{
  "_comment": "What to do now: one item per entry that carries a do-now task (non-empty actions[] or an immediate_action), any priority, whose last_changed_at falls in the last 14 days. Sorted by priority (critical, high, notable, routine), then most recently changed first. last_changed_at = max(discovered_at, every non-internal updates[].at); `change` names what moved it (new | update | correction | improvement). Poll and act on a new `id` or a changed `last_changed_at`. Schema: {id, permalink, markdown_url, priority, kind, headline, summary, last_changed_at, change, immediate_action:{title,action}|null, actions[], exploited, kev, cves[{id,cvss|null,status[],affected|null,fixed|null}], affected_products[], product_keys[], techniques[], classification|null, verification}. product_keys[] are the registry product entities the affected_products[] strings resolve to (page: entities/<key>/). URLs are absolute; markdown_url is the entry's raw Markdown source. See docs/pipeline.md.",
  "generated_at": "2026-11-07T07:39:44Z",
  "items": [
    {
      "actions": [
        "Upgrade every Cisco Secure Email Gateway appliance (physical and virtual) to AsyncOS 15.5.5-014 as re-released on 2026-10-31 (on an appliance that took the earlier build, confirm with retroscannerstatus that Retro Remediation Engine runs 4.0.2 or later), 16.0.4-302, or 16.5.0-780 (Cisco's recommended target) now; 16.0.4-302 closes CVE-2026-76461 only, because the hardening advisory names no fixed 16.0 release, so move a 16.0 appliance to 16.5.0-780 to close the five hardening-release CVEs (CVE-2026-76440, CVE-2026-76441, CVE-2026-20353, CVE-2026-76443, CVE-2026-76442) as well, one of which, CVE-2026-76443, has a public Metasploit module according to its author.",
        "Grep every appliance's mail_logs (and, if clustered, every cluster member's logs) for the pattern \"COPY.*TO PROGRAM\" and cross-check firewall/network logs external to the appliance for unexpected outbound connections; a successful exploit grants root, so an attacker may have removed local log evidence of their own access; a clean result does not rule out the S/MIME injection, which did not leave that pattern in the module author's reproduction.",
        "Secure Email Cloud customers should confirm directly with Cisco whether their instance is among those where indicators of compromise were identified; Cisco states it has already proactively contacted affected Cloud customers and upgraded all Cloud instances."
      ],
      "affected_products": [
        "Cisco Secure Email Gateway",
        "Cisco Secure Email and Web Manager"
      ],
      "change": "update",
      "classification": "A1",
      "cves": [
        {
          "affected": "AsyncOS for Cisco Secure Email Gateway 15.5 and earlier, 16.0, and 16.5, physical and virtual appliances, regardless of configuration per Cisco; the public module for it needs URL Filtering and URL Retrospective Service enabled",
          "cvss": "9.8",
          "fixed": "15.5.5-014 as re-released on 2026-10-31 (15.5 and earlier; an appliance that took the earlier build confirms with retroscannerstatus that Retro Remediation Engine runs 4.0.2 or later) / 16.0.4-302 (16.0) / 16.5.0-780 (16.5, Cisco's recommended target); no workaround exists short of upgrading",
          "id": "CVE-2026-76461",
          "status": [
            "exploited",
            "cisa-kev",
            "poc-public",
            "patch-available"
          ]
        },
        {
          "affected": "Cisco Secure Email Gateway and Secure Email and Web Manager, all configurations, from the September 2026 internal hardening review; Cisco says one vulnerability in this path-traversal class, the arbitrary file write CVE-2026-76519, is known to be actively exploited",
          "cvss": "9.8",
          "fixed": "Gateway: 15.5.5-014 / migrate off 16.0 / 16.5.0-780. Web Manager: 15.5.5-006 / migrate off 16.0 / 16.5.0-429",
          "id": "CVE-2026-76440",
          "status": [
            "patch-available"
          ]
        },
        {
          "affected": "Cisco Secure Email Gateway and Secure Email and Web Manager, all configurations; grouped under CWE-284 (Cisco's own grouping covers authorization, authentication, privileges, and bypasses, without specifying which applies to this CVE ID) from the September 2026 internal hardening review (not reported exploited)",
          "cvss": "9.8",
          "fixed": "Gateway: 15.5.5-014 / migrate off 16.0 / 16.5.0-780. Web Manager: 15.5.5-006 / migrate off 16.0 / 16.5.0-429",
          "id": "CVE-2026-76441",
          "status": [
            "patch-available"
          ]
        },
        {
          "affected": "Cisco Secure Email Gateway and Secure Email and Web Manager, all configurations; grouped under CWE-664 (Cisco's own grouping covers uncontrolled resource consumption, algorithmic complexity, recursion/iteration, deserialization, and improper resource initialization, without specifying which applies to this CVE ID) from the September 2026 internal hardening review (not reported exploited)",
          "cvss": "9.8",
          "fixed": "Gateway: 15.5.5-014 / migrate off 16.0 / 16.5.0-780. Web Manager: 15.5.5-006 / migrate off 16.0 / 16.5.0-429",
          "id": "CVE-2026-20353",
          "status": [
            "patch-available"
          ]
        },
        {
          "affected": "Cisco Secure Email Gateway and Secure Email and Web Manager, all configurations; a separate finding from the same September 2026 internal hardening review, grouped under CWE-707, which Cisco's own table describes as covering command, SQL, and code/eval injection, and cross-site scripting collectively, without stating which applies to this CVE ID specifically; listed separately from CVE-2026-76461 (Cisco says one vulnerability in this injection class, the SQL injection CVE-2026-76461, is known to be actively exploited); Rapid7's public Metasploit module, which its author believes maps to this CVE, needs S/MIME public-key harvesting enabled on the inbound mail flow policy",
          "cvss": "9.8",
          "fixed": "Gateway: 15.5.5-014 / migrate off 16.0 / 16.5.0-780. Web Manager: 15.5.5-006 / migrate off 16.0 / 16.5.0-429",
          "id": "CVE-2026-76443",
          "status": [
            "patch-available",
            "poc-public"
          ]
        },
        {
          "affected": "Cisco Secure Email Gateway and Secure Email and Web Manager, all configurations, from the September 2026 internal hardening review (not reported exploited)",
          "cvss": "7.5",
          "fixed": "Gateway: 15.5.5-014 / migrate off 16.0 / 16.5.0-780. Web Manager: 15.5.5-006 / migrate off 16.0 / 16.5.0-429",
          "id": "CVE-2026-76442",
          "status": [
            "patch-available"
          ]
        }
      ],
      "exploited": true,
      "headline": "Cisco's mail gateway can be rooted by one crafted email; found in a TAC support case, exploitation confirmed",
      "id": "2026-09-15/cve-2026-76461-cisco-secure-email-gateway-sqli-root-rce",
      "immediate_action": {
        "action": "A remote, unauthenticated attacker gains root on the appliance by sending it one crafted email; there is no workaround and no mitigation short of upgrading. Cisco found this in a TAC support case, and CISA lists it as exploited. Upgrade every physical and virtual Secure Email Gateway appliance today and hunt mail_logs for the pattern Cisco names before assuming a device is clean; a clean result does not rule out the S/MIME injection.",
        "title": "Patch every Cisco Secure Email Gateway now: unauthenticated root RCE via a single email, already exploited"
      },
      "kev": true,
      "kind": "vulnerability",
      "last_changed_at": "2026-11-07T03:49:14Z",
      "markdown_url": "https://ctipilot.ch/entries/2026-09-15/cve-2026-76461-cisco-secure-email-gateway-sqli-root-rce/index.md",
      "permalink": "https://ctipilot.ch/entries/2026-09-15/cve-2026-76461-cisco-secure-email-gateway-sqli-root-rce/",
      "priority": "critical",
      "product_keys": [
        "product:cisco-secure-email-and-web-manager",
        "product:cisco-secure-email-gateway"
      ],
      "summary": "Cisco disclosed CVE-2026-76461 (CVSS 9.8) on 2026-09-14: an unauthenticated attacker who sends a single crafted email containing SQL statements to a Cisco Secure Email Gateway can execute arbitrary OS commands as root. Cisco confirms active exploitation and says the flaw was found during the resolution of a TAC support case; there is no workaround. CISA added it to its Known Exploited Vulnerabilities catalog the same day. Cisco simultaneously shipped a hardening release fixing five further internally-found vulnerabilities in the same product; Cisco's hardening advisory says two vulnerabilities from its internal review are known to be exploited, this one and the arbitrary file write CVE-2026-76519. On 2026-10-31 Cisco re-released the 15.5.5-014 fix in light of new information related to exploit code available online, so a 15.5 appliance patched earlier needs a check of its Retro Remediation Engine version. Public Metasploit modules now exist for the exploited injection (merged 2026-11-05, its author's medium-confidence match to CVE-2026-76461) and for a second S/MIME injection that its author believes is CVE-2026-76443, for which Cisco names no fixed 16.0 build.",
      "techniques": [
        "T1190"
      ],
      "verification": "multi-source"
    },
    {
      "actions": [
        "Upgrade every Ivanti Connect Secure appliance to 25.1.1.3, 25.1.3.1 or 22.8R2.6 now, internet-facing appliances first: the Canadian Cyber Centre lists every earlier build as affected, so appliances that took only the 2026-10-13 builds 25.1.1.2 or 22.8R2.5 are still short of the root-step patch; 22.7.x and below are not affected.",
        "Run a compromise check on every appliance that was reachable on an affected build, starting with proxy, load balancer or WAF logs back to at least 2026-10-03 for welcome.cgi requests that carry an X-DSCGI-PATH header; where compromise cannot be excluded, first cut the appliance off from the internet and the internal network and snapshot a virtual appliance's file system and memory without powering it down, then follow Ivanti's recovery steps and reset the domain service account, LAPS and local passwords, certificates, API keys, the Kerberos tickets of its service accounts and the licence-server authentication the appliance held, because CERT-FR knows of lateral movement using the LDAP and Active Directory secrets."
      ],
      "affected_products": [
        "Ivanti Connect Secure"
      ],
      "change": "improvement",
      "classification": "A1",
      "cves": [
        {
          "affected": "25.1.1.1 and prior, 25.1.2.2 and prior, 22.8R2.4 and prior (22.7.x and below not affected)",
          "cvss": "8.6",
          "fixed": "25.1.1.2, 25.1.3.0, 25.1.3.1 and 22.8R2.5; Ivanti's CVE record lists release 25.1.3.0 as unaffected, as Rapid7 does, and CERT-FR's current text lists 25.1.2.x before 25.1.3.1 as affected",
          "id": "CVE-2026-104935",
          "status": [
            "exploited",
            "cisa-kev",
            "patch-available"
          ]
        },
        {
          "affected": "22.8R2.4, the only build the CVE record names; the Canadian Cyber Centre lists versions before 25.1.1.3, 25.1.3.1 and 22.8R2.6 as affected",
          "cvss": "7.0 (CVSS 3.1, CVE record)",
          "fixed": "a patch was published on 2026-10-29 (Volexity); the CVE record names no fixed build, while the Canadian Cyber Centre and CERT-FR put the first builds outside the affected ranges at 25.1.1.3, 25.1.3.1 and 22.8R2.6",
          "id": "CVE-2026-111357",
          "status": [
            "exploited",
            "cisa-kev",
            "patch-available"
          ]
        },
        {
          "affected": "Connect Secure before 25.1.1.3 and before 22.8R2.6 (Ivanti CVE record); CERT-FR also lists 25.1.2.x before 25.1.3.1 and says 25.1.3.x is not affected",
          "cvss": "4.3 (CVSS 3.1, Ivanti as CNA)",
          "fixed": "25.1.1.3, 25.1.3.1 and 22.8R2.6",
          "id": "CVE-2026-118527",
          "status": [
            "exploited",
            "cisa-kev",
            "patch-available"
          ]
        }
      ],
      "exploited": true,
      "headline": "Ivanti Connect Secure chain: root step patched 29 Oct, CISA lists three flaws; 25.1.1.2 and 22.8R2.5 fall short",
      "id": "2026-10-14/cve-2026-104935-ivanti-connect-secure-zero-day-chain-kev",
      "immediate_action": {
        "action": "Ivanti and CISA confirm exploitation of CVE-2026-104935, and Volexity saw the chain used against a fully patched 22.8R2.4 appliance from 2026-10-03. Upgrade every Connect Secure appliance to 25.1.1.3, 25.1.3.1 or 22.8R2.6, internet-facing ones first: after Ivanti patched the root-escalation step on 2026-10-29 the Canadian Cyber Centre lists every earlier build as affected, 25.1.1.2 and 22.8R2.5 included. Ivanti's Integrity Checker Tool cannot see this chain, so an appliance that was reachable on an affected build needs a compromise check and rotation of the Active Directory service account, LAPS passwords and other secrets it could reach.",
        "title": "Patch Ivanti Connect Secure now, then check the appliance and its AD account for compromise"
      },
      "kev": true,
      "kind": "vulnerability",
      "last_changed_at": "2026-11-04T03:29:23Z",
      "markdown_url": "https://ctipilot.ch/entries/2026-10-14/cve-2026-104935-ivanti-connect-secure-zero-day-chain-kev/index.md",
      "permalink": "https://ctipilot.ch/entries/2026-10-14/cve-2026-104935-ivanti-connect-secure-zero-day-chain-kev/",
      "priority": "critical",
      "product_keys": [
        "product:ivanti-pulse-connect-secure"
      ],
      "summary": "Ivanti disclosed the exploited Connect Secure authentication bypass CVE-2026-104935 on 2026-10-13; Volexity saw it chained by UTA0576 with a root escalation, CVE-2026-111357, patching library code in memory only so Ivanti's Integrity Checker Tool sees no file change, and going after the appliance's Active Directory service account, LAPS passwords and BitLocker recovery keys. Ivanti patched the root step on 2026-10-29 and CISA listed it and a third chain flaw, CVE-2026-118527, on 2026-10-30; the Canadian Cyber Centre now lists every build before 25.1.1.3, 25.1.3.1 and 22.8R2.6 as affected, which takes in 25.1.1.2 and 22.8R2.5, the builds of 2026-10-13. A patched appliance that was exposed still needs a compromise check, and CERT-FR says it knows of lateral movement using the LDAP and Active Directory secrets stored on the appliance and tells owners to isolate and preserve it before any reset.",
      "techniques": [
        "T1040",
        "T1041",
        "T1059.006",
        "T1068",
        "T1071.001",
        "T1087.002",
        "T1110.003",
        "T1190",
        "T1685.006"
      ],
      "verification": "multi-source"
    },
    {
      "actions": [
        "Update the PHP runtime, not the CMS or its plugins, on every internet-facing server and container image to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 or to your distribution's patched package, restart PHP-FPM, Apache and every long-running worker, rebuild images, and confirm the running version, because a distribution backport can keep the old version string; isolate any application that cannot be updated from public networks until it is.",
        "After updating, set session.upload_progress.enabled=0 on every PHP host and keep it there until PHP's next regular bugfix release: CVE-2026-115560, which the October releases do not fix, needs session upload progress to be enabled.",
        "List every appliance and management server whose web interface embeds PHP (firewalls, network access control and security consoles), take each interface off the internet and install its vendor's PHP2Shell fix, because Dream Research reports Palo Alto Networks PAN-OS firewalls rooted through an exposed management interface."
      ],
      "affected_products": [
        "PHP",
        "Tenable Security Center",
        "Tenable Enclave Security",
        "Siemens RUGGEDCOM APE1808"
      ],
      "change": "update",
      "classification": "A1",
      "cves": [
        {
          "affected": "PHP 8.5 before 8.5.12, 8.4 before 8.4.27, 8.3 before 8.3.36 and 8.2 before 8.2.35; PHP 8.1 and older receive no upstream update (minimal source backports exist for 7.4, 8.0 and 8.1); Cloudflare says PHP 5.4 or later is affected",
          "cvss": "9.2 (CVSS 4.0)",
          "fixed": "8.5.12, 8.4.27, 8.3.36, 8.2.35",
          "id": "CVE-2026-109618",
          "status": [
            "exploited",
            "cisa-kev",
            "patch-available",
            "poc-public"
          ]
        },
        {
          "affected": "PHP 8.5 before 8.5.12, 8.4 before 8.4.27, 8.3 before 8.3.36 and 8.2 before 8.2.35; PHP 8.1 and older receive no upstream update (minimal source backports exist for 7.4, 8.0 and 8.1); Cloudflare says PHP 5.4 or later is affected",
          "cvss": "9.2 (CVSS 4.0)",
          "fixed": "8.5.12, 8.4.27, 8.3.36, 8.2.35",
          "id": "CVE-2026-109619",
          "status": [
            "exploited",
            "cisa-kev",
            "patch-available",
            "poc-public"
          ]
        }
      ],
      "exploited": true,
      "headline": "PHP2Shell: CISA lists both flaws as exploited after honeypot code execution; update the runtime, not the CMS",
      "id": "2026-10-21/php-critical-release-pre-announced-cve-2026-109618-109619",
      "immediate_action": {
        "action": "Two unauthenticated remote-code-execution flaws in PHP itself are on CISA's exploited list since 2026-10-26, honeypots recorded working code execution and Palo Alto reports attacks on internet-exposed PAN-OS management interfaces, fixed builds (8.5.12, 8.4.27, 8.3.36, 8.2.35) have been out since 2026-10-21, and public proofs of concept circulate. Update PHP, not the CMS, on every internet-facing server and container image, restart PHP-FPM, Apache and all long-running workers, and confirm the running version, because distribution packages can keep the old version string. Isolate anything that cannot be updated from public networks, and check web roots, logs, crashes and unexpected processes, since an update does not remove an attacker who is already in.",
        "title": "Update the PHP runtime on every internet-facing host today"
      },
      "kev": true,
      "kind": "vulnerability",
      "last_changed_at": "2026-11-01T14:01:13Z",
      "markdown_url": "https://ctipilot.ch/entries/2026-10-21/php-critical-release-pre-announced-cve-2026-109618-109619/index.md",
      "permalink": "https://ctipilot.ch/entries/2026-10-21/php-critical-release-pre-announced-cve-2026-109618-109619/",
      "priority": "critical",
      "product_keys": [
        "product:php",
        "product:siemens-ruggedcom-ape1808",
        "product:tenable-enclave-security",
        "product:tenable-security-center"
      ],
      "summary": "The PHP project released 8.5.12, 8.4.27, 8.3.36 and 8.2.35 on 2026-10-21 to fix CVE-2026-109618 and CVE-2026-109619 (CVSS 4.0 9.2), two flaws in the runtime that allow unauthenticated remote code execution as the web worker account, most directly on Apache mod_php, with no upstream release for PHP 8.1 and older and a third path, CVE-2026-115560, left unfixed (keep session.upload_progress.enabled=0). CISA added both flaws to its Known Exploited Vulnerabilities catalog on 2026-10-26, after a honeypot operator documented 35 successful code executions on PHP 8.4.26 under single-worker mod_php and VulnCheck extended its working exploit across builds of PHP 8.2 to 8.5; GreyNoise's sensors have recorded shell sessions since 2026-10-28, Palo Alto Networks' advisory now reports active exploitation against internet-exposed PAN-OS management interfaces, Dream Research recovered a custom build chained with the Linux kernel flaw CVE-2026-46300 that rooted 25 Palo Alto Networks PAN-OS firewall and management servers and attacked a US government-affiliated network, SRF links a data theft at TCS Camping's booking-system supplier to the flaws without naming a CVE, and Unit 42 retracted on 2026-10-25 its update that linked an attack on a European government agency to them. As of 2026-10-22 BACS knew of no attack in Switzerland but said federal PHP applications were affected and that it had no complete overview of the update status, and Swiss cantons, universities, Cyon, the Lodur platform and Publica took sites offline as a precaution.",
      "techniques": [
        "T1059",
        "T1059.004",
        "T1068",
        "T1105",
        "T1190",
        "T1505.003",
        "T1552.001",
        "T1552.005"
      ],
      "verification": "multi-source"
    },
    {
      "actions": [
        "Apply the BT26-05-RS patch to every self-hosted BeyondTrust Remote Support appliance now and confirm in the /appliance interface that it is installed (a build older than 24.3.1 must be upgraded first, which closes the hole but does not undo earlier exposure); apply it to self-hosted Privileged Remote Access appliances too, since BeyondTrust built and tested the patch for both products although its advisory names only Remote Support as impacted.",
        "For every appliance that was internet-reachable on a build up to 26.2.3 at any time since late August 2026: before any change, snapshot a virtual appliance with memory and export its disk, and collect the off-box syslog, reverse-proxy or WAF and perimeter firewall logs because the actor deletes on-appliance logs; then redeploy from a clean, fully patched image every appliance whose compromise status is confirmed or unknown, and rotate the credentials it held in dependency order, including the Remote Support Vault and any credential typed into a support session."
      ],
      "affected_products": [
        "BeyondTrust Remote Support"
      ],
      "change": "update",
      "classification": "B1",
      "cves": [
        {
          "affected": "Remote Support, all versions up to 26.2.3 (self-hosted; SaaS tenants were patched by 2026-10-09)",
          "cvss": "9.3",
          "fixed": "BT26-05-RS patch for versions 24.3.1 to 26.2.3; versions older than 24.3.1 must first be upgraded to a supported release",
          "id": "CVE-2026-102764",
          "status": [
            "exploited",
            "cisa-kev",
            "patch-available"
          ]
        }
      ],
      "exploited": true,
      "headline": "BeyondTrust Remote Support zero-day: Rapid7 reports a Metasploit module; the actor's persistence survives reset",
      "id": "2026-10-16/cve-2026-102764-beyondtrust-remote-support-zero-day",
      "immediate_action": {
        "action": "BeyondTrust and Google's Threat Intelligence Group confirm that an unauthenticated flaw in Remote Support (all versions up to 26.2.3) was exploited as a zero-day from late August 2026, GTIG attributing it to a suspected China-nexus espionage actor, and GTIG warns organizations to prepare for widespread exploitation now that the flaw is public, and Rapid7 reports a Metasploit module for it. Apply the BT26-05-RS patch to every self-hosted appliance (builds older than 24.3.1 must be upgraded first). The actor's persistence survives reboot and configuration reset and it deletes on-appliance logs, so snapshot and collect off-box logs from any appliance that was internet-reachable on an affected build, then redeploy from a clean patched image any whose compromise status is confirmed or unknown and rotate everything it held.",
        "title": "Patch BeyondTrust Remote Support now, review every appliance exposed since late August and rebuild any with confirmed or unknown compromise status"
      },
      "kev": true,
      "kind": "vulnerability",
      "last_changed_at": "2026-10-31T03:39:00Z",
      "markdown_url": "https://ctipilot.ch/entries/2026-10-16/cve-2026-102764-beyondtrust-remote-support-zero-day/index.md",
      "permalink": "https://ctipilot.ch/entries/2026-10-16/cve-2026-102764-beyondtrust-remote-support-zero-day/",
      "priority": "critical",
      "product_keys": [
        "product:beyondtrust-remote-support"
      ],
      "summary": "BeyondTrust's advisory BT26-05 of 2026-10-15 fixes CVE-2026-102764, an improper origin validation in an internal messaging component of Remote Support that lets a remote attacker perform file operations on the appliance without authenticating; all versions up to 26.2.3 are affected. Google's Threat Intelligence Group found ARMORY CASTLE, a suspected PRC-nexus espionage actor formerly tracked as UNC5221, exploiting it as a zero-day in late August 2026, leaving a web shell, a root-SUID shell and a sudoers entry that survive reboot and configuration reset, so a patched appliance that was exposed still needs a compromise check, and a rebuild where its status is confirmed or unknown. Rapid7 published a root-cause analysis on 2026-10-30, and a Metasploit module now implements the chain.",
      "techniques": [
        "T1005",
        "T1037",
        "T1070.004",
        "T1078",
        "T1090",
        "T1098",
        "T1190",
        "T1219",
        "T1505.003",
        "T1548.001",
        "T1548.003",
        "T1555",
        "T1572",
        "T1685.006"
      ],
      "verification": "multi-source"
    },
    {
      "actions": [
        "Upgrade every internet-facing NetScaler ADC/Gateway to 14.1-73.37+ (14.1-FIPS 14.1-73.37 FIPS+) or 13.1-64.23+ (13.1-FIPS/NDcPP 13.1-37.279+) now (a SAML-configured appliance needs the later builds named for CVE-2026-88779, and an identity provider 14.1-73.46 or 13.1-64.29); on a 13.1-branch appliance run `show ns variable` first; if it returns any variables, install 13.1-64.24 instead to avoid a known reboot loop. Capture logs, an instance snapshot where the appliance is virtual, a support bundle and a core dump from each exposed appliance BEFORE patching, since the upgrade can remove forensic evidence of prior exploitation.",
        "Run Mandiant's compromise checks, extended by the Unit 42 artifacts described in the update below, Zscaler's (appliance-initiated downloads to unfamiliar addresses, an unexpected executable under /var, a Perl CGI handler added to the web server configuration) and Rapid7's (the setuid bit on /bin/sh, nsaaad crashes followed by Pitboss reboots, an outbound agent polling an external endpoint every 15 seconds), on every NetScaler that was internet-facing and unpatched at any time since early September, patched or not; isolate any hit, check both nodes of an HA pair, halt HA configuration sync until both nodes are validated, and rotate the LDAP and RADIUS bind credentials, SSL private keys and key-encryption material held in the configuration, since Rapid7 saw the configuration and backups staged and exfiltrated.",
        "Find any NetScaler ADC or Gateway still on the end-of-life 12.1 or 13.0 branches and decide isolation or replacement now: they receive no security updates and Citrix has not said whether they are affected."
      ],
      "affected_products": [
        "Citrix NetScaler ADC",
        "Citrix NetScaler Gateway"
      ],
      "change": "improvement",
      "classification": "A1",
      "cves": [
        {
          "affected": "Supported NetScaler ADC/Gateway 14.1 and 13.1, including their FIPS and NDcPP builds, before the fixed builds (default configuration, no feature required); Citrix has not said whether the end-of-life 12.1 and 13.0 branches are affected",
          "cvss": "9.5",
          "fixed": "14.1-73.37; 13.1-64.23 (13.1-64.24 if `show ns variable` returns entries); 14.1-73.37 FIPS; 13.1-37.279 FIPS/NDcPP",
          "id": "CVE-2026-88771",
          "status": [
            "exploited",
            "cisa-kev",
            "poc-public",
            "patch-available"
          ]
        },
        {
          "affected": "Releases with DTLS enabled (default state on any VPN virtual server) before the fixed builds",
          "cvss": "9.5",
          "fixed": "14.1-73.37; 13.1-64.23; 14.1-73.37 FIPS; 13.1-37.279 FIPS/NDcPP",
          "id": "CVE-2026-88772",
          "status": [
            "exploited",
            "cisa-kev",
            "poc-public",
            "patch-available"
          ]
        },
        {
          "affected": "Releases with HTTP configuration enabled before the fixed builds; not reported exploited",
          "cvss": "9.3",
          "fixed": "14.1-73.37; 13.1-64.23; 14.1-73.37 FIPS; 13.1-37.279 FIPS/NDcPP",
          "id": "CVE-2026-88773",
          "status": [
            "poc-public",
            "patch-available"
          ]
        },
        {
          "affected": "Any policy expression configured with an HTTP URL-based expression; not reported exploited",
          "cvss": "7.0",
          "fixed": "14.1-73.37; 13.1-64.23; 14.1-73.37 FIPS; 13.1-37.279 FIPS/NDcPP",
          "id": "CVE-2026-88774",
          "status": [
            "patch-available"
          ]
        },
        {
          "affected": "Configured as Gateway (SSL VPN/ICA Proxy/CVPN/RDP Proxy) or an AAA virtual server; not reported exploited",
          "cvss": "8.8",
          "fixed": "14.1-73.37; 13.1-64.23; 14.1-73.37 FIPS; 13.1-37.279 FIPS/NDcPP",
          "id": "CVE-2026-88775",
          "status": [
            "patch-available"
          ]
        },
        {
          "affected": "Configured as an Oracle-type load-balancing virtual server; not reported exploited",
          "cvss": "8.8",
          "fixed": "14.1-73.37; 13.1-64.23; 14.1-73.37 FIPS; 13.1-37.279 FIPS/NDcPP",
          "id": "CVE-2026-88776",
          "status": [
            "patch-available"
          ]
        },
        {
          "affected": "Configured as an LB/CS or CGNAT-LSN/NAT64 device with a non-HTTP L7 protocol feature enabled; not reported exploited",
          "cvss": "8.8",
          "fixed": "14.1-73.37; 13.1-64.23; 14.1-73.37 FIPS; 13.1-37.279 FIPS/NDcPP",
          "id": "CVE-2026-88777",
          "status": [
            "patch-available"
          ]
        },
        {
          "affected": "TCP configuration enabled, predictable TCP Initial Sequence Number; not reported exploited",
          "cvss": "8.8",
          "fixed": "14.1-73.37; 13.1-64.23; 14.1-73.37 FIPS; 13.1-37.279 FIPS/NDcPP (also requires enabling Enhanced ISN Generation; the version upgrade alone does not remediate this one)",
          "id": "CVE-2026-88778",
          "status": [
            "patch-available"
          ]
        }
      ],
      "exploited": true,
      "headline": "Two exploited NetScaler zero-days: one in default configuration, one on by default on VPN servers; no workaround",
      "id": "2026-09-28/cve-2026-88771-citrix-netscaler-preauth-rce-zero-day-kev",
      "immediate_action": {
        "action": "Citrix confirms CVE-2026-88771 and CVE-2026-88772 are being exploited against unmitigated NetScaler ADC and NetScaler Gateway appliances right now, and Google's Mandiant reports exploitation since at least early September. CVE-2026-88771 requires no configuration at all: every default deployment is reachable by an unauthenticated attacker; CVE-2026-88772 is reachable wherever DTLS is enabled, which Citrix states is the default on any VPN virtual server. Citrix lists no workaround, and Mandiant's interim network controls (disable DTLS where it is not needed, block inbound UDP/443 upstream) cover CVE-2026-88772 only. Capture forensic evidence (logs, an instance snapshot where the appliance is virtual, a support bundle, a core dump) from each exposed appliance before patching, since the upgrade itself can destroy evidence of prior compromise, then upgrade to 14.1-73.37+ or 13.1-64.23+ (run `show ns variable` first on 13.1; if it returns any variables, install 13.1-64.24 instead to avoid a known reboot loop), going straight to 14.1-73.41+ or 13.1-64.28+ where the appliance is configured as a SAML service provider or identity provider (CVE-2026-88779), and to 14.1-73.46+ or 13.1-64.29+ where it is an identity provider (CVE-2026-107406), and run a compromise assessment on every appliance that was internet-facing.",
        "title": "Patch every internet-facing NetScaler ADC/Gateway now and check for pre-patch compromise"
      },
      "kev": true,
      "kind": "vulnerability",
      "last_changed_at": "2026-10-25T14:05:30Z",
      "markdown_url": "https://ctipilot.ch/entries/2026-09-28/cve-2026-88771-citrix-netscaler-preauth-rce-zero-day-kev/index.md",
      "permalink": "https://ctipilot.ch/entries/2026-09-28/cve-2026-88771-citrix-netscaler-preauth-rce-zero-day-kev/",
      "priority": "critical",
      "product_keys": [
        "product:citrix-netscaler"
      ],
      "summary": "Citrix's CTX697096 bulletin (2026-09-27) fixes eight NetScaler ADC/Gateway flaws, two of which, CVE-2026-88771 (unauthenticated command execution, every default deployment) and CVE-2026-88772 (memory overflow to RCE/DoS, reachable wherever DTLS is enabled, the VPN-vServer default), were exploited before any fix existed; CISA added both to KEV and Citrix lists no workaround. Mandiant, GTIG, Unit 42, Zscaler and Rapid7 describe the compromises: web-server-configuration persistence, web shells, and in one intrusion the SAML crash CVE-2026-88779 chained with CVE-2026-88771 so that the crash handler ran the payload as root, followed by exfiltration of the appliance configuration and key material. An appliance patched after the bulletin therefore still needs a compromise check and its configuration secrets rotated. SAML-configured appliances need the later builds named for CVE-2026-88779 (14.1-73.41 or 13.1-64.28) and identity providers 14.1-73.46 or 13.1-64.29 for CVE-2026-107406; CVE-2026-88773 has a public proof of concept with no exploitation seen.",
      "techniques": [
        "T1016",
        "T1018",
        "T1020",
        "T1036.008",
        "T1037.004",
        "T1041",
        "T1046",
        "T1053.003",
        "T1059.004",
        "T1059.006",
        "T1070",
        "T1071.001",
        "T1074.001",
        "T1090.001",
        "T1105",
        "T1190",
        "T1505.003",
        "T1548.001",
        "T1552.001",
        "T1560.001",
        "T1572",
        "T1595.002"
      ],
      "verification": "multi-source"
    },
    {
      "actions": [
        "Upgrade every SonicWall Gen7 firewall and NSv that serves SAML SSLVPN logins to SonicOS 7.3.4-7013 or later and every Gen8 firewall and NSv to 8.2.3-8015 or later now, because SonicWall lists no workaround and CISA lists the flaw as exploited."
      ],
      "affected_products": [
        "SonicWall SonicOS",
        "SonicWall SSL VPN"
      ],
      "change": "new",
      "classification": "A2",
      "cves": [
        {
          "affected": "SonicOS 7.3.3-7015 and older (Gen7 hardware firewalls and NSv 270, 470, 870) and 8.2.2-8015 and older (Gen8 hardware firewalls and NSv XS, S, M, L), only when SAML is enabled for SSLVPN logins",
          "cvss": "7.1",
          "fixed": "7.3.4-7013 and higher (Gen7); 8.2.3-8015 and higher (Gen8); no workaround",
          "id": "CVE-2026-19868",
          "status": [
            "exploited",
            "cisa-kev",
            "patch-available"
          ]
        },
        {
          "affected": "SonicOS management interface, same Gen7 and Gen8 builds; permissive cross-domain policy that in specific conditions could potentially let a remote unauthenticated attacker perform unauthorized operations (not reported exploited)",
          "cvss": "8.8",
          "fixed": "7.3.4-7013 and higher (Gen7); 8.2.3-8015 and higher (Gen8)",
          "id": "CVE-2026-107155",
          "status": [
            "patch-available"
          ]
        },
        {
          "affected": "SonicOS management interface, same Gen7 and Gen8 builds; session validation flaw that in specific conditions could potentially let a remote unauthenticated attacker perform unauthorized operations (not reported exploited)",
          "cvss": "8.8",
          "fixed": "7.3.4-7013 and higher (Gen7); 8.2.3-8015 and higher (Gen8)",
          "id": "CVE-2026-107154",
          "status": [
            "patch-available"
          ]
        },
        {
          "affected": "SonicOS SSL-VPN service, same Gen7 and Gen8 builds; pre-authentication heap buffer overflow that could potentially cause an application-level denial of service (not reported exploited)",
          "cvss": "7.5",
          "fixed": "7.3.4-7013 and higher (Gen7); 8.2.3-8015 and higher (Gen8)",
          "id": "CVE-2026-82308",
          "status": [
            "patch-available"
          ]
        }
      ],
      "exploited": true,
      "headline": "SonicWall SSL VPN bypasses SAML MFA and CISA lists it exploited; upgrade Gen7 to 7.3.4-7013, Gen8 to 8.2.3-8015",
      "id": "2026-11-07/cve-2026-19868-sonicwall-sonicos-sslvpn-saml-mfa-bypass-kev",
      "immediate_action": null,
      "kev": true,
      "kind": "vulnerability",
      "last_changed_at": "2026-11-07T03:58:00Z",
      "markdown_url": "https://ctipilot.ch/entries/2026-11-07/cve-2026-19868-sonicwall-sonicos-sslvpn-saml-mfa-bypass-kev/index.md",
      "permalink": "https://ctipilot.ch/entries/2026-11-07/cve-2026-19868-sonicwall-sonicos-sslvpn-saml-mfa-bypass-kev/",
      "priority": "high",
      "product_keys": [
        "product:sonicwall-sonicos",
        "product:sonicwall-ssl-vpn"
      ],
      "summary": "SonicWall's advisory SNWLID-2026-0014 of 2026-11-06 fixes CVE-2026-19868, an SSLVPN authentication enforcement flaw (CVSS 3.1 7.1) that lets a user with valid credentials for an alternate authentication method bypass SAML, MFA enforced through SAML included, on Gen7 firewalls up to 7.3.3-7015 and Gen8 up to 8.2.2-8015 when SAML is enabled for SSLVPN logins. SonicWall says it investigated a report indicating potential exploitation and CISA lists the flaw as exploited; there is no workaround, and 7.3.4-7013 and 8.2.3-8015 fix it.",
      "techniques": [
        "T1078",
        "T1133",
        "T1190"
      ],
      "verification": "multi-source"
    },
    {
      "actions": [
        "Find every Danfoss AK-SM and AK-SC, Copeland xweb and Dixell xweb refrigeration controller, and any other refrigeration controller with a remote management interface because not every second-wave site's vendor is confirmed, in facilities you own or that a contractor manages for you and take its management interface off the internet now, restoring access only through a secure VPN or protected network (filtering to the contractor's source addresses is an emergency stop-gap, and CERT-FR asks you to check your insurance conditions before cutting the contractor's data uplink); an end-of-life unit that gets no fixes needs replacing, because a factory reset leaves it vulnerable and probably compromised again.",
        "On every such controller that was reachable from the internet, check the whole configuration, defrost ranges, alarm thresholds and notification recipients included, against the intended one, verify the actual temperatures and test that alarms reach staff; for a Danfoss unit that may have been taken over, restart it or otherwise factory-reset it, restore access only through a secure VPN or protected network and reconfigure it for service, then update its firmware, set the security level to Strict and replace the default and any weak passwords, and on every Copeland or Dixell XWEB unit confirm the factory Admin password was changed and give each contractor a named account with an expiry date."
