01Progress WS_FTP Server: unauthenticated CVSS 10.0 flaw can expose admin credentials; fixed in 2025.0.4 and 2024.0.7. Progress, as CVE numbering authority, published on 2026-10-29 CVE-2026-84295, an improper-authentication flaw in WS_FTP Server on Windows that could let an unauthenticated remote attacker reach administrative credentials (CVSS 3.1 10.0), together with an unauthenticated command injection under certain configurations (CVE-2026-90865, 9.0) and an access-control flaw in the Web Admin console (CVE-2026-90867, 8.1). Builds before 2024.0.7 and 2025.0.4 are affected, and CSIRT Italia counts 6 critical and 3 high flaws in the release and says Progress will issue no patch for unsupported versions. No source reports exploitation, and CISA's catalog holds no 2026 WS_FTP flaw, though a 2023 flaw in the same product is listed with known ransomware use. →
02Microsoft: Teams help-desk vishing into Quick Assist ended in AD CS certificates for privileged accounts and a DC. Microsoft Threat Intelligence describes two human-operated intrusions, not attributed to any actor, in which an external Teams contact impersonating help-desk staff got a user to open Quick Assist, after which the operator staged a portable runtime and used Active Directory Certificate Services to reach privileged identities: a template open to ESC1 issued certificates for privileged accounts and DCSync followed within seconds, and in the second case PetitPotam was relayed to AD CS Web Enrollment (ESC8) for a certificate for a domain controller account. An issued certificate stays valid after a password reset or a reimage of the first workstation, and in the first case one privileged account excluded from automated containment stayed usable and was used to copy data to an external SFTP destination. →
03Cursor marketplace served a trojanised Claude Code extension for 11 hours; uninstalling leaves the SSH backdoor. Between about 09:27 and 20:35 UTC on 2026-10-29 the Cursor VS Code Extension Marketplace served a modified copy of Anthropic's Claude Code extension, versions 2.1.312 and 2.1.313 for macOS and Windows, that appends an attacker's SSH key to authorized_keys, tries to enable SSH and open a reverse tunnel, and installs persistence that outlives the extension. Coding errors made the SSH step fail on most standard-user hosts, so Cursor and Sophos say the attacker could not log in there, but the key, the persistence and a host report were still written. Anthropic told Microsoft its systems were not compromised, and no source says how the attacker published under Anthropic's name. →
Microsoft Threat Intelligence describes two human-operated intrusions, not attributed to any threat actor, that began with an external Teams contact (across the broader activity Microsoft saw organisation-themed tenant names and support-style display names) who persuaded a user to open Quick Assist and read out the connection code; the activity did not exploit a Teams vulnerability. In the session the operator placed an archive in Downloads, extracted it into a newly created KB-prefixed folder under the user profile and started the payload with a portable Python, JavaScript or Java runtime, which ran host and network discovery and assessed AD CS (Microsoft Threat Intelligence, 2026-10-30).
In the first case a certificate template open to ESC1, where the requester supplies the identity, produced certificates for three privileged accounts, and about 90 minutes later for eight more after a second wave against 16 users; DCSync began within seconds of obtaining one privileged certificate. Defender's automated disruption blocked more than 1,000 SMB attempts, but a privileged account excluded from automated response stayed usable, reached a file server and ran a renamed Rclone that copied a share to an external SFTP destination (Microsoft Threat Intelligence, 2026-10-30). In the second case the operator used PetitPotam to make a domain controller authenticate to the attacker's host, relayed that NTLM authentication to an AD CS Web Enrollment endpoint, obtained a certificate from the Domain Controller template and used it for PKINIT to get a ticket-granting ticket for the controller's account; Defender raised ESC8 alerts and the customer isolated the workstation (Microsoft Threat Intelligence, 2026-10-30).
Triage: a help-desk Quick Assist session is routine; what separates this one is an external-tenant initiator with no matching ticket and an interpreter runtime launched from a newly created user-writable folder rather than a managed install path.
The activity described here is not attributed to a specific threat actor.
Resetting the user’s password or reimaging the first workstation does not revoke an issued certificate or invalidate Kerberos tickets that have already been issued.
One privileged account was excluded from automated response, so containment did not apply to that identity.
