The Hot Drop

Oct 26

The Hot Drop for 10-26-2026

A pre-embargo leak forced PHP’s emergency RCE patches. Is your Node.js stack safe from the new Node2Shell? And what’s the BRONZE SANDCASTLE AD theft revealing?

Since the last show: 7 new · 4 developing · 1 returning · 4 dropped · 25% overlap with the previous show

Contents

  1. PHP releases emergency patches for critical ‘PHP2Shell’ RCE flaws after pre-embargo leak
  2. Sophos and Check Point Detail BRONZE SANDCASTLE AD Theft and VoidLink Cloud Malware
  3. Node2Shell: Critical Brotli Decoder Flaw (CVE-2026-111497) Triggers Cross-Ecosystem Patches
  4. APT41 deploys BlackX UEFI bootkit to bypass Secure Boot on Central Asian diplomatic systems
  5. LiteLLM 1.107.0 Supply Chain Attack Distributes Privcollect Stealer
  6. Zero-Permission Token Theft Flaw in Microsoft Authenticator for Android Patched
  7. Eye Security disables Time4Popcorn updater via 2M updates to close CVE-2026-30612
  8. Ruby patches Onigmo regex bugs behind four critical GitLab RCE flaws affecting 12 years of releases
  9. CISA Adds Arista VeloCloud Orchestrator SQL Injection Flaw to KEV Catalog Amid Active Exploitation
  10. eMudhra Revokes Eight CA Certificates After Weak Key Flaw Discovered
  11. Capcom confirms 11.7M CAPCOM ID accounts breached; Ragnar Locker threat targets law enforcement contact
  12. Glassworm compromises OVHcloud CLI via GitHub account takeover

1. PHP releases emergency patches for critical ‘PHP2Shell’ RCE flaws after pre-embargo leak (Lead)

Event now covered by 19 outlets (was 16); Blast radius expanded: new vendor(s): sophos; 72 new indicator(s) observed

PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. The PHP security team stated that the risk is highest for mod_php, where an unauthenticated request can trigger the attack before any application code runs. Researchers at Wiz, Calif, and OpenAI discovered and reported the PHP2Shell flaws, which affect nearly every PHP version back to PHP 5.4. At least one European government has taken its website offline as a precaution. The exploit attempt originated from an IP address associated with a commercial anonymization network. This detail remains specific to the available reporting: Fixed ea-php packages for versions ea-php52 through ea-php85 have been released to the stable repository. This detail remains specific to the available reporting: Fastly recorded approximately 250,000 requests from PHP2Shell-named tools across roughly 3,200 public IP addresses through midday October 22. This detail remains specific to the available reporting: CrowdStrike Counter Adversary Operations reproduced a proof-of-concept exploit achieving remote code execution with the privileges of the running mod_php or PHP-FPM worker processes. Review the affected control or detection surface described in this claim. Confirm the affected product or control state against the available evidence.

Vulnerabilities

  • CVE-2024-4577 — CVSS 9.8 (Critical) · CISA KEV · CWE-78 · PHP Group PHP. In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, when using Apache and PHP-CGI on Windows, if the system is set up to use certain code pages, Windows may use “Best-Fit” behavior to replace…
  • CVE-2026-109618 — CVSS 9.8 (Critical) · CWE-416, CWE-755, CWE-824, CWE-1325, CWE-1419 · PHP Group PHP. PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request.
  • CVE-2026-64638 — CVSS 8.9 (High) · CWE-79 · WordPress WordPress. WordPress is vulnerable to a pre-auth reflected XSS vulnerability on the login screen.
  • CVE-2026-109619 — CVSS 8.1 (High) · CWE-416, CWE-755, CWE-824, CWE-1325, CWE-1419 · PHP Group PHP. PHP has various global state that temporarily points into request memory.
  • CVE-2026-87902 — CVSS 8.1 (High) · CISA KEV · CWE-98 · WordPress WordPress. An unauthenticated attacker can make get_page_template() page-template resolution include a chosen readable local .php file outside the active theme directories.
  • CVE-2012-1823 — CVSS 7.5 (High) · CISA KEV · CWE-77 · n/a n/a. sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not properly handle query strings that lack an = (equals sign) character, which allows remote…

Techniques

  • AML.T0006 Active Scanning (Reconnaissance)
  • AML.T0010.004 Container Registry (Initial Access)
  • AML.T0011.000 Unsafe AI Artifacts (Execution)
  • AML.T0016.002 Generative AI (Resource Development)
  • AML.T0049 Exploit Public-Facing Application (Initial Access)
  • AML.T0050 Command and Scripting Interpreter (Execution)
  • AML.T0054 LLM Jailbreak (Defense Evasion)
  • AML.T0072 Reverse Shell (Command And Control)
  • T1001.003 Protocol or Service Impersonation (Command And Control)
  • T1003.002 Security Account Manager (Credential Access)
  • and 10 more

Named actors and malware

  • Lazarus (actor)
  • Potassium (actor)
  • APT38 (actor)
  • Andariel (actor)
  • Kimsuky (actor)
  • Cobalt Strike (malware)
  • Lazarus Group (actor)
  • Potassium botnet (actor)

Indicators

  • 25 indicators on file

Coverage

No material change since last show

What changed

The BRONZE SANDCASTLE group stole Active Directory databases from victims in the Philippines, Taiwan, Afghanistan, Namibia, and likely South Korea between August 2025 and August 2026. They used a tool called COFFLoader to hijack legitimate Windows applications like Java, Krita, NVDA, and LINE to execute encrypted payloads. Check Point identified VoidLink, a cloud-native Linux malware framework written in Zig that supports command-and-control channels over HTTP, HTTPS, ICMP, and DNS. The group also deployed BlackLotus, a UEFI firmware rootkit that reportedly was listed for sale on the cybercrime scene for $5,000 earlier this month.