      ],
      "affected_products": [
        "Danfoss AK-SM 800",
        "Danfoss AK-SC 355",
        "Danfoss AK-SM 800A",
        "Copeland xweb",
        "Dixell xweb"
      ],
      "change": "update",
      "classification": "A2",
      "cves": [],
      "exploited": true,
      "headline": "Refrigeration attacks reach Switzerland, a K\u00f6niz butcher and three Volg stores; no actor established",
      "id": "2026-10-13/danfoss-ak-sm-ak-sc-french-supermarket-refrigeration-attack",
      "immediate_action": null,
      "kev": false,
      "kind": "incident",
      "last_changed_at": "2026-11-07T03:53:29Z",
      "markdown_url": "https://ctipilot.ch/entries/2026-10-13/danfoss-ak-sm-ak-sc-french-supermarket-refrigeration-attack/index.md",
      "permalink": "https://ctipilot.ch/entries/2026-10-13/danfoss-ak-sm-ak-sc-french-supermarket-refrigeration-attack/",
      "priority": "high",
      "product_keys": [
        "product:copeland-xweb",
        "product:danfoss-ak-sc-355",
        "product:danfoss-ak-sm-800",
        "product:danfoss-ak-sm-800a",
        "product:dixell-xweb"
      ],
      "summary": "Coop\u00e9rative U, Intermarch\u00e9 and E. Leclerc confirmed to AFP a cyberattack on their refrigeration systems overnight on 11 to 12 October 2026, a remotely forced defrost at hundreds of French stores; on 2026-11-02 more than 115 stores in at least six more countries and the first German shops followed. The French blood service EFS confirmed on 2026-11-03 that an incident at its refrigeration supplier altered the temperature and defrost thresholds of cold rooms at three EFS sites on 2 November, caught by its own alarms with no loss of blood products, and ENISA, the European Commission, Europol and the CSIRTs Network advised organisations on 2026-11-04 to take immediate action to mitigate exposure; no source ties the blood-service case to the Danfoss, Copeland or Dixell controllers. SRF reported on 2026-11-05 the first publicly known cases in Switzerland, a butcher in K\u00f6niz whose freezer reached 50 to 70 degrees and three Volg stores whose cooling parameters were changed; BACS has received one reportable notification, and CISA, FBI, HHS, USDA and DOT published a joint warning on refrigeration and cold-chain controllers that names no vendor. CERT-FR reports numerous compromises of Danfoss AK-SM and AK-SC controllers and of Copeland xweb and Dixell xweb, NCSC Switzerland rates the activity actively exploited and Coop Switzerland says attempts against it failed, ANSSI says elementary flaws were exploited, controllers directly on the internet and weak passwords, and SentinelLABS says responsibility has not been publicly established. Reuters and Nextgov report that the Pentagon treats freezer failures at US military commissaries as a suspected hack. NCSC Switzerland's advisory, updated on 2026-11-06, says the public information does not establish a common attack method or confirm exploitation of the Danfoss CVEs it lists, and Ransom-ISAC's log of one Copeland XWEB Pro compromise shows 743 parameter writes in two administrator sessions, with default credentials claimed.",
      "techniques": [
        "T1078",
        "T1133",
        "T1190"
      ],
      "verification": "multi-source"
    },
    {
      "actions": [
        "On every WordPress site your organisation, its web agencies or its hosting suppliers run, deny web access to wp-content/upgrade/ in the web server configuration (not with an .htaccess file inside that folder) and confirm it answers 403 before installing 7.1.4 or the fixed release of its branch, because the update itself still unpacks with the old code and a firewall that WordPress itself loads does not run for that request; then confirm in Dashboard > Updates that each site is on 7.1.4 or the fixed release of its branch."
      ],
      "affected_products": [
        "WordPress Core"
      ],
      "change": "update",
      "classification": "A2",
      "cves": [
        {
          "affected": "WordPress Core 4.7.0 to 7.1.3 (every branch from 4.7 below its fixed release)",
          "cvss": "8.1 (CVSS 3.1, Wordfence)",
          "fixed": "7.1.4, 7.0.8 and the backport of each branch down to 4.7.39",
          "id": "CVE-2026-119977",
          "status": [
            "exploited",
            "cisa-kev",
            "patch-available"
          ]
        }
      ],
      "exploited": true,
      "headline": "CISA lists WordPress core's upgrade-window RCE race as exploited; block wp-content/upgrade before installing 7.1.4",
      "id": "2026-10-30/wordpress-core-7-1-4-unauthenticated-upgrade-window-rce-race",
      "immediate_action": null,
      "kev": true,
      "kind": "vulnerability",
      "last_changed_at": "2026-11-07T03:51:45Z",
      "markdown_url": "https://ctipilot.ch/entries/2026-10-30/wordpress-core-7-1-4-unauthenticated-upgrade-window-rce-race/index.md",
      "permalink": "https://ctipilot.ch/entries/2026-10-30/wordpress-core-7-1-4-unauthenticated-upgrade-window-rce-race/",
      "priority": "high",
      "product_keys": [
        "product:wordpress-core"
      ],
      "summary": "WordPress 7.1.4 of 2026-10-28 fixes a weakness in the core upgrade process that lets an unauthenticated attacker reach the staged installer and run code on the server during a full-package core update, in versions 4.7 to 7.1.3, with backports for every branch down to 4.7. CISA added CVE-2026-119977 to its Known Exploited Vulnerabilities catalog on 2026-11-03; Wordfence reports more than 18,500 probing requests in the first 21 hours, while Patchstack calls the race hard to win and says it needs a web-reachable staging directory. The discoverer says the update that installs the fix still unpacks with the old code, so the staging directory must be blocked before updating.",
      "techniques": [
        "T1190"
      ],
      "verification": "multi-source"
    },
    {
      "actions": [
        "Update every SIMATIC IoT2050 (Advanced, Basic, M.2 and SM) to V4.3.4-1 or later now; where that cannot happen at once, uninstall Node-RED on units that do not use it, since Siemens names uninstalling or hardening Node-RED as its interim mitigations and exploitation takes a single unauthenticated request.",
        "On every Node-RED instance that was reachable from an untrusted network, review the deployed flows for exec nodes and http-in endpoints that nobody built, and the access logs for POST requests to /flows from non-engineering addresses."
      ],
      "affected_products": [
        "Siemens SIMATIC IoT2050 Advanced",
        "Siemens SIMATIC IoT2050 Basic",
        "Siemens SIMATIC IoT2050 M.2",
        "Siemens SIMATIC IoT2050 SM"
      ],
      "change": "update",
      "classification": "A2",
      "cves": [
        {
          "affected": "SIMATIC IoT2050 Advanced (6ES7647-0BA00-1YA2), Basic (6ES7647-0BA00-0YA2), M.2 (6ES7647-0BB00-1YA2) and SM (6ES7647-0CA00-1AA2), all versions < V4.3.4-1 running Industrial OS with Node-RED installed",
          "cvss": "10.0",
          "fixed": "V4.3.4-1 or later",
          "id": "CVE-2026-58115",
          "status": [
            "exploited",
            "patch-available"
          ]
        }
      ],
      "exploited": true,
      "headline": "VulnCheck caught exploitation of the Node-RED flaw in Siemens IoT2050; all four variants affected, V4.3.4-1 fixes",
      "id": "2026-08-13/cve-2026-58115-simatic-iot2050-node-red-unauth-root",
      "immediate_action": null,
      "kev": false,
      "kind": "vulnerability",
      "last_changed_at": "2026-11-07T03:48:06Z",
      "markdown_url": "https://ctipilot.ch/entries/2026-08-13/cve-2026-58115-simatic-iot2050-node-red-unauth-root/index.md",
      "permalink": "https://ctipilot.ch/entries/2026-08-13/cve-2026-58115-simatic-iot2050-node-red-unauth-root/",
      "priority": "high",
      "product_keys": [
        "product:siemens-simatic-iot2050-advanced",
        "product:siemens-simatic-iot2050-basic",
        "product:siemens-simatic-iot2050-m-2",
        "product:siemens-simatic-iot2050-sm"
      ],
      "summary": "Siemens ProductCERT advisory SSA-834709 of 2026-08-11 discloses CVE-2026-58115, rated 10.0 on both CVSS 3.1 and 4.0: SIMATIC IoT2050 devices running Industrial OS with Node-RED installed do not enforce authentication on the Node-RED HTTP interface, so an unauthenticated attacker with network reach can create a flow and run code with maximum privileges. Siemens' advisory, revised on 2026-11-04, lists the Advanced, Basic, M.2 and SM variants, all versions below V4.3.4-1; V4.3.4-1 is the fix, and Siemens offers uninstalling or hardening Node-RED as interim mitigations. VulnCheck reports that on 2026-10-30 one of its canaries caught exploitation, a single request that deployed a flow downloading and running a Linux bot, with web-shell flows from the same address since; the target was a canary and the activity looks like opportunistic mass scanning.",
      "techniques": [
        "T1027",
        "T1059",
        "T1059.004",
        "T1105",
        "T1190",
        "T1505.003"
      ],
      "verification": "multi-source"
    },
    {
      "actions": [
        "In every Entra tenant you run or manage for others, list the app registrations that hold client secrets, starting with multitenant, delegated-admin (GDAP) and Partner Center apps, security-tool integration apps and Azure DevOps service connections, and search the service-principal and non-interactive sign-in logs for the invalid-secret or expired-secret errors AADSTS7000215 and AADSTS7000222 followed by a success for the same app; on any hit remove all client secrets, certificates and federated credentials on that app, including ones you did not add, disable its service principal if needed and rotate everything stored in any Key Vault it could read, because issued tokens stay valid until they expire."
      ],
      "affected_products": [
        "Microsoft Entra ID",
        "Microsoft Azure",
        "Microsoft Azure DevOps",
        "Microsoft 365"
      ],
      "change": "new",
      "classification": "B2",
      "cves": [],
      "exploited": false,
      "headline": "Entra app-credential abuse: agents hunt GitHub for secrets, an operator reaches MSP clients, government among them",
      "id": "2026-11-06/exposed-app-credentials-entra-signins-msp-clients-artex",
      "immediate_action": null,
      "kev": false,
      "kind": "threat",
      "last_changed_at": "2026-11-06T03:46:00Z",
      "markdown_url": "https://ctipilot.ch/entries/2026-11-06/exposed-app-credentials-entra-signins-msp-clients-artex/index.md",
      "permalink": "https://ctipilot.ch/entries/2026-11-06/exposed-app-credentials-entra-signins-msp-clients-artex/",
      "priority": "high",
      "product_keys": [
        "product:microsoft-365",
        "product:microsoft-azure",
        "product:microsoft-azure-devops",
        "product:microsoft-entra-id"
      ],
      "summary": "Microsoft reports that since August threat actors have used the agentic framework ARTEX to query public GitHub for OAuth application secrets and cloud keys, and that from 2026-10-28 valid application credentials were used for service-principal sign-ins across dozens of applications in several tenants, a vendor-owned multitenant application among them. Todyl's telemetry shows one operator since 2026-11-01 targeting about 45 application registrations at MSPs, more than 33 of which authenticated, and reaching 27 organisations, government clients among them; Microsoft says a similar campaign involving the same addresses was reported by Todyl, while Todyl does not tie its case to ARTEX and cannot say where the secrets came from.",
      "techniques": [
        "T1078.004",
        "T1114.002",
        "T1199",
        "T1213.002",
        "T1530",
        "T1550.001",
        "T1552.001",
        "T1555.006",
        "T1580",
        "T1593.003",
        "T1651"
      ],
      "verification": "multi-source"
    },
    {
      "actions": [
        "Restrict the administrative interface of every Barracuda Email Security Gateway, Load Balancer ADC, Message Archiver, WAF Control Center, Web Application Firewall and Web Security Gateway to trusted internal networks now, update every Email Security Gateway to firmware 9.4.0.029 or later, the build Barracuda names (the CVE record lists builds before 9.4.0.030 as affected), and apply Barracuda's patch to each of the other products (BNADC-16586 for the Load Balancer ADC and the Web Application Firewall, BNMA-32468, BNWF-60060, BNYF-24789), confirming that automatic patching is on.",
        "On every Email Security Gateway whose interface was reachable before the patch, check its configuration for a restore nobody made and its timezone setting for anything other than a timezone name, because watchTowr's single unauthenticated request can reach both."
      ],
      "affected_products": [
        "Barracuda Email Security Gateway",
        "Barracuda Load Balancer ADC",
        "Barracuda Message Archiver",
        "Barracuda WAF Control Center",
        "Barracuda Web Application Firewall",
        "Barracuda Web Security Gateway"
      ],
      "change": "update",
      "classification": "A2",
      "cves": [
        {
          "affected": "Barracuda Email Security Gateway before 9.4.0.030 per the Mandiant CVE record; all versions per Barracuda Campus",
          "cvss": "9.3",
          "fixed": "firmware 9.4.0.029 or later per Barracuda Campus (the CVE record lists builds before 9.4.0.030 as affected); patches BNSF-40425 (9.4.017 and later) and BNSF-40430 (earlier)",
          "id": "CVE-2026-116606",
          "status": [
            "poc-public",
            "patch-available"
          ]
        },
        {
          "affected": "Email Security Gateway versions up to 9.4.0.27, Load Balancer ADC versions up to 6.4.0, Web Application Firewall versions up to 11.0.1, Web Security Gateway versions up to 16.1.100.100, Message Archiver versions up to 5.5.4.0 and WAF Control Center versions up to 2.2.1, per the Mandiant CVE record; an authenticated administrator on its own (Barracuda, Mandiant); on the Email Security Gateway watchTowr reaches it without an account by chaining CVE-2026-116606",
          "cvss": "8.6",
          "fixed": "BNSF-40425 (9.4.017 and later) and BNSF-40430 (earlier) for the Email Security Gateway, BNADC-16586 for the Load Balancer ADC and the Web Application Firewall, BNMA-32468 for the Message Archiver, BNWF-60060 for the WAF Control Center and BNYF-24789 for the Web Security Gateway",
          "id": "CVE-2026-111560",
          "status": [
            "poc-public",
            "patch-available"
          ]
        }
      ],
      "exploited": false,
      "headline": "Barracuda ESG: no login needed, watchTowr shows one request reaches root; update to 9.4.0.029 or later",
      "id": "2026-11-04/cve-2026-116606-barracuda-esg-auth-bypass-root-rce",
      "immediate_action": null,
      "kev": false,
      "kind": "vulnerability",
      "last_changed_at": "2026-11-06T03:41:00Z",
      "markdown_url": "https://ctipilot.ch/entries/2026-11-04/cve-2026-116606-barracuda-esg-auth-bypass-root-rce/index.md",
      "permalink": "https://ctipilot.ch/entries/2026-11-04/cve-2026-116606-barracuda-esg-auth-bypass-root-rce/",
      "priority": "high",
      "product_keys": [
        "product:barracuda-email-security-gateway",
        "product:barracuda-load-balancer-adc",
        "product:barracuda-message-archiver",
        "product:barracuda-waf-control-center",
        "product:barracuda-web-application-firewall",
        "product:barracuda-web-security-gateway"
      ],
      "summary": "Barracuda's advisory of 2026-11-02 covers CVE-2026-116606, a pre-authentication authorization bypass in the Email Security Gateway (CVSS 9.3) that lets an unauthenticated remote attacker restore a crafted backup archive through the configuration-import function, and CVE-2026-111560, a command injection in the timezone field (8.6) that also affects the Load Balancer ADC, Message Archiver, WAF Control Center, Web Application Firewall and Web Security Gateway; chained, they give root. watchTowr Labs showed on 2026-11-05 that the chain needs no account, one unauthenticated request to the login handler reaching the restore function, and Barracuda changed its advisory the same day to say authentication is not required for CVE-2026-116606, only that the administrative interface must be reachable; watchTowr published a detection tool, and no source reports attacks. Barracuda names firmware 9.4.0.029 as the fixed build while the CVE record lists builds before 9.4.0.030 as affected.",
      "techniques": [
        "T1059.004",
        "T1190"
      ],
      "verification": "multi-source"
    },
    {
      "actions": [
        "Install each Zyxel GS1900 switch's \"\u2026(x).3C0\" build now (2.90(AAHL.3)C0 on the GS1900-24, for example), including switches already moved to the June \"\u2026(x).2C0\" build, which Binarly shows still carries the flaw the recovered exploit targets, and audit and rotate any switch still on its factory-default admin credentials: GreyNoise found 564 of 996 exploited switches (57%) had never had theirs changed, which lets the actor re-enter even after the hashed credential set is rotated."
      ],
      "affected_products": [
        "Zyxel GS1900 Series Switches"
      ],
      "change": "update",
      "classification": "B2",
      "cves": [
        {
          "affected": "GS1900-8/-8HP/-10HP/-16/-24/-24E/-24EP/-24HPv2/-48/-48HPv2, each at or below its own \"\u2026(x).1C0\" baseline build",
          "cvss": "8.8",
          "fixed": "each model's own \"\u2026(x).2C0\" build fixes CVE-2026-7273 as Zyxel describes it, but those builds remain vulnerable to CVE-2026-107441; install each model's own \"\u2026(x).3C0\" build (per-model builds differ; see Zyxel's advisory tables)",
          "id": "CVE-2026-7273",
          "status": [
            "exploited",
            "cisa-kev",
            "patch-available"
          ]
        },
        {
          "affected": "GS1900-8, -8HP, -10HP, -16, -24, -24E, -24EP, -24HPv2, -48 and -48HPv2, each at or below its own \"2.90(xxxx.2)C0\" build, which includes every build Zyxel advertised as the June fix",
          "cvss": "8.8",
          "fixed": "each model's own \"2.90(xxxx.3)C0\" build (AAHH, AAHI, AAZI, AAHJ, AAHL, AAHK, ABTO, ABTP, AAHN and ABTQ for the ten models above), released 2026-10-22 per Binarly and disclosed in Zyxel's advisory of 2026-11-03",
          "id": "CVE-2026-107441",
          "status": [
            "patch-available"
          ]
        }
      ],
      "exploited": true,
      "headline": "Zyxel GS1900: Binarly says the exploit GreyNoise caught works on the June-fixed builds; install the .3C0 builds",
      "id": "2026-09-22/cve-2026-7273-zyxel-gs1900-red-heron-kev-exploited",
      "immediate_action": null,
      "kev": true,
      "kind": "vulnerability",
      "last_changed_at": "2026-11-05T03:59:29Z",
      "markdown_url": "https://ctipilot.ch/entries/2026-09-22/cve-2026-7273-zyxel-gs1900-red-heron-kev-exploited/index.md",
      "permalink": "https://ctipilot.ch/entries/2026-09-22/cve-2026-7273-zyxel-gs1900-red-heron-kev-exploited/",
      "priority": "high",
      "product_keys": [
        "product:zyxel-gs1900-series-switches"
      ],
      "summary": "CISA lists CVE-2026-7273, a pre-auth stack overflow in the CGI of Zyxel GS1900 series switches patched in June in the .2C0 builds, after GreyNoise caught an actor it assesses is the same as or related to Red Heron exfiltrating configurations and hashed root credentials from 996 switches in 48 countries from about 17 August, 57% of them still on factory-default credentials. Binarly shows the recovered exploit works against all ten June-fixed builds because it targets a separate out-of-bounds write, CVE-2026-107441, which Zyxel fixed in the .3C0 builds on 2026-10-22 and disclosed on 2026-11-03; Binarly calls it an exploited zero-day on the strength of the exploit match and BleepingComputer repeats the label, while CISA's catalog lists CVE-2026-7273 and not the new flaw.",
      "techniques": [
        "T1005",
        "T1059.004",
        "T1074.001",
        "T1078.001",
        "T1105",
        "T1190"
      ],
      "verification": "multi-source"
    },
    {
      "actions": [
        "In every Microsoft 365 tenant your organisation runs or administers, audit device code sign-ins with the authentication protocol filter of the sign-in logs and, where no documented device needs the flow, create a Conditional Access policy with the Authentication flows condition set to Device code flow and Block access, starting in report-only mode and excluding emergency-access accounts and, where devices register through it, the Device Registration Service."
      ],
      "affected_products": [
        "Microsoft 365",
        "Microsoft Entra ID"
      ],
      "change": "new",
      "classification": "A2",
      "cves": [],
      "exploited": false,
      "headline": "Vaud: device-code phishing against Microsoft 365 is running in Romandie; several organisations already affected",
      "id": "2026-11-05/vaud-m365-device-code-phishing-campaign-romandie",
      "immediate_action": null,
      "kev": false,
      "kind": "threat",
      "last_changed_at": "2026-11-05T03:56:00Z",
      "markdown_url": "https://ctipilot.ch/entries/2026-11-05/vaud-m365-device-code-phishing-campaign-romandie/index.md",
      "permalink": "https://ctipilot.ch/entries/2026-11-05/vaud-m365-device-code-phishing-campaign-romandie/",
      "priority": "high",
      "product_keys": [
        "product:microsoft-365",
        "product:microsoft-entra-id"
      ],
      "summary": "The canton of Vaud said on 2026-11-04 that a Microsoft 365 device-code phishing campaign is running in French-speaking Switzerland and that several organisations are already affected: mail that appears to come from a company or a known contact leads the reader to type a code on a genuine Microsoft sign-in page, which gives the attacker access to the account. Microsoft documents a Conditional Access policy that blocks the device code flow for tenants that do not need it.",
      "techniques": [
        "T1078.004",
        "T1528",
        "T1566.002"
      ],
      "verification": "single-source"
    },
    {
      "actions": [
        "Update every Node.js 22.x, 24.x and 26.x runtime to 22.23.4, 24.22.1 or 26.12.1, including the Node binary inside container images (a Dockerfile that pins 24.22.0 keeps the flaw until the pin changes), and upgrade the PyPI Brotli package to 1.2.1 and brotlicffi to 1.2.1.0 wherever either is installed; judge a Node.js build by its release version, because process.versions.brotli reads 1.2.0 on patched builds too, and move any application on an end-of-life Node.js line to a supported release. On every WordPress host, upgrade the operating system's libbrotli package to a patched revision (check the package revision, because Debian and Ubuntu backport the fix into 1.1.0) and rebuild WordPress container images, since the official wordpress:latest image still carried a vulnerable libbrotli1 when Patchstack wrote.",
        "Update every Envoy proxy that has the Brotli decompressor configured to v1.40.0, v1.39.3, v1.38.6, v1.37.8 or v1.36.12; the advisory names v1.39.2, v1.38.5, v1.37.7 and v1.36.11 as vulnerable. On every VMware Cloud Foundation SDDC Manager apply Broadcom's workaround, KB460732 on 9.1.1 and KB460734 on 9.1.0, 9.0.x and 5.2.x, until its patch ships. Upgrade every Splunk Enterprise 10.0 and lower to 10.2 or higher and disable or remove the Splunk Visual Exporter app on every Splunk Enterprise instance, because the upgrade does not remediate it, and install Citrix hotfix 2609.1, 2508 CU2 LTSR or 2605.1-3 on Unicon eLux Scout.",
        "On every PA-Series and VM-Series firewall on PAN-OS 12.2, 12.1 or 11.2 that has TLS decryption enabled, run show system setting brotli and, where it returns Enabled: yes, run set system setting brotli-encoding disable until the hotfix for the release is installed; Palo Alto's timeline of 2026-10-29 lists every PAN-OS hotfix for this flaw as released."
      ],
      "affected_products": [
        "Node.js",
        "Google Brotli",
        "Bun",
        "Python Brotli (PyPI)",
        "brotlicffi (PyPI)",
        "Envoy Proxy",
        "Istio",
        "Microsoft .NET",
        "Palo Alto Networks PAN-OS",
        "Palo Alto Networks Prisma Cloud Application Security Transporter Client",
        "VMware Cloud Foundation",
        "Splunk Enterprise",
        "Splunk Visual Exporter",
        "Splunk SOAR Automation Broker",
        "Splunk UBA",
        "Splunk Attack Analyzer",
        "Citrix Unicon eLux Scout"
      ],
      "change": "update",
      "classification": "A1",
      "cves": [
        {
          "affected": "Node.js 22.x, 24.x and 26.x before 22.23.4, 24.22.1 and 26.12.1; Google Brotli 1.0.3 to 1.2.0; PyPI Brotli up to 1.2.0; PyPI brotlicffi up to 1.2.0.2; Bun 1.0.21 to before 1.4.4; Istio before 1.29.9, 1.30.6 and 1.31.2; Envoy v1.39.2, v1.38.5, v1.37.7 and v1.36.11 with the Brotli decompressor configured; .NET before 8.0.33, 9.0.22 and 10.0.14 where Brotli data from untrusted parties is decompressed; PAN-OS 12.2 before 12.2.4-h1, 12.1 before 12.1.4-h13, 12.1.7-h11 and 12.1.10-h3, and 11.2 before 11.2.4-h23, 11.2.7-h23, 11.2.10-h17, 11.2.13-h4 and 11.2.16-h1, on PA-Series and VM-Series firewalls with Brotli inspection and TLS decryption enabled (PAN-OS 11.1 and 10.2 and the management interface are not affected); PHP for Windows builds without the -1 suffix, through the cURL extension when automatic decompression is enabled; Ubuntu, Debian and Alpine brotli packages and the Ruby brotli gem before the fixed builds listed; VMware Cloud Foundation SDDC Manager 9.1.1 (critical, CVSS 3.1 9.8) and 9.1.0, 9.0.x and 5.2.x (important, 7.5); Palo Alto Networks Prisma Cloud Application Security Transporter Client before 0.2.9; Splunk Enterprise 10.0 and lower, Splunk Visual Exporter (every Splunk Enterprise version), Splunk SOAR Automation Broker, Splunk UBA and Splunk Attack Analyzer, which Splunk lists as including packages affected by this and three further Node.js flaws; Citrix Unicon eLux Scout On-Prem, Scout On-Prem LTSR and Scout Cloud Gateway On-Prem (no version range stated)",
          "cvss": "9.2 (CVSS 4.0)",
          "fixed": "Node.js 22.23.4, 24.22.1, 26.12.1; Google Brotli 1.0.10, 1.1.1, 1.2.1; PyPI Brotli 1.2.1; PyPI brotlicffi 1.2.1.0; Bun 1.4.4; Istio 1.29.9, 1.30.6, 1.31.2; Envoy v1.40.0, v1.39.3, v1.38.6, v1.37.8, v1.36.12; .NET 8.0.33, 9.0.22, 10.0.14; PAN-OS hotfixes 12.2.4-h1, 12.1.4-h13, 12.1.7-h11, 12.1.10-h3, 11.2.4-h23, 11.2.7-h23, 11.2.10-h17, 11.2.13-h4 and 11.2.16-h1 (all released, as read on 2026-10-29); PHP for Windows 8.5.12-1, 8.4.27-1, 8.3.36-1, 8.2.35-1; Ubuntu brotli 1.2.0-4ubuntu0.1 (26.10), 1.2.0-3ubuntu0.1 (26.04), 1.1.0-2ubuntu0.1 (24.04), 1.0.9-2ubuntu0.1 (22.04), ESM 1.0.7-6ubuntu0.1+esm1 (20.04, whose nodejs package stays vulnerable); Debian brotli 1.0.9-2+deb12u1 (bookworm) and 1.1.0-2+deb13u1 (trixie); Alpine brotli 1.2.1-r0 (edge, 3.24, 3.23) and 1.1.1-r0 (3.21); Ruby brotli gem 0.9.1 and 0.9.2; SDDC Manager none yet, patch pending, workarounds KB460732 (9.1.1) and KB460734 (9.1.0, 9.0.x, 5.2.x); Prisma Cloud Application Security Transporter Client 0.2.9; Splunk Enterprise 10.2 or higher for the bundled Node.js runtime (no fixed 10.0 build or date), Splunk Visual Exporter none (disable or remove the app), no fix stated for the other Splunk products; Citrix Scout On-Prem hotfix 2609.1, Scout On-Prem LTSR 2508 CU2 LTSR, Scout Cloud Gateway On-Prem 2605.1-3",
          "id": "CVE-2026-111497",
          "status": [
            "exploited",
            "cisa-kev",
            "poc-public",
            "patch-available"
          ]
        }
      ],
      "exploited": true,
      "headline": "Node2Shell Brotli flaw is now on CISA KEV, with exploit traffic seen against Node.js 24.22.0; update now",
      "id": "2026-10-24/cve-2026-111497-node2shell-brotli-decoder-rce-nodejs-pypi",
      "immediate_action": null,
      "kev": true,
      "kind": "vulnerability",
      "last_changed_at": "2026-11-05T03:52:52Z",
      "markdown_url": "https://ctipilot.ch/entries/2026-10-24/cve-2026-111497-node2shell-brotli-decoder-rce-nodejs-pypi/index.md",
      "permalink": "https://ctipilot.ch/entries/2026-10-24/cve-2026-111497-node2shell-brotli-decoder-rce-nodejs-pypi/",
      "priority": "high",
      "product_keys": [
        "product:brotlicffi-pypi",
        "product:bun",
        "product:citrix-unicon-elux-scout",
        "product:envoy-proxy",
        "product:google-brotli",
        "product:istio",
        "product:microsoft-net",
        "product:node-js",
        "product:palo-alto-networks-pan-os",
        "product:palo-alto-networks-prisma-cloud-application-security-transporter-client",
        "product:python-brotli-pypi",
        "product:splunk-attack-analyzer",
        "product:splunk-enterprise",
        "product:splunk-soar-automation-broker",
        "product:splunk-uba",
        "product:splunk-visual-exporter",
        "product:vmware-cloud-foundation"
      ],
      "summary": "CISA added CVE-2026-111497, an out-of-bounds write in the Brotli decoder bundled with Node.js, to its Known Exploited Vulnerabilities catalog on 2026-10-27 on evidence of active exploitation, and ELLIO's sensors recorded exploit traffic against Node.js 24.22.0 on 2026-10-26, though its own copy of the attacker's chain got no shell. Node.js 22.23.4, 24.22.1 and 26.12.1 fix it, and because the flaw is in Google's decoder the PyPI packages Brotli (1.2.1) and brotlicffi (1.2.1.0), Envoy, Microsoft .NET, PHP for Windows, Ubuntu and, with Brotli inspection and TLS decryption enabled, PAN-OS 12.2, 12.1 and 11.2 firewalls carry it too; Palo Alto and Cisco report no malicious use against their own products. Broadcom lists VMware Cloud Foundation's SDDC Manager 9.1.1.x as critically affected (CVSS 3.1 9.8), with the patch pending and only workarounds available, and Splunk lists Splunk Enterprise 10.0 and lower among the products that include affected Node.js packages, with 10.2 or later as the upgrade target and its Visual Exporter app to be disabled.",
      "techniques": [
        "T1190"
      ],
      "verification": "multi-source"
    },
    {
      "actions": [
        "Tell the helpdesk, HR and payroll teams of every body whose staff are insured with Publica (including the federal administration and the ETH domain) or with the Pensionskasse Stadt Z\u00fcrich, which says data of its insured persons and pensioners was stolen, that AHV number, date of birth, address, salary and IBAN may now be known to criminals and must not count as proof of identity, and route requests that quote them, a request to change a payout account included, to a call-back on a known number; for staff insured with Pensionskasse Post, the Bernische Pensionskasse (which now says it must be assumed personal data left), the Ticino cantonal fund IPCT (which found data of about 1,800 of its insured persons on the attacked server and writes to all its insured because it cannot exclude more), a fund administered or advised by Libera AG or the Bernische Lehrerversicherungskasse apply the same rule until those funds report the scope; also tell insured staff that cantonal police warn of investment-fraud calls from people who know their salary and pension details, which prove nothing about the caller.",
        "If your organisation's pension administration, HR or payroll runs on PK Softech software, is being migrated to it or tested on it, or your staff are insured with Pensionskasse Post, ask the supplier or the fund in writing whether your data, test data included, was in the affected environment, project, test and migration copies included, and what it holds outside the productive system."
      ],
      "affected_products": [],
      "change": "update",
      "classification": "A2",
      "cves": [],
      "exploited": false,
      "headline": "PK Softech apparently kept Publica data it had promised in writing to delete; Tamedia says Akira holds about 100 GB",
      "id": "2026-10-09/publica-pk-softech-supplier-malware-intrusion-data-outflow",
      "immediate_action": null,
      "kev": false,
      "kind": "incident",
      "last_changed_at": "2026-11-04T03:32:27Z",
      "markdown_url": "https://ctipilot.ch/entries/2026-10-09/publica-pk-softech-supplier-malware-intrusion-data-outflow/index.md",
      "permalink": "https://ctipilot.ch/entries/2026-10-09/publica-pk-softech-supplier-malware-intrusion-data-outflow/",
      "priority": "high",
      "product_keys": [],
      "summary": "PK Softech AG, the software supplier of Publica and other Swiss pension funds, says unknown attackers used malware to reach part of its IT and that data must be assumed to have left; the Confederation headlined its 2026-10-08 release \"data outflow confirmed\", and the Federal Prosecutor's Office is investigating. Tamedia reports that PK Softech had confirmed in writing in January 2026 that it deleted Publica's 2019 migration data, which apparently stayed on its servers, and that Akira holds about 100 GB and demands ransom; Inside IT relays this and adds that the Federal Prosecutor's Office confirmed Akira took data, and Netzwoche relays that the authorities assume data on practically all current and former federal and federally affiliated staff left. Publica says personal data of insured persons has presumably left; the Pensionskasse Stadt Z\u00fcrich says its insured persons' test data was stolen, the Pensionskasse Post says personal data left, the Bernische Pensionskasse says it must be assumed so, the Ticino fund IPCT says data of about 1,800 of its insured persons sat on the attacked server and writes to all its insured because it cannot exclude more, and other funds are still checking. The Federal Data Protection Commissioner, who opened a formal investigation against PK Softech on 2026-10-22, states that data of several pension funds, Publica among them, was exfiltrated. Publica's own newsletter of 2026-10-22 says the Akira group is being associated with the attack; the demand rests on the press reports. The Pensionskasse Stadt Z\u00fcrich has suspended its planned 2027 move to PK Softech's system, PK Softech cannot rule out that non-pseudonymised data was temporarily present in project work, and the Federal Prosecutor's Office has added the case to its criminal proceeding against Akira.",
      "techniques": [
        "T1199",
        "T1657"
      ],
      "verification": "multi-source"
    },
    {
      "actions": [
        "Update every Synology DSM to the fixed build of its branch now (7.4-90075, 7.3.2-86009-4, 7.2.2-72806-9 or 7.2.1-69057-12, and 7.2-64570-4, 7.1.1-42962-7 or 6.2.4-25556-8 on the branches for which SA-26:13 names no fix), taking the management interface of any NAS that is reachable from the internet offline first, because Synology confirms ransomware is exploiting outdated DSM and lists no mitigation for the September flaws.",
        "On every NAS that was reachable from the internet on an older build, look in its shares for files renamed to .L0CK3D and for read-me3.txt notes, and isolate any hit."
      ],
      "affected_products": [
        "Synology DiskStation Manager (DSM)"
      ],
      "change": "update",
      "classification": "A3",
      "cves": [
        {
          "affected": "DSM before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075",
          "cvss": "9.8",
          "fixed": "7.4-90075 / 7.3.2-86009-4 / 7.2.2-72806-9 / 7.2.1-69057-12",
          "id": "CVE-2026-13684",
          "status": [
            "patch-available"
          ]
        },
        {
          "affected": "DSM before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075",
          "cvss": "9.8",
          "fixed": "7.4-90075 / 7.3.2-86009-4 / 7.2.2-72806-9 / 7.2.1-69057-12",
          "id": "CVE-2026-13639",
          "status": [
            "patch-available"
          ]
        },
        {
          "affected": "DSM before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075",
          "cvss": "8.8",
          "fixed": "7.4-90075 / 7.3.2-86009-4 / 7.2.2-72806-9 / 7.2.1-69057-12",
          "id": "CVE-2026-13673",
          "status": [
            "patch-available"
          ]
        },
        {
          "affected": "DSM before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075",
          "cvss": "8.1",
          "fixed": "7.4-90075 / 7.3.2-86009-4 / 7.2.2-72806-9 / 7.2.1-69057-12",
          "id": "CVE-2026-6205",
          "status": [
            "patch-available"
          ]
        },
        {
          "affected": "DSM before 7.2-64570-4, 7.2.1-69057-6 and 7.2.2-72806-1 (Synology-SA-24:20; BeeStation OS before 1.1-65374)",
          "cvss": "9.8",
          "fixed": "7.2.2-72806-1 / 7.2.1-69057-6 / 7.2-64570-4; the advisory's table also lists 7.1.1-42962-7 and, for DSM 6.2, 6.2.4-25556-8",
          "id": "CVE-2024-10441",
          "status": [
            "patch-available"
          ]
        }
      ],
      "exploited": true,
      "headline": "C3RB3R ransomware encrypts Synology NAS; Synology confirms exploitation, 360 names the September 9.8 pair",
      "id": "2026-09-22/cve-2026-13684-synology-dsm-unauth-file-read-write",
      "immediate_action": null,
      "kev": false,
      "kind": "vulnerability",
      "last_changed_at": "2026-11-03T03:35:29Z",
      "markdown_url": "https://ctipilot.ch/entries/2026-09-22/cve-2026-13684-synology-dsm-unauth-file-read-write/index.md",
      "permalink": "https://ctipilot.ch/entries/2026-09-22/cve-2026-13684-synology-dsm-unauth-file-read-write/",
      "priority": "high",
      "product_keys": [
        "product:synology-diskstation-manager-dsm"
      ],
      "summary": "Synology said on 2026-10-29 that threat actors are exploiting a vulnerability patched in December 2024 to encrypt and extort devices on outdated DSM, naming no CVE and pointing to Synology-SA-24:20, while the Chinese vendor 360 identifies the ransomware as C3RB3R, a Cerber variant, and says it got in through CVE-2026-13684 and CVE-2026-13639, the two unauthenticated CVSS 9.8 flaws of Synology-SA-26:13 (fixed in DSM 7.4-90075, 7.3.2-86009-4, 7.2.2-72806-9 and 7.2.1-69057-12, with no mitigation). The two accounts conflict and no source reconciles them; a DSM that is current on both advisories is out of scope on either.",
      "techniques": [
        "T1005",
        "T1083",
        "T1190",
        "T1486"
      ],
      "verification": "contradicted"
    },
    {
      "actions": [
        "Upgrade every self-managed GitLab CE and EE instance on 19.2, 19.3 or 19.4 to 19.2.8, 19.3.5 or 19.4.2 now, preferably to 19.2.9, 19.3.6, 19.4.3 or 19.5.1, which also fix CVE-2026-110264, internet-reachable instances and instances that allow open sign-up or public projects first, because CISA lists the flaw as exploited and NCSC Switzerland reports active exploitation; where GitLab runs on its own Ruby (a source install or a container image that does not use GitLab's packages) also install Ruby 3.3.13, 3.4.12 or 4.0.9, because the fix is a Ruby patch that only GitLab's official packages carry. On any instance that was reachable on an affected version, run the six detections GitLab published on its release page and treat the CI/CD variables, runner registration tokens and deploy keys of any hit, or of an instance where compromise cannot be ruled out, as exposed."