Between about 2:27am PT and 1:35pm PT on 2026-10-29 (09:27 to 20:35 UTC) a maliciously modified copy of Anthropic's Claude Code extension, versions 2.1.312 and 2.1.313 for macOS and Windows, was served from the Cursor VS Code Extension Marketplace; Cursor removed it, shut the marketplace down briefly, rotated its keys, rebuilt it and had the hosting provider take the attacker's server offline (Cursor, 2026-10-29). Anthropic told Microsoft its systems were not compromised and that it did not build the package, and Microsoft confirms the packages were never published to the Visual Studio Marketplace or npm (Microsoft Threat Intelligence, 2026-10-30). How the attacker published under Anthropic's name is not disclosed in any source read. Cursor estimates up to 5,000 affected users (Sophos X-Ops, 2026-10-30).
The injected loader runs when the extension module loads. It reports host and user data (hostname, username, operating system, home and working directories, the configured Git email, environment-variable names and public IP address), appends an attacker-controlled SSH public key to authorized_keys, tries to enable the local SSH service and open a reverse SSH tunnel, and installs persistence outside the extension: a LaunchAgent on macOS, and on Windows a scheduled task that asks to run as SYSTEM with a Startup-folder fallback, with background scripts retrying the tunnel about every 60 seconds (Cursor, 2026-10-29). Microsoft's analysis adds a user crontab entry for Linux (Microsoft Threat Intelligence, 2026-10-30). Because of coding errors the step that enables SSH fails unless Cursor was started with administrator privileges, so on most hosts the attacker could not log in through the tunnel, but the key, the persistence and the host report still happened (Cursor, 2026-10-29).
Triage: a running SSH process is not proof the attacker got in, since both ends must allow the connection (Microsoft Threat Intelligence, 2026-10-30); administrators run tunnels too, and what separates this one is an editor extension as the parent process and persistence written to user-writable locations rather than a managed service.
Between about 2:27am PT and 1:35pm PT today, a maliciously modified version of Anthropic’s Claude Code extension was made available in the Cursor VS Code Extension Marketplace.
Uninstalling the extension may not be sufficient, the payload drops standalone persistence scripts that keep running.
Cursor
Anthropic confirmed to Microsoft that their systems were not compromised and they did not develop the malicious package posted in Cursor marketplace.
A running SSH process does not necessarily mean the attacker gained access.
Progress, as CNA, published CVE-2026-84295 on 2026-10-29: improper authentication in WS_FTP Server on Windows that "could allow an unauthenticated remote attacker to access sensitive information, including administrative credentials"; its CVSS 3.1 vector is network, low complexity, no privileges and no user interaction, scored 10.0, and the record names no component or endpoint (ENISA EUVD, 2026-10-29). Two further flaws carry an unauthenticated vector with high attack complexity: CVE-2026-90865, an OS command injection that could allow command execution with elevated privileges under certain configurations (9.0) (ENISA EUVD, 2026-10-29), and CVE-2026-90867, improper access control in the Web Admin console that could expose administrative functionality to remote authentication attempts (8.1) (ENISA EUVD, 2026-10-29). CSIRT Italia counts 6 critical and 3 high flaws in the release, of types including authentication bypass, remote code execution and arbitrary file read and write (CSIRT Italia, 2026-10-30).
The record for CVE-2026-84295 names versions before 2024.0.6 and 2025.0.3 as affected (ENISA EUVD, 2026-10-29), and the records for the other two name versions before 2024.0.7 and 2025.0.4 (ENISA EUVD, 2026-10-29), so 2024.0.7 or 2025.0.4 is the build to reach. CSIRT Italia lists 2025.0.3 (10.0.3) and 2024.0.6 (9.0.6) and earlier as affected and says that for unsupported versions the vendor will not release a workaround or patch (translated from Italian) (CSIRT Italia, 2026-10-30). No source reports exploitation: CISA's catalog holds no 2026 WS_FTP flaw, although CVE-2023-40044 in the same product has been listed since 2023-10-05 with known ransomware use (CISA KEV catalog, 2026-10-30).
Improper authentication in Progress Software WS_FTP Server versions prior to 2024.0.6 and 2025.0.3 on Windows could allow an unauthenticated remote attacker to access sensitive information, including administrative credentials.
An OS command injection vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow arbitrary command execution with elevated privileges under certain configurations.
Improper access control in the Web Admin console of Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could expose administrative functionality to remote authentication attempts.
Broadcom's Enterprise Security Group advisory 39404, published on 2026-10-21 and last revised on 2026-10-30, lists four products as affected by the PHP flaws CVE-2026-109618 and CVE-2026-109619: Carbon Black App Control Server (moved to affected on 2026-10-22), Symantec Endpoint Protection Manager (SEPM, 2026-10-22), the CloudSOC SpanVA Appliance (2026-10-23) and Content Analysis and Malware Analysis (CASMA), which moved from under investigation to affected on 2026-10-30; the page states no versions, fixes or workarounds, and lists Content Analysis (CAS), the Symantec Endpoint Protection agent, Symantec Endpoint Security, Data Loss Prevention, Cloud Secure Web Gateway and Zero Trust Network Access among the products that are not vulnerable (Broadcom, 2026-10-30). CISA added both PHP flaws to its Known Exploited Vulnerabilities catalog on 2026-10-26 (CISA KEV catalog, 2026-10-26); Broadcom's advisory says nothing about attacks on these products.
