01Talos: UAT-11473 implants KeyDrift in Cisco SD-WAN controllers through CVE-2026-20127 to collect data-plane keys. Cisco Talos reports that a cluster it calls UAT-11473 exploited CVE-2026-20127, the peering authentication bypass in Cisco Catalyst SD-WAN Controller, Manager and Validator (CVSS 10.0, fixed releases since February 2026, no workaround), and then ran the KeyDrift implant inside the controller's control-plane process to collect session metadata and what Talos assesses to be data-plane IPsec keys. Cisco's advisory, revised on 2026-10-28 to link Talos's post, says it is aware of limited exploitation, and Talos assesses with high confidence that the operating infrastructure overlaps considerably with Volt Typhoon's Silent Train network. →
02PHP2Shell: Trend Micro Apex Central and Apex One await patches to 11 Nov; Quest KACE and NetApp ONTAP have fixes. Trend Micro's advisory of 2026-10-28 lists Apex Central and the on-premises Apex One server as impacted by the PHP flaws with critical patches due on 2026-11-11 and interim mitigations; Quest says all KACE SMA and SDA versions are affected, with SMA 15.0 CU5 and 15.1 CU2 and the SDA 9.3 hotfix out and advice to block ports 80, 443 and 52230 until applied; and NetApp's advisory lists ONTAP 9 as affected only by CVE-2026-109618, with attacker access as the www user restricted to the PHP jail and hotfix builds from 9.14.1P18HF1 to 9.19.1P3HF1. None of the three vendors reports an exploited case in what was read, although CISA lists both flaws as exploited. →
03F5 BIG-IP is affected by PHP2Shell: fixes are in 17.1.3.7, 17.5.1.11 and 21.1.0.4; APM data plane and TMUI exposed. F5's release notes for BIG-IP 17.1.3.7, 17.5.1.11 and 21.1.0.4, each updated on 2026-10-24, list K000163821 as the fix for the PHP flaws CVE-2026-109618 and CVE-2026-109619 and call each a critical release whose only new changes are PHP fixes. NCSC-NL's record of K000163821 puts BIG-IP 17.1.0 to 17.1.3, 17.5.0 to 17.5.1 and 21.1.0 in scope, through the Configuration utility of all modules and through the access-profile data plane of APM and SSL Orchestrator; F5's article itself could not be read, and nothing found reports an attack on BIG-IP, although CISA lists both flaws as exploited. →
ESET reports an active campaign in Ukraine in which Russia-aligned attackers exploited MDaemon mail servers and deployed two backdoor families, HELLAGE and HELLTAG (ESET Research, 2026-10-28). MDaemon uses ClamAV to scan attachments of incoming mail; old ClamAV versions carry CVE-2025-8088, the WinRAR path-traversal flaw ESET uncovered last year, which ESET says was fixed in ClamAV's source on 27 July 2025 (the release notes below date the fixed ClamAV builds 2026-08-07), while MDaemon kept shipping an old libclamunrar.dll until MDaemon 26.0.4 of 2026-08-25 (ESET Research, 2026-10-28). The chain ESET describes: a crafted RAR archive is mailed to any address at a vulnerable server, MDaemon invokes ClamAV to scan it, and the exploit writes a malicious DLL to the server's file system with no user interaction, so the message carries no lure (ESET Research, 2026-10-28). CERT-UA names the backdoors: HELLAGE steals email messages and other data, talks to a hardcoded server and can deploy more malware, and HELLTAG takes commands, transfers files and does reconnaissance through a hardcoded Telegram bot; ESET cannot attribute the campaign to a known Russia-aligned actor (ESET Research, 2026-10-28).
The exposure is wider than MDaemon. ClamAV's release notes of 2026-08-07 say it adopted the upstream UnRAR fix for CVE-2025-8088, which rejects path separators in NTFS alternate data stream names so that extraction cannot leave ClamAV's temporary scan directory on Windows, and that the issue affects ClamAV 0.101.0 through 1.5.3 with the fix in 1.4.6 and 1.5.4 (ClamAV, 2026-08-07). CISA has listed CVE-2025-8088 in its Known Exploited Vulnerabilities catalog since 2025-08-12 (CISA KEV, 2026-10-28).
We also identified an extensive campaign in Ukraine exploiting MDaemon mail servers, during which the attackers deployed two backdoor malware families, HELLAGE and HELLTAG.
Moldova's Electronic Governance Agency (AGE) reported on 2026-10-27 that between 19 and 23 October attackers queried about one million national identification numbers (IDNPs) through state digital services and that, on preliminary estimates, data sets for about 750,000 of them were extracted; MOLDPRES had put the access requests at about 11 million on 2026-10-24 (Moldova Electronic Governance Agency, 2026-10-27; MOLDPRES, 2026-10-24). AGE's technical explanation is that the attackers exploited vulnerabilities in services reachable without authentication and then used the data they obtained for further extractions; the first attacks hit an electronic service that logged the legal basis of processing incorrectly, which is why citizens saw entries for civil-status document requests and driving-licence issue in the data-access history of the EVO app (Moldova Electronic Governance Agency, 2026-10-27). Data that may be affected, not every category for every person, includes name, date and place of birth, first-degree relatives, insured status, family doctor, social benefits, pensions, disability, driving licence, photograph, vehicles and companies owned or run, IBAN, tax debts and payment history; AGE says card data is not held on the platform and it found no unauthorised change to state registers (Moldova Electronic Governance Agency, 2026-10-27).
AGE stopped the extraction on 23 October at 11:30, reviewed 82 digital services and suspended the exposed ones, and its timeline says 82 public services and more than 30 information systems and administration panels were disconnected as a precaution on 23 October; it blocked further attempts on 25 and 27 October, and the Prime Minister's account is that 30 of the 82 services were disconnected (Moldova Electronic Governance Agency, 2026-10-27; MOLDPRES, 2026-10-28). The Prime Minister says the incident is not isolated, that foreign state actors are being investigated and that the attackers automated the extraction, with the use of artificial intelligence allegedly facilitating the identification and exploitation of the vulnerabilities (MOLDPRES, 2026-10-28). Moldova has not attributed the attack to any country or group (The Record, 2026-10-28).
The attackers exploited vulnerabilities in services accessible without authentication, then used the data obtained for further extractions. (translated from Romanian)
data sets for about 750,000 national identification numbers were extracted (translated from Romanian)
Machelen's own timeline records that on 2026-08-20 attackers gained access to an internal laptop through misleading instructions on an external website, explored it extensively from 24 August to 1 September, and on 10 September had access to a user with high access rights and other IT systems; the municipality found the incident on 11 September, isolated all systems, reported to the Belgian CCB-CERT, restarted part of its systems from a backup of a safe date on 14 September and recorded the first evidence of leaked data on 17 September (Municipality of Machelen, 2026-09-22). It confirms that personal data was leaked and says the scope is still being investigated (Municipality of Machelen, 2026-09-22); the mayor had said on 14 September that no personal data appeared to be affected, and ITdaily reports that this proved wrong (ITdaily, 2026-09-23). Ransomware.live recorded on 2026-10-27 that Rhysida listed Machelen on its leak site, describing the listing as municipal and social-welfare file servers of about 1.3 million files, with client files that include passports and identity cards, nursing-home medical files and civil-status records, which are the group's own claims (Ransomware.live, 2026-10-27).
hackers gain access to an internal laptop through misleading instructions on an external website (translated from Dutch)
hackers have access to a user with high access rights and other IT systems within the organisation (translated from Dutch)
Cisco Talos reports that UAT-11473 exploited CVE-2026-20127, an authentication bypass in the peering authentication of Cisco Catalyst SD-WAN Controller (Cisco PSIRT, 2026-10-28), and then installed a custom framework it calls KeyDrift (Cisco Talos, 2026-10-28). CISA has listed the flaw in its Known Exploited Vulnerabilities catalog since 2026-02-25 (CISA KEV, 2026-10-28). Cisco's advisory (CVSS 10.0) says an unauthenticated remote attacker can log in as an internal high-privileged non-root user and reach NETCONF to change the SD-WAN fabric configuration, and that there is no workaround (Cisco PSIRT, 2026-10-28). Cisco's advisory, revised on 2026-10-28 to link Talos's post, says its PSIRT is aware of limited exploitation (Cisco PSIRT, 2026-10-28). Lumen's Black Lotus Labs reported on 2026-10-28 that Volt Typhoon had exploited the flaw since late 2025 and after Cisco's February disclosure (Lumen Black Lotus Labs, 2026-10-28), and Talos assesses with high confidence that UAT-11473's operating infrastructure overlaps considerably with Volt Typhoon's Silent Train network (Cisco Talos, 2026-10-28).