      ],
      "affected_products": [
        "GitLab Community Edition",
        "GitLab Enterprise Edition"
      ],
      "change": "improvement",
      "classification": "A2",
      "cves": [
        {
          "affected": "self-managed GitLab CE/EE: 19.2 before 19.2.8, 19.3 before 19.3.5, 19.4 before 19.4.2; GitLab rates it as needing no privileges, while the path Rapid7 demonstrated needs push access to a public project",
          "cvss": "10.0 (CVSS 3.1)",
          "fixed": "19.2.8; 19.3.5; 19.4.2",
          "id": "CVE-2026-97229",
          "status": [
            "exploited",
            "cisa-kev",
            "patch-available",
            "poc-public"
          ]
        }
      ],
      "exploited": true,
      "headline": "GitLab's CVSS 10.0 CI regex RCE is now on CISA KEV; the public PoC needs push access to a public project",
      "id": "2026-10-13/cve-2026-97229-gitlab-ci-regex-compiler-unauthenticated-rce",
      "immediate_action": null,
      "kev": true,
      "kind": "vulnerability",
      "last_changed_at": "2026-11-01T14:03:57Z",
      "markdown_url": "https://ctipilot.ch/entries/2026-10-13/cve-2026-97229-gitlab-ci-regex-compiler-unauthenticated-rce/index.md",
      "permalink": "https://ctipilot.ch/entries/2026-10-13/cve-2026-97229-gitlab-ci-regex-compiler-unauthenticated-rce/",
      "priority": "high",
      "product_keys": [
        "product:gitlab"
      ],
      "summary": "GitLab's critical patch release of 2026-10-12 fixes CVE-2026-97229 (CVSS 3.1 10.0), an integer overflow in the CI/CD regular-expression compiler that lets code run on the server as the git user through a crafted expression in a CI/CD configuration. CISA listed it as exploited on 2026-10-29 and NCSC Switzerland reports active exploitation on the strength of Alpine Linux's account of a newly registered account that crashed its GitLab 19.3.4 workers eight times on 2026-10-20 and 21, after which Alpine rebuilt the instance because it could not rule out code execution; GitLab's fix is a patch to the Ruby bundled in its own packages and images, so an installation with its own Ruby needs Ruby 3.3.13, 3.4.12 or 4.0.9 as well. Self-managed CE and EE from 19.2 before 19.2.8, 19.3 before 19.3.5 and 19.4 before 19.4.2 are affected, Rapid7 published a proof of concept on 2026-10-13, and the path it demonstrated needs push access to a public project.",
      "techniques": [
        "T1190"
      ],
      "verification": "multi-source"
    },
    {
      "actions": [
        "Inventory which guest VMs use the VMXNET3 adapter and patch the ESX hosts carrying them to ESXi-9.1.0.0200, ESXi-9.0.2.0100, ESXi80U3k or ESXi80U2f: the escape is reachable from guest administrative privilege, which makes any tenant-operated or lower-trust VM on a shared host a path to the hypervisor.",
        "Patch vCenter to 9.1.0.0300, 9.0.2.0100 or 8.0 U3k/U2f as applicable (vCenter 7.0 through Broadcom extended support), since there is no workaround, and on any appliance that was network-reachable and unpatched between 29 July and today, check the appliance's own scheduled-task and cron configuration for entries the platform team did not create, and its egress records for outbound SSH sessions from the appliance itself.",
        "On the ESX hosts of any vCenter estate that was exposed or compromised, install the build that fixes CVE-2026-41709 and review administrator activity from vCenter task and event records and from syslog forwarded off the host, because Broadcom says the flaw lets an administrator act without being logged and CrowdStrike reports it used as a zero-day."
      ],
      "affected_products": [
        "VMware vCenter Server",
        "VMware ESX",
        "VMware Workstation",
        "VMware Fusion",
        "VMware Cloud Foundation",
        "VMware vSphere Foundation",
        "VMware Telco Cloud Platform",
        "VMware Telco Cloud Infrastructure"
      ],
      "change": "correction",
      "classification": "A1",
      "cves": [
        {
          "affected": "vCenter component of VMware Cloud Foundation and vSphere Foundation 9.1.x.x and 9.0.x.x, standalone VMware vCenter Server 8.0 and 7.0, and the vCenter component of VMware Cloud Foundation 5.x.",
          "cvss": "9.8",
          "fixed": "vCenter 9.1.0.0300, vCenter 9.0.2.0100, and vCenter Server 8.0 U3k, or the 8.0 U2f express patch on the U2 branch (2026-08-03); Cloud Foundation 5.x takes an async patch to 8.0 U3k; vCenter 7.0 only through Broadcom Support under an extended support contract.",
          "id": "CVE-2026-59309",
          "status": [
            "patch-available"
          ]
        },
        {
          "affected": "vCenter 9.1, 9.0 and 8.0 branches below the fixed builds, and vCenter 7.0; see the Broadcom advisory's response matrix for the per-branch detail",
          "cvss": "9.8",
          "fixed": "vCenter 9.1.0.0300, 9.0.2.0100, and 8.0 U3k or 8.0 U2f depending on the deployed branch; vCenter 7.0 only through Broadcom Support under an extended support contract",
          "id": "CVE-2026-59310",
          "status": [
            "exploited",
            "cisa-kev",
            "patch-available"
          ]
        },
        {
          "affected": "ESX component where a guest VM is configured with a VMXNET3 virtual network adapter; VMs using other adapter types are not affected.",
          "cvss": "9.3",
          "fixed": "ESXi-9.1.0.0200, ESXi-9.0.2.0100, ESXi80U3k and ESXi80U2f-25626445; ESX 7.0 only through Broadcom Support under an extended support contract.",
          "id": "CVE-2026-47876",
          "status": [
            "patch-available"
          ]
        },
        {
          "affected": "ESX, Workstation and Fusion. Broadcom publishes two different scores for this CVE by product: 7.6 on ESX, where a denial of service of the host process is the more likely outcome, and 2.7 on Workstation and Fusion, where the advisory restricts the impact to information disclosure.",
          "cvss": "7.6",
          "fixed": "ESXi-9.1.0.0, ESXi-9.0.2.0100 and ESXi80U3i; VMware Cloud Foundation 5.x ESX takes 5.2.3; Workstation and Fusion both fix in 26H1.",
          "id": "CVE-2026-41703",
          "status": [
            "patch-available"
          ]
        },
        {
          "affected": "ESX only: insufficient logging that lets an administrator perform actions without those actions being recorded.",
          "cvss": "2.7",
          "fixed": "ESXi-9.1.0.0, ESXi-9.0.2.0100, ESXi80U3j and 5.2.4.",
          "id": "CVE-2026-41709",
          "status": [
            "exploited",
            "cisa-kev",
            "patch-available"
          ]
        }
      ],
      "exploited": true,
      "headline": "VMware vCenter's pre-auth Syslog RCE is exploited; patch it with the auth bypass and VMXNET3 escape, no workaround",
      "id": "2026-07-30/vmware-vmsa-2026-0006-vcenter-auth-bypass-vmxnet3-escape",
      "immediate_action": null,
      "kev": true,
      "kind": "vulnerability",
      "last_changed_at": "2026-11-01T14:03:11Z",
      "markdown_url": "https://ctipilot.ch/entries/2026-07-30/vmware-vmsa-2026-0006-vcenter-auth-bypass-vmxnet3-escape/index.md",
      "permalink": "https://ctipilot.ch/entries/2026-07-30/vmware-vmsa-2026-0006-vcenter-auth-bypass-vmxnet3-escape/",
      "priority": "high",
      "product_keys": [
        "product:vmware-cloud-foundation",
        "product:vmware-esxi",
        "product:vmware-fusion",
        "product:vmware-telco-cloud-infrastructure",
        "product:vmware-telco-cloud-platform",
        "product:vmware-vcenter-server",
        "product:vmware-vsphere-foundation",
        "product:vmware-workstation"
      ],
      "summary": "Broadcom's VMSA-2026-0006 (2026-07-29) fixes five flaws across VMware ESX, vCenter, Workstation and Fusion, and NCSC-CH, NCSC-NL and BSI CERT-Bund all carried it across 2026-07-28 and 2026-07-29. CVE-2026-59309 (CVSS 9.8) is an authentication bypass in vCenter's Directory Service reachable with nothing but network access to vCenter, and CVE-2026-59310 (CVSS 9.8) is a directory traversal in vCenter's Syslog server that reaches arbitrary code execution. CVE-2026-47876 (CVSS 9.3) is an out-of-bounds write in the VMXNET3 virtual network adapter that lets a guest administrator execute code on the ESX host, affecting only VMs using that adapter. No workaround exists for any of the five, so patching is the only control. All were reported privately to Broadcom, one of them through Pwn2Own, and CVE-2026-59310 has since been exploited in the wild and was added to CISA's KEV catalog on 2026-08-18; CISA also listed the ESX logging flaw CVE-2026-41709 as exploited on 2026-10-28, the day CrowdStrike said the actor WARP PANDA used it as a zero-day.",
      "techniques": [
        "T1053.003",
        "T1190",
        "T1486",
        "T1572",
        "T1611",
        "T1687"
      ],
      "verification": "multi-source"
    },
    {
      "actions": [
        "Deploy the 2026-10-13 cumulative update for each release (KB5127648 for Windows 11 24H2, 25H2 and 26H2, KB5127646 for Windows 11 26H1, KB5126657 for Windows 10 21H2 and 22H2, KB5126655 for Server 2022, KB5126646 for Server 2025, and the others listed in the CVE record) to every Windows endpoint and server, starting with the systems whose users open mail and chat attachments or download files; Rapid7 says Windows Server 2012 receives no patch; confirm that Microsoft Edge is at 154.0.4258.62 or later, which Microsoft added to the fix list on 2026-10-26."
      ],
      "affected_products": [
        "Microsoft Windows",
        "Microsoft Windows Server",
        "Microsoft Edge"
      ],
      "change": "update",
      "classification": "A2",
      "cves": [
        {
          "affected": "Windows 10, Windows 11 and Windows Server 2012 R2 through 2025, and Microsoft Edge (Chromium-based) below 154.0.4258.62 per Microsoft's revision of 2026-10-26; Microsoft's record lists no Windows Server 2012 product, and Rapid7 says Server 2012 receives no patch",
          "cvss": "8.8",
          "fixed": "KB5127648 (Windows 11 24H2, 25H2, 26H2), KB5127646 (26H1), KB5126653 (23H2), KB5126657 (Windows 10 21H2, 22H2), KB5126651 (Windows 10 1809, Server 2019), KB5126868 (Windows 10 1607, Server 2016), KB5126655 (Server 2022), KB5126646 (Server 2025), KB5126836 (Server 2012 R2); Microsoft Edge (Chromium-based) 154.0.4258.62 per Microsoft's revision of 2026-10-26",
          "id": "CVE-2026-96951",
          "status": [
            "exploited",
            "cisa-kev",
            "patch-available"
          ]
        }
      ],
      "exploited": true,
      "headline": "Microsoft patches an exploited Windows Shell zero-day that evades Mark of the Web protections on files and links",
      "id": "2026-10-14/cve-2026-96951-windows-shell-motw-bypass-zero-day-kev",
      "immediate_action": null,
      "kev": true,
      "kind": "vulnerability",
      "last_changed_at": "2026-11-01T14:00:02Z",
      "markdown_url": "https://ctipilot.ch/entries/2026-10-14/cve-2026-96951-windows-shell-motw-bypass-zero-day-kev/index.md",
      "permalink": "https://ctipilot.ch/entries/2026-10-14/cve-2026-96951-windows-shell-motw-bypass-zero-day-kev/",
      "priority": "high",
      "product_keys": [
        "product:microsoft-edge",
        "product:microsoft-windows",
        "product:microsoft-windows-server"
      ],
      "summary": "Microsoft's 2026-10-13 updates fix CVE-2026-96951, a Windows Shell flaw that lets an attacker evade Mark of the Web defenses once a user opens a crafted file or link sent by email or instant message, so Windows does not show the dialog the tag normally triggers. Microsoft marks it exploited and CISA added it to KEV the same day; no source names the actor, the payload or the victims. Rapid7 says Windows Server 2012 gets no patch, while Microsoft lists fixes for Server 2012 R2 and every later supported release.",
      "techniques": [
        "T1204.002",
        "T1553.005",
        "T1566.001",
        "T1566.002"
      ],
      "verification": "multi-source"
    },
    {
      "actions": [
        "Patch CVE-2026-46300 on every Linux host that runs PHP or other internet-facing code, then on multi-tenant hosts, container nodes and CI runners: apply the distribution kernel update and reboot; until then, where IPsec is not in use, block and unload the `esp4`, `esp6` and `rxrpc` modules (this breaks IPsec), and drop the page cache so a file already modified in memory reloads from disk.",
        "On any PHP web host, appliance or management server that was reachable and unpatched for the PHP2Shell flaws, look for PHP files in web-reachable directories that nobody deployed, an outbound SSH session from the host that a systemd service or an rc.local entry keeps up, and password-spray bursts against Active Directory from the host's address, because Dream Research reports a chain of the two flaws that did exactly that."
      ],
      "affected_products": [],
      "change": "correction",
      "classification": "B2",
      "cves": [
        {
          "affected": null,
          "cvss": "7.8",
          "fixed": null,
          "id": "CVE-2026-46300",
          "status": [
            "exploited",
            "cisa-kev",
            "poc-public",
            "patch-available"
          ]
        }
      ],
      "exploited": true,
      "headline": "CVE-2026-46300 (Fragnesia): CISA lists the Linux kernel root flaw as exploited, chained with PHP2Shell",
      "id": "2026-05-15/cve-2026-46300-linux-kernel-local-privilege-escalation-via-x",
      "immediate_action": null,
      "kev": true,
      "kind": "vulnerability",
      "last_changed_at": "2026-11-01T13:49:48Z",
      "markdown_url": "https://ctipilot.ch/entries/2026-05-15/cve-2026-46300-linux-kernel-local-privilege-escalation-via-x/index.md",
      "permalink": "https://ctipilot.ch/entries/2026-05-15/cve-2026-46300-linux-kernel-local-privilege-escalation-via-x/",
      "priority": "high",
      "product_keys": [],
      "summary": "CVE-2026-46300 (\"Fragnesia\", CVSS 7.8) is a local privilege escalation in the Linux kernel's xfrm ESP-in-TCP path, one of three CVEs Red Hat groups as \"Dirty Frag\"; CISA added it to its Known Exploited Vulnerabilities catalog on 2026-10-28 and says it can be chained with the PHP2Shell flaws CVE-2026-109618 and CVE-2026-109619 to implant PHP webshells and run commands as root, and Dream Research reports such a chain against 25 Palo Alto Networks PAN-OS firewall and management servers and a US government-affiliated network. Its public exploit overwrites /usr/bin/su in the page cache, and Red Hat confirms RHEL kernels are affected (CISA KEV, 2026-10-28 \u00b7 Dream Research, 2026-10-29 \u00b7 Red Hat RHSB-2026-003).",
      "techniques": [
        "T1068",
        "T1190",
        "T1505.003",
        "T1611"
      ],
      "verification": "multi-source"
    },
    {
      "actions": [
        "Inventory Joomla sites for the Balbooa Gridbox page builder and update every one to 2.20.4.2, which also closes two unauthenticated SQL injections, CVE-2026-102788 and CVE-2026-102789, and the unauthenticated blind SQL injection in the front-end blog author parameter fixed in 2.20.3.1, present in every earlier build, 2.20.3 and 2.20.2.3 included. Anything below 2.20.2 is also exposed to the exploited follow-up batch, which 2.20.1 does not close.",
        "On any site that ran Gridbox 2.20.1 or earlier while internet-reachable, review the Super User list and administrator-group members, remove accounts that entered an admin group through self-registration rather than an explicit administrative action, and review template files and the web root for changes, with particular attention to files written since 20 July, when the cookie bypass was disclosed."
      ],
      "affected_products": [
        "Balbooa Gridbox",
        "JoomShaper EasyStore",
        "Joomla Events Booking",
        "Joomla Membership Pro",
        "Balbooa Gridbox for Joomla"
      ],
      "change": "correction",
      "classification": "B2",
      "cves": [
        {
          "affected": "Balbooa Gridbox before 2.20.1 (the discloser says the vulnerable code shipped for at least nine months, probably far longer)",
          "cvss": "10.0 (CVSS 4.0, discloser's own assessment; the published CVE record scores 9.4 on a high-privileges vector)",
          "fixed": "Gridbox 2.20.1",
          "id": "CVE-2026-61425",
          "status": [
            "patch-available"
          ]
        },
        {
          "affected": "JoomShaper EasyStore for Joomla before 2.0.2",
          "cvss": "8.7 (CVSS 4.0)",
          "fixed": "EasyStore 2.0.2",
          "id": "CVE-2026-65759",
          "status": [
            "patch-available"
          ]
        },
        {
          "affected": "JoomShaper EasyStore for Joomla before 2.0.2",
          "cvss": "9.2 (CVSS 4.0)",
          "fixed": "EasyStore 2.0.2",
          "id": "CVE-2026-65760",
          "status": [
            "patch-available"
          ]
        },
        {
          "affected": "JoomShaper EasyStore for Joomla before 2.0.2",
          "cvss": "9.3 (CVSS 4.0)",
          "fixed": "EasyStore 2.0.2",
          "id": "CVE-2026-65761",
          "status": [
            "patch-available"
          ]
        },
        {
          "affected": "Events Booking for Joomla before 5.8.2",
          "cvss": null,
          "fixed": "Events Booking 5.8.2",
          "id": "CVE-2026-63047",
          "status": [
            "patch-available"
          ]
        },
        {
          "affected": "Membership Pro for Joomla before 4.6.2",
          "cvss": "9.1 (CVSS 3.1)",
          "fixed": "Membership Pro 4.6.2",
          "id": "CVE-2026-62415",
          "status": [
            "patch-available"
          ]
        },
        {
          "affected": "1.0.0-2.20.1",
          "cvss": "10.0",
          "fixed": "2.20.2",
          "id": "CVE-2026-65884",
          "status": [
            "exploited",
            "patch-available"
          ]
        },
        {
          "affected": "1.0.0-2.20.1",
          "cvss": "9.4",
          "fixed": "2.20.2",
          "id": "CVE-2026-65885",
          "status": [
            "exploited",
            "patch-available"
          ]
        },
        {
          "affected": "1.0.0-2.20.1",
          "cvss": "10.0",
          "fixed": "2.20.2",
          "id": "CVE-2026-65887",
          "status": [
            "exploited",
            "patch-available"
          ]
        },
        {
          "affected": "1.0.0-2.20.1",
          "cvss": "10.0",
          "fixed": "2.20.2",
          "id": "CVE-2026-65888",
          "status": [
            "exploited",
            "patch-available"
          ]
        },
        {
          "affected": "Gridbox 1.0.0 to 2.20.4.1",
          "cvss": "9.3 (CVSS 4.0, Joomla CNA)",
          "fixed": "2.20.4.2; no fix for sites on the Joomla 3 line, which stops at Gridbox 2.17.0.2",
          "id": "CVE-2026-102788",
          "status": [
            "patch-available"
          ]
        },
        {
          "affected": "Gridbox 1.0.0 to 2.20.4.1",
          "cvss": "9.3 (CVSS 4.0, Joomla CNA)",
          "fixed": "2.20.4.2; no fix for sites on the Joomla 3 line, which stops at Gridbox 2.17.0.2",
          "id": "CVE-2026-102789",
          "status": [
            "patch-available"
          ]
        }
      ],
      "exploited": true,
      "headline": "Balbooa Gridbox for Joomla: anonymous Super User flaws exploited since July; update to 2.20.4.2",
      "id": "2026-07-26/joomla-gridbox-cookie-forged-super-user-auth-bypass-wave",
      "immediate_action": null,
      "kev": false,
      "kind": "vulnerability",
      "last_changed_at": "2026-11-01T13:48:38Z",
      "markdown_url": "https://ctipilot.ch/entries/2026-07-26/joomla-gridbox-cookie-forged-super-user-auth-bypass-wave/index.md",
      "permalink": "https://ctipilot.ch/entries/2026-07-26/joomla-gridbox-cookie-forged-super-user-auth-bypass-wave/",
      "priority": "high",
      "product_keys": [
        "product:balbooa-gridbox",
        "product:balbooa-gridbox-for-joomla",
        "product:joomla-events-booking",
        "product:joomla-membership-pro",
        "product:joomshaper-easystore"
      ],
      "summary": "The mySites.guru research campaign against Joomla third-party extensions produced six further disclosures between 2026-07-20 and 2026-07-23, and one of them changes technique class: the Balbooa Gridbox page builder (CVE-2026-61425) trusts a client-supplied cookie value as proof of identity, so setting an administrator's username in that cookie authenticates the requester as that user with no password and no existing session. A Joomla Super User can edit templates, which is PHP execution, so this is full site compromise from a single anonymous request. Fixed in Gridbox 2.20.1; the researcher says the vulnerable code shipped for at least nine months. The same week added unauthenticated SQL injection and order-forgery flaws in EasyStore, an invoice IDOR in Events Booking, and a critical unauthenticated upload in Membership Pro. A follow-up audit of Gridbox produced eleven more CVEs, fixed in 2.20.2, four of them exploited in the wild, and Gridbox 2.20.3.1 (21 September) fixes a further unauthenticated SQL injection present in every earlier build. Gridbox 2.20.4.2 (27 October) fixes two more unauthenticated SQL injections, CVE-2026-102788 and CVE-2026-102789, with no exploitation reported.",
      "techniques": [
        "T1136.001",
        "T1190",
        "T1505.003"
      ],
      "verification": "multi-source"
    },
    {
      "actions": [
        "Take the management interface of every PA-Series and VM-Series firewall and Panorama off the internet now by restricting it to a jump box or trusted internal addresses, because Palo Alto reports active exploitation against internet-exposed management interfaces, and install the hotfix for your maintenance release, which Palo Alto's table lists for every line from 10.2.7 to 12.2.4 (11.2.10-h17 adds the Brotli fix).",
        "Rotate the directory bind account, HA replication keys, certificate private keys and device authentication keys of every PAN-OS firewall and Panorama that was reachable from the internet while unpatched and shows a PHP web shell or a tunnel, because the chain Dream Research recovered harvested exactly those from rooted firewalls, and the hotfix does not remove a web shell or tunnel already in place."
      ],
      "affected_products": [
        "Palo Alto Networks PAN-OS",
        "Palo Alto Networks Panorama"
      ],
      "change": "update",
      "classification": "A2",
      "cves": [
        {
          "affected": "PAN-OS 12.2, 12.1, 11.2, 11.1 and 10.2 (every release below the hotfix for its train); Panorama (PAN-OS software on virtual and M-Series appliances; the advisory table has no separate Panorama row); WildFire Appliance WF-500 and WF-500-B are listed as unaffected after the correction of 2026-10-23",
          "cvss": "9.2 (CVSS-B 4.0, Palo Alto's rating of the PAN-OS impact with management reachable from the internet; 7.7 where it is reachable only from an adjacent network)",
          "fixed": "Released per the advisory as read on 2026-10-30: 12.2.4-h1; 12.1.4-h13, 12.1.7-h11, 12.1.10-h3; 11.2.4-h23, 11.2.7-h23, 11.2.10-h16 (11.2.10-h17 adds the Brotli fix), 11.2.13-h4, 11.2.16-h1; 11.1.4-h38, 11.1.6-h40, 11.1.7-h12, 11.1.10-h36, 11.1.13-h16, 11.1.16-h4; 10.2.7-h39, 10.2.10-h42, 10.2.13-h27, 10.2.16-h12, 10.2.18-h13; Panorama: the table no longer distinguishes it from the PAN-OS trains",
          "id": "CVE-2026-109618",
          "status": [
            "exploited",
            "cisa-kev",
            "patch-available"
          ]
        },
        {
          "affected": "PAN-OS 12.2, 12.1, 11.2, 11.1 and 10.2 (every release below the hotfix for its train); Panorama (PAN-OS software on virtual and M-Series appliances; the advisory table has no separate Panorama row); WildFire Appliance WF-500 and WF-500-B are listed as unaffected after the correction of 2026-10-23",
          "cvss": "9.2 (CVSS-B 4.0, Palo Alto's rating of the PAN-OS impact with management reachable from the internet; 7.7 where it is reachable only from an adjacent network)",
          "fixed": "Released per the advisory as read on 2026-10-30: 12.2.4-h1; 12.1.4-h13, 12.1.7-h11, 12.1.10-h3; 11.2.4-h23, 11.2.7-h23, 11.2.10-h16 (11.2.10-h17 adds the Brotli fix), 11.2.13-h4, 11.2.16-h1; 11.1.4-h38, 11.1.6-h40, 11.1.7-h12, 11.1.10-h36, 11.1.13-h16, 11.1.16-h4; 10.2.7-h39, 10.2.10-h42, 10.2.13-h27, 10.2.16-h12, 10.2.18-h13; Panorama: the table no longer distinguishes it from the PAN-OS trains",
          "id": "CVE-2026-109619",
          "status": [
            "exploited",
            "cisa-kev",
            "patch-available"
          ]
        }
      ],
      "exploited": true,
      "headline": "PAN-OS management interfaces were rooted in the wild via PHP2Shell and a kernel flaw: hotfix, then check for compromise",
      "id": "2026-10-22/pan-os-panorama-php2shell-mgmt-interface-no-fixed-release",
      "immediate_action": null,
      "kev": true,
      "kind": "vulnerability",
      "last_changed_at": "2026-11-01T03:27:57Z",
      "markdown_url": "https://ctipilot.ch/entries/2026-10-22/pan-os-panorama-php2shell-mgmt-interface-no-fixed-release/index.md",
      "permalink": "https://ctipilot.ch/entries/2026-10-22/pan-os-panorama-php2shell-mgmt-interface-no-fixed-release/",
      "priority": "high",
      "product_keys": [
        "product:palo-alto-networks-pan-os",
        "product:palo-alto-networks-panorama"
      ],
      "summary": "Palo Alto Networks' advisory, first published on 2026-10-21 and revised since, says active exploitation has been observed against PAN-OS management interfaces exposed to the internet, and Dream Research, with Unit 42's verification, reports a custom PHP2Shell build chained with a Linux kernel flaw that rooted 25 PAN-OS firewall and management servers in the United States, Japan, Taiwan and South Korea and went on to attack a US government-affiliated Active Directory. The advisory lists every release below the hotfix for its train, of PAN-OS 12.2, 12.1, 11.2, 11.1 and 10.2 and of Panorama, as affected through the management web interface by CVE-2026-109618 and CVE-2026-109619 (CVSS-B 9.2); all twenty hotfixes are released, and GlobalProtect and the captive portal are not affected. A device that was exposed and unpatched needs a compromise check as well as the hotfix, and CISA added both PHP flaws to its Known Exploited Vulnerabilities catalog on 2026-10-26.",
      "techniques": [
        "T1037.004",
        "T1068",
        "T1087.002",
        "T1090",
        "T1110.003",
        "T1190",
        "T1505.003",
        "T1543.002",
        "T1552.004",
        "T1572"
      ],
      "verification": "multi-source"
    },
    {
      "actions": [
        "Upgrade every Cisco ASA and FTD unit that has webvpn enabled and secondary authentication on any tunnel group, DefaultWEBVPNGroup included, to the first fixed release of its branch (ASA 9.16.4.104, 9.18.4.96, 9.20.4.50, 9.22.3.200, 9.23.1.48, 9.24.1.27 or 9.24.10.1; FTD 7.0.11, 7.2.13, 7.4.9, 7.6.7, 7.7.14, 10.0.3 or 10.1.1), internet-facing units first, because Cisco reports exploitation and its only mitigation removes secondary authentication."
      ],
      "affected_products": [
        "Cisco Secure Firewall Adaptive Security Appliance (ASA)",
        "Cisco Secure Firewall Threat Defense (FTD)"
      ],
      "change": "new",
      "classification": "A2",
      "cves": [
        {
          "affected": "ASA and FTD releases below the first fixed release of their branch, with webvpn enabled on an interface and secondary-authentication-server-group set on a tunnel group or on DefaultWEBVPNGroup",
          "cvss": "8.6 (CVSS 3.1)",
          "fixed": "ASA 9.16.4.104, 9.18.4.96, 9.20.4.50, 9.22.3.200, 9.23.1.48, 9.24.1.27 and 9.24.10.1; FTD 7.0.11, 7.2.13, 7.4.9, 7.6.7, 7.7.14, 10.0.3 and 10.1.1",
          "id": "CVE-2026-76418",
          "status": [
            "exploited",
            "cisa-kev",
            "patch-available"
          ]
        }
      ],
      "exploited": true,
      "headline": "Cisco ASA and FTD SSL VPN reload flaw is exploited and on CISA KEV; fixes in every branch, no workaround",
      "id": "2026-10-30/cve-2026-76418-cisco-asa-ftd-ssl-vpn-reload-exploited",
      "immediate_action": null,
      "kev": true,
      "kind": "vulnerability",
      "last_changed_at": "2026-10-30T03:44:00Z",
      "markdown_url": "https://ctipilot.ch/entries/2026-10-30/cve-2026-76418-cisco-asa-ftd-ssl-vpn-reload-exploited/index.md",
      "permalink": "https://ctipilot.ch/entries/2026-10-30/cve-2026-76418-cisco-asa-ftd-ssl-vpn-reload-exploited/",
      "priority": "high",
      "product_keys": [
        "product:cisco-secure-firewall-adaptive-security-appliance-asa",
        "product:cisco-secure-firewall-threat-defense-ftd"
      ],
      "summary": "Cisco's advisory of 2026-10-28 fixes CVE-2026-76418, a logic error in the remote access SSL VPN of Secure Firewall ASA and Secure FTD that lets an unauthenticated attacker reload the device with a crafted connection request when a tunnel group uses secondary authentication, and says Cisco's PSIRT became aware of active exploitation in October 2026; CISA added it to the Known Exploited Vulnerabilities catalog on 2026-10-29. Cisco names no actor, offers no workaround and lists first fixed releases for every ASA and FTD branch.",
      "techniques": [
        "T1190",
        "T1499.004"
      ],
      "verification": "single-source"
    },
    {
      "actions": [
        "In every Entra tenant you or your MSP administer, disable without deleting the seven ConnectWise application identities that ConnectWise lists by client ID (Cloud Backup is 506e08f9-6e9a-4da4-942b-a099a03644ae; the other six are in ConnectWise's advisory), dormant connections included, and keep them disabled, because ConnectWise's restoration of 2026-10-28 has partners consent a new application, \u201cConnectWise Cloud Backup for M365\u201d, in each tenant, so take its details only from the instructions on ConnectWise's Trust Center; where Graph activity logs were enabled, review them for these apps until at least 90 minutes after you disabled them, because a token issued before the disable stays valid for up to 90 minutes, and preserve the sign-in and audit logs promptly without delaying containment, because Entra ID Free keeps only 7 days.",
        "In the same tenants list the apps owned by the ConnectWise tenant (ID 3f9cd7a0-127a-4ed4-bf06-2f830d5616b7), and disable each that you do not use or cannot verify as safe.",
        "In the same tenants review every enterprise application and app registration, MSP management and security tools first but none skipped (Huntress saw the secrets planted on apparently random applications, in one tenant on some of the least privileged ones), for client secrets, certificates and federated credentials added since 2026-10-13 and remove any you did not create; also check the directory roles, owners and consent grants held by ConnectWise and SkyKick service principals, Conditional Access exclusions for them, and mailbox forwarding, inbox and transport rules and delegated access, because disabling the vendor applications does not remove access planted through them."
      ],
      "affected_products": [
        "ConnectWise Cloud Backup",
        "ConnectWise Cloud Management",
        "Microsoft Entra ID"
      ],
      "change": "update",
      "classification": "A1",
      "cves": [],
      "exploited": true,
      "headline": "ConnectWise SkyKick app credential used in 162+ Microsoft 365 tenants; disabling it does not undo planted access",
      "id": "2026-10-18/connectwise-cloud-backup-skykick-m365-app-credential-abuse",
      "immediate_action": null,
      "kev": false,
      "kind": "incident",
      "last_changed_at": "2026-10-29T04:59:00Z",
      "markdown_url": "https://ctipilot.ch/entries/2026-10-18/connectwise-cloud-backup-skykick-m365-app-credential-abuse/index.md",
      "permalink": "https://ctipilot.ch/entries/2026-10-18/connectwise-cloud-backup-skykick-m365-app-credential-abuse/",
      "priority": "high",
      "product_keys": [
        "product:connectwise-cloud-backup",
        "product:connectwise-cloud-management",
        "product:microsoft-entra-id"
      ],
      "summary": "ConnectWise says it identified unauthorized access to application identities of its Cloud Backup (formerly SkyKick) service; Huntress and Todyl report that from 15 October the app's credential was used to obtain app-only Microsoft Graph tokens in customer Microsoft 365 tenants; Huntress alone confirmed unauthorized sign-ins in 162 tenants by 16 October and saw ConnectWise Cloud Management apps assign themselves directory roles in about 50 tenants and, in two tenants, a scripted Global Administrator self-grant followed by new client secrets planted on apparently random applications. ConnectWise disabled seven application identities and suspended the service on 17 October, but says disabling does not reverse changes already made in a tenant, so every tenant that ever consented a ConnectWise or SkyKick app needs the apps disabled and its application credentials, directory roles and consents reviewed. Microsoft assesses that the China-state aligned actor Storm-0940 is behind it, using the ARTEX agentic-AI framework, and says it attempted sign-ins to more than 2,250 tenants; how the credential was obtained and what data was read are not public.",
      "techniques": [
        "T1078.004",
        "T1098.001",
        "T1098.003",
        "T1110.003",
        "T1199"
      ],
      "verification": "multi-source"
    },
    {
      "actions": [
        "Upgrade every Cisco Catalyst SD-WAN Controller, Manager and Validator to its first fixed release (20.9.8.2, 20.12.5.3 or 20.12.6.1, 20.15.4.2 or 20.18.2.1; releases earlier than 20.9 must migrate), and until then limit ports 22 and 830 on the control components to known controller and management addresses, because Cisco offers no workaround."
      ],
      "affected_products": [
        "Cisco Catalyst SD-WAN Controller",
        "Cisco Catalyst SD-WAN Manager",
        "Cisco Catalyst SD-WAN Validator"
      ],
      "change": "new",
      "classification": "B2",
      "cves": [
        {
          "affected": "Cisco Catalyst SD-WAN Controller, Manager and Validator regardless of configuration, on-premises and Cisco-hosted; releases earlier than 20.9 must migrate, and 20.11, 20.13, 20.14 and 20.16 have reached end of software maintenance",
          "cvss": "10.0",
          "fixed": "20.9.8.2 (20.9); 20.12.5.3 or 20.12.6.1 (20.12); 20.15.4.2 (20.15); 20.18.2.1 (20.18); 20.11 moves to 20.12.6.1, 20.13 and 20.14 to 20.15.4.2, 20.16 to 20.18.2.1",
          "id": "CVE-2026-20127",
          "status": [
            "exploited",
            "cisa-kev",
            "patch-available"
          ]
        }
      ],
      "exploited": true,
      "headline": "Talos: UAT-11473 implants KeyDrift in Cisco SD-WAN controllers through CVE-2026-20127 to collect data-plane keys",
      "id": "2026-10-29/keydrift-uat-11473-cisco-sd-wan-controllers-cve-2026-20127",
      "immediate_action": null,
      "kev": true,
      "kind": "threat",
      "last_changed_at": "2026-10-29T04:40:00Z",
      "markdown_url": "https://ctipilot.ch/entries/2026-10-29/keydrift-uat-11473-cisco-sd-wan-controllers-cve-2026-20127/index.md",
      "permalink": "https://ctipilot.ch/entries/2026-10-29/keydrift-uat-11473-cisco-sd-wan-controllers-cve-2026-20127/",
      "priority": "high",
      "product_keys": [
        "product:cisco-catalyst-sd-wan-controller",
        "product:cisco-catalyst-sd-wan-manager",
        "product:cisco-catalyst-sd-wan-validator"
      ],
      "summary": "Cisco Talos reports that a cluster it calls UAT-11473 exploited CVE-2026-20127, the peering authentication bypass in Cisco Catalyst SD-WAN Controller, Manager and Validator (CVSS 10.0, fixed releases since February 2026, no workaround), and then ran the KeyDrift implant inside the controller's control-plane process to collect session metadata and what Talos assesses to be data-plane IPsec keys. Cisco's advisory, revised on 2026-10-28 to link Talos's post, says it is aware of limited exploitation, and Talos assesses with high confidence that the operating infrastructure overlaps considerably with Volt Typhoon's Silent Train network.",
      "techniques": [
        "T1027.002",
        "T1036.004",
        "T1037",
        "T1040",
        "T1055.008",
        "T1059.004",
        "T1070.006",
        "T1190",
        "T1497.001",
        "T1543",
        "T1573.001",
        "T1574.006"
      ],
      "verification": "multi-source"
    },
    {
      "actions": [
        "Push iOS and iPadOS 26.7.1, macOS Tahoe 26.7.1 and macOS Sequoia 15.8.1 through device management now, and iOS and iPadOS 18.7.11 to every iPhone XS, XS Max, XR and iPad 7th generation, starting with the devices of staff who could be individually targeted; Apple describes the exploitation only on iOS before iOS 27."