Broadcom's article 459982 says the App Control Server is affected in all supported versions and that builds 8.12.2 and 8.13.2 are available and contain only PHP-related changes: an installation on 8.12 or earlier may take either, one already on 8.13 must take 8.13.2 (Broadcom, 2026-10-22). For SEPM, NCSC-NL's tracker lists builds 14.3.27716.10000 and 14.4.494.0000 as the fixes, on the strength of a community report that cites Broadcom's SEPM advisory, which needs a login and which the maintainer did not verify (NCSC-NL, 2026-10-30). No fix is stated for the CloudSOC SpanVA Appliance or CASMA.
Broadcom's Enterprise Security Group is investigating CVE-2026-109618 and CVE-2026-109619
2026-10-30 12:00 PT - Content Analysis and Malware Analysis moved to Affected
The Linux kernel CVE team published CVE-2026-98432 on 2026-10-15: a use-after-free in the IPv4 TCP connection setup path, introduced in Linux 4.4 and fixed upstream in 6.12.113, 6.18.56, 7.2.10 and 7.3-rc7 (Linux kernel CVE team, 2026-10-15). An unauthenticated peer starts it by sending TCP SYN packets that carry IPv4 options, and a retransmitted SYN or the ACK of the syncookie path can then touch the freed option memory (CIQ, 2026-10-30). Anthropic wrote on 2026-10-27 that Claude produced an exploit that lets a remote attacker send packets to a Linux server with a multipath TCP (MPTCP) listener and run arbitrary commands as root without credentials (Anthropic, 2026-10-27). The Go team says the bug is not specific to MPTCP, that systems with no MPTCP listener may be open to similar attacks, and that since Go 1.24 Go programs enable MPTCP on Linux listen sockets by default (Go team, 2026-10-29). NCSC-NL judges large-scale abuse unlikely given the exploit's complexity and the mitigations distributions carry (translated from Dutch) (NCSC-NL, 2026-10-30), and BleepingComputer found no confirmed report of exploitation in the wild (BleepingComputer, 2026-10-30).
Severity is disputed: the CNA scores it 9.8, upstream 8.1 with high attack complexity (CIQ, 2026-10-30), and Red Hat rates it Critical for RHEL because it lets an unauthenticated remote attacker cause kernel memory corruption or an immediate crash over ordinary IPv4 TCP traffic, while saying reliable code execution needs precise heap control (Red Hat, 2026-10-31). Patch state as read on 2026-10-30 and 2026-10-31: Debian's security kernels 6.1.190-1 (bookworm) and 6.12.113-1 (trixie) are fixed (Debian Security Tracker, 2026-10-31); Ubuntu 22.04, 24.04, 26.04 and 26.10 are marked vulnerable with work in progress and 20.04, 18.04 and 16.04 vulnerable (Canonical, 2026-10-30); Red Hat lists RHEL 8, 9 and 10 as affected and RHEL 7 as not affected (BleepingComputer, 2026-10-30); BleepingComputer reports fixes for some kernel versions from Oracle Linux, Amazon Linux and SUSE (BleepingComputer, 2026-10-30); and CIQ had published no patched kernel for its RLC Pro LTS 9.6, RLC Pro LTS 8.10 or RLC Pro 10 variants and refers Rocky Linux community releases to Rocky errata (CIQ, 2026-10-30).
allows a remote attacker to send packets to Linux servers with a multipath TCP listener to run arbitrary commands as root, without any credentials or user interaction
Drupal's advisory SA-CONTRIB-2026-254 of 2026-10-28 says Commerce Core "doesn't sufficiently protect certain routes and entity fields, leading to an access bypass that may financially impact the vendor" and that the flaw is being actively exploited in the wild (Drupal Security Team, 2026-10-28); The Hacker News carries the same wording (The Hacker News, 2026-10-30). The Drupal security team scores it 21 of 25, which SecurityWeek reads as exploitable without authentication whatever the module's configuration, and Drupal's statistics put the module on more than 42,000 sites (SecurityWeek, 2026-10-30). The affected releases are Commerce Core 3.0.0 up to but not including 3.3.13 and earlier releases before 8.x-2.41 (SecurityWeek, 2026-10-30). Drupal has not said how the bug is exploited, by whom, how many sites were targeted or whether it was exploited before the fix (SecurityWeek, 2026-10-30); NCSC Switzerland's advisory of 2026-10-30 describes the impact as unauthenticated manipulation of order-related data with financial loss for the shop operator (NCSC Switzerland, 2026-10-30).