How it works

VoidLink achieves persistence through rootkit-style capabilities including LD_PRELOAD, LKM, and eBPF, allowing the implant to hook into dynamic linkers and kernel modules. BlackLotus bypasses secure boot features to backdoor Windows machines, while the term_pty_v3.o plugin provides an interactive backdoor for remote command execution and file operations. The attack chain leverages container CLI and API abuse to execute malicious commands in containerized environments, facilitating the exfiltration of sensitive data.

What to do

VoidLink uses a Zig-based architecture to target Kubernetes and Docker by abusing container CLI and API calls, enabling T1059.013 execution within isolated environments. This shifts exposure from host-level file systems to cluster orchestration layers, where standard endpoint controls often miss activity. Responders should audit kubectl and dockerd API interactions for unauthorized pod creation or image pulls, specifically looking for anomalous SDK calls that bypass traditional binary execution logs. The framework’s financial theft objective, mapped to T1657, suggests attackers prioritize credential harvesting from cloud providers and Git systems over immediate data destruction. This behavior implies a longer dwell time focused on account compromise rather than rapid encryption. Investigators should prioritize telemetry on credential access patterns in cloud identity providers and version control repositories, treating unusual API token usage as a higher priority signal than generic malware alerts, while acknowledging the uncertainty in specific actor attribution. Implement application control policies to block unauthorized execution of container orchestration commands such as docker exec or kubectl exec from non-standard user contexts. Enforce privileged account management controls to restrict and audit the use of Docker and Kubernetes APIs for executing commands within running containers.

Limits and watch

The specific operational scope of VoidLink’s cloud-native capabilities remains uncertain, as it is a cloud-first implant written in Zig designed to operate in modern infrastructure.

Techniques

  • T1055 Process Injection (Stealth)
  • T1057 Process Discovery (Discovery)
  • T1059.013 Container CLI/API (Execution)
  • T1087.001 Local Account (Discovery)
  • T1136.001 Local Account (Persistence)
  • T1212 Exploitation for Credential Access (Credential Access)
  • T1218.002 Control Panel (Stealth)
  • T1543.002 Systemd Service (Persistence)
  • T1552.003 Shell History (Credential Access)
  • T1552.004 Private Keys (Credential Access)
  • and 3 more

Named actors and malware

  • Cobalt Strike (malware)

Indicators

  • 13 indicators on file

Coverage

3. Node2Shell: Critical Brotli Decoder Flaw (CVE-2026-111497) Triggers Cross-Ecosystem Patches (Segment)

Event now covered by 4 outlets (was 1); Blast radius expanded: new vendor(s): google, openai, github, microsoft, python, apache, urllib3, jfrog, kubernetes; new product(s): brotli, bun, envoy, python, istio; 32 new indicator(s) observed

A critical out-of-bounds write in Google’s Brotli decoder, dubbed CVE-2026-111497, allows unauthenticated remote code execution. Wiz Research reports that 91% of cloud environments have vulnerable resources. Microsoft released fixes for .NET, Visual Studio, and PowerShell on October 25, 2026, to address the newly disclosed vulnerability. Node[.]js maintainers have reportedly released patches for the 22.x, 24.x, and 26.x lines to mitigate the flaw. The lead sheet tracks 32 new indicators and cross-ecosystem patches from Apache, JFrog, and Kubernetes maintainers. CVE-2026-111497 is a buffer overflow in Google Brotli versions 1.0.3 through 1.2.0 that allows remote attackers to corrupt memory. Node[.]js versions twenty-four point twenty-two and twenty-six point twelve fail to validate TLS hostnames when attackers use fullwidth digits. Node[.]js versions twenty-two, twenty-four, and twenty-six contain a TLS hostname verification flaw. Bun versions 1.4.3 and earlier are reportedly affected by the flaw, with a fix available in version 1.4.4.

Malformed Brotli input may cause an out-of-bounds write during decoding in the Brotli decoder bundled with Node[.]js. The flaw stems from an out-of-bounds write in the decoder, enabling code execution via crafted compressed streams. Google’s Brotli decoder allows remote attackers to corrupt memory via crafted streams since October 23. A remote attacker triggers out-of-bounds writes in the decoder to corrupt memory or execute code. Node[.]js 22.x through 26.x misnormalizes non-canonical IPv4 literals like 0127.0.0.1 during TLS hostname verification. The library incorrectly treats non-canonical IPv4 spellings as DNS names, accepting mismatched certificates. The library treats these characters as DNS names, allowing certificates with DNS entries to spoof IPv4 endpoints. The fs[.]realpathSync function bypasses read permission checks, allowing path enumeration. Reportedly, Wiz data indicates 91% of cloud environments are vulnerable to this high-severity Node[.]js decoder flaw. The exposure spans Node[.]js, .NET, FFmpeg, and Apache Arrow workloads, with specific impacts on Node[.]js 22.23.3, 24.22.0, and 26.12.0. The flaw allows attackers to validate certificates against wrong IPs, a specific bypass affecting the Node[.]js runtime bundled inside cdxgen version thirteen point four point zero. This incomplete fix affects cdxgen thirteen point four zero, which bundles Node twenty-four point twenty-one, and is vulnerable to the permission-model realpathSync bypass CVE-2026-106073. The vulnerability also affects Envoy deployments that have the Brotli decompressor configured.

