.20.4.2.

Balbooa released Gridbox 2.20.4.2 on 2026-10-27 with two security fixes rated Critical, for the versions 2.20.4.1 and earlier (Balbooa, 2026-10-27). CVE-2026-102788 is in the sort-by URL parameter of store and category post lists and CVE-2026-102789 is a missing permission check on the editor task that loads blog posts (mySites.guru, 2026-10-27); Balbooa's fixes are a strict allowlist validation for the sort-by parameter and a user edit-level check on the editor task (Balbooa, 2026-10-27). mySites.guru says the sort value previously went into the ORDER BY part of the database query and reads the second flaw as a second anonymous route to the same query. mySites.guru reports that the Joomla CNA scores both CVSS 4.0 9.3 and lists every release from 1.0.0 to 2.20.4.1 as affected, and that only two PHP files differ between 2.20.4.1 and 2.20.4.2, one per fix (mySites.guru, 2026-10-27).

Both flaws read data: an anonymous visitor can extract the Joomla user table, with its password hashes, and every other table the site's extensions created. mySites.guru says about 95% of the Gridbox sites it monitors ran an affected version on the morning of the release, that sites on the Joomla 3 line stop at Gridbox 2.17.0.2, which has no fix for this year's flaws, and that there is no public report of exploitation yet (mySites.guru, 2026-10-27). Nothing here is reported exploited, unlike the July batches above; the version to be on is now 2.20.4.2.

IDC Frontier's seventh report of 2026-10-27, which closes the investigation, names the cause: an open-source flaw in the authentication system of its customer portal, after which the attacker took administrator rights on the virtualisation platform through the management console and encrypted the virtual servers; it replaces the entry's statement that the intrusion route is not public.

IDC Frontier's seventh report of 2026-10-27 says its investigation with an external security firm is complete and names the cause: a third party exploited a vulnerability in open-source software used in the authentication system of the IDCF Cloud Portal, the portal customers use to start virtual servers and check billing, and so entered that system (translated from Japanese; IDC Frontier, 2026-10-27). The attacker then obtained administrator rights on the virtualisation platform through the management console, stopped customers' virtual servers and encrypted them; the software is not named. The provider finds no trace of customer data leaving the virtual servers, says the improper queries of portal registration data reached up to 71 customers, up from 48, that up to four customer login passwords were improperly changed and have been reset, and that backups are retrievable for 206 customers. It is rebuilding the portal in a new environment, replacing the affected authentication system with an external identity provider and limiting portal access to customer IP addresses with mandatory multi-factor authentication.

A second Swiss customer of Camping.Care, Campingplatz Hüttenberg in canton Thurgau, has warned its guests of the same WhatsApp fraud in a notice with the page date 2026-10-23; the notice says the supplier is investigating the cause and does not mention PHP, so the link to the PHP flaws rests on SRF, Blick and a TCS spokesperson's statement rather than on the supplier.

Netzwoche reported on 2026-10-27 that a second Swiss Camping.Care customer, Campingplatz Hüttenberg in canton Thurgau, has warned its guests of WhatsApp messages about existing bookings that contain real booking information and a link; the campsite's notice carries the page date 2026-10-23 (Netzwoche, 2026-10-27; Campingplatz Hüttenberg, 2026-10-23). The notice says Camping.care informed the campsite of the messages, that Camping.care is investigating the cause and that booking data must be assumed to have been used without authorisation; it does not mention PHP, and Netzwoche points out that it does not say whether the attackers used one of the PHP flaws. The link to the PHP flaws therefore rests on SRF, Blick and a TCS spokesperson's statement to Keystone-SDA (watson.ch, 2026-10-26), not on the supplier.

Inside IT reported on 2026-10-27 that SafePay has put about 30 GB of data stolen from Manno into the darknet and relays Risikomonitor's analysis of its contents (social-assistance decisions with AHV numbers, debt-enforcement and naturalisation files, a near-complete address book); the commune will make no statement. This replaces the entry's statement that the listing described no data and could not be corroborated.

Inside IT reported on 2026-10-27 that SafePay has put the data stolen from Manno into the darknet, about 30 GB, and that the security firm Risikomonitor analysed it (Inside IT, 2026-10-27). Risikomonitor's analysis, relayed by Inside IT and not verified independently, finds files with about 5,300 e-mail addresses and more than 2,000 identifiable persons, social-assistance decisions with name, address, monthly amount, AHV numbers and health insurer from 2014 to December 2025, debt-enforcement extracts, naturalisation dossiers from 2018 and payment orders against tax debtors, and information on the whole population of 1,381 inhabitants (Inside IT, 2026-10-27). The commune told Inside IT it will make no statement. The claim as Inside IT reported it on 2026-09-29 named no dataset (Inside IT, 2026-09-29).

Palo Alto Networks' advisory for both flaws now says that active exploitation has been observed against its PAN-OS management interface exposed to the internet, after a copy of 2026-10-27 said very limited exploitation; it names no victim or actor, and Unit 42's retraction of 2026-10-25 stands. Priority stays critical.

Palo Alto Networks' advisory for both flaws now states that active exploitation has been observed targeting the Palo Alto Networks management interface exposed to the internet, and its severity is Critical with urgency Highest (Palo Alto Networks, 2026-10-28). A copy of the page taken on 2026-10-27 at 17:10 UTC said instead that very limited exploitation had been observed (Palo Alto Networks, 2026-10-27). The advisory names no victim, actor or post-exploitation behaviour and does not say which flaw was used. It is a vendor statement about its own product, Unit 42's retraction of 2026-10-25 stands (Palo Alto Networks Unit 42, 2026-10-25), and Palo Alto's remaining PAN-OS hotfixes are due by 2026-10-30 (Palo Alto Networks, 2026-10-28).