      ],
      "affected_products": [
        "Apple iOS",
        "Apple iPadOS",
        "Apple macOS"
      ],
      "change": "update",
      "classification": "A2",
      "cves": [
        {
          "affected": "iOS and iPadOS before 26.7.1, and iOS and iPadOS 18 before 18.7.11 on iPhone XS, iPhone XS Max, iPhone XR and iPad 7th generation; macOS Tahoe before 26.7.1; macOS Sequoia before 15.8.1 (Apple describes the exploitation only for iOS before iOS 27)",
          "cvss": "8.8",
          "fixed": "iOS 26.7.1 and iPadOS 26.7.1; iOS 18.7.11 and iPadOS 18.7.11 (iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation); macOS Tahoe 26.7.1; macOS Sequoia 15.8.1",
          "id": "CVE-2026-86950",
          "status": [
            "exploited",
            "cisa-kev",
            "poc-public",
            "patch-available"
          ]
        }
      ],
      "exploited": true,
      "headline": "Apple's exploited CoreGraphics zero-day is now fixed for iPhone XS, XS Max, XR and iPad 7th generation (iOS 18.7.11)",
      "id": "2026-09-30/cve-2026-86950-apple-coregraphics-zero-day-kev",
      "immediate_action": null,
      "kev": true,
      "kind": "vulnerability",
      "last_changed_at": "2026-10-27T03:44:46Z",
      "markdown_url": "https://ctipilot.ch/entries/2026-09-30/cve-2026-86950-apple-coregraphics-zero-day-kev/index.md",
      "permalink": "https://ctipilot.ch/entries/2026-09-30/cve-2026-86950-apple-coregraphics-zero-day-kev/",
      "priority": "high",
      "product_keys": [
        "product:apple-ios",
        "product:apple-ipados",
        "product:apple-macos"
      ],
      "summary": "Apple's 2026-09-28 updates (iOS and iPadOS 26.7.1, macOS Tahoe 26.7.1, macOS Sequoia 15.8.1) fix CVE-2026-86950, a CoreGraphics out-of-bounds write that can run arbitrary code when a crafted file is processed, and iOS and iPadOS 18.7.11 of 2026-10-26 carry the fix for iPhone XS, XS Max, XR and iPad 7th generation, which the 26.7.1 notes do not list. Apple says it may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27, CISA added it to the KEV catalog on 2026-09-29, and no source states how the file is delivered. Since 2026-09-30 a public proof of concept crashes unpatched devices with a crafted PDF font.",
      "techniques": [
        "T1203"
      ],
      "verification": "multi-source"
    },
    {
      "actions": [
        "Upgrade every self-hosted Metabase to at least 0.58.24 / 0.59.21 / 0.60.17 / 0.61.11 / 0.62.9 / 0.63.5, then, for any instance that was reachable and unpatched during the exploitation window, revoke all active sessions by clearing the core_session table, delete unrecognised API keys, and rotate the credentials for every connected database and warehouse, not just the Metabase admin credentials, because the upgrade does not invalidate what was already retrieved.",
        "Search Metabase application or reverse-proxy ingress logs across the entire pre-upgrade exposure window for a POST to /api/session/reset_password returning HTTP 400 immediately followed by a GET to /api/user/current returning HTTP 200 from the same source; Metabase states that sequence indicates the instance was likely compromised."
      ],
      "affected_products": [
        "Metabase",
        "Metabase Cloud"
      ],
      "change": "correction",
      "classification": "A1",
      "cves": [
        {
          "affected": "Metabase Cloud and self-hosted releases in the 58 through 63 branches",
          "cvss": "10.0",
          "fixed": "latest patched release for each affected self-hosted branch; Metabase Cloud patched by the vendor",
          "id": "CVE-2026-72898",
          "status": [
            "exploited",
            "cisa-kev",
            "patch-available"
          ]
        }
      ],
      "exploited": true,
      "headline": "Metabase Cloud was breached through its own 0-day; self-hosted instances stay vulnerable until manually upgraded",
      "id": "2026-08-09/metabase-unauth-sqli-zeroday-exploited-framework-tally",
      "immediate_action": null,
      "kev": true,
      "kind": "vulnerability",
      "last_changed_at": "2026-10-25T14:07:37Z",
      "markdown_url": "https://ctipilot.ch/entries/2026-08-09/metabase-unauth-sqli-zeroday-exploited-framework-tally/index.md",
      "permalink": "https://ctipilot.ch/entries/2026-08-09/metabase-unauth-sqli-zeroday-exploited-framework-tally/",
      "priority": "high",
      "product_keys": [
        "product:metabase",
        "product:metabase-cloud"
      ],
      "summary": "Metabase disclosed on 2026-08-06 that its Metabase Cloud platform was attacked through a previously unknown vulnerability in versions 1.58 and above: an unauthenticated attacker injects arbitrary SQL against the application database and obtains administrator access to the instance, from which they can rewrite configuration, steal the stored credentials for every connected database and export the data those connections reach. The only interim workaround the vendor offers is to block the /api/session/reset_password endpoint, which is also where its published attack pattern runs. Cloud instances were patched by the vendor; self-hosted deployments stay vulnerable until manually upgraded to 0.58.24, 0.59.21, 0.60.17, 0.61.11, 0.62.9 or 0.63.5. Laptop maker Framework and form builder Tally confirmed customer data was taken from instances accessed on 2026-08-03. The flaw had no CVE identifier at disclosure; it is now tracked as CVE-2026-72898, which CISA added to its KEV catalog on 2026-08-11. VenariX now tracks fifteen publicly confirmed downstream incidents and ties two of them, at Statista and Dodo Payments, to the Dire Wolf extortion group working against self-hosted instances.",
      "techniques": [
        "T1078",
        "T1190",
        "T1213",
        "T1552"
      ],
      "verification": "multi-source"
    },
    {
      "actions": [
        "On every WordPress site your organisation, its web agencies or its hosting suppliers run with UpdraftPlus, free or premium, including old municipal, campaign and project sites, check for an UpdraftCentral key (wp option get updraft_central_localkeys, or Settings > UpdraftPlus Backups > Advanced Tools > UpdraftCentral) and delete every key even if nobody remembers using UpdraftCentral, then update to 1.26.13 or 2.26.13 or later; deleting a key stops remote management only, and backups keep working.",
        "On any site where a plugin, must-use plugin or Editor account holding manage_options appears that nobody created, delete the UpdraftCentral key first, then restore the site from a backup taken before 17 October, rotate every administrator and UpdraftCentral password, the teamupdraft.com account password (which UpdraftPlus Premium can leave stored in the site database and its backups) and end all sessions."
      ],
      "affected_products": [
        "UpdraftPlus",
        "UpdraftCentral",
        "WordPress"
      ],
      "change": "improvement",
      "classification": "B1",
      "cves": [],
      "exploited": false,
      "headline": "Stolen UpdraftCentral keys install backdoor plugins on WordPress sites; the plugin update alone does not evict them",
      "id": "2026-10-21/teamupdraft-updraftcentral-stolen-keys-backdoor-plugins",
      "immediate_action": null,
      "kev": false,
      "kind": "incident",
      "last_changed_at": "2026-10-25T14:01:43Z",
      "markdown_url": "https://ctipilot.ch/entries/2026-10-21/teamupdraft-updraftcentral-stolen-keys-backdoor-plugins/index.md",
      "permalink": "https://ctipilot.ch/entries/2026-10-21/teamupdraft-updraftcentral-stolen-keys-backdoor-plugins/",
      "priority": "high",
      "product_keys": [
        "product:updraftcentral",
        "product:updraftplus",
        "product:wordpress"
      ],
      "summary": "TeamUpdraft, the vendor of the UpdraftPlus backup plugin, says unauthorised access to teamupdraft.com on 17 and 18 October probably exposed its customer database, including UpdraftCentral connection keys, and Patchstack and Nethemba report an attacker using those keys to install backdoor plugins on connected WordPress sites, which Patchstack's telemetry dates from 2026-10-18 15:32 (it gives no time zone), and that create hidden administrators. It is not a flaw in UpdraftPlus: the plugin obeys commands signed with a valid key, a key exists on many sites that never used the service because connecting a teamupdraft.com account ticks the option by default, and the update disconnects only connections made before 13:07 BST (12:07 UTC) on 18 October, so keys created later that day have to be deleted by hand. TeamUpdraft says the attacker used a compromised key to enter its own site, and Nethemba saw the stolen keys used again on 2026-10-21, after 1.26.13 shipped.",
      "techniques": [
        "T1078",
        "T1098",
        "T1136.001",
        "T1199",
        "T1505"
      ],
      "verification": "multi-source"
    },
    {
      "actions": [
        "Patch every PAN-OS GlobalProtect portal and gateway to the fixed build in Palo Alto's advisory for its minor release (users then re-authenticate once, because the fixed firewall regenerates the override cookie), or until then disable Authentication Override or give the cookies a certificate that no other feature uses.",
        "On every GlobalProtect gateway that was internet-reachable and unpatched at any time since 2026-05-17, treat the network behind it as a ransomware compromise-assessment target: review VPN sessions that authenticated by cookie from unexpected sources, check Windows hosts for the artifacts Arctic Wolf describes (a ransomware payload staged under C:\\\\PerfLogs, a PsExec service, an LSASS dump written through comsvcs.dll to an .odt file, an ntdsutil media copy of the Active Directory database, and cleared event logs), and extend the assessment to the virtualization and backup tier: vCenter and ESXi audit logs for a changed execInstalledOnly setting and for access to a domain controller's virtual disk, and the Veeam backup server, because Unit 42 describes one intrusion that pivoted from the gateway to vCenter and dumped domain credentials offline, which in-guest EDR does not see."
      ],
      "affected_products": [
        "Palo Alto Networks PAN-OS",
        "Palo Alto Networks Prisma Access"
      ],
      "change": "correction",
      "classification": "A1",
      "cves": [
        {
          "affected": "PAN-OS 12.1, 11.2, 11.1 and 10.2 below the fixed builds, with a GlobalProtect portal or gateway where authentication override cookies are enabled and a specific certificate configuration exists; Prisma Access 11.2 and 10.2 below the fixed builds",
          "cvss": "7.8",
          "fixed": "12.1.4-h6, 12.1.7; 11.2.4-h17, 11.2.7-h14, 11.2.10-h7, 11.2.12; 11.1.4-h33, 11.1.6-h32, 11.1.7-h6, 11.1.10-h25, 11.1.13-h5, 11.1.15; 10.2.7-h34, 10.2.10-h36, 10.2.13-h21, 10.2.16-h7, 10.2.18-h6; Prisma Access 11.2.7-h13, 10.2.10-h36",
          "id": "CVE-2026-0257",
          "status": [
            "exploited",
            "cisa-kev",
            "patch-available"
          ]
        }
      ],
      "exploited": true,
      "headline": "Qilin and Inc ransomware exploit the GlobalProtect bypass; one intrusion pivoted to vCenter and ESXi past in-guest EDR",
      "id": "2026-05-30/cve-2026-0257-palo-alto-pan-os-globalprotect-pre-auth-authen",
      "immediate_action": null,
      "kev": true,
      "kind": "vulnerability",
      "last_changed_at": "2026-10-25T13:41:20Z",
      "markdown_url": "https://ctipilot.ch/entries/2026-05-30/cve-2026-0257-palo-alto-pan-os-globalprotect-pre-auth-authen/index.md",
      "permalink": "https://ctipilot.ch/entries/2026-05-30/cve-2026-0257-palo-alto-pan-os-globalprotect-pre-auth-authen/",
      "priority": "high",
      "product_keys": [
        "product:palo-alto-networks-pan-os",
        "product:palo-alto-networks-prisma-access"
      ],
      "summary": "CVE-2026-0257 is a pre-auth VPN authentication bypass in PAN-OS GlobalProtect (CISA KEV; Palo Alto reports limited exploit attempts, and Rapid7 and Unit 42 report successful exploitation): an attacker forges valid auth-override cookies by re-using the GlobalProtect certificate shared with the HTTPS service, with no credentials. CISA's KEV catalog (version 2026.10.04) marks it as used in known ransomware campaigns, and Arctic Wolf's report of 2026-07-20 describes June 2026 intrusions in which Qilin ransomware deployment began with this bypass. Unit 42 now names Qilin and Inc as exploiting it and describes one intrusion that pivoted from the VPN gateway to vCenter and ESXi and stole domain credentials offline from a domain controller's virtual disk, which in-guest EDR does not see. Patch or disable auth-override cookies, and treat a gateway that was exposed and unpatched as a compromise-assessment target that includes the virtualization and backup tier.",
      "techniques": [
        "T1003.001",
        "T1003.003",
        "T1021.001",
        "T1021.002",
        "T1053.005",
        "T1133",
        "T1190",
        "T1219",
        "T1486",
        "T1490",
        "T1547.001",
        "T1567.002",
        "T1569.002",
        "T1685",
        "T1685.005"
      ],
      "verification": "multi-source"
    },
    {
      "actions": [
        "List every monitoring server, script, scheduled task and connection manager that stores an ESXi, vCenter or Proxmox root password, replace each with a least-privilege monitoring account, and rotate the root passwords that were stored or reused across hosts."
      ],
      "affected_products": [
        "VMware ESXi",
        "Proxmox VE",
        "Paessler PRTG Network Monitor"
      ],
      "change": "new",
      "classification": "B2",
      "cves": [],
      "exploited": false,
      "headline": "Kaspersky: ESXi and Proxmox ransomware ran on a monitoring server's root password and admin notes, no VM escape",
      "id": "2026-11-07/kaspersky-esxi-proxmox-ransomware-monitoring-root-password",
      "immediate_action": null,
      "kev": false,
      "kind": "threat",
      "last_changed_at": "2026-11-07T04:00:00Z",
      "markdown_url": "https://ctipilot.ch/entries/2026-11-07/kaspersky-esxi-proxmox-ransomware-monitoring-root-password/index.md",
      "permalink": "https://ctipilot.ch/entries/2026-11-07/kaspersky-esxi-proxmox-ransomware-monitoring-root-password/",
      "priority": "notable",
      "product_keys": [
        "product:paessler-prtg-network-monitor",
        "product:proxmox-ve",
        "product:vmware-esxi"
      ],
      "summary": "Kaspersky's Global Emergency Response Team describes two ransomware cases in virtualised estates. In the BlackNevas case a PRTG Network Monitor held ESXi root access and the same root password was reused across hosts, so the attacker connected over SSH, disabled the execInstalledOnly policy with esxcli, ran the encryptor and deleted logs; in the case attributed to The Gentlemen the actor found Proxmox root credentials in plaintext notes on an administrator workstation and used the VNC web socket to encrypt the cluster. Kaspersky stresses that no VM escape was needed.",
      "techniques": [
        "T1021.004",
        "T1021.005",
        "T1078.003",
        "T1219",
        "T1486",
        "T1552.001",
        "T1685",
        "T1685.006"
      ],
      "verification": "single-source"
    },
    {
      "actions": [
        "Install the latest .NET security updates through Windows Update on every Siemens Desigo CC V8 and V9 host.",
        "On every Industrial Edge Management instance running Common Configurator, uninstall all Management Applications and put the instance behind a firewall or WAF, and stop Common Configurator on Edge devices, until Siemens ships a fix, because Siemens lists no fix for it.",
        "Apply Mitel's workaround articles KB000129034 (OpenScape SESAP), KB000129100 (OpenScape SBC) and KB000129114 (OpenScape Contact Center) on the OpenScape SESAP, SBC and Contact Center systems in use, because Mitel has released no update for them."
      ],
      "affected_products": [
        "Siemens Desigo CC",
        "Siemens Industrial Edge",
        "Mitel MiVoice Business",
        "Mitel OpenScape SBC",
        "Mitel OpenScape Contact Center",
        "Cisco Duo Network Gateway",
        "Cisco RoomOS"
      ],
      "change": "new",
      "classification": "A2",
      "cves": [
        {
          "affected": "Siemens Desigo CC V8 and V9, all versions; Industrial Edge Management Applications, Common Configurator and the configurator applications below their fixed versions; Mitel MiVoice Business 10.6.0.7 and earlier, MiVoice Business Solution Virtual Instance up to the build Mitel lists, OpenScape SBC V11R3.4.4 and earlier, OpenScape SESAP V2 R1.1.9 and earlier, OpenScape Contact Center V12R0 to V12R0FR7, OpenScape Xpert V9 R0.2.0 and earlier, OpenScape Endpoint Management V1 R2.5.1 and earlier; Cisco Duo Network Gateway and RoomOS, which Cisco's combined advisory lists in a table with no per-CVE column, below the builds it lists",
          "cvss": "9.8 (CVSS 3.1, Siemens)",
          "fixed": "Desigo CC: latest .NET security updates via Windows Update; Industrial Edge: Data Flow Monitoring V3.0.18, Flow Creator Configurator V1.15.1 and four further configurators, Common Configurator no fix; Mitel: updates planned (OpenScape SBC V11R3.4.5, SESAP V2 R1.1.10, Contact Center V12R0FR8), none released; Cisco: fixes listed in its combined advisory for Duo Network Gateway 3.4.2 and RoomOS on-premises 11.41.2.3 and 26.7.4.3, not tied to one CVE",
          "id": "CVE-2026-111497",
          "status": [
            "exploited",
            "cisa-kev",
            "poc-public",
            "patch-available",
            "no-patch"
          ]
        }
      ],
      "exploited": true,
      "headline": "Brotli flaw hits Desigo CC, Industrial Edge and Mitel; Cisco lists Duo; Mitel and Common Configurator fixes pending",
      "id": "2026-11-07/cve-2026-111497-brotli-desigo-cc-mitel-openscape-cisco-duo",
      "immediate_action": null,
      "kev": true,
      "kind": "vulnerability",
      "last_changed_at": "2026-11-07T03:58:30Z",
      "markdown_url": "https://ctipilot.ch/entries/2026-11-07/cve-2026-111497-brotli-desigo-cc-mitel-openscape-cisco-duo/index.md",
      "permalink": "https://ctipilot.ch/entries/2026-11-07/cve-2026-111497-brotli-desigo-cc-mitel-openscape-cisco-duo/",
      "priority": "notable",
      "product_keys": [
        "product:cisco-duo-network-gateway",
        "product:cisco-roomos",
        "product:mitel-mivoice-business",
        "product:mitel-openscape-contact-center",
        "product:mitel-openscape-sbc",
        "product:siemens-desigo-cc",
        "product:siemens-industrial-edge"
      ],
      "summary": "Between 2026-10-27 and 2026-11-06 Siemens, Mitel and Cisco listed affected products in advisories that cover the Brotli decoder flaw CVE-2026-111497: Siemens names Desigo CC V8 and V9 (remedy: the latest .NET security updates) and Industrial Edge, where Common Configurator has no fix; Mitel names MiVoice Business and five OpenScape products with updates planned and workaround articles for three; Cisco's combined advisory lists Duo Network Gateway (3.4.2) and RoomOS among its products with fixes, a longer list of which is dated up to 2027, without saying which of its CVEs each fix addresses. Cisco says it is not aware of malicious use against any Cisco product, and CISA lists the flaw as exploited.",
      "techniques": [
        "T1190"
      ],
      "verification": "multi-source"
    },
    {
      "actions": [
        "On every musl-based Linux host that runs sshd (Alpine, OpenWrt, Buildroot, Yocto), install OpenSSH 10.6p2 or the distribution's fixed openssh package and restart sshd, because updating the package does not replace the running server, and rebuild container and cloud images from a fixed base; until then set PasswordAuthentication no in sshd_config and restart sshd."
      ],
      "affected_products": [
        "OpenSSH",
        "Alpine Linux",
        "OpenWrt"
      ],
      "change": "update",
      "classification": "A2",
      "cves": [
        {
          "affected": "OpenSSH Portable before 10.6p2 on Linux with musl libc and no PAM; needs an account whose password field is * and at least one other account with a real password",
          "cvss": "8.1",
          "fixed": "OpenSSH Portable 10.6p2; Alpine edge 10.6_p2-r0, 3.24 10.3_p1-r2, 3.23 10.2_p1-r1, 3.22 10.0_p1-r11, 3.21 9.9_p2-r1, 3.20 9.7_p1-r6, 3.19 9.6_p1-r3, 3.18 9.3_p2-r4, 3.17 9.1_p1-r7, 3.16 9.0_p1-r6 per OX Security; temporary mitigation PasswordAuthentication no",
          "id": "CVE-2026-123158",
          "status": [
            "poc-public",
            "patch-available"
          ]
        }
      ],
      "exploited": false,
      "headline": "OpenSSH 10.6p2: password bypass on musl Linux without PAM (Alpine, OpenWrt); update or turn passwords off",
      "id": "2026-11-06/cve-2026-123158-openssh-musl-no-pam-password-bypass-sshole",
      "immediate_action": null,
      "kev": false,
      "kind": "vulnerability",
      "last_changed_at": "2026-11-07T03:52:19Z",
      "markdown_url": "https://ctipilot.ch/entries/2026-11-06/cve-2026-123158-openssh-musl-no-pam-password-bypass-sshole/index.md",
      "permalink": "https://ctipilot.ch/entries/2026-11-06/cve-2026-123158-openssh-musl-no-pam-password-bypass-sshole/",
      "priority": "notable",
      "product_keys": [
        "product:alpine-linux",
        "product:openssh",
        "product:openwrt"
      ],
      "summary": "OpenSSH Portable 10.6p2 of 2026-11-05 works around CVE-2026-123158, a password-authentication bypass on Linux systems that use musl libc and run sshd without PAM, Alpine's default OpenSSH server and OpenWrt among them: a password of 257 to 1,024 bytes logs in to an account whose password field is *. NCSC Switzerland published an advisory the same day and rates exploitation unknown; Alpine shipped fixed packages for every branch back to 3.16. Previdian's page, as read on 2026-11-07, reports 15 exploitation attempts from 10 addresses since 2026-11-06 and, according to The Hacker News, a successful root login on an Alpine honeypot; CISA does not list the flaw.",
      "techniques": [
        "T1021.004",
        "T1190"
      ],
      "verification": "multi-source"
    },
    {
      "actions": [
        "In every Okta org that allows self-service registration, review the accounts created since 2026-10-13 and every Okta Verify enrollment on them, and remove self-created accounts that nobody provisioned."
      ],
      "affected_products": [
        "Microsoft Entra ID",
        "Okta"
      ],
      "change": "update",
      "classification": "B2",
      "cves": [],
      "exploited": false,
      "headline": "Microsoft: Storm-0940 runs ARTEX at machine speed; Mandiant now sees agent frameworks in incident-response cases",
      "id": "2026-10-22/artex-storm-0940-agentic-llm-pentest-spraying-oauth-abuse",
      "immediate_action": null,
      "kev": false,
      "kind": "threat",
      "last_changed_at": "2026-11-07T03:50:15Z",
      "markdown_url": "https://ctipilot.ch/entries/2026-10-22/artex-storm-0940-agentic-llm-pentest-spraying-oauth-abuse/index.md",
      "permalink": "https://ctipilot.ch/entries/2026-10-22/artex-storm-0940-agentic-llm-pentest-spraying-oauth-abuse/",
      "priority": "notable",
      "product_keys": [
        "product:microsoft-entra-id",
        "product:okta"
      ],
      "summary": "Microsoft reports that since at least September 2026 Storm-0940, a China-state aligned actor, has used ARTEX, an open-source multi-agent LLM penetration-testing framework, to automate scanning, password spraying and OAuth-application abuse against hundreds of organizations across many industries including government, reaching privileged cloud access in under three hours in several cases; Expel saw the same infrastructure create its own accounts through Okta self-service registration. Google Threat Intelligence Group and Mandiant report on 2026-10-31 that since late August they have seen ARTEX, PentAGI and CAIRN operated in incident-response cases, with ARTEX adopted by extortion groups and suspected PRC-nexus clusters whose victims include US government organizations, and that the original ARTEX repository was taken down in October while forks keep it in circulation. CrowdStrike and Recorded Future document another actor using the framework, and Seoul police referred a criminal group's leader to prosecutors on 2026-10-23 for extorting 38 of more than 90 organizations, with the same framework according to BleepingComputer. Microsoft adds on 2026-11-06 another cluster, the Cambodia-based, financially motivated Storm-3358 targeting financial organisations, and Check Point reads ten exposed operator consoles that show near-autonomous, opportunistic ARTEX campaigns.",
      "techniques": [
        "T1078",
        "T1078.004",
        "T1087.002",
        "T1087.004",
        "T1098.001",
        "T1098.003",
        "T1098.005",
        "T1105",
        "T1110.003",
        "T1136.003",
        "T1190",
        "T1219",
        "T1505.003",
        "T1580",
        "T1588.007",
        "T1595"
      ],
      "verification": "multi-source"
    },
    {
      "actions": [
        "Upgrade every FreeSWITCH to 1.11.3, or until then set enable-chat=false on every SIP profile that does not need inbound SIP chat and remove directory users that have no password; on an instance that SIP peers could reach, rotate the SIP trunk and directory credentials stored in its configuration, because the advisory lists disclosure of configuration and credentials as an impact and says exploitation has been observed."
      ],
      "affected_products": [
        "FreeSWITCH"
      ],
      "change": "new",
      "classification": "A2",
      "cves": [
        {
          "affected": "FreeSWITCH 1.11.2 and earlier; any SIP profile that accepts inbound MESSAGE, which stock conf/vanilla enables on the internal and external profiles",
          "cvss": "9.8",
          "fixed": "FreeSWITCH 1.11.3, which adds a per-profile enable-chat-api-proto parameter that is off unless set",
          "id": "CVE-2026-116779",
          "status": [
            "exploited",
            "patch-available"
          ]
        }
      ],
      "exploited": true,
      "headline": "FreeSWITCH: one SIP MESSAGE runs API commands, vendor says exploited; fixed in 1.11.3",
      "id": "2026-11-06/cve-2026-116779-freeswitch-sip-message-api-command-execution",
      "immediate_action": null,
      "kev": false,
      "kind": "vulnerability",
      "last_changed_at": "2026-11-06T03:42:00Z",
      "markdown_url": "https://ctipilot.ch/entries/2026-11-06/cve-2026-116779-freeswitch-sip-message-api-command-execution/index.md",
      "permalink": "https://ctipilot.ch/entries/2026-11-06/cve-2026-116779-freeswitch-sip-message-api-command-execution/",
      "priority": "notable",
      "product_keys": [
        "product:freeswitch"
      ],
      "summary": "SignalWire's advisory of 2026-10-28 describes CVE-2026-116779 (CVSS 3.1 9.8): an inbound SIP MESSAGE to a FreeSWITCH SIP profile selects the api chat proto and runs FreeSWITCH API commands with the privileges of the FreeSWITCH process, in the default configuration of 1.11.2 and earlier, and the advisory states that exploitation of this path has been observed in the wild. BSI CERT-Bund relayed it as a critical advisory on 2026-11-05; no source names an actor or victim, and the exploitation claim is the vendor's alone.",
      "techniques": [
        "T1059",
        "T1190"
      ],
      "verification": "single-source"
    },
    {
      "actions": [
        "On every internet-facing Linux server and every XenServer or XCP-ng host with its Workload Balancing and Conversion Manager appliances, install the vendor's fix and reboot as soon as it ships, then confirm the running version; Red Hat, Debian, CIQ, Amazon Linux, XCP-ng, MikroTik and Citrix updates are out, and XCP-ng says that a host which cannot reboot at once should take its iptables-based mitigation first and the update later.",
        "On hosts that cannot reboot yet, drop IPv4 TCP packets that carry IP options ahead of the TCP stack as CIQ, AWS and Vates describe, after testing on one non-production host because it also drops legitimate option-bearing traffic; disabling MPTCP alone does not close the path."
      ],
      "affected_products": [
        "Linux kernel",
        "Ubuntu",
        "Red Hat Enterprise Linux",
        "Citrix XenServer",
        "Citrix Workload Balancing",
        "Citrix Conversion Manager",
        "XCP-ng",
        "Xen Orchestra Appliance",
        "MikroTik RouterOS",
        "WatchGuard Fireware OS",
        "WatchGuard AP",
        "WatchGuard Dimension"
      ],
      "change": "update",
      "classification": "B2",
      "cves": [
        {
          "affected": "Linux kernels from 4.4 on the IPv4 TCP path; Ubuntu 22.04, 24.04, 26.04 and 26.10 (fix in progress) and 20.04, 18.04 and 16.04; RHEL 8, 9 and 10; Rocky Linux 8, 9 and 10 (CIQ lists patched kernels for every RLC Pro variant, community releases follow Rocky errata); RHEL 7 and Ubuntu 14.04 are not affected; Citrix XenServer 8.4 and 9, Workload Balancing before 2026.1.1 and Conversion Manager before 2026.2.0; XCP-ng 8.3 and Xen Orchestra Appliance; WatchGuard Fireware OS, AP and Dimension (potentially affected, unresolved)",
          "cvss": "9.8 (CVSS 3.1, kernel.org CNA and Red Hat; upstream rates it 8.1 per CIQ)",
          "fixed": "upstream 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.56, 7.2.10 and 7.3-rc7; Debian bookworm 6.1.190-1 and trixie 6.12.113-1; CIQ RLC Pro LTS 9.6 and FIPS 9.6 kernel-5.14.0-570.60.1+27.2.el9_6_ciq, LTS 9.2 and FIPS 9.2 kernel-5.14.0-284.30.1+45.1.el9_2_ciq, LTS 8.6 kernel-4.18.0-372.32.1+40.1.el8_6_ciq (2026-10-31), RLC Pro 8 and FIPS 8.10 kernel-4.18.0-553.178.1+2.1.el8_10_ciq, FIPS 8.6 kernel-4.18.0-553.178.1+2.1.el8_6.ciqfips, RLC Pro 9 kernel-5.14.0-687.60.1+2.1.el9_8_ciq and RLC Pro 10 kernel-6.12.0-211.68.1+2.1.el10_2_ciq (2026-11-01); Debian trixie security 6.12.115-2; Amazon Linux 2 and 2023 kernel packages (AWS, 2026-11-02); fixes for some kernels from Oracle Linux and SUSE; Ubuntu fixes in progress as of 2026-11-04; Citrix XenServer 8.4 and 9 updates in the Early Access and Normal channels (no build named), Workload Balancing 2026.1.1 or later and Conversion Manager 2026.2.0; XCP-ng 8.3 kernel-4.19.19-8.0.46.14.xcpng8.3 and Xen Orchestra Appliance linux 6.1.190-1 (reboot required); MikroTik RouterOS 7.25.1 and 7.24.6; no fix yet from WatchGuard or Fortinet; Red Hat RHEL 8 kernel-4.18.0-553.182.1.el8_10 (RHSA-2026:93414), RHEL 9 kernel-5.14.0-687.64.1.el9_8 (RHSA-2026:93412) and RHEL 10 kernel-6.12.0-211.72.1.el10_2 (RHSA-2026:93413), all released 2026-11-01",
          "id": "CVE-2026-98432",
          "status": [
            "patch-available"
          ]
        }
      ],
      "exploited": false,
      "headline": "Linux TCP use-after-free: Citrix XenServer and XCP-ng fixes are out, WatchGuard and Fortinet still have none",
      "id": "2026-10-31/cve-2026-98432-linux-kernel-tcp-uaf-mptcp-remote-root",
      "immediate_action": null,
      "kev": false,
      "kind": "vulnerability",
      "last_changed_at": "2026-11-05T04:04:49Z",
      "markdown_url": "https://ctipilot.ch/entries/2026-10-31/cve-2026-98432-linux-kernel-tcp-uaf-mptcp-remote-root/index.md",
      "permalink": "https://ctipilot.ch/entries/2026-10-31/cve-2026-98432-linux-kernel-tcp-uaf-mptcp-remote-root/",
      "priority": "notable",
      "product_keys": [
        "product:citrix-conversion-manager",
        "product:citrix-workload-balancing",
        "product:citrix-xenserver",
        "product:linux-kernel",
        "product:mikrotik-routeros",
        "product:red-hat-enterprise-linux",
        "product:ubuntu",
        "product:watchguard-ap",
        "product:watchguard-dimension",
        "product:watchguard-fireware-os",
        "product:xcp-ng",
        "product:xen-orchestra-appliance"
      ],
      "summary": "The Linux kernel CVE team published CVE-2026-98432 on 2026-10-15, a use-after-free in the IPv4 TCP connection setup path that dates to Linux 4.4 and is reached by a SYN packet carrying IP options; the CNA scores it CVSS 9.8. Anthropic reports that Claude wrote an exploit giving a remote, unauthenticated attacker root on servers with a multipath TCP (MPTCP) listener, which CloudLinux's kernel team could not reproduce; the Go team says the bug is not specific to MPTCP and Akamai that disabling MPTCP does not prevent exploitation, and no source reports attacks. Citrix rates its XenServer 8.4 and 9 bulletin Critical and names fixes for Workload Balancing and Conversion Manager, XCP-ng released a kernel fix, MikroTik's RouterOS 7.25.1 and 7.24.6 list the CVE, Red Hat, Debian, CIQ and Amazon Linux kernels are fixed and Ubuntu's were still in progress on 2026-11-04, while WatchGuard (Fireware OS, AP, Dimension) and Fortinet list their products as unresolved or under investigation without a fixed build.",
      "techniques": [
        "T1190",
        "T1499.004"
      ],
      "verification": "multi-source"
    },
    {
      "actions": [
        "Move every managed iPhone and iPad to the newest iOS available for its model and every managed Android phone to Chrome 146 or later and the OEM patch level that fixes CVE-2025-27038, and list the devices that cannot go past iOS 16.7.x (iPhone 8, 8 Plus, X, iPad 5th generation, iPad Pro 9.7-inch and 12.9-inch 1st generation per Apple), because Sekoia's chains do not work against fully updated devices and CISA lists all eight flaws they deliver as exploited."