cdxgen thirteen point four bypasses hostname checks, exposing services to unauthorized certificate acceptance. Operators must patch cdxgen 13.4.0 bundles today to stop this specific certificate spoofing chain. Defenders can reduce risk by using the npm package on a patched Node[.]js version instead of the standalone binary, or by deploying capabilities that detect, block, and mitigate conditions indicative of software exploits. The specific action is to enable built-in exploit protection features provided by modern operating systems and restrict the execution of code to a controlled and isolated environment, such as a virtual environment or container, to prevent potentially malicious code from affecting the rest of the system. Update Brotli libraries to 1.0.10 or 1.1.1 immediately, as WAF rules from Imperva and Wiz now detect the flaw. Istio 1.31 users must upgrade to 1.31.2 or later to mitigate the reported vulnerabilities. Reportedly, Vercel added rules on October 21 that block the attack in inbound requests. However, as of October 23, no confirmed in-the-wild exploitation of Node2Shell has been reported, and CISA’s assessment recorded exploitation as none, meaning the uncertainty remains that while the fix is available, the actual compromise has not yet occurred in the wild.

Brotli decompression is not enabled by default in an out-of-the-box .NET or ASP[.]NET Core install, limiting the immediate attack surface for those specific configurations. The attack complexity for the vulnerability is High, which may affect the likelihood of successful exploitation in certain environments. Look for these specific signals to confirm active exploitation.

Vulnerabilities

  • CVE-2026-111497 — CVSS 9.2 (Critical) · CWE-787, CWE-252 · Google Brotli. A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory…
  • CVE-2026-105483 — CVSS 7.4 (High) · CWE-295 · nodejs node. A flaw in Node.js TLS hostname verification allows a certificate without a matching IP address SAN to authenticate a connection to an IPv4 address when the host is written with non-ASCII characters, such as fullwidth…
  • CVE-2026-106069 — CVSS 7.4 (High) · CWE-295 · nodejs node. A flaw in Node.js TLS hostname verification can cause a server certificate to be validated against a different IP address than the one the client connected to, when the host is a non-canonical IPv4 literal with a…
  • CVE-2026-106072 — CVSS 6.7 (Medium) · CWE-295 · nodejs node. A flaw in Node.js TLS hostname verification allows a certificate with only a DNS SAN to authenticate an IP endpoint when the client connects using a non-canonical IPv4 spelling, such as 0177.0.0.1, 0x7f.0.0.1…
  • CVE-2026-106073 — CVSS 3.3 (Low) · CWE-284 · nodejs node. A flaw in Node.js Permission Model filesystem enforcement leaves fs.realpathSync() without the required read permission checks.

Techniques

  • AML.T0105 Escape to Host (Privilege Escalation)
  • T1102 Web Service (Command And Control)
  • T1203 Exploitation for Client Execution (Execution)
  • T1210 Exploitation of Remote Services (Lateral Movement)
  • T1497 Virtualization/Sandbox Evasion (Stealth)
  • T1583.006 Web Services (Resource Development)
  • T1584.006 Web Services (Resource Development)
  • T1584.007 Serverless (Resource Development)
  • T1588.007 Artificial Intelligence (Resource Development)
  • T1648 Serverless Execution (Execution)

Indicators

  • 25 indicators on file

Coverage

4. APT41 deploys BlackX UEFI bootkit to bypass Secure Boot on Central Asian diplomatic systems (Segment)

Event now covered by 2 outlets (was 1); Blast radius expanded: new vendor(s): google, intel, avast, github; new product(s): onedrive, google drive, windows 11, unified extensible firmware interface, pvmdijgkax2, create_plugin; 5 new indicator(s) observed

Reportedly, Kaspersky identified a new UEFI bootkit called BlackX, which APT41 used to bypass Secure Boot on diplomatic systems in Tajikistan, Uzbekistan, and Turkmenistan. The report links this activity to the Chinese state-sponsored group APT41 with medium confidence, based on overlaps with previously reported activity and shared technical details. BlackX malware exploits the Baton Drop vulnerability, CVE-2022-21894, to enroll custom Machine Owner Keys. ESET confirmed these capabilities in March 2023, demonstrating the exploitation of Baton Drop. Analysts assess BlackX as an updated version of BlackLotus, a bootkit first observed in late 2022. BlackX closely resembles BlackLotus, which was previously sold on underground forums.

BlackLotus, linked to CVE-2023-24932, exploited bootloader flaws to disable enforcement despite status indicators showing it was active. The attacker used this flaw to bypass security features, allowing code execution that would normally be blocked by platform integrity checks. The attack chain required legitimate binaries like Windows Hypervisor Loader combined with custom Boot Configuration Data to trigger the Secure Boot bypass. This distinction matters because the Low Access and Low Attack Complexity scores mean attackers only need a single legitimate binary to compromise the boot chain on vulnerable Windows versions.