KeyDrift runs inside the control-plane daemon. The actor edits the runit launchers of sshd and of a look-alike aaamgr service and remounts /rootfs.rw executable: the sshd launcher starts a script that injects the PolyFlame library into every running vdaemon process by ptrace, and the aaamgr launcher runs a packed PolyFlame loader directly (Cisco Talos, 2026-10-28). PolyFlame is tasked in-band over the control-plane traffic and offers a command, file-write and file-read backdoor and an intermediate command relay; Talos recovered no hardcoded address, port or domain (Cisco Talos, 2026-10-28). A second component, LittleFilch, hooks SSL_read in vdaemon and collects peer system addresses and 32-byte values Talos assesses to be OMP-distributed IPsec data-plane keys, writing them RSA-encrypted to /var/tmp (Cisco Talos, 2026-10-28). Talos lists observed targeting as space and satellite services, defense and aerospace technology, and policy research, calls the activity historical and does not say how many controllers were affected (Cisco Talos, 2026-10-28).
Triage: an aaamgr service that runs as a compiled ELF is the discriminator, because the legitimate component is a Python package and does not normally appear that way (Cisco Talos, 2026-10-28).
Observed targeting spans across space and satellite services, defense and aerospace technology, and policy research.
The legitimate Cisco aaamgr component is a Python package; it does not normally appear as a compiled ELF runit service.
SafeDep counts 19 npm packages from the same operator between 2026-10-19 and 2026-10-27, eight of them published through four npm accounts, that carry a worm sharing code with the June Miasma worm and adding the token-revocation wiper of Mini Shai-Hulud; SafeDep has not confirmed the lineage, and JFrog says its evidence does not establish that the original Miasma operators are responsible (SafeDep, 2026-10-27; JFrog Security Research, 2026-10-26). The install trigger has changed twice: first a command expansion in a binding.gyp file, with no install script; then a postinstall script that loads a native addon which decodes and starts the worm; and, since SafeDep's update of 27 October, an addon that runs when an application imports the package, so a hardening step that disables install scripts does not stop it (SafeDep, 2026-10-27).
The payload exits on CIS locales and in known analysis sandboxes. It steals SSH keys, registry and Git credentials, .env files, browser logins, AI-tool, cloud, Vault and Kubernetes secrets and GitHub Actions secrets read from runner memory (SafeDep, 2026-10-27). It exfiltrates by committing encrypted data, with the victim's encrypted GitHub token, to a new public repository in the victim's own account, injects a GitLab CI job that requests npm and PyPI OIDC tokens, adds its loader to the victim's npm packages and publishes new patch versions, republishes to PyPI and RubyGems, commits a fake CodeQL workflow and AI-agent configuration files that infect the host again, and copies itself over SSH to the hosts in known_hosts (SafeDep, 2026-10-27). A persistence service checks the stolen GitHub token every 45 seconds for 48 hours and on an authentication failure deletes the home directory (SafeDep, 2026-10-27). JFrog found 42 armed third-party GitHub repositories of 11 legitimate owners with hooks for AI coding assistants and IDEs, and says the payload blobs were large enough to evade GitHub's search and API paths (JFrog Security Research, 2026-10-26).
Any application that imports the package starts the worm.
The malicious versions steal credentials, spread to other packages and repositories, and install a wiper that deletes the home directory when the victim revokes the stolen GitHub token.
Huntress reports several recent incidents in which attackers used legitimate mobile-device-management platforms, not flaws in them, as a trusted management path, naming Hexnode and Rippling as the two it saw and noting the list is not definitive (Huntress, 2026-10-28). In the first case, proposal-themed emails led a user to download an MSI named like a DocuSign installer that installed Hexnode components (gateway, agent and PostgreSQL components); ScreenConnect followed shortly after and connected to an attacker relay, the managed-service provider removed it, and it came back several hours later to the same relay while the Hexnode client was still installed (Huntress, 2026-10-28). In the second, a receptionist clicked a link in an email about tax planning that led to a fake Teams calendar page; about a minute later a Rippling enrolment registry key appeared, the agent was downloaded into a SYSTEM profile path and installed with SYSTEM rights, and about 35 minutes after that the attacker used the MDM to stage and run a ScreenConnect installer as SYSTEM (Huntress, 2026-10-28).
Triage: a corporate enrolment started by IT looks similar in process telemetry; the discriminators are a tenant that is not in the authorised inventory, a trigger that is an emailed link or a user-run installer instead of IT's enrolment workflow, and an RMM install within minutes (an inference from Huntress's two cases).
removing it does not remove the unauthorized management architecture that delivered it.
MDM enrollment should be treated as security-sensitive activity as opposed to a routine administrative task.
Maintain an inventory of authorized MDM products, tenants, agents, and RMM instances.
Trend Micro's customer advisory KA-0024802, last updated on 2026-10-28, lists Apex Central and the Apex One on-premises server as impacted by CVE-2026-109618 and CVE-2026-109619 with a critical patch expected on 2026-11-11 and an interim mitigation page for each; Trend Micro Web Security in the cloud is due on 2026-11-06, Deep Discovery Inspector and Email Inspector on 2026-10-30 and Deep Discovery Analyzer on 2026-11-12, and Apex One as a Service was addressed on 2026-10-23 (Trend Micro, 2026-10-28). Trend Micro says it has not seen successful exploitation in its products or services and asks customers to restrict the impacted management servers and consoles to trusted addresses until the patches ship (Trend Micro, 2026-10-28).
Quest's knowledge-base article says all versions of the KACE Systems Management Appliance (SMA) and Systems Deployment Appliance (SDA) are affected and that CVE-2026-115560 does not affect them; KACE SMA 15.0 CU5 (15.0.378) and 15.1 CU2 (15.1.177) with PHP 8.4.27 were published on 2026-10-23, the cumulative updates 15.0 Patch 4 and 15.1 Patch 1 do not contain the fix, and the SDA 9.3 hotfix 9.3.312 with PHP 8.3.36 followed (Quest Software, 2026-10-28). Until an appliance is updated Quest says to block all public internet access and, because a potentially exploitable communication path remains after the agent tunnel on port 52230 is established, to block inbound web traffic including ports 80, 443 and 52230 (Quest Software, 2026-10-28).
NetApp's advisory lists ONTAP 9 as affected only by CVE-2026-109618, scored CVSS 4.0 9.2, where an unauthenticated attacker could potentially gain access as the www user but would be restricted to the PHP jail, and lists the hotfix builds 9.14.1P18HF1, 9.15.1P20HF1, 9.16.1P16HF1, 9.17.1P11HF1, 9.18.1P8HF1 and 9.19.1P3HF1 (NetApp, 2026-10-26; NetApp, 2026-10-26). NetApp's knowledge-base article names all ONTAP web services as affected, System Manager, the SPI web portal, the REST API, ZAPI and HTTP and HTTPS access, and recommends upgrading to a fixed version and undoing any workaround afterwards (NetApp Knowledge Base, 2026-10-26). CISA lists both PHP flaws as exploited since 2026-10-26, although none of the three vendors reports an exploited case (CISA KEV, 2026-10-28).