This vulnerability is being actively exploited in the wild.
Sites should audit their orders for inconsistencies as this vulnerability is being actively exploited
SecurityWeek (quoting the Drupal advisory)
Successful exploitation allows unauthenticated attackers to bypass access controls and manipulate order-related data, potentially causing financial losses for online store vendors via network access.
Cisco's PHP2Shell advisory, revised to version 1.10 on 2026-10-30, now lists 26.2.1.9 (Nov 2026) as the fixed release for Ultra-Reliable Wireless Backhaul and Unified Industrial Wireless Software, replacing 27.1.1, and shows ISE Portal Builder as fix deployed with no customer action required.
Cisco revised the advisory to version 1.10 on 2026-10-30, updating the fix status for ISE Portal Builder and the fixed release for Ultra-Reliable Wireless Backhaul and Unified Industrial Wireless Software (Cisco PSIRT, 2026-10-30). The table now lists release 26.2.1.9 (Nov 2026) for that wireless software instead of 27.1.1, and shows ISE Portal Builder as "Fix deployed, no customer action required" instead of offline for remediation; Cisco also added Webex Events to the products it confirms are not vulnerable (Cisco PSIRT, 2026-10-30). Expressway 15.5.21 and Duo Access Gateway 3.2.0 are unchanged.
Trend Micro's PHP2Shell advisory, updated 2026-10-30, now lists critical patches for Deep Discovery Inspector and Email Inspector and adds Mobile Security for Enterprise as impacted with a patch due on 2026-11-17; the Apex Central and Apex One server patches stay due on 2026-11-11. Quest published KACE SDA hotfix 9.3.313 and NetApp added ONTAP 9.19.1P4 to its fixed builds, both on 2026-10-29.
Trend Micro's customer advisory KA-0024802 now reads last updated 2026-10-30, with its status table as of Oct. 30 (Trend Micro, 2026-10-30). The table now lists critical patches for Deep Discovery Inspector, one per listed line from CP 1077 on 7.0 to CP 1200 on 6.5, and for Deep Discovery Email Inspector 5.1 (CP 4902), which Trend Micro had listed as due on 2026-10-30 (Trend Micro, 2026-10-30). Trend Micro Mobile Security for Enterprise is newly listed as impacted, with a critical patch due on 2026-11-17 and mitigation through Trend Micro support (Trend Micro, 2026-10-30). Apex Central and the Apex One on-premises server stay due on 2026-11-11, Deep Discovery Analyzer on 2026-11-12 and the Trend Micro Web Security cloud service on 2026-11-06, and Trend Micro still says it has seen no exploitation in its products (Trend Micro, 2026-10-30). Quest's knowledge-base article now also lists KACE SDA hotfix 9.3.313, published on 2026-10-29, which covers systems on hotfix versions 9.3.305-9.3.111 and on GA version 9.3.304 (Quest Software, 2026-10-29), and NetApp's advisory data adds ONTAP 9.19.1P4 to the fixed builds in revision 10.0 of 2026-10-29 (NetApp, 2026-10-29).
QNAP's advisory QSA-26-18 now lists Notes Station 3 as resolved by 3.9.15 (revision V1.2, 2026-10-28), while QNE (ADRA), moved to its own advisory QSA-26-19, still has no fixed version.
QNAP revised advisory QSA-26-18 to V1.2 on 2026-10-28 ("Notes Station 3 Resolved Published"), and its table now lists Notes Station 3 3.9.14 and earlier as resolved by Notes Station 3 3.9.15 (QNAP, 2026-10-28). QNE (ADRA) 1.0.7 and earlier is no longer in that table: it has its own advisory, QSA-26-19, released on 2026-10-22, whose status is Fixing and whose fixed version is still to be announced (QNAP, 2026-10-22). Both advisories still say QNAP has received no reports of exploitation targeting QNAP products, and QSA-26-19 repeats that until fixed versions are available the most effective protection is to keep the device off the internet (QNAP, 2026-10-22).
Rapid7 published a root-cause analysis of CVE-2026-102764 on 2026-10-30 and says a Metasploit module now implements the unauthenticated file-write to code-execution chain; its successful request is an extensionless URL that rules matching only .php requests miss.