      ],
      "affected_products": [
        "Apple iOS",
        "Apple iPadOS",
        "Google Chrome",
        "Qualcomm Adreno GPU driver",
        "Plerdy SEO Tracker"
      ],
      "change": "new",
      "classification": "B2",
      "cves": [
        {
          "affected": "iOS and iPadOS before 16.7.8 (iPhone 8, 8 Plus, X, iPad 5th generation, iPad Pro 9.7-inch and 12.9-inch 1st generation) and before 17.5; CISA's catalog entry also lists macOS, Safari, tvOS and watchOS; Sekoia reports exploitation only against iOS 16.7",
          "cvss": null,
          "fixed": "iOS and iPadOS 16.7.8 and 17.5 (both released 2024-05-13); CISA's catalog entry lists the other Apple platforms",
          "id": "CVE-2024-27834",
          "status": [
            "exploited",
            "cisa-kev",
            "patch-available"
          ]
        },
        {
          "affected": "iOS before 26.2 and 18.7.3; first step of Sekoia's iOS 16.7 chain and of the DarkSword-based chain",
          "cvss": null,
          "fixed": "iOS 26.2 and 18.7.3; no fetched Apple page lists a fix for iOS 16.7.x",
          "id": "CVE-2025-43529",
          "status": [
            "exploited",
            "cisa-kev",
            "patch-available"
          ]
        },
        {
          "affected": "iOS before 26.3; pointer-authentication bypass in the DarkSword-based chain",
          "cvss": null,
          "fixed": "iOS 26.3",
          "id": "CVE-2026-20700",
          "status": [
            "exploited",
            "cisa-kev",
            "patch-available"
          ]
        },
        {
          "affected": "iOS before 26.2 and 18.7.3; first sandbox escape of the DarkSword-based chain",
          "cvss": null,
          "fixed": "iOS 26.2 and 18.7.3",
          "id": "CVE-2025-14174",
          "status": [
            "exploited",
            "cisa-kev",
            "patch-available"
          ]
        },
        {
          "affected": "iOS before 26.1 and 18.7.2; second sandbox escape of the DarkSword-based chain",
          "cvss": null,
          "fixed": "iOS 26.1 and 18.7.2",
          "id": "CVE-2025-43510",
          "status": [
            "exploited",
            "cisa-kev",
            "patch-available"
          ]
        },
        {
          "affected": "iOS before 26.1 and 18.7.2; kernel read and write step of the DarkSword-based chain",
          "cvss": null,
          "fixed": "iOS 26.1 and 18.7.2",
          "id": "CVE-2025-43520",
          "status": [
            "exploited",
            "cisa-kev",
            "patch-available"
          ]
        },
        {
          "affected": "Chrome before 146 on Android, served by Sekoia's delivery host to Chrome 139 to 145 except 143; code execution in the V8 renderer",
          "cvss": null,
          "fixed": "Chrome 146 (desktop stable 146.0.7680.75/76 of 2026-03-12)",
          "id": "CVE-2026-3910",
          "status": [
            "exploited",
            "cisa-kev",
            "patch-available"
          ]
        },
        {
          "affected": "Android phones with a vulnerable Qualcomm Adreno GPU driver; sandbox escape of the Android chain, which stops on the Samsung Galaxy S25 Ultra",
          "cvss": null,
          "fixed": "OEM patch level; CISA's catalog entry says to check with each OEM for patching status",
          "id": "CVE-2025-27038",
          "status": [
            "exploited",
            "cisa-kev",
            "patch-available"
          ]
        }
      ],
      "exploited": true,
      "headline": "APT29-linked watering hole uses n-day iOS and Chrome chains; CISA lists CVE-2024-27834; updated devices resist",
      "id": "2026-11-05/apt29-watering-hole-ios-android-n-day-chains-kev",
      "immediate_action": null,
      "kev": true,
      "kind": "threat",
      "last_changed_at": "2026-11-05T03:58:30Z",
      "markdown_url": "https://ctipilot.ch/entries/2026-11-05/apt29-watering-hole-ios-android-n-day-chains-kev/index.md",
      "permalink": "https://ctipilot.ch/entries/2026-11-05/apt29-watering-hole-ios-android-n-day-chains-kev/",
      "priority": "notable",
      "product_keys": [
        "product:apple-ios",
        "product:apple-ipados",
        "product:google-chrome",
        "product:plerdy-seo-tracker",
        "product:qualcomm-adreno-gpu-driver"
      ],
      "summary": "Sekoia reports a watering-hole campaign it assesses with moderate to high confidence to be APT29 or a subgroup, serving platform-specific exploit chains for iOS 16.7, a DarkSword-based iOS chain and Chrome 139 to 145 on Android through injected sites, clone domains and a one-week compromise of the Plerdy analytics script; Sekoia says none of the chains works against fully updated devices. CISA added the Apple WebKit pointer-authentication bypass CVE-2024-27834, the second step of the iOS 16.7 chain and fixed in May 2024, to its Known Exploited Vulnerabilities catalog on 2026-11-04; no Swiss victim is named.",
      "techniques": [
        "T1005",
        "T1041",
        "T1068",
        "T1189",
        "T1195.002",
        "T1203",
        "T1539",
        "T1555.003",
        "T1557",
        "T1583.001",
        "T1592"
      ],
      "verification": "single-source"
    },
    {
      "actions": [
        "Upgrade every SEPPmail Secure Email Gateway to 15.1.1 now, moving 15.0.x gateways to the 15.1 branch because 15.0.7 is the last 15.0 release, and check each gateway's active address-replacement rules for values taken from the message and its Large File Transfer setting, the two conditions the CNA names."
      ],
      "affected_products": [
        "SEPPmail Secure E-Mail Gateway"
      ],
      "change": "new",
      "classification": "A2",
      "cves": [
        {
          "affected": "SEPPmail Secure Email Gateway before 15.1.1, 15.0.x included; reachable only where an active rule uses message-derived replacement data and its search condition matches",
          "cvss": "9.2 (CVSS 4.0)",
          "fixed": "15.1.1 (patch release of 2026-11-03); no 15.0.x fix, 15.0.7 of 2026-09-02 is the last 15.0 release",
          "id": "CVE-2026-114424",
          "status": [
            "patch-available"
          ]
        },
        {
          "affected": "SEPPmail Secure Email Gateway before 15.1.1, 15.0.x included; reachable only where Large File Transfer is enabled and the message reaches an affected secure-mail processing path",
          "cvss": "9.2 (CVSS 4.0)",
          "fixed": "15.1.1 (patch release of 2026-11-03); no 15.0.x fix",
          "id": "CVE-2026-114425",
          "status": [
            "patch-available"
          ]
        },
        {
          "affected": "SEPPmail Secure Email Gateway before 15.1.1, 15.0.x included",
          "cvss": "8.7 (CVSS 4.0)",
          "fixed": "15.1.1 (patch release of 2026-11-03); no 15.0.x fix",
          "id": "CVE-2026-114426",
          "status": [
            "patch-available"
          ]
        },
        {
          "affected": "SEPPmail Secure Email Gateway before 15.1.1, 15.0.x included; GINA webmail accounts that were created but not registered and still have an empty initial password",
          "cvss": "8.3 (CVSS 4.0)",
          "fixed": "15.1.1 (patch release of 2026-11-03); no 15.0.x fix",
          "id": "CVE-2026-114421",
          "status": [
            "patch-available"
          ]
        },
        {
          "affected": "SEPPmail Secure Email Gateway before 15.1.1, 15.0.x included; GINA web interface account selection",
          "cvss": "6.9 (CVSS 4.0)",
          "fixed": "15.1.1 (patch release of 2026-11-03); no 15.0.x fix",
          "id": "CVE-2026-114420",
          "status": [
            "patch-available"
          ]
        }
      ],
      "exploited": false,
      "headline": "SEPPmail gateway: unauthenticated sender reaches root RCE or file access; fixed in 15.1.1, 15.0.x has no fix",
      "id": "2026-11-05/seppmail-gateway-15-1-1-unauth-root-rce-and-file-access",
      "immediate_action": null,
      "kev": false,
      "kind": "vulnerability",
      "last_changed_at": "2026-11-05T03:58:00Z",
      "markdown_url": "https://ctipilot.ch/entries/2026-11-05/seppmail-gateway-15-1-1-unauth-root-rce-and-file-access/index.md",
      "permalink": "https://ctipilot.ch/entries/2026-11-05/seppmail-gateway-15-1-1-unauth-root-rce-and-file-access/",
      "priority": "notable",
      "product_keys": [
        "product:seppmail-secure-e-mail-gateway"
      ],
      "summary": "SEPPmail's patch release 15.1.1 of 2026-11-03 fixes five flaws in the Secure Email Gateway, with NCSC.ch as the CNA: CVE-2026-114424 lets an unauthenticated remote sender run operating-system commands as root through an active address-replacement rule that uses message-derived data, and CVE-2026-114425 lets one disclose, move or delete files as root when Large File Transfer is enabled (both CVSS 4.0 9.2). The vendor says 15.0.7 was the last 15.0 release, so 15.0.x gateways must move to the 15.1 branch; no source reports exploitation.",
      "techniques": [
        "T1059",
        "T1190"
      ],
      "verification": "single-source"
    },
    {
      "actions": [
        "List the computers in Active Directory that carry the service principal name the iSCSI Target Server registers and every host that listens on TCP 3260, then enable CHAP on each target and restrict TCP 3260 to the addresses of the cluster nodes, starting with targets whose volumes hold Hyper-V disks of domain controllers."
      ],
      "affected_products": [
        "Microsoft iSCSI Target Server"
      ],
      "change": "new",
      "classification": "B2",
      "cves": [],
      "exploited": false,
      "headline": "SpecterOps: iSCSI Target Server without CHAP lets a host that knows the target and initiator names read shared disks",
      "id": "2026-11-05/windows-iscsi-target-server-without-chap-disk-access",
      "immediate_action": null,
      "kev": false,
      "kind": "research",
      "last_changed_at": "2026-11-05T03:56:30Z",
      "markdown_url": "https://ctipilot.ch/entries/2026-11-05/windows-iscsi-target-server-without-chap-disk-access/index.md",
      "permalink": "https://ctipilot.ch/entries/2026-11-05/windows-iscsi-target-server-without-chap-disk-access/",
      "priority": "notable",
      "product_keys": [
        "product:microsoft-iscsi-target-server"
      ],
      "summary": "SpecterOps (2026-11-04) shows that a Windows iSCSI Target Server configured as a common cluster guide describes, with the optional CHAP step skipped, accepts a login from any host that knows the target host, the target name and an authorised initiator name, and the post says the host and the names can be found. The attacker then reads the shared disk below file-system permissions; where it holds a Hyper-V domain controller's virtual disk, the directory database and local credential stores are exposed. CHAP, network segmentation and volume encryption are the levers.",
      "techniques": [
        "T1003.002",
        "T1003.003",
        "T1003.004",
        "T1018"
      ],
      "verification": "single-source"
    },
    {
      "actions": [
        "Until Xerox's fixes ship (AltaLink, EC81xx and VersaLink expected 2026-11-06; WorkCentre 3655, EC7836 and EC7856 in development), limit the web interface (HTTP/HTTPS) of those printers to trusted networks or management hosts with a firewall or segmentation, or disable HTTP/HTTPS where remote web administration is not needed, accepting that this also disables the embedded web server and the features that depend on it."
      ],
      "affected_products": [
        "Xerox AltaLink",
        "Xerox EC81xx",
        "Xerox VersaLink",
        "Xerox WorkCentre",
        "Fiery Digital Front End",
        "Xerox Worldwide Ticketing Tool"
      ],
      "change": "update",
      "classification": "A2",
      "cves": [
        {
          "affected": "Xerox AltaLink and EC81xx; VersaLink C/B415, C/B625 and C/B620; WorkCentre 3655, EC7836 and EC7856; Fiery Digital Front End; Worldwide Ticketing Tool (most current releases evaluated, bulletin XRX26-016 of 2026-11-03)",
          "cvss": null,
          "fixed": "none released as of 2026-11-03: AltaLink, EC81xx and VersaLink fixes expected 2026-11-06; Fiery patches by 2026-11-09 (FS500 to FS800, Pro included), 2026-11-16 (FS300 to FS400, Pro included) and 2026-11-23 (FS200, Pro included); WorkCentre and Worldwide Ticketing Tool fixes in development; interim measure for AltaLink, EC81xx, VersaLink and WorkCentre: restrict the web interface (HTTP/HTTPS) to trusted networks or management hosts, or disable it",
          "id": "CVE-2026-109618",
          "status": [
            "cisa-kev",
            "no-patch",
            "mitigation-only"
          ]
        },
        {
          "affected": "Xerox AltaLink and EC81xx; VersaLink C/B415, C/B625 and C/B620; WorkCentre 3655, EC7836 and EC7856; Fiery Digital Front End; Worldwide Ticketing Tool (most current releases evaluated, bulletin XRX26-016 of 2026-11-03)",
          "cvss": null,
          "fixed": "none released as of 2026-11-03: AltaLink, EC81xx and VersaLink fixes expected 2026-11-06; Fiery patches by 2026-11-09 (FS500 to FS800, Pro included), 2026-11-16 (FS300 to FS400, Pro included) and 2026-11-23 (FS200, Pro included); WorkCentre and Worldwide Ticketing Tool fixes in development; interim measure for AltaLink, EC81xx, VersaLink and WorkCentre: restrict the web interface (HTTP/HTTPS) to trusted networks or management hosts, or disable it",
          "id": "CVE-2026-109619",
          "status": [
            "cisa-kev",
            "no-patch",
            "mitigation-only"
          ]
        }
      ],
      "exploited": true,
      "headline": "PHP2Shell affects Xerox AltaLink and VersaLink printers and Fiery controllers; fixes due 6 to 23 November",
      "id": "2026-11-02/xerox-fiery-php2shell-printers-fixes-due-6-to-23-november",
      "immediate_action": null,
      "kev": true,
      "kind": "vulnerability",
      "last_changed_at": "2026-11-05T03:51:20Z",
      "markdown_url": "https://ctipilot.ch/entries/2026-11-02/xerox-fiery-php2shell-printers-fixes-due-6-to-23-november/index.md",
      "permalink": "https://ctipilot.ch/entries/2026-11-02/xerox-fiery-php2shell-printers-fixes-due-6-to-23-november/",
      "priority": "notable",
      "product_keys": [
        "product:fiery-digital-front-end",
        "product:xerox-altalink",
        "product:xerox-ec81xx",
        "product:xerox-versalink",
        "product:xerox-workcentre",
        "product:xerox-worldwide-ticketing-tool"
      ],
      "summary": "Xerox's security bulletin XRX26-016 (published 2026-10-23, updated 2026-11-03) lists AltaLink, EC81xx, VersaLink C/B415, C/B625 and C/B620, WorkCentre 3655, EC7836 and EC7856, the Fiery Digital Front End and the Worldwide Ticketing Tool as affected by the PHP flaws CVE-2026-109618 and CVE-2026-109619, and no fixed build is out: Xerox expects the AltaLink, EC81xx and VersaLink fixes on 2026-11-06, Fiery patches are due between 2026-11-09 and 2026-11-23, and the WorkCentre and Ticketing Tool fixes are in development. Until then Xerox says to restrict the web interface of AltaLink, EC81xx, VersaLink and WorkCentre devices to trusted networks or management hosts, or to disable HTTP/HTTPS; the bulletin gives no statement on exploitation of Xerox devices, and CISA lists both PHP flaws as exploited.",
      "techniques": [
        "T1190"
      ],
      "verification": "single-source"
    },
    {
      "actions": [
        "On every Linux server that ran cPGuard on 2026-11-02, update to the latest version (the disclosure names 5.88.26 as the clean update), confirm that the hidden root shell and the scheduled task the fake update left are gone, then reset root and local passwords from a trusted environment and rotate the root SSH keys, the MySQL root password, any cloud storage keys and every secret in root's shell history; rebuild from a clean backup taken before 1 November any server the vendor tells you the attacker logged in to by hand."
      ],
      "affected_products": [
        "OpsShield cPGuard"
      ],
      "change": "new",
      "classification": "B2",
      "cves": [],
      "exploited": false,
      "headline": "cPGuard update channel pushed a fake root update to about 2,950 servers on 2 Nov; update, then rotate root secrets",
      "id": "2026-11-04/cpguard-update-channel-hijacked-backdoor-root-secrets",
      "immediate_action": null,
      "kev": false,
      "kind": "incident",
      "last_changed_at": "2026-11-04T03:45:00Z",
      "markdown_url": "https://ctipilot.ch/entries/2026-11-04/cpguard-update-channel-hijacked-backdoor-root-secrets/index.md",
      "permalink": "https://ctipilot.ch/entries/2026-11-04/cpguard-update-channel-hijacked-backdoor-root-secrets/",
      "priority": "notable",
      "product_keys": [
        "product:opsshield-cpguard"
      ],
      "summary": "OPSSHIELD's disclosure of 2026-11-03 says an attacker registered as a customer on its billing portal and ran commands on the billing and licensing server, through crafted requests to the portal's callback pages (the vendor's logs do not record the exact request that gave access), took the keys used to publish updates and shipped a fake cPGuard update for about 70 minutes on 2026-11-02 (02:08 to 03:20 UTC). The update ran as root on about 2,950 customer servers, copied password hashes, root SSH keys, the MySQL root password and root shell history (cloud storage keys on a few) and left a hidden root shell and a scheduled task; about 7,900 billing-portal accounts were exposed as well. The clean update 5.88.26 removes the shell and a follow-up update removes the task, but credentials copied before cleanup may still be usable.",
      "techniques": [
        "T1003.008",
        "T1041",
        "T1053.003",
        "T1059.004",
        "T1078",
        "T1190",
        "T1195.002",
        "T1552.001",
        "T1552.003",
        "T1552.004"
      ],
      "verification": "single-source-victim"
    },
    {
      "actions": [
        "Restrict the Trend Micro Apex Central and Apex One server consoles and web endpoints to administrator networks now, apply Trend Micro's interim mitigation, and install the critical patches when they ship, due on 2026-11-11, and the Mobile Security for Enterprise patch due on 2026-11-17 (until then take its mitigation from Trend Micro support); install the critical patches the table now lists for Deep Discovery Inspector and Email Inspector.",
        "Install KACE SMA 15.0 CU5 or 15.1 CU2 and the SDA 9.3 hotfix 9.3.313 (9.3.312 where already installed), and until then block inbound ports 80, 443 and 52230 to every appliance, as Quest advises."
      ],
      "affected_products": [
        "Trend Micro Apex Central",
        "Trend Micro Apex One",
        "Trend Micro Mobile Security for Enterprise",
        "Quest KACE Systems Management Appliance",
        "Quest KACE Systems Deployment Appliance",
        "NetApp ONTAP 9"
      ],
      "change": "update",
      "classification": "A2",
      "cves": [
        {
          "affected": "Trend Micro Apex Central, Apex One on-premises server and Mobile Security for Enterprise (versions not given); Quest KACE SMA and SDA, all versions; NetApp ONTAP 9 (releases not enumerated)",
          "cvss": "9.2 (NetApp, CVSS 4.0)",
          "fixed": "Trend Micro: none yet for Apex Central and Apex One server, critical patches due 2026-11-11, and Mobile Security for Enterprise due 2026-11-17; Deep Discovery Inspector and Email Inspector critical patches listed as of 2026-10-30; Quest KACE SMA 15.0 CU5 (15.0.378) and 15.1 CU2 (15.1.177), SDA 9.3 hotfix 9.3.313 (9.3.312 where already installed); NetApp ONTAP 9.12.1P20HF1, 9.13.1P21HF1, 9.14.1P18HF1, 9.15.1P20HF1, 9.16.1P16HF1, 9.17.1P11HF1, 9.18.1P8HF1, 9.19.1P3HF1 and 9.19.1P4",
          "id": "CVE-2026-109618",
          "status": [
            "cisa-kev",
            "patch-available"
          ]
        },
        {
          "affected": "Trend Micro Apex Central, Apex One on-premises server and Mobile Security for Enterprise (versions not given); Quest KACE SMA and SDA, all versions; NetApp ONTAP 9 is not affected by this flaw",
          "cvss": "9.2 (NetApp, CVSS 4.0)",
          "fixed": "Trend Micro: none yet for Apex Central and Apex One server, critical patches due 2026-11-11, and Mobile Security for Enterprise due 2026-11-17; Deep Discovery Inspector and Email Inspector critical patches listed as of 2026-10-30; Quest KACE SMA 15.0 CU5 (15.0.378) and 15.1 CU2 (15.1.177), SDA 9.3 hotfix 9.3.313 (9.3.312 where already installed)",
          "id": "CVE-2026-109619",
          "status": [
            "cisa-kev",
            "patch-available"
          ]
        }
      ],
      "exploited": true,
      "headline": "PHP2Shell: Trend Micro Apex Central and Apex One await patches to 11 Nov; Quest KACE and NetApp ONTAP have fixes",
      "id": "2026-10-29/php2shell-trend-micro-apex-quest-kace-netapp-ontap",
      "immediate_action": null,
      "kev": true,
      "kind": "vulnerability",
      "last_changed_at": "2026-11-03T03:47:17Z",
      "markdown_url": "https://ctipilot.ch/entries/2026-10-29/php2shell-trend-micro-apex-quest-kace-netapp-ontap/index.md",
      "permalink": "https://ctipilot.ch/entries/2026-10-29/php2shell-trend-micro-apex-quest-kace-netapp-ontap/",
      "priority": "notable",
      "product_keys": [
        "product:netapp-ontap-9",
        "product:quest-kace-systems-deployment-appliance",
        "product:quest-kace-systems-management-appliance",
        "product:trend-micro-apex-central",
        "product:trend-micro-apex-one",
        "product:trend-micro-mobile-security-for-enterprise"
      ],
      "summary": "Trend Micro's advisory, last updated 2026-11-02, lists Apex Central and the on-premises Apex One server as impacted by the PHP flaws with critical patches due on 2026-11-11 and interim mitigations, shows critical patches for Deep Discovery Inspector and Email Inspector, and adds Mobile Security for Enterprise as impacted with a patch due on 2026-11-17; Quest says all KACE SMA and SDA versions are affected, with SMA 15.0 CU5 and 15.1 CU2 and the SDA 9.3 hotfix out and advice to block ports 80, 443 and 52230 until applied; and NetApp's advisory lists ONTAP 9 as affected only by CVE-2026-109618, with attacker access as the www user restricted to the PHP jail and hotfix builds from 9.12.1P20HF1 to 9.19.1P4. NetApp says it is aware of public discussion of the vulnerability and none of the three vendors reports an exploited case in what was read, although CISA lists both flaws as exploited.",
      "techniques": [
        "T1190"
      ],
      "verification": "single-source"
    },
    {
      "actions": [
        "Upgrade every WS_FTP Server on Windows to 2024.0.7 or 2025.0.4 now, partner-facing and internet-reachable instances first, and rotate its administrator credentials afterwards, because CVE-2026-84295 can expose them to an unauthenticated attacker and the upgrade does not change what was already read; an instance on an unsupported branch gets no patch from Progress, so take it off the network or migrate it."
      ],
      "affected_products": [
        "Progress WS_FTP Server"
      ],
      "change": "improvement",
      "classification": "A2",
      "cves": [
        {
          "affected": "WS_FTP Server on Windows, versions before 2024.0.6 and 2025.0.3 (2024 and 2025 branches)",
          "cvss": "10.0 (CVSS 3.1, Progress as CNA)",
          "fixed": "2024.0.6 and 2025.0.3; 2024.0.7 and 2025.0.4 carry the later fixes for the other two flaws and are the builds to reach; no patch for unsupported versions",
          "id": "CVE-2026-84295",
          "status": [
            "patch-available"
          ]
        },
        {
          "affected": "WS_FTP Server on Windows, versions before 2024.0.7 and 2025.0.4, under certain configurations",
          "cvss": "9.0 (CVSS 3.1, Progress as CNA; attack complexity high)",
          "fixed": "2024.0.7 and 2025.0.4; no patch for unsupported versions",
          "id": "CVE-2026-90865",
          "status": [
            "patch-available"
          ]
        },
        {
          "affected": "WS_FTP Server on Windows, versions before 2024.0.7 and 2025.0.4",
          "cvss": "8.1 (CVSS 3.1, Progress as CNA; attack complexity high)",
          "fixed": "2024.0.7 and 2025.0.4; no patch for unsupported versions",
          "id": "CVE-2026-90867",
          "status": [
            "patch-available"
          ]
        },
        {
          "affected": "WS_FTP Server on Windows, versions before 2024.0.7 and 2025.0.4, under certain configurations",
          "cvss": "9.9 (CVSS 3.1, Progress as CNA)",
          "fixed": "2024.0.7 and 2025.0.4; no patch for unsupported versions",
          "id": "CVE-2026-90868",
          "status": [
            "patch-available"
          ]
        },
        {
          "affected": "WS_FTP Server on Windows, versions before 2024.0.7 and 2025.0.4; needs a delegated Host Administrator",
          "cvss": "9.1 (CVSS 3.1, Progress as CNA)",
          "fixed": "2024.0.7 and 2025.0.4; no patch for unsupported versions",
          "id": "CVE-2026-90866",
          "status": [
            "patch-available"
          ]
        },
        {
          "affected": "WS_FTP Server on Windows, versions before 2024.0.7 and 2025.0.4; needs a delegated Host Administrator",
          "cvss": "9.1 (CVSS 3.1, Progress as CNA)",
          "fixed": "2024.0.7 and 2025.0.4; no patch for unsupported versions",
          "id": "CVE-2026-90864",
          "status": [
            "patch-available"
          ]
        },
        {
          "affected": "WS_FTP Server on Windows, versions before 2024.0.7 and 2025.0.4; needs a delegated Host Administrator",
          "cvss": "9.1 (CVSS 3.1, Progress as CNA)",
          "fixed": "2024.0.7 and 2025.0.4; no patch for unsupported versions",
          "id": "CVE-2026-90863",
          "status": [
            "patch-available"
          ]
        }
      ],
      "exploited": false,
      "headline": "WS_FTP Server: unauthenticated CVSS 10.0 admin-credential leak, five more critical flaws; fix 2025.0.4, 2024.0.7",
      "id": "2026-10-31/progress-ws-ftp-server-cve-2026-84295-unauth-cvss-10",
      "immediate_action": null,
      "kev": false,
      "kind": "vulnerability",
      "last_changed_at": "2026-11-03T03:32:33Z",
      "markdown_url": "https://ctipilot.ch/entries/2026-10-31/progress-ws-ftp-server-cve-2026-84295-unauth-cvss-10/index.md",
      "permalink": "https://ctipilot.ch/entries/2026-10-31/progress-ws-ftp-server-cve-2026-84295-unauth-cvss-10/",
      "priority": "notable",
      "product_keys": [
        "product:progress-ws-ftp-server"
      ],
      "summary": "Progress's bulletin, as listed by heise, covers fifteen WS_FTP Server flaws on Windows, six of them critical: CVE-2026-84295, an improper-authentication flaw that could let an unauthenticated remote attacker reach administrative credentials (CVSS 3.1 10.0), and five command-injection, path-traversal and missing-authorization flaws (CVE-2026-90868 at 9.9, CVE-2026-90866, CVE-2026-90864 and CVE-2026-90863 at 9.1, CVE-2026-90865 at 9.0), four of which NCSC Switzerland describes as a route from the exposed administrator credentials to full server compromise. Builds before 2024.0.7 and 2025.0.4 are affected, and CSIRT Italia says Progress will issue no patch for unsupported versions. NCSC Switzerland lists exploitation as unknown and no source reports it; CISA's catalog holds no 2026 WS_FTP flaw, though a 2023 flaw in the same product is listed with known ransomware use.",
      "techniques": [
        "T1059",
        "T1078",
        "T1190"
      ],
      "verification": "single-source"
    },
    {
      "actions": [
        "Turn off Easy4IP (P2P cloud access) on every Dahua camera and recorder that does not need it, and search each device's audit log for DVRIP logins from 127.0.0.1."
      ],
      "affected_products": [
        "Dahua IP Camera",
        "Dahua NVR",
        "Dahua DVR",
        "Dahua Easy4IP"
      ],
      "change": "new",
      "classification": "A2",
      "cves": [
        {
          "affected": "Dahua camera, intercom, access-control and recorder series listed in advisory DHCC-SA-202106-001, on firmware older than the fixed builds",
          "cvss": "8.1 (CVSS 3, as stated by Dahua)",
          "fixed": "model-specific firmware builds dated June to August 2021, listed per model in DHCC-SA-202106-001",
          "id": "CVE-2021-33044",
          "status": [
            "exploited",
            "cisa-kev",
            "patch-available"
          ]
        },
        {
          "affected": "Dahua camera, intercom, access-control and recorder series listed in advisory DHCC-SA-202106-001, on firmware older than the fixed builds",
          "cvss": "8.1 (CVSS 3, as stated by Dahua)",
          "fixed": "model-specific firmware builds dated June to August 2021, listed per model in DHCC-SA-202106-001",
          "id": "CVE-2021-33045",
          "status": [
            "exploited",
            "cisa-kev",
            "patch-available"
          ]
        }
      ],
      "exploited": true,
      "headline": "CERT-UA: Dahua cameras are taken over through the Easy4IP cloud even with no port exposed; turn P2P off",
      "id": "2026-11-02/dahua-easy4ip-p2p-cloud-camera-takeover-cert-ua",
      "immediate_action": null,
      "kev": true,
      "kind": "threat",
      "last_changed_at": "2026-11-02T03:46:20Z",
      "markdown_url": "https://ctipilot.ch/entries/2026-11-02/dahua-easy4ip-p2p-cloud-camera-takeover-cert-ua/index.md",
      "permalink": "https://ctipilot.ch/entries/2026-11-02/dahua-easy4ip-p2p-cloud-camera-takeover-cert-ua/",
      "priority": "notable",
      "product_keys": [
        "product:dahua-dvr",
        "product:dahua-easy4ip",
        "product:dahua-ip-camera",
        "product:dahua-nvr"
      ],
      "summary": "Ukraine's CERT-UA reports, in an alert dated 2026-10-23, compromises of Dahua IP cameras and video recorders in which attackers viewed the stream, changed device settings and created accounts of their own. The main vector is Easy4IP, Dahua's peer-to-peer remote-access feature, which reaches a device through Dahua's cloud by its guessable serial number without any published port; passwords are then guessed or, CERT-UA says, the 2021 authentication-bypass flaws CVE-2021-33044 and CVE-2021-33045 are used on outdated firmware, a use eSecurity Planet says is unconfirmed in these cases.",
      "techniques": [
        "T1110.001",
        "T1125",
        "T1133",
        "T1136.001",
        "T1190"
      ],
      "verification": "single-source-national-cert"
    },
    {
      "actions": [
        "Update every QNAP NAS on QTS, QuTS hero or QuTScloud to the builds of 2026-10-23 (QTS 6.1.0.3656 or 5.2.11.3661, QuTS hero h6.1.0.3656, h6.0.2.3656 (h5.3.x included) or h5.2.11.3661, QuTScloud c5.2.9.3661), every QVR Surveillance (ARM32 models) to 3.0.3.1756, every TVR OS to 1.0.5 and every Notes Station 3 to 3.9.15, and take any QNAP device running QNE (ADRA) off the internet until QNAP lists a fix."
      ],
      "affected_products": [
        "QNAP QTS",
        "QNAP QuTS hero",
        "QNAP QuTScloud",
        "QNAP Note Station 3",
        "QNAP QNE",
        "QNAP QVR Surveillance",
        "QNAP TVR OS",
        "Synology Mail Station",
        "Synology Calendar",
        "PHP"
      ],
      "change": "update",
      "classification": "A2",
      "cves": [
        {
          "affected": "QTS 6.1.0 and 5.2.11 and earlier, QuTS hero h6.1.0, h6.0.x, h5.3.x and h5.2.11 and earlier, QuTScloud c5.2.9 and earlier, Notes Station 3 3.9.14 and earlier, QNE (ADRA) 1.0.7 and earlier, QVR Surveillance 3.0.3 and earlier (ARM32 models), TVR OS 1.0.4 and earlier; Synology PHP 7.3 to 8.4 packages, Mail Station and Synology Calendar",
          "cvss": "9.2 (CVSS 4.0, as stated by QNAP for the PHP flaw)",
          "fixed": "QTS 6.1.0.3656 and 5.2.11.3661, QuTS hero h6.1.0.3656, h6.0.2.3656 (also for h5.3.x) and h5.2.11.3661, QuTScloud c5.2.9.3661 (builds of 2026-10-23), QVR Surveillance 3.0.3.1756, TVR OS 1.0.5 and Notes Station 3 3.9.15 (listed as resolved as of 2026-10-28); no fix yet for QNE (ADRA), which has its own advisory QSA-26-19; Synology on DSM 7.2 and above PHP 7.4.33-0131, 8.0.30-0122, Mail Station 30000002.3.19-20333 and Calendar 3.0.4-21435; on DSM 7.0 to 7.1 PHP 7.4.33-0122, 8.0.30-0104, Mail Station 30000002.3.19-10333 and Calendar 2.4.8-10948; on DSM 6.2 PHP 7.4.33-0010, Mail Station 30000002.3.19-0333 and Calendar 2.4.8-0948 (the table lists no PHP 8.0 build for DSM 6.2); PHP 8.1.34-0120, 8.2.35-0171, 8.3.36-0051 and 8.4.27-0051 on every DSM; no fix for the end-of-life PHP 7.3 package",
          "id": "CVE-2026-109618",
          "status": [
            "cisa-kev",
            "patch-available"
          ]
        },
        {
          "affected": "QTS 6.1.0 and 5.2.11 and earlier, QuTS hero h6.1.0, h6.0.x, h5.3.x and h5.2.11 and earlier, QuTScloud c5.2.9 and earlier, Notes Station 3 3.9.14 and earlier, QNE (ADRA) 1.0.7 and earlier, QVR Surveillance 3.0.3 and earlier (ARM32 models), TVR OS 1.0.4 and earlier; Synology PHP 7.3 to 8.4 packages, Mail Station and Synology Calendar",
          "cvss": "9.2 (CVSS 4.0, as stated by QNAP for the PHP flaw)",
          "fixed": "QTS 6.1.0.3656 and 5.2.11.3661, QuTS hero h6.1.0.3656, h6.0.2.3656 (also for h5.3.x) and h5.2.11.3661, QuTScloud c5.2.9.3661 (builds of 2026-10-23), QVR Surveillance 3.0.3.1756, TVR OS 1.0.5 and Notes Station 3 3.9.15 (listed as resolved as of 2026-10-28); no fix yet for QNE (ADRA), which has its own advisory QSA-26-19; Synology on DSM 7.2 and above PHP 7.4.33-0131, 8.0.30-0122, Mail Station 30000002.3.19-20333 and Calendar 3.0.4-21435; on DSM 7.0 to 7.1 PHP 7.4.33-0122, 8.0.30-0104, Mail Station 30000002.3.19-10333 and Calendar 2.4.8-10948; on DSM 6.2 PHP 7.4.33-0010, Mail Station 30000002.3.19-0333 and Calendar 2.4.8-0948 (the table lists no PHP 8.0 build for DSM 6.2); PHP 8.1.34-0120, 8.2.35-0171, 8.3.36-0051 and 8.4.27-0051 on every DSM; no fix for the end-of-life PHP 7.3 package",
          "id": "CVE-2026-109619",
          "status": [
            "cisa-kev",
            "patch-available"
          ]
        }
      ],
      "exploited": true,
      "headline": "PHP2Shell hits QNAP NAS before login: QTS, QuTS hero, QVR, TVR OS and Notes Station 3 fixed, QNE still unfixed",
      "id": "2026-10-25/qnap-synology-php2shell-qts-quts-hero-fixed-others-unfixed",
      "immediate_action": null,
      "kev": true,
      "kind": "vulnerability",
      "last_changed_at": "2026-11-02T03:46:02Z",
      "markdown_url": "https://ctipilot.ch/entries/2026-10-25/qnap-synology-php2shell-qts-quts-hero-fixed-others-unfixed/index.md",
      "permalink": "https://ctipilot.ch/entries/2026-10-25/qnap-synology-php2shell-qts-quts-hero-fixed-others-unfixed/",
      "priority": "notable",
      "product_keys": [
        "product:php",
        "product:qnap-note-station-3",
        "product:qnap-qne",
        "product:qnap-qts",
        "product:qnap-quts-hero",
        "product:qnap-qutscloud",
        "product:qnap-qvr-surveillance",
        "product:qnap-tvr-os",
        "product:synology-calendar",
        "product:synology-mail-station"
      ],
      "summary": "QNAP's advisory QSA-26-18 says the PHP2Shell flaws CVE-2026-109618 and CVE-2026-109619 (CVSS 4.0 9.2) affect the PHP in the web components of QTS, QuTS hero, QuTScloud and several QNAP applications and can be triggered before authentication, and fixed builds dated 2026-10-23 are out for QTS, QuTS hero and QuTScloud. As of 2026-10-28 (revision V1.2) the table lists QVR Surveillance (ARM32) 3.0.3.1756, TVR OS 1.0.5 and Notes Station 3 3.9.15 as resolved; QNE (ADRA) has its own advisory, QSA-26-19, with no fixed version and QNAP says to keep devices off the internet; QNAP has seen scanning and exploitation attempts in the wild but no reports of exploitation targeting its products, and CISA added both flaws to its Known Exploited Vulnerabilities catalog on 2026-10-26. Synology's advisory, revised on 2026-10-31, fixes its PHP packages (except the end-of-life PHP 7.3), Mail Station and Calendar, with builds for DSM 7.2 and above, DSM 7.0 to 7.1 and, for PHP 7.4, Mail Station and Calendar, DSM 6.2.",
      "techniques": [
        "T1190"
      ],
      "verification": "single-source"
    },
    {
      "actions": [
        "Install the October 2026 Android security update on every managed Android phone below that patch level, phones of emergency-service and on-call staff first."
      ],
      "affected_products": [
        "Google Android"
      ],
      "change": "new",
      "classification": "B2",
      "cves": [],
      "exploited": false,
      "headline": "Android 'SMS of Death': one hidden SMS drops calls, emergency calls included; Android 12 and 13 get no fix",
      "id": "2026-11-02/android-sms-of-death-wap-push-telephony-crash",
      "immediate_action": null,
      "kev": false,
      "kind": "vulnerability",
      "last_changed_at": "2026-11-02T03:46:00Z",
      "markdown_url": "https://ctipilot.ch/entries/2026-11-02/android-sms-of-death-wap-push-telephony-crash/index.md",
      "permalink": "https://ctipilot.ch/entries/2026-11-02/android-sms-of-death-wap-push-telephony-crash/",
      "priority": "notable",
      "product_keys": [
        "product:google-android"
      ],
      "summary": "An independent researcher published a working proof of concept on 2026-10-29 for a zero-click remote denial of service in Android's telephony framework: one malformed WAP Push data message crashes the com.android.phone process, drops active calls including emergency calls and, because the message is retried, can leave a phone in a restart loop. Per the researcher, Google's fix shipped in the October 2026 update for Android 14 to 17, so Android 12 and 13 phones run the same code unfixed; no source reports exploitation.",
      "techniques": [
        "T1499.004"
      ],
      "verification": "single-source"
    },
    {
      "actions": [
        "Install Carbon Black App Control Server 8.12.2 or 8.13.2 (8.13.2 where the server already runs 8.13), confirm the SEPM fix build against Broadcom's login-gated advisory 39421 before treating 14.3.27716.10000 or 14.4.494.0000 as the target, and until each server is fixed limit the management console of every SEPM, App Control Server, CloudSOC SpanVA appliance and CASMA to administrator networks."