BlackLotus exploited CVE-2023-24932 to disable Secure Boot on Windows Server 2025 and 2022, while indicators falsely showed protection was active, and the group also used the Baton Drop flaw in Windows Boot Manager to bypass Secure Boot on Windows 10 and Server 2019. BlackX disables process, thread, and registry callbacks, and interferes with Event Tracing for Windows, creating uncertainty about the effectiveness of T1204.002 mitigations like Behavior Prevention on Endpoint. Because the malicious driver tampers with ETW providers, defenders cannot rely solely on signature-based detection or standard application control to stop the initial compromise. Investigators should audit system logs for user behavior anomalies and verify boot process integrity, specifically looking for the OxiDLLRunner payload or the inst[.]exe installer. Uncertainty remains regarding the full extent of the compromise, as the leaked source code is incomplete and the malware may impair BitLocker and Hypervisor-protected Code Integrity. BlackX deployment requires prior network compromise and administrator privileges, meaning the threat targets high-value diplomatic infrastructure rather than general user endpoints. The primary signal to watch for is the presence of the OxiDLLRunner payload or the inst[.]exe installer dropping files to exploit the vulnerability. Manually install the update to restore Secure Boot enforcement, since Microsoft disabled the fix by default. Verify that the ‘Windows Production PCA 2011’ certificate is explicitly revoked in UEFI firmware to close the Baton Drop gap. Hunt for the RC4-encrypted extensionless file named PVMDIJGKAX2 on systems where administrator privileges were recently used.

While BlackX is viewed as an updated version of BlackLotus, the specific technical differences between the two bootkits remain unclear in current evidence. Watch for unusual modifications to MBR, VBR, or EFI partitions that do not correlate with legitimate patch cycles or OS upgrades. Also watch for API calls such as DeviceIoControl writing directly to raw disk sectors, which indicates potential pre-OS boot persistence attempts.

Vulnerabilities

  • CVE-2023-24932 — CVSS 6.7 (Medium) · Microsoft Windows Server 2025 (Server Core installation); Microsoft Windows 11 Version 24H2; Microsoft Windows Server 2025. Secure Boot Security Feature Bypass Vulnerability
  • CVE-2022-21894 — CVSS 4.9 (Medium) · Microsoft Windows 10 Version 1809; Microsoft Windows 10 Version 1809; Microsoft Windows Server 2019. Secure Boot Security Feature Bypass Vulnerability

Techniques

  • AML.T0010 AI Supply Chain Compromise (Initial Access)
  • AML.T0010.001 AI Software (Initial Access)
  • AML.T0010.005 AI Agent Tool (Initial Access)
  • AML.T0112 Machine Compromise (Impact)
  • T1001.001 Junk Data (Command And Control)
  • T1003 OS Credential Dumping (Credential Access)
  • T1003.001 LSASS Memory (Credential Access)
  • T1003.002 Security Account Manager (Credential Access)
  • T1003.003 NTDS (Credential Access)
  • T1005 Data from Local System (Collection)
  • and 10 more

Named actors and malware

  • APT41 (actor)
  • RAT (malware)
  • APT28 (actor)
  • FinSpy (malware)
  • LoJax (malware)
  • WingBird (malware)

Indicators

  • 10 indicators on file

Coverage

5. LiteLLM 1.107.0 Supply Chain Attack Distributes Privcollect Stealer (Segment)

Event first seen in a show

LiteLLM version 1.107.0 is compromised. On October 21, threat actors pushed a malicious release to PyPI and Docker registries, distributing the ‘privcollect’ credential stealer. While high-profile users like NVIDIA and Netflix utilize LiteLLM, the maintainer states private enterprise customers were not impacted. If they did, rotate all cloud and SSH credentials immediately and revert to version 1.106.2. JFrog Security Research confirmed that the litellm 1.107.0 package contains malicious code that functions as a credential stealer and a backdoor. Wiz reported that the compromised package was downloaded approximately 49,000 times and that stolen cloud credentials were tested within hours of the release.

The malware executes a background process that retrieves and runs attacker-controlled Python code every hour to maintain remote access. A script named cook[.]py deobfuscates itself to run the privcollect stealer, which gathers system, browser, developer, cloud, and AI tool secrets before exfiltrating them via HTTP POST to litellm[.]dev/healthcheck. LiteLLM stated that a key accidentally exposed in May was behind this supply-chain attack, which is believed to have hit tens of thousands of users last week.

The malicious version reportedly contains compiled malware designed to steal credentials and load remote-code execution tools, creating immediate exposure for any environment that imported the package. Implement an AI Bill of Materials to track artifact provenance and enable rapid identification of compromised dependencies in future supply chain incidents.

The full scope of credential exfiltration remains uncertain, as the malware reportedly sends data over plaintext HTTP to a domain that was created and updated in the days preceding the attack. It is not yet established whether the second documented hijacking of LiteLLM in 2026 resulted in persistent backdoor access beyond the initial credential theft. Watch for user or script-based access to directories such as ~/.ssh containing private keys, which may indicate an adversary attempting to export keys for remote service authentication.