At this time, TrendAI has not seen any active instances or scenarios of successful exploitation of either of the vulnerabilities in our products or services.
F5's release notes for BIG-IP 17.1.3.7, 21.1.0.4 and 17.5.1.11, each updated on 2026-10-24, list K000163821 as the reference for the fix of the PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619 and describe each build as a critical release whose only new changes are PHP vulnerability fixes and which is cumulative and includes earlier hardened and critical releases (F5, 2026-10-24; F5, 2026-10-24; F5, 2026-10-24). NCSC-NL records F5 as confirming that BIG-IP 17.1.0 to 17.1.3, 17.5.0 to 17.5.1 and 21.1.0 are vulnerable through the Configuration utility control plane in all modules and, for APM and SSL Orchestrator, through the access-profile data plane, and that earlier affected releases stay vulnerable until updated (NCSC-NL, 2026-10-26). CISA lists both PHP flaws as exploited since 2026-10-26; nothing found reports an attack on BIG-IP (CISA KEV, 2026-10-28).
The only new changes in this release are PHP vulnerability fixes.
Check Point's advisory sk1000302, created on 2026-10-21 and last modified on 2026-10-29, says that under certain circumstances the PHP flaws CVE-2026-109618 and CVE-2026-109619, both scored CVSS 9.2, may allow remote code execution through firewall web interfaces (Check Point, 2026-10-29). Affected are Force, Spark and Cloud firewalls that use one or more of Mobile Access Portal (not Spark), Remote Access VPN with SSL Network Extender (not Spark), Remote Access VPN with SAML realm authentication, the Identity Awareness captive portal, the UserCheck portal and Zero Phishing, on R81.20, R82, R82.10 and R82.20 and on Spark R81.10.x and R82.00.x; R80 to R81.10 and the older Spark lines are end of support and also listed (Check Point, 2026-10-29). Check Point's portal and SaaS services are already patched, Security Management and Log Servers are not affected, and its products are not vulnerable to the third PHP issue, CVE-2026-115560 (Check Point, 2026-10-29).
The hotfix, first published on 2026-10-23, implements the PHP 7.4 fix, is compatible with every Jumbo Hotfix Accumulator take, goes on each gateway, cluster member, security-group member or standalone server and needs a reboot; the R82, R82.10 and R82.20 packages were reissued on 2026-10-26 to support standalone deployments, and the R81.20 package was reissued on 2026-10-28 to fix a Mobile Access problem, must sit on take 166 or higher and is required where the Mobile Access Portal is used (Check Point, 2026-10-29). For the gateway packages the fix is also planned for the Jumbo Hotfix Accumulators of 2026-11-11, and Spark has R82.00.11 (build 998002823) and R81.10.17 (build 996004992) (Check Point, 2026-10-29); a hotfix for the end-of-support R81.10 gateway release was published on 2026-10-29 at 11:30 GMT (Check Point, 2026-10-29). Until a hotfix is installed, Check Point's mitigation is a block in cp-httpd.conf that denies requests with a multipart Content-Type, followed by a restart of the portals, which is removed before installing the hotfix; R82.20 gateways are also protected by the "PHP Remote Code Execution" IPS signature even when IPS is not enabled (Check Point, 2026-10-29). CISA lists both PHP flaws as exploited since 2026-10-26, and the sk makes no statement on exploitation of Check Point gateways (CISA KEV, 2026-10-28).
Under certain circumstances, PHP vulnerabilities may allow Remote Code Execution through firewall web interfaces.
Check Point products are not vulnerable to CVE-2026-115560.
This Hotfix implements the PHP 7.4 published fix for CVE-2026-109618 and CVE-2026-109619.
Check Point's sk1000302 carries a new note of 2026-10-29 at 11:30 GMT, "Released Hotfix for R81.10" (Check Point, 2026-10-29). R81.10 is an end-of-support gateway release that the sk still lists as affected, so a gateway on it now has a hotfix to install. The other hotfixes and the exploitation statement are unchanged.
WatchGuard's advisory listing of 2026-10-27 opens with 18 rows, 17 for Fireware OS and one for Mobile VPN with SSL Client for Windows, and seven of the 17 are scored 9.0 or higher (WatchGuard PSIRT, 2026-10-27). The fixes are in Fireware OS 2026.4, 12.12.4 and, for T15 and T35 models, 12.5.22. Three of the seven need no authentication but a specific feature. CVE-2026-93866 (9.2) is an integer overflow in the WebSocket handling of the Access Portal that lets a remote unauthenticated attacker write beyond the bounds of a heap buffer while the Access Portal is enabled (WatchGuard PSIRT, 2026-10-27). CVE-2026-93857 (9.2) is a stack buffer overflow in the SIP proxy that gives remote code execution when a SIP proxy is configured on the Firebox (WatchGuard PSIRT, 2026-10-27). CVE-2026-93865 (9.2) is missing authentication in the FireCluster synchronization daemon: a remote unauthenticated attacker invokes privileged administrative actions with a crafted request to the FireCluster management IP when clustering is enabled (WatchGuard PSIRT, 2026-10-27).
The other four need a network position. CVE-2026-112709 and CVE-2026-112710 (9.2 each) are heap overflows in the authentication service that give denial of service and possibly code execution to an attacker who controls or intercepts traffic to the configured Active Directory server and returns a crafted response (WatchGuard PSIRT, 2026-10-27; WatchGuard PSIRT, 2026-10-27). CVE-2026-103594 (9.5) is a stack overflow in WireGuard configuration processing for a man-in-the-middle with TLS-decrypted access between a Firebox that acts as a FireCloud Gateway and WatchGuard Cloud (WatchGuard PSIRT, 2026-10-27). CVE-2026-103593 (9.1) is a stack overflow in the logging service that gives root code execution to a network-adjacent attacker who impersonates or intercepts traffic to the log server with a crafted certificate, in FIPS mode (WatchGuard PSIRT, 2026-10-27). Six rows affect Fireware OS 2025.1 up to before 2026.4 and 12.0 up to before 12.12.4, T15 and T35 up to before 12.5.22, the WireGuard row starts at 2026.2 and 12.12, and each page states that WatchGuard is not aware of exploitation in the wild (WatchGuard PSIRT, 2026-10-27; WatchGuard PSIRT, 2026-10-27; WatchGuard PSIRT, 2026-10-27; WatchGuard PSIRT, 2026-10-27; WatchGuard PSIRT, 2026-10-27; WatchGuard PSIRT, 2026-10-27; WatchGuard PSIRT, 2026-10-27).
WatchGuard is not aware of any exploitation of this vulnerability in the wild.
allows a remote, unauthenticated attacker to write beyond the bounds of a heap buffer by sending a specially crafted request while the Access Portal feature is enabled.
allows a remote, unauthenticated attacker to invoke privileged system-level administrative actions by sending a specially crafted request to the FireCluster management IP when the clustering feature is enabled.