      ],
      "affected_products": [
        "Symantec Endpoint Protection Manager",
        "Carbon Black App Control Server",
        "CloudSOC SpanVA Appliance",
        "Content Analysis and Malware Analysis"
      ],
      "change": "correction",
      "classification": "A2",
      "cves": [
        {
          "affected": "Carbon Black App Control Server, all supported versions; Symantec Endpoint Protection Manager, CloudSOC SpanVA Appliance and Content Analysis and Malware Analysis (CASMA), with no versions stated in Broadcom's umbrella advisory",
          "cvss": "n/a",
          "fixed": "App Control Server 8.12.2 and 8.13.2 (Broadcom article 459982); SEPM 14.3.27716.10000 and 14.4.494.0000 per NCSC-NL's tracker, which accepted a community report citing Broadcom's login-gated advisory and did not verify it; no fix stated for CloudSOC SpanVA or CASMA",
          "id": "CVE-2026-109618",
          "status": [
            "cisa-kev",
            "patch-available"
          ]
        },
        {
          "affected": "Carbon Black App Control Server, all supported versions; Symantec Endpoint Protection Manager, CloudSOC SpanVA Appliance and Content Analysis and Malware Analysis (CASMA), with no versions stated in Broadcom's umbrella advisory",
          "cvss": "n/a",
          "fixed": "App Control Server 8.12.2 and 8.13.2 (Broadcom article 459982); SEPM 14.3.27716.10000 and 14.4.494.0000 per NCSC-NL's tracker, which accepted a community report citing Broadcom's login-gated advisory and did not verify it; no fix stated for CloudSOC SpanVA or CASMA",
          "id": "CVE-2026-109619",
          "status": [
            "cisa-kev",
            "patch-available"
          ]
        }
      ],
      "exploited": true,
      "headline": "PHP2Shell hits Broadcom endpoint-security servers: App Control 8.12.2 or 8.13.2; SEPM fix builds unconfirmed",
      "id": "2026-10-31/php2shell-broadcom-sepm-carbon-black-app-control-casma",
      "immediate_action": null,
      "kev": true,
      "kind": "vulnerability",
      "last_changed_at": "2026-11-01T14:05:02Z",
      "markdown_url": "https://ctipilot.ch/entries/2026-10-31/php2shell-broadcom-sepm-carbon-black-app-control-casma/index.md",
      "permalink": "https://ctipilot.ch/entries/2026-10-31/php2shell-broadcom-sepm-carbon-black-app-control-casma/",
      "priority": "notable",
      "product_keys": [
        "product:carbon-black-app-control-server",
        "product:cloudsoc-spanva-appliance",
        "product:content-analysis-and-malware-analysis",
        "product:symantec-endpoint-protection-manager"
      ],
      "summary": "Broadcom's Enterprise Security Group advisory 39404, last revised on 2026-10-30, lists Carbon Black App Control Server, Symantec Endpoint Protection Manager (SEPM), the CloudSOC SpanVA Appliance and, since 2026-10-30, Content Analysis and Malware Analysis (CASMA) as affected by the PHP flaws CVE-2026-109618 and CVE-2026-109619, and gives no versions, fixes or workarounds. Broadcom's article 459982 names App Control Server 8.12.2 and 8.13.2 as the fixes for all supported versions; the SEPM builds 14.3.27716.10000 and 14.4.494.0000 rest on a community report that NCSC-NL's tracker accepts, because Broadcom's SEPM advisory needs a login. CISA lists both PHP flaws as exploited, and Broadcom's advisory says nothing about attacks on these products.",
      "techniques": [
        "T1190"
      ],
      "verification": "single-source"
    },
    {
      "actions": [
        "Run an organisation-scoped GitHub code search in every organisation your teams and suppliers administer for workflow files under .github/workflows that present themselves as a security audit, a security check or an Actions security workflow and were added since 2026-08-31; any hit means assume breach: revoke the credential that committed it, rotate every secret found anywhere in the repository's git history, not only the configured Actions secrets, and check the crontab of every developer machine and self-hosted runner that opened or ran the repository since 2026-10-14 for a five-minute job that runs a remote script."
      ],
      "affected_products": [
        "GitHub Actions"
      ],
      "change": "update",
      "classification": "B1",
      "cves": [],
      "exploited": false,
      "headline": "GhostAction: fake security workflows now harvest whole git histories; rotating Actions secrets is not enough",
      "id": "2026-10-10/ghostaction-fake-audit-workflow-git-history-credential-theft",
      "immediate_action": null,
      "kev": false,
      "kind": "threat",
      "last_changed_at": "2026-11-01T13:58:24Z",
      "markdown_url": "https://ctipilot.ch/entries/2026-10-10/ghostaction-fake-audit-workflow-git-history-credential-theft/index.md",
      "permalink": "https://ctipilot.ch/entries/2026-10-10/ghostaction-fake-audit-workflow-git-history-credential-theft/",
      "priority": "notable",
      "product_keys": [
        "product:github-actions"
      ],
      "summary": "StepSecurity and Socket report that on 2026-10-08 the GhostAction campaign used the GitHub credentials of two open-source maintainers to commit a workflow disguised as a security audit straight to the default branch of 345 to 346 repositories, including one of an Uber-owned organisation, and that the workflow now sends the credentials found in the working tree and in the entire git history, besides the named Actions secrets, to a hardcoded address over plain HTTP. GitGuardian's own data puts the wave of 8 to 12 October at more than 30,000 repositories reached through about 1,900 compromised GitHub accounts, and says GitHub has prevented the workflow from running since 9 October. Between 13 and 21 October the operator pushed at least 72,026 further commits, mostly from accounts whose tokens were already used on 8 October, including a stealer disguised as a font file that a hidden VS Code task runs on developer machines, outside GitHub's workflow hold, and a cron job that survives cleaning the repository.",
      "techniques": [
        "T1048.003",
        "T1053.003",
        "T1059.007",
        "T1078.004",
        "T1552.001",
        "T1552.005"
      ],
      "verification": "multi-source"
    },
    {
      "actions": [
        "Install .NET 8.0.33, 9.0.22 or 10.0.14 (11 Release Candidate 3 for the preview) on every host that runs .NET applications, including Windows hosts already updated on 2026-10-13, which still carry CVE-2026-70197; rebuild and republish self-contained applications and rebuild container images from the updated .NET images, because a runtime update on the host does not change a bundled runtime."
      ],
      "affected_products": [
        "Microsoft .NET",
        "Microsoft ASP.NET Core",
        "Microsoft Visual Studio"
      ],
      "change": "correction",
      "classification": "A2",
      "cves": [
        {
          "affected": ".NET 8 before 8.0.33, .NET 9 before 9.0.22, .NET 10 before 10.0.14 and .NET 11 before Release Candidate 3 (runtime and NativeAOT packages); .NET Framework is not affected",
          "cvss": "8.1 (CVSS 3.1)",
          "fixed": "8.0.33, 9.0.22, 10.0.14, 11.0.0-rc.3",
          "id": "CVE-2026-111497",
          "status": [
            "exploited",
            "cisa-kev",
            "patch-available"
          ]
        },
        {
          "affected": "Windows runtime packages of .NET 8 before 8.0.33, .NET 9 before 9.0.22, .NET 10 before 10.0.14 and .NET 11 before Release Candidate 3; the 2026-10-13 release did not contain the fix",
          "cvss": "8.1 (CVSS 3.1)",
          "fixed": "8.0.33, 9.0.22, 10.0.14, 11.0.0-rc.3",
          "id": "CVE-2026-70197",
          "status": [
            "patch-available"
          ]
        },
        {
          "affected": "Microsoft.AspNetCore.Components.WebAssembly.Server and Microsoft.AspNetCore.Components.WebAssembly.DevServer 10.0.0 before 10.0.14 and 11.0.0-preview.1 before 11.0.0-rc.3",
          "cvss": "8.8 (CVSS 3.1)",
          "fixed": "10.0.14, 11.0.0-rc.3",
          "id": "CVE-2026-102870",
          "status": [
            "patch-available"
          ]
        },
        {
          "affected": "ASP.NET Core runtime and targeting-pack Linux tarballs of .NET 8 before 8.0.33 and .NET 9 before 9.0.22; source-built .NET Linux distributions of .NET 8 before 8.0.133, .NET 9 before 9.0.123, 10.0.1xx up to 10.0.113, 10.0.4xx up to 10.0.402 and .NET 11 previews up to 11.0.100-rc.2",
          "cvss": "7.8 (CVSS 3.1)",
          "fixed": "ASP.NET Core tarballs 8.0.33 and 9.0.22; source-built SDK releases 8.0.133, 9.0.123, 10.0.114, 10.0.403 and 11.0.100-rc.3",
          "id": "CVE-2026-114148",
          "status": [
            "patch-available"
          ]
        }
      ],
      "exploited": true,
      "headline": "Microsoft ships out-of-band .NET fixes: hosts updated on 13 October still carry the Windows sockets flaw",
      "id": "2026-10-26/cve-2026-111497-microsoft-net-oob-update-brotli-sockets-fix",
      "immediate_action": null,
      "kev": true,
      "kind": "vulnerability",
      "last_changed_at": "2026-11-01T13:56:55Z",
      "markdown_url": "https://ctipilot.ch/entries/2026-10-26/cve-2026-111497-microsoft-net-oob-update-brotli-sockets-fix/index.md",
      "permalink": "https://ctipilot.ch/entries/2026-10-26/cve-2026-111497-microsoft-net-oob-update-brotli-sockets-fix/",
      "priority": "notable",
      "product_keys": [
        "product:microsoft-asp-net-core",
        "product:microsoft-net",
        "product:microsoft-visual-studio"
      ],
      "summary": "Microsoft released .NET 8.0.33, 9.0.22, 10.0.14 and 11 Release Candidate 3 out of band on 2026-10-25 to fix the Brotli decoder flaw CVE-2026-111497 (CVSS 3.1 8.1, publicly disclosed, rated Exploitation More Likely) and to deliver the corrected fixes for CVE-2026-70197 (Windows sockets memory corruption, CVSS 3.1 8.1) and CVE-2026-102870 (Blazor debugger), which the 2026-10-13 release did not fully address. Brotli exposure needs an application that decompresses attacker-controlled Brotli data, which ASP.NET Core and HttpClient do not do by default; CISA lists CVE-2026-111497 as exploited since 2026-10-27, although Microsoft's record still said not exploited on 2026-10-25 and no source reports an attack on .NET.",
      "techniques": [
        "T1068",
        "T1190",
        "T1203"
      ],
      "verification": "single-source"
    },
    {
      "actions": [
        "Upgrade every Belden NetModule NRSW router to 5.0.0.105, and where that is not yet possible disable its web interface after confirming SSH access, with the CLI settings http.status=0 and https.status=0; patch macmon 7.x from the service portal and move macmon 6.x to 7.x, and keep the web interfaces of both off networks that are not trusted."
      ],
      "affected_products": [
        "Belden NetModule NRSW",
        "Belden macmon NAC",
        "Schneider Electric EcoStruxure Security Expert",
        "Schneider Electric EcoStruxure Control Engineering",
        "ProLeiT LINEoptimize",
        "B&R APROL",
        "HMS Networks Netbiter",
        "Wibu-Systems CodeMeter License Central",
        "Johnson Controls Illustra",
        "Johnson Controls Visonic PowerManage",
        "Oracle Secure Backup",
        "Oracle Solaris"
      ],
      "change": "update",
      "classification": "A2",
      "cves": [
        {
          "affected": "Belden NetModule NRSW up to and including release 5.0.0.104; macmon 6.x and 7.x; Schneider Electric EcoStruxure Security Expert Web Client before 1.48.4.0, LINEoptimize and EcoStruxure Control Engineering all versions, EcoStruxure Foxboro DCS H90 Server; B&R APROL up to R 4.4-65; HMS Netbiter firmware up to 3.00.10; Wibu-Systems CodeMeter License Central web interface and extensions; Oracle Secure Backup 19.1.0.0.0 to 19.1.0.1.0 and Oracle Solaris 11",
          "cvss": "9.8 (CVSS 3.1, as stated by Belden and Oracle)",
          "fixed": "NRSW release 5.0.0.105, or the web interface disabled where the upgrade is not possible; macmon 7.x: patch from the service portal, 6.x: upgrade to 7.x; Security Expert 1.48.4.0; LINEoptimize and Control Engineering: remediation through ProLeiT support and Schneider Electric; APROL: patches planned 2026-10-26 and 2026-10-29; Netbiter 3.00.11; CodeMeter License Central 5.2.3 (5.2.2 with the php.ini hardening) or the patch installer for 5.1.2 and 5.0.x; Foxboro DCS H90 Server: mitigation only, block TCP ports 2301 and 2381; Oracle patches per its Security Alert Rev 2",
          "id": "CVE-2026-109618",
          "status": [
            "cisa-kev",
            "patch-available",
            "mitigation-only"
          ]
        },
        {
          "affected": "Belden NetModule NRSW up to and including release 5.0.0.104; macmon 6.x and 7.x; Schneider Electric EcoStruxure Security Expert Web Client before 1.48.4.0, LINEoptimize and EcoStruxure Control Engineering all versions, EcoStruxure Foxboro DCS H90 Server; B&R APROL up to R 4.4-65; HMS Netbiter firmware up to 3.00.10; Wibu-Systems CodeMeter License Central web interface and extensions; Oracle Secure Backup 19.1.0.0.0 to 19.1.0.1.0 and Oracle Solaris 11",
          "cvss": "9.8 (CVSS 3.1, as stated by Belden)",
          "fixed": "NRSW release 5.0.0.105, or the web interface disabled where the upgrade is not possible; macmon 7.x: patch from the service portal, 6.x: upgrade to 7.x; Security Expert 1.48.4.0; LINEoptimize and Control Engineering: remediation through ProLeiT support and Schneider Electric; APROL: patches planned 2026-10-26 and 2026-10-29; Netbiter 3.00.11; CodeMeter License Central 5.2.3 (5.2.2 with the php.ini hardening) or the patch installer for 5.1.2 and 5.0.x; Foxboro DCS H90 Server: mitigation only, block TCP ports 2301 and 2381; the Oracle patch for CVE-2026-109618 also addresses CVE-2026-109619",
          "id": "CVE-2026-109619",
          "status": [
            "cisa-kev",
            "patch-available",
            "mitigation-only"
          ]
        }
      ],
      "exploited": true,
      "headline": "PHP2Shell hits NetModule routers (fix: NRSW 5.0.0.105), macmon, Schneider, B&R, HMS, Wibu and Oracle products",
      "id": "2026-10-27/php2shell-ot-products-netmodule-nrsw-no-fix-macmon-schneider",
      "immediate_action": null,
      "kev": true,
      "kind": "vulnerability",
      "last_changed_at": "2026-11-01T13:52:31Z",
      "markdown_url": "https://ctipilot.ch/entries/2026-10-27/php2shell-ot-products-netmodule-nrsw-no-fix-macmon-schneider/index.md",
      "permalink": "https://ctipilot.ch/entries/2026-10-27/php2shell-ot-products-netmodule-nrsw-no-fix-macmon-schneider/",
      "priority": "notable",
      "product_keys": [
        "product:b-r-aprol",
        "product:belden-macmon-nac",
        "product:belden-netmodule-nrsw",
        "product:hms-networks-netbiter",
        "product:johnson-controls-illustra",
        "product:johnson-controls-visonic-powermanage",
        "product:oracle-secure-backup",
        "product:oracle-solaris",
        "product:proleit-lineoptimize",
        "product:schneider-electric-ecostruxure-control-engineering",
        "product:schneider-electric-ecostruxure-security-expert",
        "product:wibu-systems-codemeter-license-central"
      ],
      "summary": "Industrial, building and network-access vendors have published their own notices for the PHP flaws CVE-2026-109618 and CVE-2026-109619, which CISA added to its Known Exploited Vulnerabilities catalog on 2026-10-26. Belden says all versions of NetModule NRSW, the router software of the Bern-headquartered NetModule AG, are affected up to release 5.0.0.104 and recommends upgrading to release 5.0.0.105, with disabling the web interface as the fallback; macmon 6.x and 7.x, Schneider Electric Security Expert and Control Engineering, B&R APROL, HMS Netbiter, Wibu-Systems CodeMeter License Central and Oracle Secure Backup and Solaris 11 carry fixes or remediations at varying stages.",
      "techniques": [
        "T1190"
      ],
      "verification": "multi-source"
    },
    {
      "actions": [
        "Update every on-premise Adobe Campaign Classic v7 server, and the on-premise components of any hybrid deployment, to build 9403; build 9402 is affected by APSB26-162, including a SQL injection that needs no privileges, build 9401 fixes only APSB26-134's three flaws, and an Adobe-hosted instance that still reports 9401 is not evidence of exposure."
      ],
      "affected_products": [
        "Adobe Campaign Classic"
      ],
      "change": "update",
      "classification": "A2",
      "cves": [
        {
          "affected": "Adobe Campaign Classic v7 7.4.4 build 9401 and earlier (on-premise deployments and the on-premise components of hybrid deployments)",
          "cvss": "10.0",
          "fixed": "ACC v7 7.4.4 build 9402",
          "id": "CVE-2026-82004",
          "status": [
            "patch-available"
          ]
        },
        {
          "affected": "Adobe Campaign Classic v7 7.4.4 build 9401 and earlier (on-premise deployments and the on-premise components of hybrid deployments)",
          "cvss": "10.0",
          "fixed": "ACC v7 7.4.4 build 9402",
          "id": "CVE-2026-73369",
          "status": [
            "patch-available"
          ]
        },
        {
          "affected": "Adobe Campaign Classic v7 7.4.4 build 9401 and earlier (on-premise deployments and the on-premise components of hybrid deployments)",
          "cvss": "10.0",
          "fixed": "ACC v7 7.4.4 build 9402",
          "id": "CVE-2026-84412",
          "status": [
            "patch-available"
          ]
        },
        {
          "affected": "Adobe Campaign Classic v7 7.4.4 build 9401 and earlier (on-premise deployments and the on-premise components of hybrid deployments)",
          "cvss": "10.0",
          "fixed": "ACC v7 7.4.4 build 9402",
          "id": "CVE-2026-89275",
          "status": [
            "patch-available"
          ]
        },
        {
          "affected": "Adobe Campaign Classic v7 7.4.4 build 9401 and earlier (on-premise deployments and the on-premise components of hybrid deployments)",
          "cvss": "10.0",
          "fixed": "ACC v7 7.4.4 build 9402",
          "id": "CVE-2026-75723",
          "status": [
            "patch-available"
          ]
        },
        {
          "affected": "Adobe Campaign Classic v7 7.4.4 build 9401 and earlier (on-premise deployments and the on-premise components of hybrid deployments)",
          "cvss": "10.0",
          "fixed": "ACC v7 7.4.4 build 9402",
          "id": "CVE-2026-75699",
          "status": [
            "patch-available"
          ]
        },
        {
          "affected": "Adobe Campaign Classic v7 7.4.4 build 9401 and earlier (on-premise deployments and the on-premise components of hybrid deployments)",
          "cvss": "10.0",
          "fixed": "ACC v7 7.4.4 build 9402",
          "id": "CVE-2026-75703",
          "status": [
            "patch-available"
          ]
        },
        {
          "affected": "Adobe Campaign Classic v7 7.4.4 build 9401 and earlier (on-premise deployments and the on-premise components of hybrid deployments)",
          "cvss": "10.0",
          "fixed": "ACC v7 7.4.4 build 9402",
          "id": "CVE-2026-75721",
          "status": [
            "patch-available"
          ]
        },
        {
          "affected": "Adobe Campaign Classic v7 7.4.4 build 9401 and earlier (on-premise deployments and the on-premise components of hybrid deployments)",
          "cvss": "9.9",
          "fixed": "ACC v7 7.4.4 build 9402",
          "id": "CVE-2026-83660",
          "status": [
            "patch-available"
          ]
        },
        {
          "affected": "Adobe Campaign Classic v7 7.4.4 build 9401 and earlier (on-premise deployments and the on-premise components of hybrid deployments)",
          "cvss": "9.1",
          "fixed": "ACC v7 7.4.4 build 9402",
          "id": "CVE-2026-75728",
          "status": [
            "patch-available"
          ]
        },
        {
          "affected": "Adobe Campaign Classic v7 7.4.4 build 9400 and earlier",
          "cvss": "10.0",
          "fixed": "ACC v7 7.4.4 build 9401 (build 9402 also carries it)",
          "id": "CVE-2026-76197",
          "status": [
            "patch-available"
          ]
        },
        {
          "affected": "Adobe Campaign Classic v7 7.4.4 build 9400 and earlier",
          "cvss": "10.0",
          "fixed": "ACC v7 7.4.4 build 9401 (build 9402 also carries it)",
          "id": "CVE-2026-76195",
          "status": [
            "patch-available"
          ]
        },
        {
          "affected": "Adobe Campaign Classic v7 7.4.4 build 9400 and earlier",
          "cvss": "10.0",
          "fixed": "ACC v7 7.4.4 build 9401 (build 9402 also carries it)",
          "id": "CVE-2026-76193",
          "status": [
            "patch-available"
          ]
        },
        {
          "affected": "Adobe Campaign Classic v7 7.4.4 build 9402 and earlier",
          "cvss": "9.8",
          "fixed": "ACC v7 7.4.4 build 9403",
          "id": "CVE-2026-105781",
          "status": [
            "patch-available"
          ]
        },
        {
          "affected": "Adobe Campaign Classic v7 7.4.4 build 9402 and earlier",
          "cvss": "9.9",
          "fixed": "ACC v7 7.4.4 build 9403",
          "id": "CVE-2026-104351",
          "status": [
            "patch-available"
          ]
        },
        {
          "affected": "Adobe Campaign Classic v7 7.4.4 build 9402 and earlier",
          "cvss": "9.9",
          "fixed": "ACC v7 7.4.4 build 9403",
          "id": "CVE-2026-104353",
          "status": [
            "patch-available"
          ]
        },
        {
          "affected": "Adobe Campaign Classic v7 7.4.4 build 9402 and earlier",
          "cvss": "9.9",
          "fixed": "ACC v7 7.4.4 build 9403",
          "id": "CVE-2026-105780",
          "status": [
            "patch-available"
          ]
        },
        {
          "affected": "Adobe Campaign Classic v7 7.4.4 build 9402 and earlier",
          "cvss": "9.9",
          "fixed": "ACC v7 7.4.4 build 9403",
          "id": "CVE-2026-105489",
          "status": [
            "patch-available"
          ]
        },
        {
          "affected": "Adobe Campaign Classic v7 7.4.4 build 9402 and earlier",
          "cvss": "9.3",
          "fixed": "ACC v7 7.4.4 build 9403",
          "id": "CVE-2026-104350",
          "status": [
            "patch-available"
          ]
        },
        {
          "affected": "Adobe Campaign Classic v7 7.4.4 build 9402 and earlier",
          "cvss": "9.1",
          "fixed": "ACC v7 7.4.4 build 9403",
          "id": "CVE-2026-104354",
          "status": [
            "patch-available"
          ]
        },
        {
          "affected": "Adobe Campaign Classic v7 7.4.4 build 9402 and earlier",
          "cvss": "9.1",
          "fixed": "ACC v7 7.4.4 build 9403",
          "id": "CVE-2026-105779",
          "status": [
            "patch-available"
          ]
        }
      ],
      "exploited": false,
      "headline": "Adobe Campaign Classic build 9402 is now affected: APSB26-162 adds a pre-auth CVSS 9.8 SQL injection; update to 9403",
      "id": "2026-10-02/adobe-campaign-classic-apsb26-142-134-unauth-cvss10",
      "immediate_action": null,
      "kev": false,
      "kind": "vulnerability",
      "last_changed_at": "2026-11-01T13:51:27Z",
      "markdown_url": "https://ctipilot.ch/entries/2026-10-02/adobe-campaign-classic-apsb26-142-134-unauth-cvss10/index.md",
      "permalink": "https://ctipilot.ch/entries/2026-10-02/adobe-campaign-classic-apsb26-142-134-unauth-cvss10/",
      "priority": "notable",
      "product_keys": [
        "product:adobe-campaign-classic"
      ],
      "summary": "Adobe's Priority 1 bulletin APSB26-142 for on-premise Adobe Campaign Classic v7 was published on 2026-09-08 with one CVE and revised on 2026-09-22 to eighteen Critical CVEs, ten needing no privileges, eight of them CVSS 10.0; builds 9401 and earlier are affected and build 9402 is the fix. The earlier bulletin APSB26-134 (build 9401, 2026-08-25) fixed three more unauthenticated CVSS 10.0 flaws. On 2026-10-27 the Priority 2 bulletin APSB26-162 fixed eight further Critical flaws in build 9402 and earlier, one needing neither privileges nor user interaction (CVE-2026-105781, SQL injection, 9.8), so build 9403 is now the fix. Adobe is not aware of exploitation of any of these flaws, and none of the CVEs was in CISA KEV as of its 2026-10-30 catalog.",
      "techniques": [
        "T1190"
      ],
      "verification": "single-source"
    },
    {
      "actions": [
        "Update every non-browser TLS client that keeps its own CA bundle or does not check revocation to a fixed version: standalone Java runtimes, including those already updated on 2026-10-21, to the update of Oracle's Security Alert CVE-2026-114820 or OpenJDK (Oracle Database Server, Autonomous Health Framework and OPatch installations too), Python 3.15.2, 3.14.10, 3.13.18, 3.12.16 or 3.11.18 together with pip 26.2.2 or later, Go 1.27.3 or 1.26.10, and self-managed GitLab to a fixed patch release together with GitLab Runner 19.5.1; then confirm with curl against the incident tracker's test host that the client rejects the certificate.",
        "Replace, by hand where the ACME client does not support ACME Renewal Information, every TLS certificate your organisation holds that chains to emSign ECC Root CA - G3 or to another of the seven certificates Microsoft removed from the Windows and Edge trust lists, because Chrome's removal of the G3 root was due on 2026-10-27 and the Windows change takes effect when the trust-list update reaches a device; deliver the updated Disallowed Certificate Trust List and the trust-list changes Microsoft describes, including its out-of-band update of 2026-10-26, to Windows devices that do not receive automatic certificate-trust updates.",
        "Apply Cisco's remediation now for the products its eMudhra advisory (version 1.5) lists with a fix or a procedure available: the guidance for Secure Firewall ASA, FTD and FMC, Secure Email Gateway and Secure Email and Web Manager (run the updatenow command where updates are manual), Duo Access Gateway 3.2.0, Duo Network Gateway 3.4.1, Duo Agentic Authorization Connector 1.0.1 and ThousandEyes Enterprise Agent (Application-hosting Agent 5.2.2)."
      ],
      "affected_products": [
        "Oracle Java SE",
        "Oracle GraalVM for JDK",
        "OpenJDK",
        "CPython",
        "Cisco Secure Firewall Management Center",
        "Cisco Duo Access Gateway",
        "Cisco Duo Network Gateway",
        "Cisco ThousandEyes Enterprise Agent",
        "Cisco IOS XR Software",
        "Microsoft Windows",
        "Microsoft Edge",
        "GitLab",
        "Cisco Identity Services Engine",
        "Oracle Database Server",
        "Oracle Autonomous Health Framework",
        "Oracle Global Lifecycle Management OPatch",
        "Oracle Hospitality Cruise Shipboard Property Management"
      ],
      "change": "correction",
      "classification": "A1",
      "cves": [
        {
          "affected": "Oracle Java SE 8u511, 8u511-perf, 11.0.33, 17.0.21, 21.0.13, 25.0.5, 27.0.1; Oracle GraalVM for JDK 17.0.21 and 21.0.13; Oracle GraalVM Enterprise Edition 21.3.20; OpenJDK 27.0.1, 25.0.5, 21.0.13, 17.0.21, 11.0.32.1, 8u504 and earlier",
          "cvss": "9.1 (CVSS 3.1)",
          "fixed": "superseded by the Java updates of Oracle's Security Alert CVE-2026-114820 and the OpenJDK advisory of 2026-10-24: Oracle's second alert lists the builds 27.0.1.0.2, 25.0.5.0.2, 21.0.13.0.2, 17.0.21.0.2, 11.0.33.0.2 and 8u511-b32 as affected, and OpenJDK says to act even on runtimes updated in the past few days",
          "id": "CVE-2026-91403",
          "status": [
            "patch-available",
            "mitigation-only"
          ]
        },
        {
          "affected": "Oracle Java SE 8u511-b32, 8u511-perf-b32, 11.0.33.0.2, 17.0.21.0.2, 21.0.13.0.2, 25.0.5.0.2, 27.0.1.0.2; Oracle GraalVM for JDK 17.0.21.0.2 and 21.0.13.0.2; Oracle GraalVM Enterprise Edition 21.3.20.0.2; OpenJDK 27.0.1.0.2, 25.0.5.0.2, 21.0.13.0.2, 17.0.21.0.2, 11.0.32.1, 8u504 and earlier; Oracle Database Server 19.3-19.32, 21.3-21.23 and 23.4.0-23.26.3 (RDBMS, Java; not applicable to client-only installations), Oracle Autonomous Health Framework Trace File Analyzer 26.3-26.10, Oracle Global Lifecycle Management OPatch 12.2.0.1.16-12.2.0.1.52 and Oracle Hospitality Cruise Shipboard Property Management Next-Gen SPMS 23.3.4-23.3.6 (revision 2 of 2026-10-30)",
          "cvss": "9.1 (CVSS 3.1)",
          "fixed": "the Java updates of Oracle's Security Alert CVE-2026-114820 (build numbers in Oracle's Patch Availability Document) and the OpenJDK update whose release note names JDK-8395690; until updated, delete the cacerts aliases emsignrootcag1, emsignrootcag2, emsigneccrootcag3 and comodoaaaca or enable revocation checking; the incident tracker lists Oracle JDK 27.0.1.0.3, 25.0.5.0.3, 21.0.13.0.3, 17.0.21.0.3, 11.0.33.0.3 and 8u511 b33 as fixed and OpenJDK builds as pending",
          "id": "CVE-2026-114820",
          "status": [
            "patch-available",
            "mitigation-only"
          ]
        },
        {
          "affected": "CPython 3.15.0 before 3.15.2, 3.14.0 before 3.14.10, 3.13.0 before 3.13.18, 3.12.0 before 3.12.16, every release before 3.11.18, and 3.16.0a1 before 3.16.0 per ENISA's record",
          "cvss": "9.4 (CVSS 4.0)",
          "fixed": "Python 3.15.2, 3.14.10, 3.13.18, 3.12.16 and 3.11.18 carry the ssl denylist (Python Insider, 2026-10-26), which the post says makes normal uses of pip safe even if pip is not updated; Christian Heimes says in the announcement thread that pip before 26.2.2 keeps trusting the compromised intermediates whatever the system trust store holds, because it always loads its own vendored certifi",
          "id": "CVE-2026-115557",
          "status": [
            "patch-available"
          ]
        }
      ],
      "exploited": false,
      "headline": "Eight eMudhra CA keys were guessable; Windows drops seven certificates, and Java, Python, Go and GitLab need updates",
      "id": "2026-10-21/emudhra-intermediate-ca-keys-recoverable-trust-store-updates",
      "immediate_action": null,
      "kev": false,
      "kind": "incident",
      "last_changed_at": "2026-11-01T13:46:55Z",
      "markdown_url": "https://ctipilot.ch/entries/2026-10-21/emudhra-intermediate-ca-keys-recoverable-trust-store-updates/index.md",
      "permalink": "https://ctipilot.ch/entries/2026-10-21/emudhra-intermediate-ca-keys-recoverable-trust-store-updates/",
      "priority": "notable",
      "product_keys": [
        "product:cisco-duo-access-gateway",
        "product:cisco-duo-network-gateway",
        "product:cisco-identity-services-engine",
        "product:cisco-ios-xr-software",
        "product:cisco-secure-firewall-management-center",
        "product:cisco-thousandeyes-enterprise-agent",
        "product:cpython",
        "product:gitlab",
        "product:microsoft-edge",
        "product:microsoft-windows",
        "product:openjdk",
        "product:oracle-autonomous-health-framework",
        "product:oracle-database-server",
        "product:oracle-global-lifecycle-management-opatch",
        "product:oracle-graalvm-for-jdk",
        "product:oracle-hospitality-cruise-shipboard-property-management",
        "product:oracle-java-se"
      ],
      "summary": "On 2026-10-17 a researcher reported that the private keys of eight eMudhra intermediate CA certificates had been generated with too little randomness, so anyone could recover them and forge trusted HTTPS certificates for any site. Firefox, Chrome, Apple and Microsoft platforms block the intermediates and eMudhra revoked them; Microsoft went further on 2026-10-26 and removed seven eMudhra-hierarchy certificates from the Windows trust list, and from the Edge trust list on 2026-10-27. Software that keeps its own trust store or does not check revocation stays exposed until updated: Go fixed it in 1.27.3 and 1.26.10 as CVE-2026-111943, GitLab in its releases of 2026-10-29, Python added a built-in denylist as CVE-2026-115557, and Java needs the second update of 2026-10-24 (CVE-2026-114820, CVSS 3.1 9.1) even on a runtime updated in the past few days. Chrome's removal of the emSign ECC Root CA - G3 root was due on 2026-10-27; Cisco's advisory dates its ISE fixes to December 2026 and April 2027, and no exploitation is reported.",
      "techniques": [
        "T1557"
      ],
      "verification": "multi-source"
    },
    {
      "actions": [
        "In every forest with an enterprise CA, list the AD CS Web Enrollment and Certificate Enrollment Web Service endpoints that lack HTTPS and Extended Protection for Authentication and the certificate templates that accept requester-supplied identity with broad enrollment rights, because both intrusions turned a Quick Assist session into a certificate for a privileged identity."
      ],
      "affected_products": [
        "Microsoft Teams",
        "Microsoft Quick Assist",
        "Microsoft Active Directory Certificate Services"
      ],
      "change": "new",
      "classification": "B2",
      "cves": [],
      "exploited": false,
      "headline": "Microsoft: Teams help-desk vishing into Quick Assist ended in AD CS certificates for privileged accounts and a DC",
      "id": "2026-10-31/teams-help-desk-impersonation-quick-assist-ad-cs-esc1-esc8",
      "immediate_action": null,
      "kev": false,
      "kind": "threat",
      "last_changed_at": "2026-10-31T03:51:00Z",
      "markdown_url": "https://ctipilot.ch/entries/2026-10-31/teams-help-desk-impersonation-quick-assist-ad-cs-esc1-esc8/index.md",
      "permalink": "https://ctipilot.ch/entries/2026-10-31/teams-help-desk-impersonation-quick-assist-ad-cs-esc1-esc8/",
      "priority": "notable",
      "product_keys": [
        "product:microsoft-active-directory-certificate-services",
        "product:microsoft-quick-assist",
        "product:microsoft-teams"
      ],
      "summary": "Microsoft Threat Intelligence describes two human-operated intrusions, not attributed to any actor, in which an external Teams contact impersonating help-desk staff got a user to open Quick Assist, after which the operator staged a portable runtime and used Active Directory Certificate Services to reach privileged identities: a template open to ESC1 issued certificates for privileged accounts and DCSync followed within seconds, and in the second case PetitPotam was relayed to AD CS Web Enrollment (ESC8) for a certificate for a domain controller account. An issued certificate stays valid after a password reset or a reimage of the first workstation, and in the first case one privileged account excluded from automated containment stayed usable and was used to copy data to an external SFTP destination.",
      "techniques": [
        "T1003.006",
        "T1016",
        "T1036.003",
        "T1048",
        "T1059.007",
        "T1078.002",
        "T1082",
        "T1187",
        "T1219",
        "T1557",
        "T1566.003",
        "T1566.004",
        "T1649"
      ],
      "verification": "single-source"
    },
    {
      "actions": [
        "On every developer endpoint that runs Cursor, check extension-install telemetry for Anthropic.claude-code 2.1.312 or 2.1.313 installed between 09:27 and 20:35 UTC on 2026-10-29; where it is found, isolate the host, remove the unauthorized SSH key, the persistence and any running tunnel process, because uninstalling the extension removes none of them, and rotate every credential reachable from the host from a trusted system."
      ],
      "affected_products": [
        "Cursor",
        "Anthropic Claude Code"
      ],
      "change": "new",
      "classification": "B1",
      "cves": [],
      "exploited": false,
      "headline": "Cursor marketplace served a trojanised Claude Code extension for 11 hours; uninstalling leaves the SSH backdoor",
      "id": "2026-10-31/cursor-marketplace-claude-code-extension-ssh-backdoor",
      "immediate_action": null,
      "kev": false,
      "kind": "incident",
      "last_changed_at": "2026-10-31T03:50:00Z",
      "markdown_url": "https://ctipilot.ch/entries/2026-10-31/cursor-marketplace-claude-code-extension-ssh-backdoor/index.md",
      "permalink": "https://ctipilot.ch/entries/2026-10-31/cursor-marketplace-claude-code-extension-ssh-backdoor/",
      "priority": "notable",
      "product_keys": [
        "product:anthropic-claude-code",
        "product:cursor"
      ],
      "summary": "Between about 09:27 and 20:35 UTC on 2026-10-29 the Cursor VS Code Extension Marketplace served a modified copy of Anthropic's Claude Code extension, versions 2.1.312 and 2.1.313 for macOS and Windows, that appends an attacker's SSH key to authorized_keys, tries to enable SSH and open a reverse tunnel, and installs persistence that outlives the extension. Coding errors made the SSH step fail on most standard-user hosts, so Cursor and Sophos say the attacker could not log in there, but the key, the persistence and a host report were still written. Anthropic told Microsoft its systems were not compromised, and no source says how the attacker published under Anthropic's name.",
      "techniques": [
        "T1036.005",
        "T1053.003",
        "T1053.005",
        "T1059.007",
        "T1082",
        "T1098.004",
        "T1195.002",
        "T1543.001",
        "T1547.001",
        "T1572"
      ],
      "verification": "multi-source"
    },
    {
      "actions": [
        "Update Commerce Core on every Drupal site to 3.3.13 (3.x) or 8.x-2.41 (earlier releases) now, then audit orders back as far as your logs reach for inconsistencies, because Drupal says the flaw is exploited, names no other mitigation and does not say when exploitation began."