Techniques

  • AML.T0010 AI Supply Chain Compromise (Initial Access)
  • AML.T0010.001 AI Software (Initial Access)
  • AML.T0010.004 Container Registry (Initial Access)
  • AML.T0011.001 Malicious Package (Execution)
  • T1005 Data from Local System (Collection)
  • T1027.003 Steganography (Stealth)
  • T1036.005 Match Legitimate Resource Name or Location (Stealth)
  • T1059.004 Unix Shell (Execution)
  • T1059.006 Python (Execution)
  • T1059.007 JavaScript (Execution)
  • and 10 more

Named actors and malware

  • TeamPCP (actor)

Indicators

  • 23 indicators on file

Coverage

6. Zero-Permission Token Theft Flaw in Microsoft Authenticator for Android Patched (Segment)

Event first seen in a show

What changed

Microsoft confirmed the issue and released a patch in version 6.2606.4246 via Google Play in July 2026, with the advisory published on September 8, 2026. Microsoft patched a high-severity flaw in Authenticator for Android, fixing an improper authentication issue that allowed local privilege escalation. Microsoft confirmed a high-severity elevation-of-privilege flaw in Microsoft Authenticator for Android on September 8, 2026, and published the advisory for CVE-2026-80097. The vendor released the fix in version 6.2606.4246 via Google Play in July 2026, preceding the public disclosure of the vulnerability details. Microsoft classified CVE-2026-80097 as a local elevation-of-privilege vulnerability with a CVSS score of 8.6, affecting Microsoft Authenticator versions earlier than 6.2606.4246. The caller’s identity was never used for any trust decision, so a single exported activity handed out tokens for the work account.

How it works

The flaw stems from improper authentication where an attacker can assume the identity of a legitimate user to execute unauthorized commands. This flaw grants attackers read access to application data and execution of unauthorized commands, a high-impact consequence rated 8.6 by Microsoft. The vulnerability, rated 8.6, lets an attacker spoof identity claims because the app fails to sufficiently prove the claimed identity is correct. The vulnerability, rated 8.6, lets an attacker spoof identities to gain unauthorized access, a risk that requires the identity to be modifiable without detection. The broker component failed to verify the real calling application during token requests, allowing a malicious app to impersonate trusted applications like Microsoft Teams. According to the source, successful requests returned token data through the activity result bundle, including access tokens, refresh tokens, ID tokens, and client information in plaintext. The flaw affected Android devices with Microsoft Authenticator installed and a signed-in work account, exposing users to the risk of unauthorized access to sensitive data. This improper authentication weakness allows attackers to gain privileges or assume identity, potentially leading to the execution of unauthorized code or commands.

What to do

Defenders must update Authenticator to version 6.2606.4246 or later immediately, as Microsoft fixed this high-severity issue on September 8, 2026. Defenders must update to version 6.2606.4246 immediately, as static analysis tools currently struggle to detect this custom authentication scheme without manual review. This specific failure in version 6.0.0 exposes users to unauthorized code execution and data access, distinct from broader network-based threats. Update Android devices to version 6.2606.4246 or later to close this gap, as the fix addresses the specific authentication failure in the mobile client. The attacker behavior of exploiting this flaw to impersonate trusted applications resembles the T1212 Exploitation for Credential Access pattern where adversaries take advantage of programming errors to collect credentials, but the specific uncertainty remains whether a malicious app without permissions has already successfully duplicated a token in the wild. This uncertainty forces a decision to prioritize checking for application isolation failures, as the T1212 mitigation option of Application Isolation and Sandboxing would have restricted the execution of such code to a controlled environment, preventing it from affecting the rest of the system. Consequently, the most useful investigation focus is verifying if any signed-in work accounts on affected Android devices have experienced unauthorized token creation or renewal, which would indicate the exploitation of the CWE-287 improper authentication weakness. Because the broker component failed to verify the actual caller, a single exported activity could hand out access, refresh, and ID tokens for a signed-in work account. Update all Android devices running Microsoft Authenticator to version 6.2606.4246 or later to close the improper authentication flaw in the broker component. Run automated static analysis on custom authentication schemes to identify configurations that rely solely on claimed identity rather than verified caller context.

Limits and watch

The vulnerability is classified as a local elevation-of-privilege issue with a CVSS score of 8.6, but the evidence does not establish whether remote exploitation paths exist for this specific Android implementation. Correlate suspicious command-line executions with API calls to DuplicateToken or ImpersonateLoggedOnUser on Windows endpoints to catch token duplication and impersonation attempts. Watch for abnormal LSASS memory access or replayed authentication attempts, which may indicate follow-on credential theft from exploited authentication mechanisms.

Vulnerabilities

  • CVE-2026-80097 — CVSS 8.6 (High) · CWE-287 · Microsoft Microsoft Authenticator for Android. Improper authentication in Microsoft Authenticator allows an unauthorized attacker to elevate privileges locally.

Techniques

  • T1134.001 Token Impersonation/Theft (Stealth)
  • T1212 Exploitation for Credential Access (Credential Access)

Indicators

  • 5 indicators on file

Coverage

7. Eye Security disables Time4Popcorn updater via 2M updates to close CVE-2026-30612 (Segment)

Event first seen in a show

Eye Security researchers discovered the vulnerability after registering the popcorntimeupd[.]xyz domain and observing up to three million Windows and 350,000 macOS client connections to the Time4Popcorn app. The team subsequently force-fed a self-disabling update to these devices to close the remote code execution flaw. If you see this path or the domain popcorntimeupd[.]xyz in your logs, investigate immediately. Eye Security neutralized a critical remote code execution flaw in the abandoned Time4Popcorn app by force-feeding a self-disabling update to over two million devices. On Windows, the vulnerable updater runs as a service called Update Service from an executable typically located at C:\Program Files\Popcorn Time\Updater[.]exe. The flaw is tracked as CVE-2026-30612 and rated 9.8 out of 10 by the U.S. Cybersecurity and Infrastructure Security Agency. The update infrastructure is now sinkholed by The Shadowserver Foundation, and the domains have been transferred to them. Any new activity on those domains is suspicious. Separately, ASUS Control Center Enterprise through version 4[.]0[.]0[.]2 exposes an unauthenticated endpoint that leaks encryption keys.