Veeam published three advisories on 2026-10-27. In Backup & Replication, CVE-2026-108142 (CVSS 4.0 9.1, critical) lets an unauthenticated attacker bypass authorization on the CDP Coordinator Service of Windows-based Backup & Replication and of the Veeam Software Appliance; it affects 13.1.1.18 and all earlier 13.1 builds and 13.0.2.29 and all earlier 13.0 builds, is fixed in 13.1.2 (build 13.1.2.57) and 13.0.3 (build 13.0.3.63), and does not affect 12.x (Veeam KB4948, 2026-10-27). The same advisory fixes two medium path-traversal flaws that need the Restore Operator role plus control over the contents of a backed-up NAS share and that write attacker-controlled files to an arbitrary path on the backup server, and a local privilege escalation in Veeam Agent for Linux version 13.1.1.4 and earlier that applies only to agents managed by a Backup & Replication server (Veeam KB4948, 2026-10-27). Veeam Backup for Microsoft 365 8.5.0.1014 and earlier carry CVE-2026-106076 (9.0, critical): an authenticated organization-transfer peer injects SQL into the source server's configuration database, which gives cross-tenant read and write of configuration data and remote code execution as the PostgreSQL service account; the fix is 8.6 (build 8.6.0.1102), as it is for CVE-2026-106077 (8.3), which lets a user with the Backup for Microsoft 365 Administrator role read arbitrary files on the backup server as LocalSystem; two further flaws, an unauthenticated REST API authentication bypass with a forged federation token (6.9) and an installer file-write (4.3), need 8.6 Patch 1 (build 8.6.0.5011) (Veeam KB4957, 2026-10-27). Veeam ONE 13.1.0.7233 and earlier let an attacker with valid Administrator credentials disable multi-factor authentication globally before completing MFA verification (8.5, high; fixed in 13.1 P1, build 13.1.0.7940) (Veeam KB4951, 2026-10-27).
NCSC Switzerland relayed the Backup & Replication and Veeam ONE advisories on 2026-10-28, lists the exploitation status as unknown with the vendor reporting no evidence of active exploitation, and gives the prerequisite for the critical flaw as network access to the backup server's CDP Coordinator Service (NCSC Switzerland, 2026-10-28). heise adds that backup servers are a favourite target of ransomware groups (translated from German) (heise online, 2026-10-28), and Veeam itself says attackers will likely try to reverse-engineer a disclosed patch to exploit unpatched deployments (Veeam KB4948, 2026-10-27).
A vulnerability allowing an unauthenticated attacker to bypass authorization on the CDP Coordinator Service.
Note: Older versions (e.g., 12.x) are not affected.
A vulnerability allowing an attacker with valid Administrator credentials to bypass multi-factor authentication by disabling it globally before completing MFA verification.
Palo Alto's advisory as read on 2026-10-29 shows nineteen of the twenty PAN-OS hotfixes released, the ETAs of 10.2.7-h39, 10.2.10-h42, 11.2.4-h23, 12.1.4-h13 and 12.1.10-h3 having been removed, with only 11.1.7-h12 still carrying an estimated date of 2026-10-30. The title, headline, summary, fixed-release strings, the first action and the hotfix sentences in the text are updated to match.
Palo Alto Networks' advisory timeline of 2026-10-29 removes the estimated dates of 10.2.7-h39, 10.2.10-h42, 11.2.4-h23, 12.1.4-h13 and 12.1.10-h3 because those builds are released (Palo Alto Networks, 2026-10-29). Nineteen of the twenty hotfixes are now available, and the advisory table gives only 11.1.7-h12 an estimated date, 2026-10-30 (Palo Alto Networks, 2026-10-29). Its exploitation statement is unchanged.
Broadcom's advisory VMSA-2026-0008.1 lists VMware Cloud Foundation's SDDC Manager as affected, critical (CVSS 3.1 9.8) on 9.1.1 and important (7.5) on 9.1.0, 9.0.x and 5.2.x, with the patch pending and workarounds only; the SDDC Manager workaround is added to the actions. Palo Alto's timeline of 2026-10-29 records the last three PAN-OS hotfixes (11.2.4-h23, 12.1.4-h13 and 12.1.10-h3) as released, so the PAN-OS action no longer says they are due. Removed from the main text: ELLIO's reading of the attacker as a mass-exploitation operator and its count of 50 attempts (the 2026-10-28 section still carries them). The Ubuntu 20.04 entry in the CVE record now shows the ESM fix.
Broadcom's advisory VMSA-2026-0008, issued on 2026-10-27 and revised as 0008.1 on 2026-10-28 to clarify the impacted products, lists VMware Cloud Foundation's SDDC Manager as affected because it uses Node.js: a malicious actor with network access to SDDC Manager may exploit the flaw to execute arbitrary code (Broadcom, 2026-10-28). Broadcom rates it critical, CVSS 3.1 9.8, on SDDC Manager 9.1.1 only and important, 7.5, on 9.1.0, 9.0.x and 5.2.x, none has a patch yet, and workarounds are in KB460732 for 9.1.1 and KB460734 for the others (Broadcom, 2026-10-28).
Palo Alto Networks' timeline of 2026-10-29 removes the estimated dates of 11.2.4-h23, 12.1.4-h13 and 12.1.10-h3 because those builds are released, so every PAN-OS hotfix listed for this flaw is now available (Palo Alto Networks, 2026-10-29).
Dream Research reports a production chain of a custom PHP2Shell build with the Linux kernel flaw CVE-2026-46300 that gave unauthenticated root on 24 firewalls of one unnamed vendor and led to an attack on the Active Directory of a US government-affiliated organization; CISA's catalog entry for the kernel flaw of 2026-10-28 says the same chaining. The earlier statement that no source ties a named CVE to a production compromise is replaced, an action for appliances that embed PHP is added, the URWB fix date in the vendor list is corrected from March 2027 to November 2026 (advisory version 1.9), and the PAN-OS hotfix status is updated to nineteen of twenty released (advisory of 2026-10-29). Removed from the text: the sentence on the release time, Karimi's two-source-address-clusters and PHPSESSID remarks in the main text (the 2026-10-27 section keeps his reliability caveat), VulnCheck's failed web-shell attempt in the main text (the Detection line keeps it), the lab log-path remark and most of Sansec's note on its CVE attribution (kept as a short clause); the 'no source ties a named CVE' statement of 2026-10-27 is dated, and the evidence record for Karimi's clusters remark is dropped.
CISA's catalog entry of 2026-10-28 for the Linux kernel flaw CVE-2026-46300 says it can be chained with CVE-2026-109618 and CVE-2026-109619 to implant PHP webshells and run commands as root (CISA KEV, 2026-10-28). Dream Research reports a chain that takes these flaws to root on appliances: a custom, non-public PHP2Shell build for the management web server of one large vendor's firewall software, which runs PHP 8.0.30 with a high memory limit, gave code execution as the nobody user, and the kernel flaw lifted it to root in one HTTP request in under 15 minutes (Dream Research, 2026-10-27). Dream found the build tuned to eleven firmware versions, nine exploitable, with offsets from the vendor's own PHP library, the deployment-specific calibration CrowdStrike expects a reliable exploit to need (an inference) (Dream Research, 2026-10-27; CrowdStrike, 2026-10-23). From about 19,000 internet-facing firewalls of that vendor it narrowed to 240, rooted 24 and left a PHP webshell on each, and from the second of two firewalls of a US government-affiliated organization (the first crashed) built a persistent outbound SSH tunnel, rooted the organization's firewall management server through it and began an attack on its Active Directory; Dream could not tell whether that attack succeeded, does not name the vendor, calls the campaign apparently Chinese and AI-assisted and does not attribute it to a named actor (Dream Research, 2026-10-27). The targets were firewalls whose management interfaces were reachable from the internet (Dream Research, 2026-10-27).
Palo Alto Networks' advisory as read on 2026-10-29 lists all PAN-OS hotfixes as released except 11.1.7-h12, due on 2026-10-30 (Palo Alto Networks, 2026-10-29).
AlmaLinux announced on 2026-10-28 that fixed production kernels are available for releases 8, 9 and 10 and TuxCare reports its rebootless patch out for EL9 and EL10 and the upstream fix accepted into the networking tree; the earlier statements that no fix is merged or shipped in a distribution kernel are replaced and an action to install the kernel is added. Removed from the main text: the sentence on the vmwgfx and nvmet reports, which only had titles public.