      ],
      "affected_products": [
        "Drupal Commerce Core"
      ],
      "change": "new",
      "classification": "A2",
      "cves": [
        {
          "affected": "Commerce Core 3.0.0 up to but not including 3.3.13, and earlier releases before 8.x-2.41",
          "cvss": "n/a",
          "fixed": "3.3.13 on the 3.x line; 8.x-2.41 on earlier releases",
          "id": "CVE-2026-118539",
          "status": [
            "exploited",
            "patch-available"
          ]
        }
      ],
      "exploited": true,
      "headline": "Drupal Commerce Core access bypass is exploited in the wild; update to 3.3.13 or 8.x-2.41 and audit orders",
      "id": "2026-10-31/cve-2026-118539-drupal-commerce-core-access-bypass-exploited",
      "immediate_action": null,
      "kev": false,
      "kind": "vulnerability",
      "last_changed_at": "2026-10-31T03:47:00Z",
      "markdown_url": "https://ctipilot.ch/entries/2026-10-31/cve-2026-118539-drupal-commerce-core-access-bypass-exploited/index.md",
      "permalink": "https://ctipilot.ch/entries/2026-10-31/cve-2026-118539-drupal-commerce-core-access-bypass-exploited/",
      "priority": "notable",
      "product_keys": [
        "product:drupal-commerce-core"
      ],
      "summary": "Drupal's advisory SA-CONTRIB-2026-254 of 2026-10-28 says an access bypass in the Commerce Core module, which adds a shopping cart and checkout to Drupal sites, is being actively exploited in the wild; the Drupal security team scores it 21 of 25, needing no authentication and affecting every module configuration. Commerce Core 3.0.0 up to but not including 3.3.13, and earlier releases before 8.x-2.41, are affected, and Drupal tells operators to update and audit their orders for inconsistencies. NCSC Switzerland issued its own advisory on 2026-10-30; Drupal says nothing on the method, the actor or the number of sites hit.",
      "techniques": [
        "T1190",
        "T1565.001"
      ],
      "verification": "multi-source"
    },
    {
      "actions": [
        "Upgrade every Cisco Expressway-C, Expressway-E and Expressway Select unit to 15.5.21, including units already moved to X15.5.20 for CVE-2026-76466, which Cisco's table does not name as the PHP2Shell fix, and until then apply the workaround in bug CSCwx37062; take any Duo Access Gateway to 3.2.0."
      ],
      "affected_products": [
        "Cisco Expressway Series",
        "Cisco Expressway Select Series",
        "Cisco Ultra-Reliable Wireless Backhaul",
        "Cisco Unified Industrial Wireless Software",
        "Cisco Duo Access Gateway",
        "Cisco Identity Services Engine Portal Builder"
      ],
      "change": "update",
      "classification": "A2",
      "cves": [
        {
          "affected": "Expressway Series and Expressway Select Series, Ultra-Reliable Wireless Backhaul and Unified Industrial Wireless Software, Duo Access Gateway and Identity Services Engine Portal Builder; the advisory gives no version ranges (its bug records CSCwx37062 and CSCwx37073 carry platform-specific information)",
          "cvss": "n/a",
          "fixed": "Expressway 15.5.21; Ultra-Reliable Wireless Backhaul and Unified Industrial Wireless Software 26.2.1.9 (November 2026); Duo Access Gateway 3.2.0; ISE Portal Builder fix deployed, no customer action required",
          "id": "CVE-2026-109618",
          "status": [
            "cisa-kev",
            "patch-available"
          ]
        },
        {
          "affected": "Expressway Series and Expressway Select Series, Ultra-Reliable Wireless Backhaul and Unified Industrial Wireless Software, Duo Access Gateway and Identity Services Engine Portal Builder; the advisory gives no version ranges (its bug records CSCwx37062 and CSCwx37073 carry platform-specific information)",
          "cvss": "n/a",
          "fixed": "Expressway 15.5.21; Ultra-Reliable Wireless Backhaul and Unified Industrial Wireless Software 26.2.1.9 (November 2026); Duo Access Gateway 3.2.0; ISE Portal Builder fix deployed, no customer action required",
          "id": "CVE-2026-109619",
          "status": [
            "cisa-kev",
            "patch-available"
          ]
        }
      ],
      "exploited": true,
      "headline": "Cisco's final PHP2Shell advisory: Expressway needs 15.5.21, Duo Access Gateway 3.2.0; Cisco knows of no malicious use",
      "id": "2026-10-28/cisco-php2shell-expressway-urwb-duo-access-gateway-fixes",
      "immediate_action": null,
      "kev": true,
      "kind": "vulnerability",
      "last_changed_at": "2026-10-31T03:41:32Z",
      "markdown_url": "https://ctipilot.ch/entries/2026-10-28/cisco-php2shell-expressway-urwb-duo-access-gateway-fixes/index.md",
      "permalink": "https://ctipilot.ch/entries/2026-10-28/cisco-php2shell-expressway-urwb-duo-access-gateway-fixes/",
      "priority": "notable",
      "product_keys": [
        "product:cisco-duo-access-gateway",
        "product:cisco-expressway-select-series",
        "product:cisco-expressway-series",
        "product:cisco-identity-services-engine-portal-builder",
        "product:cisco-ultra-reliable-wireless-backhaul",
        "product:cisco-unified-industrial-wireless-software"
      ],
      "summary": "Cisco's advisory cisco-sa-php-october26-Jj384Daq, final at version 1.10 on 2026-10-30, lists Expressway Series and Expressway Select Series (fixed release 15.5.21, workaround in the bug record), Ultra-Reliable Wireless Backhaul and Unified Industrial Wireless Software (fixed release 26.2.1.9, listed for November 2026, workaround in the bug record), Duo Access Gateway (3.2.0) and ISE Portal Builder (fix deployed, no customer action required) as affected by the PHP flaws CVE-2026-109618 and CVE-2026-109619. Cisco knows of no malicious use against a Cisco product, although CISA added both flaws to its Known Exploited Vulnerabilities catalog on 2026-10-26.",
      "techniques": [
        "T1190"
      ],
      "verification": "single-source"
    },
    {
      "actions": [
        "Install the Check Point hotfix for your release on every gateway, cluster member and security-group member that uses Mobile Access, SSL Network Extender, SAML-realm VPN, the Identity Awareness captive portal, UserCheck or Zero Phishing, put the R81.20 package of 2026-10-28 on Jumbo Hotfix Accumulator take 166 or later wherever Mobile Access is used, and until the hotfix is in apply Check Point's cp-httpd.conf mitigation, which you remove before installing it."
      ],
      "affected_products": [
        "Check Point Force Firewalls",
        "Check Point Spark Firewalls",
        "Check Point Cloud Firewall"
      ],
      "change": "update",
      "classification": "A2",
      "cves": [
        {
          "affected": "Force, Spark and Cloud firewalls on R81.20, R82, R82.10 and R82.20 (R80 to R81.10 are end of support) and Spark R81.10.x and R82.00.x, with Mobile Access Portal, Remote Access VPN with SSL Network Extender, SAML-realm VPN, Identity Awareness Captive Portal, UserCheck Portal or Zero Phishing in use",
          "cvss": "9.2 (Check Point)",
          "fixed": "release-specific hotfix packages, also planned for the Jumbo Hotfix Accumulators of 2026-11-11; Spark R82.00.11 (build 998002823) and R81.10.17 (build 996004992); a hotfix for the R81.10 gateway release, published 2026-10-29",
          "id": "CVE-2026-109618",
          "status": [
            "cisa-kev",
            "patch-available"
          ]
        },
        {
          "affected": "Force, Spark and Cloud firewalls on R81.20, R82, R82.10 and R82.20 (R80 to R81.10 are end of support) and Spark R81.10.x and R82.00.x, with Mobile Access Portal, Remote Access VPN with SSL Network Extender, SAML-realm VPN, Identity Awareness Captive Portal, UserCheck Portal or Zero Phishing in use",
          "cvss": "9.2 (Check Point)",
          "fixed": "release-specific hotfix packages, also planned for the Jumbo Hotfix Accumulators of 2026-11-11; Spark R82.00.11 (build 998002823) and R81.10.17 (build 996004992); a hotfix for the R81.10 gateway release, published 2026-10-29",
          "id": "CVE-2026-109619",
          "status": [
            "cisa-kev",
            "patch-available"
          ]
        }
      ],
      "exploited": true,
      "headline": "Check Point: PHP2Shell hits gateway VPN and portal web interfaces; hotfixes out, R81.20 package reissued 28 October",
      "id": "2026-10-29/check-point-php2shell-sk1000302-portal-and-vpn-gateways",
      "immediate_action": null,
      "kev": true,
      "kind": "vulnerability",
      "last_changed_at": "2026-10-30T03:54:02Z",
      "markdown_url": "https://ctipilot.ch/entries/2026-10-29/check-point-php2shell-sk1000302-portal-and-vpn-gateways/index.md",
      "permalink": "https://ctipilot.ch/entries/2026-10-29/check-point-php2shell-sk1000302-portal-and-vpn-gateways/",
      "priority": "notable",
      "product_keys": [
        "product:check-point-cloud-firewall",
        "product:check-point-force-firewalls",
        "product:check-point-spark-firewall"
      ],
      "summary": "Check Point's advisory sk1000302, last modified 2026-10-29, says the PHP flaws CVE-2026-109618 and CVE-2026-109619 (CVSS 9.2 each) can give remote code execution through the web interfaces of Force, Spark and Cloud firewalls that use Mobile Access, SSL Network Extender VPN, SAML-realm VPN authentication, the Identity Awareness captive portal, the UserCheck portal or Zero Phishing. Hotfixes exist for R81.20, R82, R82.10 and R82.20 and for Spark R82.00 and R81.10; the R81.20 package was reissued on 2026-10-28 for gateways that use Mobile Access, and a hotfix for the end-of-support gateway release R81.10 followed on 2026-10-29. The sk makes no statement on exploitation of Check Point products, and CISA lists both flaws as exploited.",
      "techniques": [
        "T1190"
      ],
      "verification": "single-source"
    },
    {
      "actions": [
        "Install the HPE ClearPass 6.14.1, 6.12.8 or 6.11.16 hotfix patch for CVE-2026-109618 and CVE-2026-109619 on every ClearPass Policy Manager node from the HPE Networking Support Portal, and until it is installed take the guest portal and the CLI and web management interfaces off public networks, confining management to a dedicated layer 2 segment or behind firewall policy."
      ],
      "affected_products": [
        "HPE Networking ClearPass Policy Manager"
      ],
      "change": "update",
      "classification": "A2",
      "cves": [
        {
          "affected": "ClearPass Policy Manager 6.14.0 and earlier in the 6.14 train and 6.11.15 and earlier in the 6.11 train per the advisory note, and per its machine-readable record the 6.14, 6.11 and, since revision 3, 6.12 trains below the hotfix boundaries 6.14.1, 6.11.16 and 6.12.8; versions past end of maintenance are presumed affected and versions past end of support were not assessed",
          "cvss": "9.8",
          "fixed": "ClearPass 6.14.1 Hotfix Patch, ClearPass 6.12.8 Hotfix Patch and ClearPass 6.11.16 Hotfix Patch, from the HPE Networking Support Portal",
          "id": "CVE-2026-109618",
          "status": [
            "cisa-kev",
            "patch-available"
          ]
        },
        {
          "affected": "ClearPass Policy Manager 6.14.0 and earlier in the 6.14 train and 6.11.15 and earlier in the 6.11 train per the advisory note, and per its machine-readable record the 6.14, 6.11 and, since revision 3, 6.12 trains below the hotfix boundaries 6.14.1, 6.11.16 and 6.12.8; versions past end of maintenance are presumed affected and versions past end of support were not assessed",
          "cvss": "9.8",
          "fixed": "ClearPass 6.14.1 Hotfix Patch, ClearPass 6.12.8 Hotfix Patch and ClearPass 6.11.16 Hotfix Patch, from the HPE Networking Support Portal",
          "id": "CVE-2026-109619",
          "status": [
            "cisa-kev",
            "patch-available"
          ]
        }
      ],
      "exploited": true,
      "headline": "HPE ClearPass 6.14, 6.12 and 6.11 are affected by PHP2Shell; a hotfix patch exists for each train",
      "id": "2026-10-28/hpe-clearpass-php2shell-hotfixes-hpesbnw05171",
      "immediate_action": null,
      "kev": true,
      "kind": "vulnerability",
      "last_changed_at": "2026-10-30T03:53:29Z",
      "markdown_url": "https://ctipilot.ch/entries/2026-10-28/hpe-clearpass-php2shell-hotfixes-hpesbnw05171/index.md",
      "permalink": "https://ctipilot.ch/entries/2026-10-28/hpe-clearpass-php2shell-hotfixes-hpesbnw05171/",
      "priority": "notable",
      "product_keys": [
        "product:hpe-networking-clearpass-policy-manager"
      ],
      "summary": "HPE Networking's bulletin HPESBNW05171, released on 2026-10-22 and revised on 2026-10-23 and 2026-10-29, lists ClearPass Policy Manager 6.14.0 and earlier and 6.11.15 and earlier as affected by the PHP flaws CVE-2026-109618 and CVE-2026-109619, each scored CVSS 3.1 9.8, adds the 6.12 train in its machine-readable record, and names a hotfix patch for 6.14.1, 6.12.8 and 6.11.16. HPE asks customers to consider removing guest portals and all management interfaces from public access until the affected instances are upgraded; the bulletin says nothing about exploitation of ClearPass, although CISA added both flaws to its Known Exploited Vulnerabilities catalog on 2026-10-26.",
      "techniques": [
        "T1190"
      ],
      "verification": "single-source"
    },
    {
      "actions": [
        "On every AlmaLinux host where untrusted users or workloads run code, install kernel-4.18.0-553.178.1.el8_10, kernel-5.14.0-687.60.1.el9_8 or kernel-6.12.0-211.69.1.el10_2 or later and reboot, or apply TuxCare's KernelCare patch on EL9 and EL10."
      ],
      "affected_products": [
        "Linux kernel",
        "Linux kernel ksmbd"
      ],
      "change": "update",
      "classification": "B2",
      "cves": [],
      "exploited": false,
      "headline": "Public root exploit for a Linux page-cache write past the Dirty Frag fix; AlmaLinux kernels carry the fix, no CVE yet",
      "id": "2026-10-25/zdi-linux-kernel-reports-public-skb-zerocopy-root-exploit",
      "immediate_action": null,
      "kev": false,
      "kind": "vulnerability",
      "last_changed_at": "2026-10-29T05:00:00Z",
      "markdown_url": "https://ctipilot.ch/entries/2026-10-25/zdi-linux-kernel-reports-public-skb-zerocopy-root-exploit/index.md",
      "permalink": "https://ctipilot.ch/entries/2026-10-25/zdi-linux-kernel-reports-public-skb-zerocopy-root-exploit/",
      "priority": "notable",
      "product_keys": [
        "product:linux-kernel",
        "product:linux-kernel-ksmbd"
      ],
      "summary": "Trend Micro's Zero Day Initiative copied public Linux kernel lists on five kernel reports on 2026-10-21 before any fix was merged, and Sysdig ranks ZDI-CAN-33367 as the one to act on: a local privilege escalation through skb_zerocopy() that gets past the Dirty Frag fix, with a public exploit that TuxCare reproduced as root on AlmaLinux 8 to 10, CloudLinux 9 and 10, Debian 12 and 13 and Ubuntu 24.04 and 26.04. A reviewed patch is in the kernel's networking tree but not in mainline, AlmaLinux announced on 2026-10-28 that fixed kernels are in production for 8, 9 and 10, none of the six reports has a CVE, and two ksmbd reports that ZDI scores CVSS 9.0 matter only where the in-kernel SMB server runs; no exploitation in the wild is reported.",
      "techniques": [
        "T1068",
        "T1210"
      ],
      "verification": "multi-source"
    },
    {
      "actions": [
        "Patch every E-Business Suite 12.2.3 to 12.2.15 web tier for CVE-2026-101767 now, because exploit attempts began a week after release, and review its web logs since 2026-10-27 for unauthenticated requests to the Thin Client Framework servlet and for database or Concurrent Manager activity that followed."
      ],
      "affected_products": [
        "Oracle WebLogic Server",
        "Oracle SOA Suite",
        "Oracle Access Manager",
        "Oracle Identity Manager",
        "Oracle E-Business Suite",
        "Oracle JD Edwards EnterpriseOne"
      ],
      "change": "update",
      "classification": "A2",
      "cves": [
        {
          "affected": "Oracle Access Manager 12.2.1.4.0 and 14.1.2.1.0, Authentication Engine component, reachable over HTTP",
          "cvss": "10.0",
          "fixed": "October 2026 Critical Patch Update",
          "id": "CVE-2026-87337",
          "status": [
            "patch-available"
          ]
        },
        {
          "affected": "Oracle SOA Suite 12.2.1.4.0 and 14.1.2.0.0, Adapters component, reachable over HTTP",
          "cvss": "10.0",
          "fixed": "October 2026 Critical Patch Update",
          "id": "CVE-2026-91231",
          "status": [
            "patch-available"
          ]
        },
        {
          "affected": "Oracle SOA Suite 12.2.1.4.0 and 14.1.2.0.0, Fabric Layer component, reachable over T3 and IIOP",
          "cvss": "10.0",
          "fixed": "October 2026 Critical Patch Update",
          "id": "CVE-2026-91216",
          "status": [
            "patch-available"
          ]
        },
        {
          "affected": "Oracle SOA Suite 12.2.1.4.0 and 14.1.2.0.0, Fabric Layer component, reachable over T3 and IIOP",
          "cvss": "10.0",
          "fixed": "October 2026 Critical Patch Update",
          "id": "CVE-2026-91221",
          "status": [
            "patch-available"
          ]
        },
        {
          "affected": "Oracle E-Business Suite 12.2.3 to 12.2.15, Workflow Notification Mailer component, reachable over HTTP",
          "cvss": "10.0",
          "fixed": "October 2026 Critical Patch Update",
          "id": "CVE-2026-101809",
          "status": [
            "patch-available"
          ]
        },
        {
          "affected": "Oracle E-Business Suite 12.2.3 to 12.2.15, Application Object Library Core component (Thin Client Framework servlet), reachable over HTTP",
          "cvss": "9.8 (CVSS 3.1)",
          "fixed": "October 2026 Critical Patch Update",
          "id": "CVE-2026-101767",
          "status": [
            "patch-available"
          ]
        },
        {
          "affected": "Oracle JD Edwards EnterpriseOne 9.2.0.0 to 9.2.26.5, E1 IOT Orchestrator Security component (Orchestrator), reachable over HTTP",
          "cvss": "10.0",
          "fixed": "October 2026 Critical Patch Update",
          "id": "CVE-2026-91299",
          "status": [
            "patch-available"
          ]
        },
        {
          "affected": "Oracle WebLogic Server 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0, Core component, reachable over HTTP",
          "cvss": "9.8",
          "fixed": "October 2026 Critical Patch Update",
          "id": "CVE-2026-91323",
          "status": [
            "patch-available"
          ]
        },
        {
          "affected": "Oracle WebLogic Server 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0, Core component, reachable over T3 and IIOP",
          "cvss": "9.8",
          "fixed": "October 2026 Critical Patch Update",
          "id": "CVE-2026-83399",
          "status": [
            "patch-available"
          ]
        },
        {
          "affected": "Oracle WebLogic Server 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0, Core component, reachable over HTTP; Oracle's matrix rates availability impact None",
          "cvss": "9.1",
          "fixed": "October 2026 Critical Patch Update",
          "id": "CVE-2026-87302",
          "status": [
            "patch-available"
          ]
        },
        {
          "affected": "Oracle Identity Manager 12.2.1.4.0 and 14.1.2.1.0, End User Self Service component, reachable over T3 and IIOP",
          "cvss": "9.8",
          "fixed": "October 2026 Critical Patch Update",
          "id": "CVE-2026-91408",
          "status": [
            "patch-available"
          ]
        },
        {
          "affected": "Oracle Access Manager 12.2.1.4.0 and 14.1.2.1.0, Authentication Engine component, reachable over SAML",
          "cvss": "9.8",
          "fixed": "October 2026 Critical Patch Update",
          "id": "CVE-2026-87251",
          "status": [
            "patch-available"
          ]
        }
      ],
      "exploited": false,
      "headline": "Oracle's October CPU: six unauthenticated CVSS 10.0 rows, two WebLogic 9.8 flaws; EBS decoys probed on 27 Oct",
      "id": "2026-10-21/oracle-october-2026-cpu-six-unauthenticated-cvss-10-rows",
      "immediate_action": null,
      "kev": false,
      "kind": "vulnerability",
      "last_changed_at": "2026-10-29T04:56:00Z",
      "markdown_url": "https://ctipilot.ch/entries/2026-10-21/oracle-october-2026-cpu-six-unauthenticated-cvss-10-rows/index.md",
      "permalink": "https://ctipilot.ch/entries/2026-10-21/oracle-october-2026-cpu-six-unauthenticated-cvss-10-rows/",
      "priority": "notable",
      "product_keys": [
        "product:oracle-access-manager",
        "product:oracle-e-business-suite",
        "product:oracle-identity-manager",
        "product:oracle-jd-edwards-enterpriseone",
        "product:oracle-soa-suite",
        "product:oracle-weblogic-server"
      ],
      "summary": "Oracle's Critical Patch Update of 2026-10-20 carries 1295 new patches. Its risk matrices list 90 rows (73 distinct CVE ids) scored CVSS 3.1 9.0 or higher that need no authentication over the network, among them six at 10.0 in Access Manager, SOA Suite (three), E-Business Suite Workflow Notification Mailer and JD Edwards EnterpriseOne Orchestrator, and two WebLogic Server flaws at 9.8 reachable over HTTP and over T3 and IIOP. The advisory states no exploitation for any row; Defused reported exploit attempts against its E-Business Suite decoys for CVE-2026-101767 on 2026-10-27, and no compromise of a production system is reported.",
      "techniques": [
        "T1059.004",
        "T1190"
      ],
      "verification": "single-source"
    },
    {
      "actions": [
        "Update every F5 BIG-IP on 17.1, 17.5 or 21.1 to 17.1.3.7, 17.5.1.11 or 21.1.0.4, systems that publish an APM or SSL Orchestrator access profile first, because NCSC-NL records the access-profile data plane as exposed as well as the Configuration utility."
      ],
      "affected_products": [
        "F5 BIG-IP",
        "F5 BIG-IP Access Policy Manager",
        "F5 BIG-IP SSL Orchestrator"
      ],
      "change": "new",
      "classification": "A2",
      "cves": [
        {
          "affected": "BIG-IP 17.1.0 to 17.1.3, 17.5.0 to 17.5.1 and 21.1.0 (Configuration utility of all modules; APM and SSL Orchestrator access-profile data plane), as NCSC-NL records F5's K000163821; earlier affected releases remain vulnerable",
          "cvss": "n/a",
          "fixed": "17.1.3.7, 17.5.1.11 and 21.1.0.4",
          "id": "CVE-2026-109618",
          "status": [
            "cisa-kev",
            "patch-available"
          ]
        },
        {
          "affected": "BIG-IP 17.1.0 to 17.1.3, 17.5.0 to 17.5.1 and 21.1.0 (Configuration utility of all modules; APM and SSL Orchestrator access-profile data plane), as NCSC-NL records F5's K000163821; earlier affected releases remain vulnerable",
          "cvss": "n/a",
          "fixed": "17.1.3.7, 17.5.1.11 and 21.1.0.4",
          "id": "CVE-2026-109619",
          "status": [
            "cisa-kev",
            "patch-available"
          ]
        }
      ],
      "exploited": true,
      "headline": "F5 BIG-IP is affected by PHP2Shell: fixes are in 17.1.3.7, 17.5.1.11 and 21.1.0.4; APM data plane and TMUI exposed",
      "id": "2026-10-29/f5-big-ip-php2shell-k000163821-critical-releases",
      "immediate_action": null,
      "kev": true,
      "kind": "vulnerability",
      "last_changed_at": "2026-10-29T04:49:00Z",
      "markdown_url": "https://ctipilot.ch/entries/2026-10-29/f5-big-ip-php2shell-k000163821-critical-releases/index.md",
      "permalink": "https://ctipilot.ch/entries/2026-10-29/f5-big-ip-php2shell-k000163821-critical-releases/",
      "priority": "notable",
      "product_keys": [
        "product:f5-big-ip",
        "product:f5-big-ip-access-policy-manager-apm",
        "product:f5-big-ip-ssl-orchestrator"
      ],
      "summary": "F5's release notes for BIG-IP 17.1.3.7, 17.5.1.11 and 21.1.0.4, each updated on 2026-10-24, list K000163821 as the fix for the PHP flaws CVE-2026-109618 and CVE-2026-109619 and call each a critical release whose only new changes are PHP fixes. NCSC-NL's record of K000163821 puts BIG-IP 17.1.0 to 17.1.3, 17.5.0 to 17.5.1 and 21.1.0 in scope, through the Configuration utility of all modules and through the access-profile data plane of APM and SSL Orchestrator; F5's article itself could not be read, and nothing found reports an attack on BIG-IP, although CISA lists both flaws as exploited.",
      "techniques": [
        "T1190"
      ],
      "verification": "single-source"
    },
    {
      "actions": [
        "Compare every lockfile and CI cache against the package list in SafeDep's post; on each host that installed or imported a listed package, disconnect it, remove persistence first and only then rotate the GitHub, npm, cloud and SSH credentials it could read, because the worm wipes the home directory when the stolen GitHub token is revoked."
      ],
      "affected_products": [
        "npm",
        "GitHub Actions",
        "GitLab CI"
      ],
      "change": "new",
      "classification": "B2",
      "cves": [],
      "exploited": false,
      "headline": "SafeDep and JFrog: the testmetest npm worm now runs on import, so --ignore-scripts does not stop it; 42 repos armed",
      "id": "2026-10-29/testmetest-npm-worm-runs-on-import-ignore-scripts",
      "immediate_action": null,
      "kev": false,
      "kind": "threat",
      "last_changed_at": "2026-10-29T04:47:00Z",
      "markdown_url": "https://ctipilot.ch/entries/2026-10-29/testmetest-npm-worm-runs-on-import-ignore-scripts/index.md",
      "permalink": "https://ctipilot.ch/entries/2026-10-29/testmetest-npm-worm-runs-on-import-ignore-scripts/",
      "priority": "notable",
      "product_keys": [
        "product:github-actions",
        "product:gitlab-ci",
        "product:npm"
      ],
      "summary": "SafeDep and JFrog describe an npm worm, tracked as testmetest, whose newest builds start when an application imports the package, so installing with --ignore-scripts does not stop it. It steals SSH, registry, cloud, CI and AI-tool credentials, publishes new patch versions of the victim's own packages, and wipes the home directory when the stolen GitHub token is revoked. SafeDep counts 19 packages from one operator between 2026-10-19 and 2026-10-27; JFrog found 42 armed GitHub repositories of 11 legitimate owners; neither lab names an actor.",
      "techniques": [
        "T1027",
        "T1059.007",
        "T1195.002",
        "T1485",
        "T1497.001",
        "T1552.001",
        "T1567.001"
      ],
      "verification": "multi-source"
    },
    {
      "actions": [
        "Update every MDaemon mail server to 26.0.4 or later and every Windows host that scans mail or files with ClamAV to 1.4.6 or 1.5.4, then check each mail server for DLLs it should not hold and treat stored mail on a server that ran an older build as possibly read, because HELLAGE steals email."
      ],
      "affected_products": [
        "MDaemon Email Server",
        "ClamAV"
      ],
      "change": "new",
      "classification": "B2",
      "cves": [
        {
          "affected": "ClamAV 0.101.0 through 1.5.3 on Windows, through its bundled UnRAR library; MDaemon mail server before 26.0.4",
          "cvss": "n/a",
          "fixed": "ClamAV 1.4.6 and 1.5.4; MDaemon 26.0.4 (2026-08-25)",
          "id": "CVE-2025-8088",
          "status": [
            "exploited",
            "cisa-kev",
            "patch-available"
          ]
        }
      ],
      "exploited": true,
      "headline": "ESET: an emailed RAR ran code on MDaemon servers via ClamAV's UnRAR; fixed in MDaemon 26.0.4, ClamAV 1.4.6 and 1.5.4",
      "id": "2026-10-29/mdaemon-clamav-unrar-cve-2025-8088-exploited-in-ukraine",
      "immediate_action": null,
      "kev": true,
      "kind": "threat",
      "last_changed_at": "2026-10-29T04:46:00Z",
      "markdown_url": "https://ctipilot.ch/entries/2026-10-29/mdaemon-clamav-unrar-cve-2025-8088-exploited-in-ukraine/index.md",
      "permalink": "https://ctipilot.ch/entries/2026-10-29/mdaemon-clamav-unrar-cve-2025-8088-exploited-in-ukraine/",
      "priority": "notable",
      "product_keys": [
        "product:clamav",
        "product:mdaemon-email-server"
      ],
      "summary": "ESET reports an active campaign in Ukraine in which Russia-aligned attackers exploited MDaemon mail servers: a crafted RAR archive mailed to any address makes MDaemon invoke ClamAV, whose old bundled UnRAR library carries the path-traversal flaw CVE-2025-8088, and the exploit writes a malicious DLL to the server with no user interaction. MDaemon fixed it in 26.0.4 on 2026-08-25, and ClamAV's own notes show that every Windows ClamAV from 0.101.0 to 1.5.3 is affected, fixed in 1.4.6 and 1.5.4. The attackers deployed the HELLAGE mail-stealing backdoor and the Telegram-controlled HELLTAG backdoor.",
      "techniques": [
        "T1102",
        "T1114.001",
        "T1190"
      ],
      "verification": "multi-source"
    },
    {
      "actions": [
        "On every endpoint from which an unauthorised ScreenConnect or other RMM agent has been removed, check for a Hexnode or Rippling MDM agent or enrolment that nobody authorised and unenrol the device from that tenant, because in Huntress's Hexnode case ScreenConnect returned hours after its removal while the MDM client stayed."
      ],
      "affected_products": [
        "Hexnode MDM",
        "Rippling MDM",
        "ConnectWise ScreenConnect"
      ],
      "change": "new",
      "classification": "B2",
      "cves": [],
      "exploited": false,
      "headline": "Huntress: phished MDM enrolments push ScreenConnect back after removal; the RMM is not the root of the intrusion",
      "id": "2026-10-29/huntress-mdm-enrolment-brings-back-removed-screenconnect",
      "immediate_action": null,
      "kev": false,
      "kind": "threat",
      "last_changed_at": "2026-10-29T04:45:00Z",
      "markdown_url": "https://ctipilot.ch/entries/2026-10-29/huntress-mdm-enrolment-brings-back-removed-screenconnect/index.md",
      "permalink": "https://ctipilot.ch/entries/2026-10-29/huntress-mdm-enrolment-brings-back-removed-screenconnect/",
      "priority": "notable",
      "product_keys": [
        "product:connectwise-screenconnect",
        "product:hexnode-mdm",
        "product:rippling-mdm"
      ],
      "summary": "Huntress reports several recent incidents in which phishing victims ended up with an MDM client from Hexnode or Rippling followed by an unauthorised ScreenConnect agent. In the Rippling case the attacker used the MDM, running with SYSTEM rights, to stage and run ScreenConnect; in the Hexnode case the managed-service provider removed ScreenConnect and it returned several hours later to the same relay while the Hexnode client was still installed. Huntress says the products are not at fault and that removing the RMM does not remove the management architecture behind it.",
      "techniques": [
        "T1072",
        "T1204.002",
        "T1219",
        "T1566.002"
      ],
      "verification": "single-source"
    },
    {
      "actions": [
        "Upgrade every WatchGuard Firebox to Fireware OS 2026.4, 12.12.4 or, on T15 and T35 models, 12.5.22, starting with appliances that have the Access Portal or a SIP proxy enabled or that are FireCluster members, because WatchGuard names no workaround for the three unauthenticated flaws."
      ],
      "affected_products": [
        "WatchGuard Fireware OS"
      ],
      "change": "new",
      "classification": "A2",
      "cves": [
        {
          "affected": "Fireware OS 2025.1 up to before 2026.4 and 12.0 up to before 12.12.4, T15 and T35 12.0 up to before 12.5.22, with the Access Portal enabled",
          "cvss": "9.2 (CVSS 4.0)",
          "fixed": "Fireware OS 2026.4, 12.12.4 and 12.5.22 (T15 and T35)",
          "id": "CVE-2026-93866",
          "status": [
            "patch-available"
          ]
        },
        {
          "affected": "Fireware OS 2025.1 up to before 2026.4 and 12.0 up to before 12.12.4, T15 and T35 12.0 up to before 12.5.22, with a SIP proxy configured",
          "cvss": "9.2 (CVSS 4.0)",
          "fixed": "Fireware OS 2026.4, 12.12.4 and 12.5.22 (T15 and T35)",
          "id": "CVE-2026-93857",
          "status": [
            "patch-available"
          ]
        },
        {
          "affected": "Fireware OS 2025.1 up to before 2026.4 and 12.0 up to before 12.12.4, T15 and T35 12.0 up to before 12.5.22, on Firebox appliances that are FireCluster members",
          "cvss": "9.2 (CVSS 4.0)",
          "fixed": "Fireware OS 2026.4, 12.12.4 and 12.5.22 (T15 and T35)",
          "id": "CVE-2026-93865",
          "status": [
            "patch-available"
          ]
        },
        {
          "affected": "Fireware OS 2025.1 up to before 2026.4 and 12.0 up to before 12.12.4, T15 and T35 12.0 up to before 12.5.22, with an Active Directory authentication server configured; needs an attacker who controls or intercepts traffic to that server",
          "cvss": "9.2 (CVSS 4.0)",
          "fixed": "Fireware OS 2026.4, 12.12.4 and 12.5.22 (T15 and T35)",
          "id": "CVE-2026-112710",
          "status": [
            "patch-available"
          ]
        },
        {
          "affected": "Fireware OS 2025.1 up to before 2026.4 and 12.0 up to before 12.12.4, T15 and T35 12.0 up to before 12.5.22, with an Active Directory authentication server configured; needs an attacker who controls or intercepts traffic to that server",
          "cvss": "9.2 (CVSS 4.0)",
          "fixed": "Fireware OS 2026.4, 12.12.4 and 12.5.22 (T15 and T35)",
          "id": "CVE-2026-112709",
          "status": [
            "patch-available"
          ]
        },
        {
          "affected": "Fireware OS 2026.2 up to before 2026.4 and 12.12 up to before 12.12.4, on a Firebox that acts as a FireCloud Gateway; needs a man-in-the-middle position with TLS-decrypted access between the Firebox and WatchGuard Cloud",
          "cvss": "9.5 (CVSS 4.0)",
          "fixed": "Fireware OS 2026.4 and 12.12.4",
          "id": "CVE-2026-103594",
          "status": [
            "patch-available"
          ]
        },
        {
          "affected": "Fireware OS 2025.1 up to before 2026.4 and 12.0 up to before 12.12.4, T15 and T35 12.0 up to before 12.5.22, in FIPS mode with an external log server; needs a network-adjacent attacker who can impersonate or intercept traffic to the log server",
          "cvss": "9.1 (CVSS 4.0)",
          "fixed": "Fireware OS 2026.4, 12.12.4 and 12.5.22 (T15 and T35)",
          "id": "CVE-2026-103593",
          "status": [
            "patch-available"
          ]
        }
      ],
      "exploited": false,
      "headline": "WatchGuard fixes three feature-dependent unauthenticated flaws scored 9.2 in Fireware OS; no exploitation known",
      "id": "2026-10-29/watchguard-fireware-2026-4-three-preauth-rows-at-9-2",
      "immediate_action": null,
      "kev": false,
      "kind": "vulnerability",
      "last_changed_at": "2026-10-29T04:42:00Z",
      "markdown_url": "https://ctipilot.ch/entries/2026-10-29/watchguard-fireware-2026-4-three-preauth-rows-at-9-2/index.md",
      "permalink": "https://ctipilot.ch/entries/2026-10-29/watchguard-fireware-2026-4-three-preauth-rows-at-9-2/",
      "priority": "notable",
      "product_keys": [
        "product:watchguard-fireware-os"
      ],
      "summary": "WatchGuard's advisories of 2026-10-27 fix 17 flaws in Fireware OS 2026.4, 12.12.4 and, for T15 and T35 models, 12.5.22, seven of them scored 9.0 or higher. Three need no authentication but a specific feature: a heap write in the Access Portal's WebSocket handling, a stack overflow in the SIP proxy and missing authentication in the FireCluster sync daemon, each scored 9.2. Four more need an attacker who controls or intercepts traffic to an Active Directory server, to WatchGuard Cloud or to a log server. WatchGuard is not aware of exploitation of any of them.",
      "techniques": [
        "T1190"
      ],
      "verification": "single-source"
    },
    {
      "actions": [
        "Upgrade every Veeam Backup & Replication 13.x server and Veeam Software Appliance to 13.1.2 (build 13.1.2.57) or 13.0.3 (build 13.0.3.63), Veeam Backup for Microsoft 365 to 8.6 Patch 1 (build 8.6.0.5011) and Veeam ONE 13.1 to Patch 1 (build 13.1.0.7940), because Veeam names no workaround and warns that attackers reverse-engineer its patches."