Attackers bypassed ASUS Control Center 4[.]0[.]0[.]2 by sending an HTTP request that leaked an encryption key, triggering a missing authentication flaw and SSRF. This missing authentication triggers a local service to enable SSH on port 2222, allowing login with hard-coded credentials to gain root access. The SSRF flaw lets unauthorized users bypass access controls to read, write, and delete data across the entire enterprise network. Because the updater checked for new versions over an unencrypted connection and installed them at the highest privilege level without verifying the sender, anyone controlling the update domain could execute code as SYSTEM on Windows and as root on macOS. This insecure update channel allowed the distribution of malicious updates that executed with full system privileges on Windows and Mac without user interaction, while Android users were prompted to install attacker-supplied APKs. Time4Popcorn for Windows 6[.]2[.]1[.]18 and earlier let attackers run code via updater[.]exe because the abandoned popcorntimeupd[.]xyz domain accepted unsigned files. The vulnerability affected Windows and macOS updaters that contacted the abandoned domain popcorntimeupd[.]xyz, exposing millions of devices to remote code execution attacks. With a CVSS score of ten, this vulnerability permits remote control of all connected servers and workstations, allowing direct data manipulation across the enterprise. With root control, adversaries can read, write, or delete data and remotely manage all connected servers and workstations in the network. While Eye Security reduced requests to the update domain by 98 percent between November 2025 and March 2026, Android users remain exposed because the researchers could not disable the updater remotely on that platform.

This flaw scores 9.8 with no user interaction needed, making it a high-priority baseline for the recent Time4Popcorn event alongside CVE-2026-75754. Update to ACC or later immediately to close the unauthenticated access path before the next scheduled scan. Isolate affected systems immediately and block traffic to popcorntimeupd[.]xyz until the vendor releases a patched version. Deploy the self-disabling update provided by Eye Security to stop and disable the Update Service on all Windows, Mac, and Android devices running Time4Popcorn. Investigate any log entries referencing the domain popcorntimeupd[.]xyz or the Updater[.]exe path, as these indicate active exploitation attempts against the vulnerable component.

The Time4Popcorn app reportedly uses a severely outdated Chrome engine from 2014 with no sandbox protections, which may be exploited in attacks. Watch for multi-signal correlation patterns where abnormal HTTP requests to public endpoints are followed by web server processes spawning shells or writing webshells. Track outbound callbacks from compromised hosts to determine if adversaries are leveraging the exploited application for command and control.

Vulnerabilities

  • CVE-2026-75754 — CVSS 10 (Critical) · CWE-306, CWE-918, CWE-798 · ASUS Control Center Enterprise (ACC). Missing Authentication for Critical Function, Server-Side Request Forgery (SSRF), and Use of Hard-coded Credentials in ASUS Control Center allow an unauthorized user to obtain the encryption key via an HTTP request…
  • CVE-2026-30612 — CVSS 9.8 (Critical) · n/a n/a. An issue in Time4 Popcorn for Windows <= 6.2.1.18 and Time4Popcorn for MacOS <= 6.2.1.17 and Time4Popcorn for Android <= 3.5.0.173 allows a remote attacker to execute arbitrary code via the updater.exe for windows…

Techniques

  • T1190 Exploit Public-Facing Application (Initial Access)
  • T1543.003 Windows Service (Persistence)

Named actors and malware

  • Emotet botnet (malware)

Indicators

  • 3 indicators on file

Coverage

8. Ruby patches Onigmo regex bugs behind four critical GitLab RCE flaws affecting 12 years of releases (Segment)

Event first seen in a show

GitLab disclosed a critical vulnerability on October 21, 2026, releasing patched versions to stop unauthenticated attackers from executing arbitrary code on the server. The flaws, including CVE-2026-110264, let attackers corrupt memory by feeding specially crafted patterns to the compiler. Researcher Johan Carlsson reported all four issues via HackerOne between late September and October 21, 2026. GitLab released fixes in versions 19.5.1, 19.4.3, and 19.3.6, with backports for older branches. The fix was backported to versions 19.2.9, 19.1.9, 19.0.10, and 18.11.13, closing a gap that has existed since GitLab 7.0 was released in June 2014. GitLab versions 7.0 through 19.5 contain a critical integer overflow flaw that allows unauthenticated attackers to execute arbitrary code on the server. GitLab assigned the vulnerability a CVSS v3.1 score of 10.0, indicating a network-accessible flaw with no authentication or user interaction required. As of October 23, 2026, none of the four associated CVEs were listed in the CISA Known Exploited Vulnerabilities catalog, and no public proof of concept has been published.

GitLab patched versions 19.2.8, 19.3.5, and 19.4.2 yesterday to stop unauthenticated code execution via a flawed regular expression. The attack chain relies on an integer overflow in the Onigmo regular expression engine, which is built into Ruby and used by GitLab to process user-supplied patterns. Feeding a specially crafted regular expression to the compiler causes an integer variable to wrap to a very small or negative number, bypassing memory safety checks. An unauthenticated attacker can trigger this by submitting a crafted regex that forces an integer variable out of range, leading to memory corruption and arbitrary code execution. An attacker increments a register past its maximum, causing a wrap to negative and arbitrary code execution. This integer overflow flaw lets attackers crash the server, granting full control over the GitLab instance. With a CVSS score of ten, this flaw grants full control over confidentiality, integrity, and availability without requiring any user interaction or prior access. According to Ruby, any application that builds a regular expression from attacker-controlled text is affected, extending the risk beyond GitLab to other systems using the Onigmo engine. SOC Prime warned that server-level compromise could create opportunities for credential theft, repository manipulation, supply chain attacks, persistence, or lateral movement.