AlmaLinux says its fix for ZDI-CAN-33367 is now in the regular kernel updates in the production repositories for every supported release: kernel-4.18.0-553.178.1.el8_10 for AlmaLinux 8, kernel-5.14.0-687.60.1.el9_8 for 9 and kernel-6.12.0-211.69.1.el10_2 for 10, installed with a metadata refresh, an upgrade and a reboot; the earlier testing-repository kernels also carry the fix (AlmaLinux, 2026-10-28). TuxCare's status of 2026-10-27 adds that the upstream fix has been accepted into the kernel's networking tree but not mainline, that no CVE exists and no exploitation has been reported, that its rebootless patch is out for EL9 and EL10 on AlmaLinux, CloudLinux, RHEL, Oracle Linux and Rocky Linux with EL8 ready for release, and that Debian and Ubuntu work is in progress (TuxCare, 2026-10-27).
ConnectWise's status page of 2026-10-28 opens partner re-authorisation of Microsoft 365 backup and restore through a new application that each partner must consent in every tenant, with instructions on its Trust Center (restoration in controlled phases had begun on 2026-10-21); the earlier advice to keep the old connections disabled until restoration instructions exist is replaced. The text on the vendor tenant is corrected: the name 'ConnectWise S-K LLC' and the claim that Todyl says all SkyKick apps come from one vendor tenant are removed. Removed from the text: the heise restoration sentence and the SaaS Security outage clause.
ConnectWise's status page announced on 2026-10-28 at 17:09 UTC, after restoration in controlled phases had begun on 2026-10-21, that it is beginning phased restoration for partners, starting with Microsoft 365 backups and restores through a new, security-hardened application, with other features returning in phases over the coming days (ConnectWise status page, 2026-10-28). Partners must re-authorize each Microsoft 365 tenant using the new application, “ConnectWise Cloud Backup for M365”, to resume backup and restore operations, and ConnectWise points to its Trust Center for the detailed instructions (ConnectWise status page, 2026-10-28). Before that, from 2026-10-26, it had said it would first enable a process to restore data from existing backups and then phased re-enrollment, and it still told partners to keep affected connections disabled until instructions applied to their service (ConnectWise status page, 2026-10-28).
Cisco revised the advisory to version 1.9 on 2026-10-28 and moved the fixed-release date for Ultra-Reliable Wireless Backhaul and Unified Industrial Wireless Software 27.1.1 from March 2027 to November 2026; the earlier statement that there is no fixed release before March 2027 is replaced.
Cisco published version 1.9 of the advisory on 2026-10-28 to update the fix availability date for Ultra-Reliable Wireless Backhaul and Unified Industrial Wireless Software: release 27.1.1 is now listed for November 2026 instead of March 2027, and the workaround in bug CSCwx37073 remains the control until it ships (Cisco PSIRT, 2026-10-28). The other rows are unchanged, and Cisco still knows of no malicious use against its products (Cisco PSIRT, 2026-10-28).
Defused reports its E-Business Suite decoys recorded exploratory exploit attempts against CVE-2026-101767 on 2026-10-27; the earlier statement that none of the rows is reported exploited is replaced, the row is not marked exploited because no production compromise is reported, and an action to patch the web tier and review its logs is added. The takeaway's advice to take T3, IIOP and the administration console off untrusted networks, which no cited page supports, is removed.
Threat-intelligence firm Defused reported that its Oracle E-Business Suite decoys recorded exploratory exploit attempts against CVE-2026-101767 on the morning of 2026-10-27, one week after the October update (SecurityWeek, 2026-10-28; BleepingComputer, 2026-10-28). BleepingComputer notes that Oracle has not tagged the flaw as exploited and that Shadowserver tracks more than 670 internet-exposed E-Business Suite instances, without saying how many are decoys or already patched (BleepingComputer, 2026-10-28). SecurityWeek adds that there have been no other reports of in-the-wild exploitation; the attempts hit decoys, and neither article describes a compromise of a production system (SecurityWeek, 2026-10-28).
CISA added the ESX insufficient-logging flaw CVE-2026-41709 to its Known Exploited Vulnerabilities catalog on 2026-10-28, and CrowdStrike says the actor WARP PANDA exploited it as a zero-day in vCenter-environment intrusions as late as early 2026; Broadcom's advisory still carries no exploitation statement. The CVE record moves to exploited and KEV-listed, and ESX audit logs can no longer be treated as a complete record of administrator activity.
CISA added CVE-2026-41709, the ESX insufficient-logging flaw, to its Known Exploited Vulnerabilities catalog on 2026-10-28 on evidence of active exploitation, naming no actor (CISA KEV). CrowdStrike says WARP PANDA deployed several forms of malware in victims' VMware vCenter environments and that in several of these cases, as late as early 2026, the adversary exploited the ESXi command logging bypass CVE-2026-41709 as a zero-day; it describes intrusions at U.S.-based entities that included the legal sector, and gives no indicators, no account of what goes unlogged and no date of first exploitation (CrowdStrike, 2026-10-28). Broadcom's advisory rates the flaw 2.7 and carries no exploitation statement (Broadcom, 2026-07-29). CrowdStrike does not say how the actor obtained administrator rights on the host or whether the flaws of CVE-2026-59309 and CVE-2026-59310 were involved, so no link to them is drawn. Until the fix is installed, ESX logs from a period of administrator access are not reliable evidence of what was done; vCenter task and event records and syslog forwarded off the host are the sources to review.
CISA added CVE-2026-46300 to its Known Exploited Vulnerabilities catalog on 2026-10-28 and says it can be chained with the PHP2Shell flaws to implant PHP webshells and run commands as root; Dream Research describes such a chain used against 24 firewalls of one unnamed vendor and a US government-affiliated network. The CVE record moves to exploited, the priority from notable to high, and the earlier statement that no source reports exploitation of this CVE is replaced. Removed from the text: the sentence that an attacker can modify any file the user can read (the Detection line still carries it) and, from the summary, the clause on Aikido's report of working Kubernetes exploits for the Dirty Frag family.
CISA added CVE-2026-46300 to its Known Exploited Vulnerabilities catalog on 2026-10-28 and says in the entry that the flaw can be chained with CVE-2026-109618 and CVE-2026-109619 to implant PHP webshells and run commands as root, naming no actor or victim (CISA KEV, 2026-10-28). Dream Research describes a chain of this kind from artifacts its tooling recovered: a custom, non-public PHP2Shell build, tailored to the management web server of one large vendor's firewall software that runs PHP 8.0.30, gives code execution as the nobody user, and the Fragnesia exploit then overwrites /etc/pam.d/su in the page cache so that su root succeeds without a password; Dream says SELinux confines the web server's domain from modifying system files and that the whole chain runs in one HTTP request in under 15 minutes (Dream Research, 2026-10-27). From about 19,000 internet-facing firewalls of that vendor that it found through a search engine, the attacker narrowed to 240 in the United States, Japan, Taiwan and South Korea, rooted 24 and planted a PHP webshell on each; on the second of two firewalls of a US government-affiliated organization (the first crashed) it set up an outbound SSH tunnel kept up by a systemd service and an rc.local entry, rooted the organization's firewall management server through the tunnel, decrypted the LDAP service-account password with root access and sprayed passwords against a domain that had no lockout threshold (Dream Research, 2026-10-27). Dream could not tell whether any of the Active Directory attacks succeeded, does not name the vendor, calls the campaign apparently Chinese and AI-assisted and does not attribute it to a named actor (Dream Research, 2026-10-27).
Update the PHP runtime, not the CMS or its plugins, on every internet-facing server and container image to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 or to your distribution's patched package, restart PHP-FPM, Apache and every long-running worker, rebuild images, and confirm the running version, because a distribution backport can keep the old version string; isolate any application that cannot be updated from public networks until it is.