      ],
      "affected_products": [
        "Veeam Backup & Replication",
        "Veeam Software Appliance",
        "Veeam Backup for Microsoft 365",
        "Veeam ONE",
        "Veeam Agent for Linux"
      ],
      "change": "new",
      "classification": "A2",
      "cves": [
        {
          "affected": "Veeam Backup & Replication 13.1.1.18 and all earlier 13.1 builds and 13.0.2.29 and all earlier 13.0 builds, Windows-based and Veeam Software Appliance; 12.x is not affected",
          "cvss": "9.1 (CVSS 4.0)",
          "fixed": "13.1.2 (build 13.1.2.57) and 13.0.3 (build 13.0.3.63)",
          "id": "CVE-2026-108142",
          "status": [
            "patch-available"
          ]
        },
        {
          "affected": "Veeam Agent for Linux 13.1.1.4 and all earlier 13.1 builds, only when managed by a Backup & Replication instance",
          "cvss": "7.3 (CVSS 4.0)",
          "fixed": "13.1.2 (build 13.1.2.11)",
          "id": "CVE-2026-105477",
          "status": [
            "patch-available"
          ]
        },
        {
          "affected": "Veeam Backup for Microsoft 365 8.5.0.1014 and all earlier version 8 builds; Veeam says unsupported versions are likely affected",
          "cvss": "9.0 (CVSS 4.0)",
          "fixed": "8.6 (build 8.6.0.1102)",
          "id": "CVE-2026-106076",
          "status": [
            "patch-available"
          ]
        },
        {
          "affected": "Veeam Backup for Microsoft 365 8.5.0.1014 and all earlier version 8 builds",
          "cvss": "8.3 (CVSS 4.0)",
          "fixed": "8.6 (build 8.6.0.1102)",
          "id": "CVE-2026-106077",
          "status": [
            "patch-available"
          ]
        },
        {
          "affected": "Veeam Backup for Microsoft 365 8.6.0.1102 and all earlier version 8 builds",
          "cvss": "6.9 (CVSS 4.0)",
          "fixed": "8.6 Patch 1 (build 8.6.0.5011)",
          "id": "CVE-2026-106078",
          "status": [
            "patch-available"
          ]
        },
        {
          "affected": "Veeam ONE 13.1.0.7233 and all earlier 13.1 builds; 13.0.x and 12.x are not affected",
          "cvss": "8.5 (CVSS 4.0)",
          "fixed": "13.1 P1 (build 13.1.0.7940)",
          "id": "CVE-2026-107671",
          "status": [
            "patch-available"
          ]
        }
      ],
      "exploited": false,
      "headline": "Veeam fixes an unauthenticated 9.1 authorization bypass on 13.x servers, a VB365 SQL injection and a ONE MFA bypass",
      "id": "2026-10-29/veeam-cve-2026-108142-cdp-coordinator-authorization-bypass",
      "immediate_action": null,
      "kev": false,
      "kind": "vulnerability",
      "last_changed_at": "2026-10-29T04:41:00Z",
      "markdown_url": "https://ctipilot.ch/entries/2026-10-29/veeam-cve-2026-108142-cdp-coordinator-authorization-bypass/index.md",
      "permalink": "https://ctipilot.ch/entries/2026-10-29/veeam-cve-2026-108142-cdp-coordinator-authorization-bypass/",
      "priority": "notable",
      "product_keys": [
        "product:veeam-agent-for-linux",
        "product:veeam-backup-for-microsoft-365",
        "product:veeam-backup-replication",
        "product:veeam-one",
        "product:veeam-software-appliance"
      ],
      "summary": "Veeam's advisories of 2026-10-27 fix CVE-2026-108142, an unauthenticated authorization bypass on the CDP Coordinator Service of Veeam Backup & Replication 13.1 and 13.0 on Windows and of the Veeam Software Appliance (CVSS 4.0 9.1, fixed in 13.1.2 and 13.0.3; 12.x is not affected), a SQL injection in Veeam Backup for Microsoft 365 that reaches code execution as the PostgreSQL service account (9.0, fixed in 8.6) and an MFA bypass in Veeam ONE 13.1 for an attacker holding Administrator credentials (8.5). NCSC Switzerland relayed the Backup & Replication and Veeam ONE advisories on 2026-10-28 and says the vendor reports no evidence of exploitation.",
      "techniques": [
        "T1068",
        "T1190",
        "T1556.006"
      ],
      "verification": "single-source"
    },
    {
      "actions": [
        "Update every Magento Open Source and Adobe Commerce store, those on 2.4.9 included, to the 2026-jul fix in bulletin APSB26-73, then check for compromise: any script file in the custom-options upload directory, administrator accounts nobody created and loader scripts in CMS blocks, because a store that ran an unpatched build since March 2026 may already hold a webshell that the update does not remove."
      ],
      "affected_products": [
        "Adobe Commerce",
        "Adobe Commerce B2B",
        "Magento Open Source"
      ],
      "change": "new",
      "classification": "B2",
      "cves": [
        {
          "affected": "Magento Open Source and Adobe Commerce up to 2.4.9-alpha2 per Sansec; Adobe's bulletin lists Adobe Commerce 2.4.9 and 2.4.8-p5, 2.4.7-p10, 2.4.6-p15, 2.4.5-p17 and 2.4.4-p18 and earlier, Magento Open Source 2.4.9 and 2.4.8-p5, 2.4.7-p10 and 2.4.6-p15 and earlier, and Adobe Commerce B2B 1.5.3 and 1.5.2-p5, 1.4.2-p10, 1.3.4-p17 and 1.3.3-p18 and earlier (its version table covers every fix of the update)",
          "cvss": "9.6 (CVSS 3.1, Adobe bulletin; Adobe's CVE record says 9.3)",
          "fixed": "the 2026-jul builds of every line per bulletin APSB26-73 (2026-07-14), 2.4.9-2026-jul included; Sansec says plain 2.4.9 of 2026-05-12 carries a fix, which Adobe's bulletin does not reflect",
          "id": "CVE-2026-48356",
          "status": [
            "exploited",
            "cisa-kev",
            "patch-available"
          ]
        }
      ],
      "exploited": true,
      "headline": "PolyShell (CVE-2026-48356): Magento upload flaw attacked since March, fixed in July, CISA lists it as exploited",
      "id": "2026-10-28/cve-2026-48356-adobe-commerce-magento-upload-flaw-cisa-kev",
      "immediate_action": null,
      "kev": true,
      "kind": "vulnerability",
      "last_changed_at": "2026-10-28T03:54:00Z",
      "markdown_url": "https://ctipilot.ch/entries/2026-10-28/cve-2026-48356-adobe-commerce-magento-upload-flaw-cisa-kev/index.md",
      "permalink": "https://ctipilot.ch/entries/2026-10-28/cve-2026-48356-adobe-commerce-magento-upload-flaw-cisa-kev/",
      "priority": "notable",
      "product_keys": [
        "product:adobe-commerce",
        "product:adobe-commerce-b2b",
        "product:magento-open-source"
      ],
      "summary": "Sansec reports that PolyShell, the unauthenticated file upload in the Magento and Adobe Commerce REST API that Adobe tracks as CVE-2026-48356, has been attacked since 2026-03-19, with a mass wave on 2026-03-30 that put a JavaScript loader on 471 stores in one hour. Adobe's bulletin APSB26-73 of 2026-07-14 names the 2026-jul builds as the fix and still says Adobe knows of no exploits, while Sansec says Magento 2.4.9 carried a fix on 2026-05-12; CISA added the flaw to its Known Exploited Vulnerabilities catalog on 2026-10-27. A store that ran an unpatched build may carry a webshell that the update does not remove.",
      "techniques": [
        "T1190",
        "T1505.003"
      ],
      "verification": "multi-source"
    },
    {
      "actions": [
        "List every third-party script domain on the public websites your organisation, its agencies and its hosting suppliers run, and remove or re-verify each whose provider has shut down, because DeadTag buys exactly those expired domains."
      ],
      "affected_products": [
        "Apple iOS"
      ],
      "change": "new",
      "classification": "B2",
      "cves": [],
      "exploited": false,
      "headline": "DeadTag: expired tag domains send visitors to iPhone exploit kits; opening the page is enough on vulnerable iOS",
      "id": "2026-10-28/deadtag-expired-tag-domains-coruna-darksword-iphone-kits",
      "immediate_action": null,
      "kev": false,
      "kind": "threat",
      "last_changed_at": "2026-10-28T03:54:00Z",
      "markdown_url": "https://ctipilot.ch/entries/2026-10-28/deadtag-expired-tag-domains-coruna-darksword-iphone-kits/index.md",
      "permalink": "https://ctipilot.ch/entries/2026-10-28/deadtag-expired-tag-domains-coruna-darksword-iphone-kits/",
      "priority": "notable",
      "product_keys": [
        "product:apple-ios"
      ],
      "summary": "Report URI and iVerify report that an operator they call DeadTag buys the expired domains of old analytics and advertising tags that thousands of websites still load, so every page that carries the tag runs the operator's script, and sells the visitors on; Report URI counts more than 660 re-registered domains. For chosen iPhone visitors one chain ends at a page that serves the Coruna kit to iOS 13 to 17.2.1 and a modified DarkSword kit to iOS 18.4 to 18.7, both of which attack the browser itself, so that opening the page compromises a vulnerable device and steals keychain passwords and crypto-wallet data.",
      "techniques": [
        "T1189",
        "T1203",
        "T1555.001",
        "T1584.001"
      ],
      "verification": "multi-source"
    },
    {
      "actions": [
        "Install NetScaler ADC and Gateway 14.1-73.49, 13.1-64.32, 14.1-FIPS 14.1-73.49 FIPS or 13.1-FIPS and 13.1-NDcPP 13.1.37.286 (or later) on every appliance whose NSIP, a management-enabled SNIP or the cluster IP answers on its GUI or API, internet-reachable ones first; until each has its build, restrict GUI and API access on those addresses to trusted administrative hosts with ACLs, keeping NetScaler Console access working."
      ],
      "affected_products": [
        "Citrix NetScaler ADC",
        "Citrix NetScaler Gateway",
        "PHP"
      ],
      "change": "update",
      "classification": "A2",
      "cves": [
        {
          "affected": "NetScaler management interfaces (NSIP GUI, management-enabled SNIP, cluster IP GUI) on all supported software versions",
          "cvss": "9.2 (CVSS 4.0, as stated by Citrix for the PHP flaw)",
          "fixed": "ADC and Gateway 14.1-73.49 and later, 13.1-64.32 and later of 13.1; ADC 14.1-FIPS 14.1-73.49 FIPS and later; ADC 13.1-FIPS and 13.1-NDcPP 13.1.37.286 and later",
          "id": "CVE-2026-109618",
          "status": [
            "cisa-kev",
            "patch-available"
          ]
        },
        {
          "affected": "NetScaler management interfaces (NSIP GUI, management-enabled SNIP, cluster IP GUI) on all supported software versions",
          "cvss": "9.2 (CVSS 4.0, as stated by Citrix for the PHP flaw)",
          "fixed": "ADC and Gateway 14.1-73.49 and later, 13.1-64.32 and later of 13.1; ADC 14.1-FIPS 14.1-73.49 FIPS and later; ADC 13.1-FIPS and 13.1-NDcPP 13.1.37.286 and later",
          "id": "CVE-2026-109619",
          "status": [
            "cisa-kev",
            "patch-available"
          ]
        }
      ],
      "exploited": true,
      "headline": "NetScaler's PHP2Shell fix is out: 14.1-73.49, 13.1-64.32 and FIPS builds; restrict management access until installed",
      "id": "2026-10-23/netscaler-php2shell-management-gui-fixes-2026-10-27",
      "immediate_action": null,
      "kev": true,
      "kind": "vulnerability",
      "last_changed_at": "2026-10-28T03:37:38Z",
      "markdown_url": "https://ctipilot.ch/entries/2026-10-23/netscaler-php2shell-management-gui-fixes-2026-10-27/index.md",
      "permalink": "https://ctipilot.ch/entries/2026-10-23/netscaler-php2shell-management-gui-fixes-2026-10-27/",
      "priority": "notable",
      "product_keys": [
        "product:citrix-netscaler",
        "product:php"
      ],
      "summary": "NetScaler Product Security says the two PHP flaws CVE-2026-109618 and CVE-2026-109619 affect the NetScaler Management Portal, reached through the NSIP GUI, any SNIP that permits management access and the cluster IP GUI, on all supported software versions; NetScaler Console and SVM are not affected. Citrix's bulletin now names the fixed builds, 14.1-73.49, 13.1-64.32, 14.1-FIPS 14.1-73.49 FIPS and 13.1-FIPS and 13.1-NDcPP 13.1.37.286 and later, and tells customers to immediately restrict management access to trusted networks; no source reports an attack on NetScaler, although CISA added both PHP flaws to its Known Exploited Vulnerabilities catalog on 2026-10-26.",
      "techniques": [
        "T1190"
      ],
      "verification": "single-source"
    },
    {
      "actions": [
        "In every GitHub organisation your teams or suppliers administer, private repositories and GitHub Enterprise Server included, search for branches named ci-sync- plus six random characters that add only the workflow file sync-check.yml, and for any workflow run on them; for every hit, rotate all repository, organisation and environment secrets that repository could read and revoke the token that pushed the commit, because deleting the run or the branch does not undo the exposure."
      ],
      "affected_products": [
        "GitHub Actions",
        "GitHub Enterprise Server"
      ],
      "change": "new",
      "classification": "B2",
      "cves": [],
      "exploited": false,
      "headline": "Gheist abuses stolen GitHub tokens to dump secrets through Actions; GitHub's hold covers public repositories only",
      "id": "2026-10-27/gheist-stolen-github-tokens-secret-dumping-workflows",
      "immediate_action": null,
      "kev": false,
      "kind": "threat",
      "last_changed_at": "2026-10-27T03:54:00Z",
      "markdown_url": "https://ctipilot.ch/entries/2026-10-27/gheist-stolen-github-tokens-secret-dumping-workflows/index.md",
      "permalink": "https://ctipilot.ch/entries/2026-10-27/gheist-stolen-github-tokens-secret-dumping-workflows/",
      "priority": "notable",
      "product_keys": [
        "product:github-actions",
        "product:github-enterprise-server"
      ],
      "summary": "Wiz Research has tracked since 2026-09-15 an automated campaign, Gheist, that uses stolen GitHub tokens to commit a secret-dumping Actions workflow to every repository each token can reach, more than 13,500 branches from more than 850 accounts. GitHub's approval hold of 2026-07-28 stops the workflow on public github.com repositories, but not on private repositories or GitHub Enterprise Server, where Wiz saw the runs complete and the organizations' own workflows assume AWS roles on the attacker branches.",
      "techniques": [
        "T1070",
        "T1078",
        "T1213.003",
        "T1550.001",
        "T1552",
        "T1567",
        "T1611"
      ],
      "verification": "single-source"
    },
    {
      "actions": [
        "Upgrade every HPE Networking (Aruba) Mobility Conductor, Controller, Gateway and access point on AOS-10 or AOS-8 to the fixed build of its train (10.8.1.2, 10.7.2.7, 10.4.1.14, 8.13.3.1 or 8.10.0.24), and until then confine the CLI and web management interfaces to a dedicated layer 2 segment or VLAN behind firewall policy, as HPE advises."
      ],
      "affected_products": [
        "HPE Networking AOS-10",
        "HPE Networking AOS-8"
      ],
      "change": "correction",
      "classification": "A2",
      "cves": [
        {
          "affected": "AOS-10 10.8.0.0 to 10.8.1.1, 10.7.0.0 to 10.7.2.6, 10.4.0.0 to 10.4.1.13; end-of-maintenance versions presumed affected",
          "cvss": "10.0 (CVSS 3.1)",
          "fixed": "AOS-10.8.1.2, AOS-10.7.2.7, AOS-10.4.1.14",
          "id": "CVE-2026-79844",
          "status": [
            "patch-available"
          ]
        },
        {
          "affected": "AOS-10 10.8.0.0 to 10.8.1.1, 10.7.0.0 to 10.7.2.6, 10.4.0.0 to 10.4.1.13; end-of-maintenance versions presumed affected",
          "cvss": "10.0 (CVSS 3.1)",
          "fixed": "AOS-10.8.1.2, AOS-10.7.2.7, AOS-10.4.1.14",
          "id": "CVE-2026-79845",
          "status": [
            "patch-available"
          ]
        },
        {
          "affected": "AOS-8 8.13.0.0 to 8.13.3.0, 8.10.0.0 to 8.10.0.23; end-of-maintenance versions presumed affected",
          "cvss": "10.0 (CVSS 3.1)",
          "fixed": "AOS-8.13.3.1, AOS-8.10.0.24",
          "id": "CVE-2026-79846",
          "status": [
            "patch-available"
          ]
        },
        {
          "affected": "AOS-10 10.8.0.0 to 10.8.1.1, 10.7.0.0 to 10.7.2.6, 10.4.0.0 to 10.4.1.13; end-of-maintenance versions presumed affected",
          "cvss": "10.0 (CVSS 3.1)",
          "fixed": "AOS-10.8.1.2, AOS-10.7.2.7, AOS-10.4.1.14",
          "id": "CVE-2026-79847",
          "status": [
            "patch-available"
          ]
        },
        {
          "affected": "AOS-8 8.13.0.0 to 8.13.3.0, 8.10.0.0 to 8.10.0.23; end-of-maintenance versions presumed affected",
          "cvss": "10.0 (CVSS 3.1)",
          "fixed": "AOS-8.13.3.1, AOS-8.10.0.24",
          "id": "CVE-2026-79848",
          "status": [
            "patch-available"
          ]
        },
        {
          "affected": "AOS-8 8.13.0.0 to 8.13.3.0, 8.10.0.0 to 8.10.0.23; end-of-maintenance versions presumed affected",
          "cvss": "10.0 (CVSS 3.1)",
          "fixed": "AOS-8.13.3.1, AOS-8.10.0.24",
          "id": "CVE-2026-79849",
          "status": [
            "patch-available"
          ]
        },
        {
          "affected": "AOS-8 8.13.0.0 to 8.13.3.0, 8.10.0.0 to 8.10.0.23; end-of-maintenance versions presumed affected",
          "cvss": "10.0 (CVSS 3.1)",
          "fixed": "AOS-8.13.3.1, AOS-8.10.0.24",
          "id": "CVE-2026-79850",
          "status": [
            "patch-available"
          ]
        },
        {
          "affected": "AOS-10 10.8.0.0 to 10.8.1.1, 10.7.0.0 to 10.7.2.6, 10.4.0.0 to 10.4.1.13; end-of-maintenance versions presumed affected",
          "cvss": "10.0 (CVSS 3.1)",
          "fixed": "AOS-10.8.1.2, AOS-10.7.2.7, AOS-10.4.1.14",
          "id": "CVE-2026-79851",
          "status": [
            "patch-available"
          ]
        },
        {
          "affected": "AOS-10 10.8.0.0 to 10.8.1.1, 10.7.0.0 to 10.7.2.6, 10.4.0.0 to 10.4.1.13; end-of-maintenance versions presumed affected; AOS-8 8.13.0.0 to 8.13.3.0, 8.10.0.0 to 8.10.0.23; end-of-maintenance versions presumed affected",
          "cvss": "9.8 (CVSS 3.1)",
          "fixed": "AOS-10.8.1.2, AOS-10.7.2.7, AOS-10.4.1.14, AOS-8.13.3.1, AOS-8.10.0.24",
          "id": "CVE-2026-79852",
          "status": [
            "patch-available"
          ]
        },
        {
          "affected": "AOS-10 10.8.0.0 to 10.8.1.1, 10.7.0.0 to 10.7.2.6, 10.4.0.0 to 10.4.1.13; end-of-maintenance versions presumed affected",
          "cvss": "9.8 (CVSS 3.1)",
          "fixed": "AOS-10.8.1.2, AOS-10.7.2.7, AOS-10.4.1.14",
          "id": "CVE-2026-79853",
          "status": [
            "patch-available"
          ]
        },
        {
          "affected": "AOS-10 10.8.0.0 to 10.8.1.1, 10.7.0.0 to 10.7.2.6, 10.4.0.0 to 10.4.1.13; end-of-maintenance versions presumed affected",
          "cvss": "9.8 (CVSS 3.1)",
          "fixed": "AOS-10.8.1.2, AOS-10.7.2.7, AOS-10.4.1.14",
          "id": "CVE-2026-79854",
          "status": [
            "patch-available"
          ]
        },
        {
          "affected": "AOS-8 8.13.0.0 to 8.13.3.0, 8.10.0.0 to 8.10.0.23; end-of-maintenance versions presumed affected",
          "cvss": "9.8 (CVSS 3.1)",
          "fixed": "AOS-8.13.3.1, AOS-8.10.0.24",
          "id": "CVE-2026-79855",
          "status": [
            "patch-available"
          ]
        },
        {
          "affected": "AOS-8 8.13.0.0 to 8.13.3.0, 8.10.0.0 to 8.10.0.23; end-of-maintenance versions presumed affected",
          "cvss": "9.8 (CVSS 3.1)",
          "fixed": "AOS-8.13.3.1, AOS-8.10.0.24",
          "id": "CVE-2026-79856",
          "status": [
            "patch-available"
          ]
        },
        {
          "affected": "AOS-8 8.13.0.0 to 8.13.3.0, 8.10.0.0 to 8.10.0.23; end-of-maintenance versions presumed affected",
          "cvss": "9.8 (CVSS 3.1)",
          "fixed": "AOS-8.13.3.1, AOS-8.10.0.24",
          "id": "CVE-2026-79857",
          "status": [
            "patch-available"
          ]
        },
        {
          "affected": "AOS-8 8.13.0.0 to 8.13.3.0, 8.10.0.0 to 8.10.0.23; end-of-maintenance versions presumed affected",
          "cvss": "9.8 (CVSS 3.1)",
          "fixed": "AOS-8.13.3.1, AOS-8.10.0.24",
          "id": "CVE-2026-79858",
          "status": [
            "patch-available"
          ]
        },
        {
          "affected": "AOS-8 8.13.0.0 to 8.13.3.0, 8.10.0.0 to 8.10.0.23; end-of-maintenance versions presumed affected",
          "cvss": "9.8 (CVSS 3.1)",
          "fixed": "AOS-8.13.3.1, AOS-8.10.0.24",
          "id": "CVE-2026-79859",
          "status": [
            "patch-available"
          ]
        },
        {
          "affected": "AOS-8 8.13.0.0 to 8.13.3.0, 8.10.0.0 to 8.10.0.23; end-of-maintenance versions presumed affected",
          "cvss": "9.8 (CVSS 3.1)",
          "fixed": "AOS-8.13.3.1, AOS-8.10.0.24",
          "id": "CVE-2026-79860",
          "status": [
            "patch-available"
          ]
        },
        {
          "affected": "AOS-10 10.8.0.0 to 10.8.1.1, 10.7.0.0 to 10.7.2.6, 10.4.0.0 to 10.4.1.13; end-of-maintenance versions presumed affected",
          "cvss": "9.8 (CVSS 3.1)",
          "fixed": "AOS-10.8.1.2, AOS-10.7.2.7, AOS-10.4.1.14",
          "id": "CVE-2026-79861",
          "status": [
            "patch-available"
          ]
        },
        {
          "affected": "AOS-10 10.8.0.0 to 10.8.1.1, 10.7.0.0 to 10.7.2.6, 10.4.0.0 to 10.4.1.13; end-of-maintenance versions presumed affected; AOS-8 8.13.0.0 to 8.13.3.0, 8.10.0.0 to 8.10.0.23; end-of-maintenance versions presumed affected",
          "cvss": "9.4 (CVSS 3.1)",
          "fixed": "AOS-10.8.1.2, AOS-10.7.2.7, AOS-10.4.1.14, AOS-8.13.3.1, AOS-8.10.0.24",
          "id": "CVE-2026-79872",
          "status": [
            "patch-available"
          ]
        }
      ],
      "exploited": false,
      "headline": "HPE's Aruba wireless bulletin fixes 19 unauthenticated network flaws at CVSS 9.0+; HPE knows of no public exploit code",
      "id": "2026-10-23/hpesbnw05162-hpe-aruba-aos-8-aos-10-72-cves-19-unauth",
      "immediate_action": null,
      "kev": false,
      "kind": "vulnerability",
      "last_changed_at": "2026-10-25T14:04:41Z",
      "markdown_url": "https://ctipilot.ch/entries/2026-10-23/hpesbnw05162-hpe-aruba-aos-8-aos-10-72-cves-19-unauth/index.md",
      "permalink": "https://ctipilot.ch/entries/2026-10-23/hpesbnw05162-hpe-aruba-aos-8-aos-10-72-cves-19-unauth/",
      "priority": "notable",
      "product_keys": [
        "product:hpe-networking-aos-10",
        "product:hpe-networking-aos-8"
      ],
      "summary": "HPE Networking's bulletin HPESBNW05162 of 2026-10-22 fixes 72 CVEs in AOS-8 and AOS-10 for Mobility Conductors, Controllers, Gateways and access points, 33 of them at CVSS 3.1 9.0 or higher and 19 of those reachable over the network without authentication (eight at 10.0). HPE found the flaws through internal research, knows of no public discussion or exploit code, and strongly urges patching; its only workaround is to confine the CLI and web management interfaces to a dedicated segment behind firewall policy.",
      "techniques": [
        "T1190",
        "T1210"
      ],
      "verification": "single-source"
    },
    {
      "actions": [
        "Run nginx -T on every internet-facing NGINX reverse proxy, load balancer and ingress and upgrade each one whose configuration uses alias with rewrite and $request_filename, a regex map whose captures are referenced before its output variable, or aio together with ssi, HTTP/3 or TLS session ticket key rotation to nginx 1.30.6 or 1.31.7 (NGINX Plus 37.0.5.1 or 37.1.0.1); where the package comes from Debian trixie, install the DSA-6575-1 update (1.26.3-3+deb13u10); on bookworm, which the tracker still marks vulnerable, apply F5's configuration workaround until the distribution ships a fix."
      ],
      "affected_products": [
        "F5 NGINX Open Source",
        "F5 NGINX Plus"
      ],
      "change": "update",
      "classification": "A2",
      "cves": [
        {
          "affected": "NGINX Open Source 0.1.29 to 1.30.5 and 1.31.0 to 1.31.6; NGINX Plus R33 to R36, 37.0.0 to 37.0.5 and 37.1.0",
          "cvss": "9.2 (CVSS 4.0)",
          "fixed": "NGINX Open Source 1.30.6 (stable) and 1.31.7 (mainline); NGINX Plus 37.0.5.1 and 37.1.0.1",
          "id": "CVE-2026-15176",
          "status": [
            "patch-available"
          ]
        },
        {
          "affected": "NGINX Open Source 1.30.0 to 1.30.5 and 1.31.2 to 1.31.6, builds that already carry the CVE-2026-42533 fix included; NGINX Plus R33 to R36, 37.0.0 to 37.0.5 and 37.1.0",
          "cvss": "9.2 (CVSS 4.0)",
          "fixed": "NGINX Open Source 1.30.6 (stable) and 1.31.7 (mainline); NGINX Plus 37.0.5.1 and 37.1.0.1",
          "id": "CVE-2026-93479",
          "status": [
            "patch-available"
          ]
        },
        {
          "affected": "NGINX Open Source 0.8.11 to 1.31.6 (nginx.org), only with asynchronous file I/O and SSI enabled; NGINX Plus is listed among the fixed releases; Daily CyberSecurity gives one Plus range for all three advisories (37.0.0 through 37.0.4 and R33 to R36) where CCB gives 37.0.0 to 37.0.5 for the first two",
          "cvss": "9.2 (CVSS 4.0)",
          "fixed": "NGINX Open Source 1.30.6 (stable) and 1.31.7 (mainline); NGINX Plus 37.0.5.1 and 37.1.0.1",
          "id": "CVE-2026-97205",
          "status": [
            "patch-available"
          ]
        },
        {
          "affected": "NGINX Open Source 1.25.0 to 1.31.6, with HTTP/3 in use",
          "cvss": "medium (nginx.org rating; no score read)",
          "fixed": "NGINX Open Source 1.30.6 (stable) and 1.31.7 (mainline)",
          "id": "CVE-2026-95101",
          "status": [
            "patch-available"
          ]
        },
        {
          "affected": "NGINX Open Source 1.23.2 to 1.31.6, with TLS session ticket key rotation in use",
          "cvss": "medium (nginx.org rating; no score read)",
          "fixed": "NGINX Open Source 1.30.6 (stable) and 1.31.7 (mainline)",
          "id": "CVE-2026-97629",
          "status": [
            "patch-available"
          ]
        }
      ],
      "exploited": false,
      "headline": "Three configuration-dependent NGINX heap flaws (CVSS 9.2) are fixed in 1.30.6, 1.31.7 and Debian trixie, not bookworm",
      "id": "2026-10-20/nginx-three-unauth-heap-corruption-flaws-fixed-1-30-6",
      "immediate_action": null,
      "kev": false,
      "kind": "vulnerability",
      "last_changed_at": "2026-10-25T14:03:33Z",
      "markdown_url": "https://ctipilot.ch/entries/2026-10-20/nginx-three-unauth-heap-corruption-flaws-fixed-1-30-6/index.md",
      "permalink": "https://ctipilot.ch/entries/2026-10-20/nginx-three-unauth-heap-corruption-flaws-fixed-1-30-6/",
      "priority": "notable",
      "product_keys": [
        "product:f5-nginx-open-source",
        "product:f5-nginx-plus"
      ],
      "summary": "The nginx 1.30.6 (stable) and 1.31.7 (mainline) releases of 2026-10-14 fix five security flaws, three of them heap-corruption bugs that F5 scores CVSS 4.0 9.2 and an unauthenticated attacker can reach with crafted HTTP requests, but only on configurations that combine alias with rewrite and $request_filename, use a regex map whose captures are referenced before its output variable, or enable asynchronous file I/O with server-side includes; the other two concern HTTP/3 and TLS session ticket key rotation. F5 says the heap flaws restart the worker, with code execution only where ASLR is disabled or bypassed; no exploitation or public proof of concept is reported, nginx.org rates all five medium, and Debian fixed trixie with DSA-6575-1 while its bookworm package is still marked vulnerable.",
      "techniques": [
        "T1190",
        "T1499.004"
      ],
      "verification": "multi-source"
    },
    {
      "actions": [
        "Find every host, build agent and container that installed litellm 1.107.0 from PyPI between 11:39 and 13:23 UTC on 2026-10-21, or pulled the v1.107.0, latest, main-latest or main-stable tag of the official GHCR or Docker Hub LiteLLM images between 11:46 and 14:20 UTC; treat each as compromised, inspect it with tooling that does not start Python in the affected environment, rebuild it from a reviewed artifact pinned to 1.106.2 or an image digest, and rotate every cloud, Kubernetes, registry, SSH, database and AI-provider credential it could read, including the provider keys stored in a LiteLLM proxy database."
      ],
      "affected_products": [
        "LiteLLM"
      ],
      "change": "improvement",
      "classification": "B1",
      "cves": [],
      "exploited": false,
      "headline": "LiteLLM 1.107.0 on PyPI and in the official images stole cloud and AI credentials; removing the package does not stop it",
      "id": "2026-10-22/litellm-1-107-0-pypi-docker-credential-stealer-lookalike",
      "immediate_action": null,
      "kev": false,
      "kind": "incident",
      "last_changed_at": "2026-10-25T13:42:16Z",
      "markdown_url": "https://ctipilot.ch/entries/2026-10-22/litellm-1-107-0-pypi-docker-credential-stealer-lookalike/index.md",
      "permalink": "https://ctipilot.ch/entries/2026-10-22/litellm-1-107-0-pypi-docker-credential-stealer-lookalike/",
      "priority": "notable",
      "product_keys": [
        "product:litellm"
      ],
      "summary": "On 2026-10-21 LiteLLM 1.107.0, the open-source LLM gateway, shipped with malicious Python startup files in all seven PyPI wheels (live 11:39 to 13:23 UTC) and in the official GHCR and Docker Hub images behind the v1.107.0, latest, main-latest and main-stable tags (11:46 to 14:20 UTC); they run a credential stealer at every Python start and start a background loader that could execute code fetched from an attacker-chosen host, though Socket saw its pointer empty at 13:01 UTC. The maintainers' root-cause post of 2026-10-23 says a master key committed to a public repository on 2026-05-27 and never revoked gave the attacker, from 2026-10-10, a GitHub organization owner's CLI token, with which it stole two maintainers' tokens and, on 2026-10-21, overrode branch protection to build the release from a look-alike repository; Socket independently found secret-stealing workflows running on 2026-10-10. Wiz saw stolen AWS instance-role credentials tested about 4.5 hours after exfiltration; PyPI and the registries removed the release the same day and the maintainers say to pin 1.106.2 or an explicit earlier version.",
      "techniques": [
        "T1027.013",
        "T1070",
        "T1078.004",
        "T1087.004",
        "T1102.001",
        "T1105",
        "T1140",
        "T1195.001",
        "T1195.002",
        "T1528",
        "T1546.018",
        "T1552.001",
        "T1552.004",
        "T1552.005",
        "T1555.003"
      ],
      "verification": "multi-source"
    },
    {
      "actions": [
        "Confirm that every domain controller has the cumulative update of 2026-10-13 and every Windows server the September 2026 one for its Windows release (SpecterOps names KB5126646, the October update for Windows Server 2025, and KB5122882, the September update for Windows Server 2022; other releases have their own packages), then list the computer accounts whose msDS-AllowedToActOnBehalfOfOtherIdentity or msDS-KeyCredentialLink holds a value nobody set, because patching does not remove what a relay already wrote."
      ],
      "affected_products": [
        "Microsoft Windows Server"
      ],
      "change": "new",
      "classification": "B2",
      "cves": [],
      "exploited": false,
      "headline": "Required LDAP and SMB signing did not stop NTLM relay: a re-authenticated session kept the attacker's key",
      "id": "2026-10-25/ntlm-relay-signing-bypass-reauthentication-ldap-smb",
      "immediate_action": null,
      "kev": false,
      "kind": "research",
      "last_changed_at": "2026-10-25T03:34:00Z",
      "markdown_url": "https://ctipilot.ch/entries/2026-10-25/ntlm-relay-signing-bypass-reauthentication-ldap-smb/index.md",
      "permalink": "https://ctipilot.ch/entries/2026-10-25/ntlm-relay-signing-bypass-reauthentication-ldap-smb/",
      "priority": "notable",
      "product_keys": [
        "product:microsoft-windows-server"
      ],
      "summary": "SpecterOps (LDAP, 2026-10-23) and Blackfield (SMB, 2026-10-21) independently show that a domain controller or file server that requires signing still accepts a relayed NTLM authentication when the attacker first opens a signed session of its own and then re-authenticates it as the victim, so the session keeps a signing key the attacker knows. Microsoft fixed the SMB variant in September 2026 and the LDAP variant in the 2026-10-13 cumulative update; SpecterOps reports no reply to its report and Blackfield found no CVE for the SMB change; public tooling exists and neither researcher reports use in attacks.",
      "techniques": [
        "T1003.006",
        "T1098",
        "T1187",
        "T1557",
        "T1557.001"
      ],
      "verification": "multi-source"
    },
    {
      "actions": [
        "Find every SonicWall GMS instance on 9.5.2 or earlier, Virtual Appliance or Windows, cut its reachability from untrusted networks and schedule its replacement with Network Security Manager, because SonicWall will release no fix and names no workaround."
      ],
      "affected_products": [
        "SonicWall GMS"
      ],
      "change": "new",
      "classification": "A2",
      "cves": [
        {
          "affected": "SonicWall GMS Virtual Appliance and Windows, 9.5.2 and earlier versions",
          "cvss": "9.1",
          "fixed": "none: the product has reached end of life and SonicWall will release no remediation; no workaround",
          "id": "CVE-2026-109593",
          "status": [
            "no-patch"
          ]
        },
        {
          "affected": "SonicWall GMS Virtual Appliance and Windows, 9.5.2 and earlier versions",
          "cvss": "6.8",
          "fixed": "none: the product has reached end of life and SonicWall will release no remediation; no workaround",
          "id": "CVE-2026-109594",
          "status": [
            "no-patch"
          ]
        }
      ],
      "exploited": false,
      "headline": "SonicWall GMS 9.5.2 and earlier: unauthenticated file read, no fix will ship; replace with NSM",
      "id": "2026-11-05/sonicwall-gms-eol-unauthenticated-file-read-no-fix",
      "immediate_action": null,
      "kev": false,
      "kind": "vulnerability",
      "last_changed_at": "2026-11-05T03:59:00Z",
      "markdown_url": "https://ctipilot.ch/entries/2026-11-05/sonicwall-gms-eol-unauthenticated-file-read-no-fix/index.md",
      "permalink": "https://ctipilot.ch/entries/2026-11-05/sonicwall-gms-eol-unauthenticated-file-read-no-fix/",
      "priority": "routine",
      "product_keys": [
        "product:sonicwall-gms"
      ],
      "summary": "SonicWall's advisory SNWLID-2026-0019 of 2026-11-03 says an unauthenticated attacker with network access to SonicWall GMS 9.5.2 and earlier may read internal GMS files (CVE-2026-109593, CVSS 3.1 9.1), with a post-authentication SQL injection beside it (CVE-2026-109594, 6.8). The product reached end of support on 2026-09-30, so SonicWall releases no fix, names no workaround and urges migration to Network Security Manager; the advisory says nothing about exploitation.",
      "techniques": [
        "T1005",
        "T1190"
      ],
      "verification": "single-source"
    }
  ],
  "window_days": 14
}