The reported behavior of injecting malicious code into CI/CD pipelines to poison build processes resembles the current threat actor behavior of exploiting the Onigmo flaw to execute arbitrary code. As of October 23, 2026, there is no evidence that attackers have been exploiting this weakness throughout the 12-year vulnerable period or that GitLab has published a public exploit. The CVSS 10.0 score with a network attack vector and no required privileges means any unauthenticated actor can compromise the GitLab server’s integrity and availability. Because GitLab has not published a public exploit or proof of concept, the immediate risk is limited to the theoretical maximum impact rather than confirmed active exploitation. This remaining uncertainty means the most useful investigation focus is verifying the status of self-managed runners and checking for credential theft or repository manipulation opportunities. While GitLab-managed infrastructure remains patched, the absence of in-the-wild exploitation attempts does not eliminate the risk to organizations that have not yet upgraded. Static analysis tools detect this overflow, so update immediately to 18.11.13 or 19.0.10 before exploitation. Static analysis tools detected the issue, so operators must verify their CI/CD regex patterns before the next deployment cycle. Upgrade self-managed GitLab instances to versions 19.5.1, 19.4.3, or 19.3.6 immediately, as these releases contain the patched Ruby that resolves the integer overflow. Verify that GitLab[.]com and GitLab Dedicated tenants are already patched, but prioritize the upgrade for any on-premises or self-hosted deployments that lack a workaround.

Without a public proof of concept, defenders cannot validate specific exploitation patterns or confirm the exact conditions needed to trigger the integer overflow. Monitor inbound network access to GitLab service ports that correlates with near-time service instability, such as crashes or abnormal restarts, to detect potential remote exploitation. Watch for suspicious child process creation or shell spawning from the GitLab service context following network access, which indicates a transition from exploitation to lateral movement. Track these signals to identify active exploitation attempts.

Vulnerabilities

  • CVE-2026-110264 — CVSS 10 (Critical) · CWE-190 · GitLab GitLab. An issue has been discovered in GitLab CE/EE affecting all versions from 7.0 before 18.11.13, 19.0 before 19.0.10, 19.1 before 19.1.9, 19.2 before 19.2.9, 19.3 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1…
  • CVE-2026-97229 — CVSS 10 (Critical) · CWE-190 · GitLab GitLab. GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an unauthenticated user to…

Techniques

  • T1210 Exploitation of Remote Services (Lateral Movement)
  • T1677 Poisoned Pipeline Execution (Execution)

Coverage

9. CISA Adds Arista VeloCloud Orchestrator SQL Injection Flaw to KEV Catalog Amid Active Exploitation (Segment)

Event first seen in a show

CISA added CVE-2026-114625 to its Known Exploited Vulnerabilities Catalog citing active exploitation against Arista VeloCloud Orchestrator. Arista disclosed the flaw on October 22, 2026, identifying source IP addresses 74[.]82[.]197[.]86 and 38[.]54[.]50[.]151 as the origins of the observed attacks. This mandates rapid remediation for federal agencies under Binding Operational Directive 26-04. VeloCloud Gateway and Edge products are explicitly unaffected. Arista patched VeloCloud Orchestrator versions 5.2.0, 6.1.0, and 6.4.0 to fix a critical SQL injection flaw listed in the CISA Known Exploited Vulnerabilities catalog. The vulnerability is confirmed as an SQL Injection flaw in Arista VeloCloud Orchestrator, tracked internally as BUG2043622 and classified under CWE-89. Specifically, VCO 5.2.x releases before 5[.]2[.]3[.]18, 6.1.x before 6[.]1[.]3[.]10, and 6.4.x before 6[.]4[.]2[.]12 are affected. Hosted and Dedicated versions of VCO have already been patched, while the CISA catalog entry confirms active exploitation is occurring against unpatched systems.

An attacker with an authenticated session exploits SQL injection in the orchestrator to execute arbitrary commands. This improper neutralization of special elements allows them to masquerade as a local superuser. The flaw bypasses intended access controls, granting unauthorized access to privileged internal functionality. Attackers can inject commands via the command line or ORM to run unauthorized operations on the host. Arista Networks patched VeloCloud Orchestrator versions 5.2.0, 6.1.0, and 6.4.0 against CVE-2026-114625, which lets any authenticated user masquerade as a superuser operator. This CISA-listed vulnerability carries a CVSS score of 9.4, allowing full compromise of the orchestrator host and its managed data.

Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and the data it manages, exposing the entire network management stack. Verify on-prem VCO instances are patched today, since hosted versions are already fixed, and scan for SQL injection indicators. Prioritize patching alongside a review for signs of compromise rather than treating the upgrade as routine maintenance, given that exploitation is already confirmed.

Arista identified 74[.]82[.]197[.]86 and 38[.]54[.]50[.]151 as source IP addresses observed conducting attacks, though this detail comes from a single source. While hosted and dedicated versions have been patched, the specific scope of internal data exfiltration or command execution remains unconfirmed beyond the potential for orchestrator compromise. Watch access logs for abnormal request patterns to public endpoints followed by elevated 4xx and 5xx errors and then shell spawning by web server processes. Track exploitation of remote services that enables lateral movement to internal systems, especially when vulnerable remote services are used for privilege escalation or access to additional resources.