After updating, set session.upload_progress.enabled=0 on every PHP host and keep it there until PHP's next regular bugfix release: CVE-2026-115560, which the October releases do not fix, needs session upload progress to be enabled.
List every appliance and management server whose web interface embeds PHP (firewalls, network access control, wireless controllers, backup, storage and security consoles), take each interface off the internet and install its vendor's PHP2Shell fix, because Dream Research reports one appliance vendor's firewalls rooted through an exposed management interface.
Inventory which guest VMs use the VMXNET3 adapter and patch the ESX hosts carrying them to ESXi-9.1.0.0200, ESXi-9.0.2.0100 or ESXi80U3k: the escape is reachable from guest administrative privilege, which makes any tenant-operated or lower-trust VM on a shared host a path to the hypervisor.
Patch vCenter to 9.1.0.0300, 9.0.2.0100 or 8.0 U3k/U2f as applicable (there is no workaround) and on any appliance that was network-reachable and unpatched between 29 July and today, check the appliance's own scheduled-task and cron configuration for entries the platform team did not create, and its egress records for outbound SSH sessions from the appliance itself.
On the ESX hosts of any vCenter estate that was exposed or compromised, install the build that fixes CVE-2026-41709 and review administrator activity from vCenter task and event records and from syslog forwarded off the host, because Broadcom says the flaw lets an administrator act without being logged and CrowdStrike reports it used as a zero-day.
Update every MDaemon mail server to 26.0.4 or later and every Windows host that scans mail or files with ClamAV to 1.4.6 or 1.5.4, then check each mail server for DLLs it should not hold and treat stored mail on a server that ran an older build as possibly read, because HELLAGE steals email.
Upgrade every Cisco Catalyst SD-WAN Controller, Manager and Validator to its first fixed release (20.9.8.2, 20.12.5.3 or 20.12.6.1, 20.15.4.2 or 20.18.2.1; releases earlier than 20.9 must migrate), and until then limit ports 22 and 830 on the control components to known controller and management addresses, because Cisco offers no workaround.
Update every Node.js 22.x, 24.x and 26.x runtime to 22.23.4, 24.22.1 or 26.12.1, including the Node binary inside container images (a Dockerfile that pins 24.22.0 keeps the flaw until the pin changes), and upgrade the PyPI Brotli package to 1.2.1 and brotlicffi to 1.2.1.0 wherever either is installed; judge a Node.js build by its release version, because process.versions.brotli reads 1.2.0 on patched builds too, and move any application on an end-of-life Node.js line to a supported release.
Update every Envoy proxy that has the Brotli decompressor configured to v1.40.0, v1.39.3, v1.38.6, v1.37.8 or v1.36.12; the advisory names v1.39.2, v1.38.5, v1.37.7 and v1.36.11 as vulnerable. On every VMware Cloud Foundation SDDC Manager apply Broadcom's workaround, KB460732 on 9.1.1 and KB460734 on 9.1.0, 9.0.x and 5.2.x, until its patch ships.
On every PA-Series and VM-Series firewall on PAN-OS 12.2, 12.1 or 11.2 that has TLS decryption enabled, run show system setting brotli and, where it returns Enabled: yes, run set system setting brotli-encoding disable until the hotfix for the release is installed; Palo Alto's timeline of 2026-10-29 lists every PAN-OS hotfix for this flaw as released.
Take the management interface of every PA-Series and VM-Series firewall and Panorama off the internet now by restricting it to a jump box or trusted internal addresses, because Palo Alto reports active exploitation against internet-exposed management interfaces, and install the hotfix for your maintenance release, which Palo Alto's table lists for every line from 10.2.7 to 12.2.4 (11.2.10-h17 adds the Brotli fix).
In every Entra tenant you or your MSP administer, disable without deleting the seven ConnectWise application identities that ConnectWise lists by client ID (Cloud Backup is 506e08f9-6e9a-4da4-942b-a099a03644ae; the other six are in ConnectWise's advisory), dormant connections included, and keep them disabled, because ConnectWise's restoration of 2026-10-28 has partners consent a new application, “ConnectWise Cloud Backup for M365”, in each tenant, so take its details only from the instructions on ConnectWise's Trust Center; where Graph activity logs were enabled, review them for these apps until at least 90 minutes after you disabled them, because a token issued before the disable stays valid for up to 90 minutes, and preserve the sign-in and audit logs promptly without delaying containment, because Entra ID Free keeps only 7 days.
In the same tenants list the apps owned by the ConnectWise tenant (ID 3f9cd7a0-127a-4ed4-bf06-2f830d5616b7), and disable each that you do not use or cannot verify as safe.
In the same tenants review every enterprise application and app registration, MSP management and security tools first but none skipped (Huntress saw the secrets planted on apparently random applications, in one tenant on some of the least privileged ones), for client secrets, certificates and federated credentials added since 2026-10-13 and remove any you did not create; also check the directory roles, owners and consent grants held by ConnectWise and SkyKick service principals, Conditional Access exclusions for them, and mailbox forwarding, inbox and transport rules and delegated access, because disabling the vendor applications does not remove access planted through them.
Patch CVE-2026-46300 on every Linux host that runs PHP or other internet-facing code, then on multi-tenant hosts, container nodes and CI runners: apply the distribution kernel update and reboot; until then, where IPsec is not in use, block and unload the esp4, esp6 and rxrpc modules (this breaks IPsec), and drop the page cache so a file already modified in memory reloads from disk.
On any PHP web host, appliance or management server that was reachable and unpatched for the PHP2Shell flaws, look for PHP files in web-reachable directories that nobody deployed, an outbound SSH session from the host that a systemd service or an rc.local entry keeps up, and password-spray bursts against Active Directory from the host's address, because Dream Research reports a chain of the two flaws that did exactly that.
Restrict the Trend Micro Apex Central and Apex One server consoles and web endpoints to administrator networks now, apply Trend Micro's interim mitigation, and install the critical patches when they ship, due on 2026-11-11; patch Deep Discovery Inspector and Email Inspector when theirs arrive on 2026-10-30.
Install KACE SMA 15.0 CU5 or 15.1 CU2 and the SDA 9.3 hotfix 9.3.312, and until then block inbound ports 80, 443 and 52230 to every appliance, as Quest advises.
Update every F5 BIG-IP on 17.1, 17.5 or 21.1 to 17.1.3.7, 17.5.1.11 or 21.1.0.4, systems that publish an APM or SSL Orchestrator access profile first, because NCSC-NL records the access-profile data plane as exposed as well as the Configuration utility.
Install the Check Point hotfix for your release on every gateway, cluster member and security-group member that uses Mobile Access, SSL Network Extender, SAML-realm VPN, the Identity Awareness captive portal, UserCheck or Zero Phishing, put the R81.20 package of 2026-10-28 on Jumbo Hotfix Accumulator take 166 or later wherever Mobile Access is used, and until the hotfix is in apply Check Point's cp-httpd.conf mitigation, which you remove before installing it.
Compare every lockfile and CI cache against the package list in SafeDep's post; on each host that installed or imported a listed package, disconnect it, remove persistence first and only then rotate the GitHub, npm, cloud and SSH credentials it could read, because the worm wipes the home directory when the stolen GitHub token is revoked.
On every endpoint from which an unauthorised ScreenConnect or other RMM agent has been removed, check for a Hexnode or Rippling MDM agent or enrolment that nobody authorised and unenrol the device from that tenant, because in Huntress's Hexnode case ScreenConnect returned hours after its removal while the MDM client stayed.
Upgrade every WatchGuard Firebox to Fireware OS 2026.4, 12.12.4 or, on T15 and T35 models, 12.5.22, starting with appliances that have the Access Portal or a SIP proxy enabled or that are FireCluster members, because WatchGuard names no workaround for the three unauthenticated flaws.