Rapid7 published a root-cause analysis on 2026-10-30 and says a Metasploit module now implements the chain, with PHP and Unix Command targets (Rapid7, 2026-10-30). An anonymous customer session, started through the public customer connection, sends a message whose source address carries a reserved local router ID; the appliance's customer worker accepts that address as proof that the request came from a local component, which exposes an internal file-transfer service with its native filesystem provider. Rapid7 used it to write a PHP file into the site's public directory and ran it as the site's operating-system user (Rapid7, 2026-10-30). The successful request was an extensionless URL, because the web server answers a direct .php request with 404 and maps an extensionless URL to the existing file, so detection that only searches for requests ending in .php would miss it; the appliance's thin-scc logs record file-transfer stream creation and rejected requests (Rapid7, 2026-10-30). Rapid7 tested Remote Support 24.1.2 and says other affected releases and fixed builds have not been established; BeyondTrust's advisory remains the reference for affected and fixed versions (BeyondTrust, 2026-10-15).
Ivanti patched the root-escalation step of the exploited Connect Secure chain, CVE-2026-111357, on 2026-10-29, and CISA listed it and a third chain flaw, CVE-2026-118527, on 2026-10-30. The Canadian Cyber Centre and CISA now list builds 25.1.1.2 and 22.8R2.5 as affected, so the builds of 2026-10-13 are no longer the target.
Volexity's report now carries an update banner saying Ivanti published a patch on 2026-10-29 for the privilege-escalation step, which is tracked as CVE-2026-111357 (Volexity, 2026-10-13). CISA added CVE-2026-111357 and a third chain flaw, CVE-2026-118527, to its Known Exploited Vulnerabilities catalog on 2026-10-30 (CISA, 2026-10-30). The catalog describes CVE-2026-118527 as a generation-of-predictable-numbers-or-identifiers flaw that lets a remote authenticated attacker upload files with attacker-controlled content to a known location on disk, and says it can be chained with CVE-2026-104935 and CVE-2026-111357 (CISA KEV catalog, 2026-10-30). The Canadian Cyber Centre's bulletin on Ivanti's advisory, updated 2026-10-30, now lists the Connect Secure versions before 25.1.1.3, 25.1.3.1 and 22.8R2.6 as affected (Canadian Centre for Cyber Security, 2026-10-13), a range that takes in 25.1.1.2 and 22.8R2.5, the builds of 2026-10-13; CISA's alert, updated the same day, lists versions 25.1.1.2 and prior, 25.1.2.2 and prior and 22.8R2.5 and prior as affected by the three chain CVEs (CISA, 2026-10-13). Ivanti's advisory page could not be read, so which build carries which CVE's fix is not confirmed, and CVE-2026-118527 has no public CVE record, affected range or fixed build yet.
Apply the BT26-05-RS patch to every self-hosted BeyondTrust Remote Support appliance now and confirm in the /appliance interface that it is installed (a build older than 24.3.1 must be upgraded first, which closes the hole but does not undo earlier exposure); apply it to self-hosted Privileged Remote Access appliances too, since BeyondTrust built and tested the patch for both products although its advisory names only Remote Support as impacted.
For every appliance that was internet-reachable on a build up to 26.2.3 at any time since late August 2026: before any change, snapshot a virtual appliance with memory and export its disk, and collect the off-box syslog, reverse-proxy or WAF and perimeter firewall logs because the actor deletes on-appliance logs; then redeploy from a clean, fully patched image every appliance whose compromise status is confirmed or unknown, and rotate the credentials it held in dependency order, including the Remote Support Vault and any credential typed into a support session.
Upgrade every Ivanti Connect Secure appliance to 25.1.1.3, 25.1.3.1 or 22.8R2.6 now, internet-facing appliances first: the Canadian Cyber Centre lists every earlier build as affected, so appliances that took only the 2026-10-13 builds 25.1.1.2 or 22.8R2.5 are still short of the root-step patch; 22.7.x and below are not affected.
Run a compromise check on every appliance that was reachable on an affected build, starting with proxy, load balancer or WAF logs back to at least 2026-10-03 for welcome.cgi requests that carry an X-DSCGI-PATH header; where compromise cannot be excluded, first cut the appliance off from the internet and the internal network and snapshot a virtual appliance's file system and memory without powering it down, then follow Ivanti's recovery steps and reset the domain service account, LAPS and local passwords, certificates, API keys, the Kerberos tickets of its service accounts and the licence-server authentication the appliance held, because CERT-FR knows of lateral movement using the LDAP and Active Directory secrets.