CISA added the Brotli decoder flaw CVE-2026-111497 to its Known Exploited Vulnerabilities catalog on 2026-10-27, so the entry's CVE record moves to exploited and KEV-listed; Microsoft's own record still said not exploited on 2026-10-25 and no source reports an attack on .NET.

CISA added CVE-2026-111497, the Brotli decoder flaw this release fixes for .NET, to its Known Exploited Vulnerabilities catalog on 2026-10-27 "based on evidence of active exploitation", without describing the evidence (CISA, 2026-10-27). ELLIO's sensors recorded exploit traffic against Node.js 24.22.0 on 2026-10-26 (ELLIO, 2026-10-26); no source reports an attack on .NET, and Microsoft's own record marked the flaw not exploited on 2026-10-25 (MSRC, 2026-10-25).

CISA added CVE-2026-111497 to its Known Exploited Vulnerabilities catalog on 2026-10-27 on evidence of active exploitation, and ELLIO's sensors recorded exploit traffic against Node.js 24.22.0 on 2026-10-26; JFrog shows the decoder reachable beyond HTTP and Cisco and Palo Alto report no malicious use against their products. The entry's earlier statement that no source reports exploitation is replaced, the priority moves from notable to high. Palo Alto's advisory, as read on 2026-10-28, shows six of its nine PAN-OS hotfixes released and three due on 2026-10-29 and 2026-10-30.

CISA added CVE-2026-111497 to its Known Exploited Vulnerabilities catalog on 2026-10-27 "based on evidence of active exploitation", naming no actor or victim (CISA, 2026-10-27). ELLIO's sensors recorded a public checker that maps hosts decompressing Brotli and then, on 2026-10-26, one Brotli-coded request body of about 23 MB built against Node.js 24.22.0 on x86-64, which ELLIO reads as adoption by an operator focused on mass exploitation; its own test of the attacker's chain against that build got no shell in 50 attempts, so a failed attempt shows as a worker crash (ELLIO, 2026-10-26). Tenable relays the report and has not confirmed it (Tenable, 2026-10-26); Cisco and Palo Alto report no malicious use against their own products (Cisco PSIRT, 2026-10-27; Palo Alto Networks, 2026-10-28). Palo Alto's advisory, as read on 2026-10-28, shows six of the nine PAN-OS hotfixes released and the other three, 12.1.4-h13, 12.1.10-h3 and 11.2.4-h23, due on 2026-10-29 and 2026-10-30 (Palo Alto Networks, 2026-10-28).

JFrog reproduced a remote crash of a ClickHouse server with one request carrying a crafted 23 MB body, with the fix merged but not released when it wrote (JFrog, 2026-10-25). Akamai gives a lever for Express 5 and body-parser 2 services that accept no compressed request bodies: set the inflate option to false (Akamai, 2026-10-26). A Node.js build is judged by its release version, because the bundled version string reads 1.2.0 on patched builds as well (ELLIO, 2026-10-26).

Palo Alto Networks' advisory now says, as read on 2026-10-28, that active exploitation has been observed targeting the PAN-OS management interface exposed to the internet, after a copy of 2026-10-27 said very limited exploitation; severity is Critical with urgency Highest (CVSS-B 9.2, up from 8.7 for availability impact only), and the priority moves from notable to high.

Palo Alto Networks' advisory now states that active exploitation has been observed targeting the Palo Alto Networks management interface exposed to the internet (Palo Alto Networks, 2026-10-28). A copy of the page taken on 2026-10-27 at 17:10 UTC said instead that very limited exploitation had been observed (Palo Alto Networks, 2026-10-27); the vendor timeline records no change of wording, and its entries of 2026-10-27 are two removals of hotfix estimated dates and the 16:40 UTC change that raised the severity to Critical and the urgency to Highest (Palo Alto Networks, 2026-10-28). The vendor score is now CVSS-B 9.2 with high impact on confidentiality, integrity and availability when management is reachable from the internet, and 7.7 when it is reachable only from an adjacent network; the earlier text scored availability impact only (8.7) and knew of no exploitation. The advisory names no actor, victim or post-exploitation behaviour. CISA's catalog flags both PHP flaws with forensic triage requirements (CISA KEV, 2026-10-27). The hotfix table has moved on since the previous record: as read on 2026-10-28, fourteen builds are released and six are due by 2026-10-30 (Palo Alto Networks, 2026-10-28).

Citrix revised bulletin CTX697263 on 2026-10-27 to name the fixed builds (14.1-73.49, 13.1-64.32, the 14.1-FIPS and the 13.1-FIPS and NDcPP builds), which CERT-FR restates; no source reports an attack on NetScaler.

Citrix revised bulletin CTX697263 on 2026-10-27 to name fixed builds: NetScaler ADC and Gateway 14.1-73.49 and later, 13.1-64.32 and later of 13.1, ADC 14.1-FIPS 14.1-73.49 FIPS and later, and ADC 13.1-FIPS and 13.1-NDcPP 13.1.37.286 and later (Citrix, 2026-10-22). CERT-FR's notice of 2026-10-27 lists the same first fixed builds for ADC and Gateway (CERT-FR, 2026-10-27). Neither page says NetScaler has been attacked, and no source reports an attack on it.