Upgrade every Veeam Backup & Replication 13.x server and Veeam Software Appliance to 13.1.2 (build 13.1.2.57) or 13.0.3 (build 13.0.3.63), Veeam Backup for Microsoft 365 to 8.6 Patch 1 (build 8.6.0.5011) and Veeam ONE 13.1 to Patch 1 (build 13.1.0.7940), because Veeam names no workaround and warns that attackers reverse-engineer its patches.
On every AlmaLinux host where untrusted users or workloads run code, install kernel-4.18.0-553.178.1.el8_10, kernel-5.14.0-687.60.1.el9_8 or kernel-6.12.0-211.69.1.el10_2 or later and reboot, or apply TuxCare's KernelCare patch on EL9 and EL10.
Patch every E-Business Suite 12.2.3 to 12.2.15 web tier for CVE-2026-101767 now, because exploit attempts began a week after release, and review its web logs since 2026-10-27 for unauthenticated requests to the Thin Client Framework servlet and for database or Concurrent Manager activity that followed.
2026-10-29T0255Z-intel· Sonnet 5.5 · window 26 h · 11 entries published
Verification & coverage notes
Window 26 h (gap 24.0 h to 2026-10-28T0256Z-intel, normal cadence, no outage backfill). entities/registry.yaml (676 KB) was grepped per key instead of read whole; the 14-day prior_coverage.json (73 records) was read in full. Slice build: S1 took 6 essential and 14 rotation sources, S2 15 and 14, S3 14 rotation, S4 its 4-source pool; every slice ledger row came back attempted (20, 29, 14 and 4 records), and no continuation was needed. One Phase 2 follow-up agent (FU1) swept the PHP2Shell vendor status lists and the CERT-FR bulletins of 2026-10-28 and found the Check Point, F5 and Trend Micro, Quest KACE and NetApp gaps. No intel drops, so no S5.
Verification. Eight iterations ran: 1 to 4 and 6 returned NEEDS_FIXES, 5 and 7 returned CLEAN, and iteration 8, the confirmation pass of the iteration 7 CLEAN, returned NEEDS_FIXES at the 8-iteration cap, so the run publishes by the cap's fail-open with verification_residual_count 5 (truth 4, editorial 1; findings and remediations are in the record above). The iteration 8 wording fixes (the KeyDrift Cisco citation and fixed-release string, the VMware CISA and CrowdStrike order, the Machelen Detection absolute) were applied after the cap and were not re-verified. Left for the quality audit: the VMware vCenter and ESX 7.0 rows (extended-support fix only, in the Broadcom matrix since before this run), the legacy VMware em dashes and wording, and the Citrix NetScaler clause in the PHP2Shell entry (page unreadable on every transport). Declined with rebuttal in the iteration records: WatchGuard as an F7 include (three feature-dependent unauthenticated rows at 9.2 on perimeter firewalls; the store keeps comparable rows at notable; iteration 2 agreed) and the ConnectWise Trust Center anchor (the anchored URL answers 403 on every transport and raises a source-urls warning; iteration 4 accepted the decline). The status-page citation for ConnectWise is the incident permalink.
What this fire changed. Eleven new entries and nine changelog records. The two that matter most: Cisco's advisory for CVE-2026-20127 (version 2.1 of 2026-10-28 adds the Talos link; it says Cisco is aware of limited exploitation) is matched by Talos's description of the KeyDrift implant that UAT-11473 ran inside the SD-WAN controller process (new high entry, patch does not evict it); and CISA's KEV listing of the Linux kernel flaw CVE-2026-46300 on 2026-10-28, with its chaining to the PHP2Shell flaws and Dream Research's account of 24 rooted firewalls, moved that entry from notable to high and gave the critical PHP2Shell entry its first production-compromise chain. Three new entries close PHP2Shell vendor gaps (Check Point, F5 BIG-IP, and Trend Micro with Quest KACE and NetApp ONTAP).
KEV rows (kev-window.txt).
CVE-2026-41709 (VMware ESX, KEV 2026-10-28): COVERED-STALE on the VMSA-2026-0006 entry, given an update record: its CVE record now carries exploited and cisa-kev, and CrowdStrike's claim of zero-day use by WARP PANDA is attributed to CrowdStrike.
CVE-2026-46300 (Linux kernel, KEV 2026-10-28): COVERED-STALE on the Fragnesia entry, given an update record (exploited, cisa-kev, priority notable to high).
No NOT COVERED, MENTION-ONLY or RANSOMWARE rows.
Backlog (state/coverage_backlog.md). ARX Group SA (Aurora leak-site claim of 2026-10-23): held, unchanged. S4 re-read the ransomware.live record and API, the Inside IT, Netzwoche and SRF feeds and ARX's own site and searched in four languages; no ARX, client or regulator statement and no Swiss press report exist, expiry 2026-11-07. Breachsense lists the claim and five infostealer logins for the ARX domain, an aggregator and not corroboration.
Supersessions and corrections. The PHP2Shell entry's "no source ties a named CVE to a production compromise" is replaced by Dream Research's recovered-artifact account (and its clause that Sansec's CVE attribution differs from the PHP advisories is cut to one half-sentence); the Oracle CPU entry's "none of the rows is reported exploited" now carries Defused's decoy telemetry for CVE-2026-101767 without marking the row exploited; the ZDI entry's "no fix merged upstream or shipped in a distribution kernel" is replaced by AlmaLinux's production kernels and TuxCare's networking-tree statement, and its evidence quote is replaced by one still on TuxCare's updated page; the Cisco PHP2Shell entry's "no fixed release before March 2027" for URWB becomes November 2026 (advisory version 1.9); the ConnectWise entry's advice to keep the old connections disabled until restoration instructions exist now says restoration runs through a new application each tenant must consent.
Contradictions and borderline includes.
Contradiction: Dream's headline says 25 servers rooted, its text says 24 firewalls rooted in the batch and a third government server exploited through the tunnel; the entry carries the 24 firewalls and the management server separately and says Dream could not confirm the outcome of the Active Directory attack.
Contradiction: NCSC-NL's PHP2Shell list gives 2026-11-11 for Check Point's Jumbo fix, while sk1000302 lists hotfixes since 2026-10-23 and calls the Jumbo fix planned for 2026-11-11; the entry follows the vendor page and says so.
Contradiction: Defused and BleepingComputer report exploit attempts against decoys for CVE-2026-101767 while Oracle has not tagged it exploited and no production compromise is reported; the row stays patch-available, not exploited.
Borderline include: Veeam Backup & Replication CVE-2026-108142 with the Backup for Microsoft 365 and ONE rows (no exploitation reported), kept under the "otherwise" limb of PD-11 (b): an unauthenticated authorization bypass on backup-server infrastructure of a product family that ransomware operators target, relayed by the NCSC.ch hub. After the first verifier pass the cves[] records are held to six rows, the lowest scored 6.9 (the unauthenticated REST API bypass in Backup for Microsoft 365); the three lowest rows (two medium path traversals needing the Restore Operator role, an installer file-write) stay in the prose only.
Borderline include: WatchGuard Fireware 2026.4 (three pre-auth rows at 9.2 in perimeter firewalls, configuration dependent, no exploitation reported); the store keeps comparable perimeter-firewall rows at notable.
Borderline include: testmetest npm worm, first coverage through the rotational lookback (SafeDep 2026-10-27 update, JFrog 2026-10-26), included because installing with --ignore-scripts no longer protects and the wiper fires when the stolen token is revoked.
Borderline include: Machelen municipality (routine): its own timeline names the foothold method and a 22-day dwell, satisfying the incident floor; Moldova's e-government extraction (PD-11 c) is the transferable parallel to the Swiss cantonal e-autoindex harvesting entry.
Single-source and reduced-confidence inclusions.