Upgrade every WS_FTP Server on Windows to 2024.0.7 or 2025.0.4 now, partner-facing and internet-reachable instances first, and rotate its administrator credentials afterwards, because CVE-2026-84295 can expose them to an unauthenticated attacker and the upgrade does not change what was already read; an instance on an unsupported branch gets no patch from Progress, so take it off the network or migrate it.
In every forest with an enterprise CA, list the AD CS Web Enrollment and Certificate Enrollment Web Service endpoints that lack HTTPS and Extended Protection for Authentication and the certificate templates that accept requester-supplied identity with broad enrollment rights, because both intrusions turned a Quick Assist session into a certificate for a privileged identity.
On every developer endpoint that runs Cursor, check extension-install telemetry for Anthropic.claude-code 2.1.312 or 2.1.313 installed between 09:27 and 20:35 UTC on 2026-10-29; where it is found, isolate the host, remove the unauthorized SSH key, the persistence and any running tunnel process, because uninstalling the extension removes none of them, and rotate every credential reachable from the host from a trusted system.
Install Carbon Black App Control Server 8.12.2 or 8.13.2 (8.13.2 where the server already runs 8.13), confirm the SEPM fix build against Broadcom's login-gated advisory 39421 before treating 14.3.27716.10000 or 14.4.494.0000 as the target, and until each server is fixed limit the management console of every SEPM, App Control Server, CloudSOC SpanVA appliance and CASMA to administrator networks.
On every internet-facing Linux server, install the distribution kernel that fixes CVE-2026-98432 and reboot as soon as it ships (Debian bookworm 6.1.190-1 and trixie 6.12.113-1 are out; Ubuntu and RHEL kernels were not as of 2026-10-30), and until then drop IPv4 TCP packets that carry IP options ahead of the TCP stack as CIQ describes, after testing on one non-production host because it also drops legitimate option-bearing traffic; disabling MPTCP alone does not close the path.
Update Commerce Core on every Drupal site to 3.3.13 (3.x) or 8.x-2.41 (earlier releases) now, then audit orders back as far as your logs reach for inconsistencies, because Drupal says the flaw is exploited, names no other mitigation and does not say when exploitation began.
Restrict the Trend Micro Apex Central and Apex One server consoles and web endpoints to administrator networks now, apply Trend Micro's interim mitigation, and install the critical patches when they ship, due on 2026-11-11, and the Mobile Security for Enterprise patch due on 2026-11-17 (until then take its mitigation from Trend Micro support); install the critical patches the table now lists for Deep Discovery Inspector and Email Inspector.
Install KACE SMA 15.0 CU5 or 15.1 CU2 and the SDA 9.3 hotfix 9.3.313 (9.3.312 where already installed), and until then block inbound ports 80, 443 and 52230 to every appliance, as Quest advises.
Update every QNAP NAS on QTS, QuTS hero or QuTScloud to the builds of 2026-10-23 (QTS 6.1.0.3656 or 5.2.11.3661, QuTS hero h6.1.0.3656, h6.0.2.3656 (h5.3.x included) or h5.2.11.3661, QuTScloud c5.2.9.3661), every QVR Surveillance (ARM32 models) to 3.0.3.1756, every TVR OS to 1.0.5 and every Notes Station 3 to 3.9.15, and take any QNAP device running QNE (ADRA) off the internet until QNAP lists a fix.
2026-10-31T0256Z-intel· Sonnet 5.5 · window 26 h · 6 entries published
Verification & coverage notes
A moderate window: six new entries and five changelog records. No deep dive and no critical entry: nothing new met the stop-and-act bar, and the one existing critical entry that moved (BeyondTrust CVE-2026-102764, where Rapid7 reports a Metasploit module on 2026-10-30) stays critical.
KEV sweep (work/2026-10-31T0256Z-intel/kev-window.txt): both additions of 2026-10-30 are Ivanti Connect Secure. CVE-2026-118527 (NOT COVERED) and CVE-2026-111357 (COVERED, but not yet cisa-kev or patch-available) are one update record on the covered chain entry, which also moves the fixed-build targets to 25.1.1.3, 25.1.3.1 and 22.8R2.6 on the Canadian Cyber Centre's affected-version lists. No COVERED-STALE and no RANSOMWARE row.
Backlog: the ARX Group SA row (Aurora leak-site claim) stays held. S2 and S4 re-searched in DE, FR, IT and EN and read the Swiss press feeds: ransomware.live still has no press field, and no statement from ARX, SBB, ASTRA/USTRA, BACS or Swiss press exists. Expiry 2026-11-07, struck then if unconfirmed.