Check Point, Trend Micro, Quest KACE, NetApp and F5: each vendor is the disclosing party for its own products. F5's advisory K000163821 could not be read, so the F5 entry rests on F5's release notes for the fixed builds and NCSC-NL's record of the exposure scope, confidence medium; NetApp's advisory page renders only in a browser and was read from the advisory data behind it.
Veeam: vendor first-party, three KB pages, relayed by NCSC.ch and heise; single-source in the entry's frame.
Moldova: the agency's own account with MOLDPRES and The Record; Machelen: the municipality's own timeline with ITdaily; the Rhysida listing is the group's claim as Ransomware.live records it.
Huntress MDM enrolment: one vendor's research, single-source.
KeyDrift: the implant analysis is Talos alone; Cisco and Lumen are independent for the flaw and for Volt Typhoon's exploitation of it.
borderline-drop lines.
Cisco Secure Firewall ASA, FTD and FMC hardening CVE-2026-20329 to 20336: the Cisco primaries date from 2026-09-16 and 09-18, outside the window, only NCSC-NL's relay is inside it; authenticated rows, and the exploited ones are already covered.
Amadeus reservation data (Korean Air, Asiana, JAL): out of nexus, no Swiss entity, no vector beyond a supplier account credential, Amadeus silent; reopen if a Swiss or European carrier confirms.
Belgium FPS Finance cyberattack: incident floor not met (no vector, no actor, no data theft indicated).
SoftwareOne and The Gentlemen: single paywalled source, leak-site claim with partial denial, no listing seen (PD-6).
BACS weekly review week 43 (WhatsApp account takeover): published 2026-10-27, consumer fraud, no public-sector victim; Swiss Ice Hockey Federation MySIHF portal: private federation; Vaud CYBER26 exercise invitation and the Federal Council AI-regulation status report: no obligation or technical consequence; OFAC DPRK IT-worker designations: policy watch, four IT-worker entries already carry the lesson.
Acronis TRU Qilin encryptor analysis, Enclave AuthMask CVE-2026-80097 (fixed in September), EPICS Base CVE-2026-114595 to 114598, Tailscale Tailworm (needs an authorised peer, patched in 1.104.4), TeamViewer 15.83, 123 Reg AI-driven intrusion, Socket Searchjacked, Check Point Yoba, Eclipse Vert.x CVE-2026-102479, Zscaler Node2Shell decoy telemetry: below the bar (single source, narrow exposure, patch-cycle item or low delta, no exploitation, no constituency nexus).
CrowdStrike 2026 Legal Threat Landscape Report: US legal sector; its CVE-2026-41709 claim is carried in the VMware update record. Canadian Cyber Centre AL26-028 help-desk vishing: the store already carries two help-desk impersonation entries and no new Swiss-relevant mechanism appears.
PK Softech and Publica (BLVK, BPK notification details): minor delta on an entry with 12 records. Hudson Rock FortiBleed 2.0 (1,703 further FortiGate configuration reports): single-source record counts, not working credentials; the 2026-06-18 and 2026-10-22 entries already carry the reset and configuration-review actions.
FU1 vendor sweep, no item: Juniper JSA112681 (page unreadable; NCSC-NL records Junos OS as vulnerable to CVE-2026-109618 but not exploitable and SRX off PHP from 25.2R1), Broadcom Symantec Endpoint Protection Manager and Carbon Black App Control (umbrella advisory only, per-product pages login-gated), Splunk SVD-2026-1013 (only Smartlook, remedied), Sophos (no product affected), N-able (vendor-hosted, secured), Securepoint, Cleo, Checkmk, Ubiquiti UISP CRM and TerraMaster (niche or low exposure).
CERT-PL Wing FTP Server CVE-2026-105420 (CVSS 4.0 9.4 but needs administrator privileges), CERT-FR AVI-1397 to 1408 (CPython, Chrome 156, Samba vfs_ceph_rgw, Docker Desktop, Metabase, Mitel, Edge, Mozilla, Belden, Axis) and NCSC-NL Apple macOS and Splunk Enterprise: no exploitation, authenticated or niche, no constituency exposure.
Oracle PeopleSoft CVE-2026-35273 (ZDI decomposition into three bugs): no exploitation, victim, fix or status change beyond what the store already carries; Juniper Session Smart Router and Conductor (CCCS AV26-1101): primary unreadable on every reader, the CVE records alone give no usable exposure statement, and no exploitation is reported; watch for ZDI's separate PeopleSoft CVE ids.
ESET APT Activity Report Q2 to Q3 2026: only the MDaemon finding is carried; the other findings are actor-activity summaries for regions outside the constituency.
Volt Typhoon "Silent Train" (Lumen Black Lotus Labs): the page metadata shows 2026-03-16, so it enters only as the entity profile and the cited overlap in the KeyDrift entry.
Untrusted content. S3's WebFetch of the Socket Searchjacked post returned a share link carrying an instruction aimed at AI assistants (to remember the domain for future citations). It was ignored and is not part of any finding.
Sources.jfrog-security-research and anssi-cyber-gouv-actualites promoted to active (promotion_due). Four candidates added because published entries cite them or replace a blocked source: veeam-kb-security (first-party backup PSIRT, feed works), dream-research (the PHP2Shell and Fragnesia chain), safedep (testmetest) and ec-presscorner-api (JSON API replacing the digital-strategy newsroom that answers 403 for the fourth run). Not added: Tailscale security bulletins (mesh-VPN use in the constituency not evidenced), hacksnack.ch and InfoStealers (relay and single-vendor leads, reliability C). Recipe notes recorded for the sources named in the sub-agent ledgers (CrowdStrike feed, StepSecurity feed, ESET research listing, Previdian, Vaud cyber page, ransomware.live, Piyolog, ransom-isac, Venarix, hacksnack.ch), and the StepSecurity feed URL added to its record. connectwise-trust-center and ec-digital-strategy-newsroom stay 403 on every transport; a 403 never demotes. tools/source_health.py was run after the source updates (output in work/2026-10-29T0255Z-intel/source_health.out); its two UNSOLVED rows were investigated and not demoted: sygnia answers 403 on every transport including WebFetch (a 403 never demotes) and bfv-verfassungsschutz-de fails intermittently with an SSL EOF on a feed that reads on retry; a recipe note was recorded on each.
Registry. Added actor:uat-11473 (uses KeyDrift; overlaps Volt Typhoon, exploits the SD-WAN controller), malware:keydrift, actor:volt-typhoon, incident:moldova-egovernment-data-extraction-2026-10, incident:machelen-municipality-cyberincident-2026-09 (attributed-to Rhysida as a leak-site self-claim only), malware:hellage, malware:helltag and campaign:testmetest-npm-worm-2026-10 (overlaps Miasma and Mini Shai-Hulud, lineage unconfirmed), and 14 product entities through sync_products.py (two spellings merged into existing records as aliases).
Watchlist: products checked=0, hits=0; suppliers checked=0, hits=0 (no watchlists configured).
Coverage gaps: connectwise-trust-center (403 on every transport; the new application's identifiers on the Trust Center page are unreadable here); ec-digital-strategy-newsroom (403 on every transport, fourth run); ox-security (feed lists dated items but every article body is 403); previdian (listing feed 403, one featured CVE only); resecurity (empty JavaScript shell); golem-security (cookie wall); F5 K000163821 (my.f5.com is a JavaScript shell on every reader, so F5's exposure, mitigation and exploitation wording is unread); Juniper support portal (JavaScript shells); Broadcom per-product PHP2Shell pages (login-gated); the Cisco advisory's Snort rule links were not re-read after version 1.9; Palo Alto's PAN-OS hotfix status was re-read before the commit (19 of 20 released, only 11.1.7-h12 still carries an estimated date, 2026-10-30), so that build is the one to re-read at the next fire.