Window: the previous intel run started 24 h earlier, so gap 24.0 h and window 26 h. The two earlier fires' attempts excluded 92 standard records from the slices; the breaches pool was small enough that S4 took its seven oldest-cursor records without the exclusion (bitdefender-threat-debrief, piyolog, ransom-isac, venarix, bleepingcomputer, cnil-fr, cyberinsider), so some were swept again.
Completeness follow-up: S1 dropped Progress WS_FTP Server and Veeam Management Pack on the strength of BSI's 'high' rating while CSIRT Italia counted 6 critical flaws including an authentication bypass, so one scoped follow-up (FU1, one continuation) read the vendor CNA records. WS_FTP clears PD-11(b) on its own mechanics: an unauthenticated network path to administrative credentials (CVSS 10.0) on a file-transfer server used with external partners, in a product whose 2023 flaw is in KEV with known ransomware use; no exploitation found, so it ships as notable with its fixed builds (2024.0.7, 2025.0.4). Progress's own bulletin is a script-rendered page no transport could read, so the entry's sourcing note says so.
borderline-drop: Veeam Management Pack for Microsoft System Center 9.x (KB 4961 of 2026-10-29), one unauthenticated RCE (CVE-2023-22793, CVSS 4.0 9.3, on servers running the Virtualization Extensions service) and two authenticated flaws; no exploitation, an internal management-plane add-in for System Center Operations Manager, and the fix is a move to 13.1.0.334 because 9.x gets no patch. Reopen on an exploitation report.
Source repairs from the health sweep: ec-digital-strategy-newsroom now reads through its RSS feed (general-news scope), sygnia joined the handled transport-blocked set, bfv-verfassungsschutz-de is checked through its feed recipe, and socprime is demoted on the content axis (its 20 newest feed items are product how-tos); ncsc-nl-php2shell-tracker and wordpress-org-news were promoted by the digest's promotion list; one new candidate, phorion.
Mid-run stop-hook nudges to commit were noted and ignored: the run commits atomically in Phase 6.
Spawn message error: the FU1 follow-up was told the time was about 04:40Z when it was about 03:55Z; its in-window anchor (2026-10-30T00:56Z) was stated explicitly and unaffected.
Single-source: Teams-to-AD CS (Microsoft Threat Intelligence is first-hand on both intrusions), Broadcom endpoint-security servers (Broadcom is the disclosing party; the SEPM fix builds rest on NCSC-NL's tracker and are marked unverified), and the Cisco, Trend Micro and QNAP revisions (vendor advisories for their own products). Each carries the matching sourcing_note.
Reduced confidence: Linux kernel CVE-2026-98432 carries confidence: medium because severity ratings disagree (9.8, 8.1, Critical for RHEL, 5.9 as BleepingComputer reported) and the exploit claim is Anthropic's alone; Broadcom SEPM fix builds as above. The drupal.org advisory answers a client challenge to extract, so its wording was read with WebFetch and the two quotes cited from it are not machine-checkable.
Dates: the Phorion post is dated 2026-10-30 with a 2026-10-31 update widening the version guidance from 2.1.313 to 2.1.312 and 2.1.313; Cursor's notice, Microsoft's analysis and Sophos agree. Broadcom's knowledge article 459982 shows a placeholder date (2026-01-01) in the extracted text; its structured data gives the publication date 2026-10-22, which the entry cites.
Contradiction: the Cursor extension entry. NCSC Switzerland's post 13121 places the backdoored extension on Open VSX and says Anthropic pulled npm and VS Code versions of 2.1.313; Microsoft says the packages were never published to the Visual Studio Marketplace or npm, and Cursor and Phorion name the Cursor marketplace only. The entry follows Microsoft, Cursor and Phorion and states the difference in its Exposure paragraph and sourcing note.
Contradiction held, not resolved: the Berlin Landesnetz entry records BSI's own confirmation that TerminalFix was the vector, while rbb24 writes that BSI did not confirm that pattern to it; no record was written (see the borderline-drop for that item).
borderline-drop: Pentagon commissary freezer failures (update-of the Danfoss refrigeration entry); attribution rests on two anonymous-source reports (Reuters via four officials, Nextgov via two people), no vector is stated, the lesson of the entry is unchanged, and the entry's analysis (1,291 words) is already far past the length bound, so a rewrite would be needed to carry it.
borderline-drop: Request Tracker 6.0.4 and 5.0.11, RTIR (30 CVEs), stored XSS from unauthenticated email and an authenticated code-execution bypass, no exploitation, and no source shows Swiss public-sector use; patch-cycle.
borderline-drop: Dell PowerProtect Data Domain DSA-2026-416, first published 2026-10-01 and last revised 2026-10-19, only NCSC-NL's relay of 2026-10-30 falls in the window; internal-facing backup appliance, no exploitation reported.
borderline-drop: Siemens SSA-166980 revision 1.2; the revision predates the window and the energy products named have mostly no fix by design of the wave; the PHP2Shell OT entry already carries Siemens.
borderline-drop: GitLab 19.5.3 and the other 2026-10-29 patch releases removing the eight eMudhra intermediates (CVE-2026-111943), patch-cycle, no exploitation; the eMudhra entry's action already covers updating CA bundles and Go.
borderline-drop: Linux kernel PwnEscape CVE-2026-99999 (S1 bundled it with CVE-2026-98432), guest-to-host flaw, fixed since 2026-10-15, local vector; the expectation of exploits within weeks is the discoverer's, not an observation. It would be a separate entry if exploitation or a hypervisor exposure statement appears.
borderline-drop: Android 'SMS of Death' CVE-2026-58882, zero-click DoS on telephony, public PoC, fixed in the October bulletin; patch-cycle, status rests on heise alone.
borderline-drop: ReliaQuest victim-matched residential proxies in vishing-led SaaS intrusions, single vendor, the vishing pattern is covered by the Talos IR, Huntress and new Microsoft entries.
borderline-drop: TeamViewer TV-2026-1011 (CVE-2026-111585, viewer-side code execution), no exploitation, bulletin of 2026-10-28 outside the window; patch-cycle.
borderline-drop: CrowdStrike 2026 Legal Threat Landscape Report (annual-report candidate), legal sector outside the constituency, report gated; the transferable content (IT-impersonation vishing into remote tools) is covered.
borderline-drop: Binance (about USD 6.36 billion, largest crypto theft on record; S3 and S4 returned it), clears breach limb (a) on scale only; no Swiss public-sector nexus, the stated vector (a compromised DevOps engineer's laptop) is covered ground, so an entry would be awareness only. Reopen if a post-mortem names a transferable technique.
borderline-drop: Berlin Landesnetz detection gap (rbb24, attack-detection licences covering 5 percent of devices); the rbb24 primary is 10 days old and only a blog relay is in the window; an organisational lesson that changes no detection decision.
borderline-drop: RMS Cloud and feratel Deskline booking-platform breaches, no Swiss customer named at either vendor; same WhatsApp booking-fraud pattern as the covered Camping.Care entry.
borderline-drop: SIHF and Swiss Basketball member-portal incidents, private associations; the 2026-10-30 fire dropped SIHF for the same reason, and the basketball claim rests on FrenchBreaches alone.
borderline-drop: Fehmarnbelt contractor FLC, Leipzig University and Charité, Ruag MRO law-firm investigation, FortiBleed 2.0 (Hudson Rock), no Swiss entity or no vector or actor (incident floor), the Ruag item is insider fraud without an intrusion, and the FortiBleed data is dated February with no new vector.
borderline-drop: S2's policy and enforcement candidates (Federal Council e-evidence transitional rule, DVS Microsoft 365 exit study, BACS WhatsApp fake-vote update, Qilin arrest, INTERPOL Serengeti III); no change to what the constituency's defenders are obliged or advised to do, or outside the window. Canton Bern's ICSG enters into force 2026-11-01 and is already in the store.
S3 left three out-of-window leads for the audit to weigh, none fetched as a primary: Microsoft Authenticator CVE-2026-80097 (2026-10-28), EDK II PXE flaw CVE-2026-97631 (seen only in a search summary), and the 2026-10-29 research posts from Talos (NIK C2), Securelist (NetamLoader) and Group-IB (MadApe).
Coverage gaps: ivanti advisory hub (login shell on every transport; per-CVE fixed builds unconfirmed); connectwise-trust-center (403, WebSearch only); ox-security (article bodies 403); resecurity, onapsis, openjdk-vulnerability-advisories, zimbra-security-advisories (listings unreadable or empty); broadcom advisories 39411 and 39421 (login-gated). Recipe findings are recorded in the sources_changed notes: schneier, blick-ch, qnap, synology, siemens, the NCSC-NL tracker change log.
Verification: iteration 3 returned NEEDS_FIXES with 2 truth and 0 editorial findings (none F1 or F4) on full coverage (238 of 238 claims); all five of its findings were fixed in the entries and the run published on the low-residual early exit without a fourth pass, so the two truth fixes are unconfirmed by a later cold read (residual count 2).