Vulnerabilities

  • CVE-2026-114625 — CVSS 9.4 (Critical) · CISA KEV · CWE-89 · Arista Networks VeloCloud Orchestrator. VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host.

Techniques

  • T1190 Exploit Public-Facing Application (Initial Access)
  • T1203 Exploitation for Client Execution (Execution)
  • T1210 Exploitation of Remote Services (Lateral Movement)

Indicators

  • 4 indicators on file

Coverage

10. eMudhra Revokes Eight CA Certificates After Weak Key Flaw Discovered (Segment)

Event now covered by 4 outlets (was 3); 4 new indicator(s) observed

What changed

Mozilla, Google, Apple, and Microsoft immediately blocked the affected certs. Mozilla used OneCRL on October 17 and released Firefox 158.0.1 for CVE-2026-113470. The Go team released versions 1.27.3 and 1.26.10 on October 20 to reject chains containing the compromised keys, addressing CVE-2026-111943. Reportedly, On October 20, Mozilla and Google confirmed that eight eMudhra intermediate CA private keys were compromised, triggering immediate blocking of the affected certificates in Chrome and Firefox. Mozilla removed emSign ECC Root CA - G3 from NSS on October 20, while Go blocked the keys in its October 20 security releases without naming the CA. Researchers reported the breach on October 17, and no malicious certificate chaining was logged to Certificate Transparency prior to the blocks.

How it works

The fix ensures clients block these certificates even if RemoteSettings is disabled, addressing a weakness where access required no user interaction. This fix stops the Go standard library crypto/x509 from trusting outdated intermediates that bypassed the system trust store update. Following the disclosure, eMudhra revoked the compromised certificates and stopped issuing new certificates under its G3 root. A key generation flaw in April 2025 reduced cryptographic entropy from 384 bits to single or double digits, allowing the P-384 private keys to be recovered instantly. Possession of these weak private keys enables an attacker to impersonate any website or service by forging trusted certificates.

What to do

Mozilla blocked compromised eMudhra certificates via OneCRL after distributing the fix to Firefox 158.0.1 and earlier versions on October 17. Defenders must verify their Firefox versions are at 158.0.1 or higher to prevent the low-impact, low-effort certificate blocking from being bypassed. Operators must verify their Go runtime matches version 1.27.3 or 1.26.10 to ensure the denylist in crypto/x509 is active. The compromise of eight eMudhra intermediate CA private keys, attributed to a script error in April 2025, allows an attacker holding any of these keys to impersonate any website or service. Go’s decision to handle the fix on its URGENT track, reserved for ecosystem integrity threats or active exploitation, signals that the risk extends beyond standard patch cycles. Verify that Go runtime environments are updated to versions 1.27.3 or 1.26.10, which reject certificate chains containing the compromised keys, even though the releases did not explicitly name the CA.

Limits and watch

The root cause is attributed to a script error in April 2025, but the exact scope of how the private keys were exposed or whether they were actively exploited prior to the blocks remains unconfirmed. Monitor for suspicious access to private key files with extensions such as .key, .pem, or .p12 in user profile paths or system certificate stores, particularly when followed by network connections or compression activity. Watch for the execution of binaries signed with unusual or recently issued code signing certificates, or mismatched certificate chains, which may indicate the use of stolen code signing materials to bypass security policies.

Vulnerabilities

  • CVE-2026-113470 — CVSS 5.4 (Medium) · Mozilla Firefox. Mozilla blocked compromised intermediate eMudhra certificates via OneCRL on the 17th of October which was distributed to clients via RemoteSettings the same day.
  • CVE-2026-111943 — CVSS 0 (Low) · Go standard library crypto/x509. On most platforms, Go uses the given system root certificates.

Techniques

  • T1552.004 Private Keys (Credential Access)
  • T1553.002 Code Signing (Defense Impairment)
  • T1587.003 Digital Certificates (Resource Development)
  • T1588.004 Digital Certificates (Resource Development)
  • T1596.003 Digital Certificates (Reconnaissance)
  • T1649 Steal or Forge Authentication Certificates (Credential Access)

Indicators

  • 12 indicators on file

Coverage

11. Capcom confirms 11.7M CAPCOM ID accounts breached; Ragnar Locker threat targets law enforcement contact (Segment)

Event first seen in a show

What changed

Capcom confirmed that 11.7 million CAPCOM ID accounts were breached, exposing email addresses, login timestamps, and IP addresses. This incident traces back to a November 2020 ransomware attack by the Ragnar Locker gang. The company reported the incident to police and Japan’s Personal Information Protection Commission on October 21, 2026. Ragnar Locker announced on its darknet leak site that it would leak stolen data if victims contacted law enforcement or professional negotiators. Watch for phishing campaigns impersonating Capcom or its partners, as the company urges users to guard against these attempts.

How it works

Adversaries gather email addresses from public-facing infrastructure or by probing authentication services to identify valid usernames for targeting. These collected addresses enable adversaries to conduct phishing campaigns or brute-force attacks against external remote services to gain initial access. Ragnar Locker demanded eleven million dollars in bitcoins to withhold stolen files and provide a decrypter. The group alleged stealing one terabyte from Capcom and threatens release if victims seek professional negotiation.

What to do

Ragnar Locker threatens to leak data if victims hire negotiators or call police, complicating response by potentially exposing the one terabyte of stolen data. Implement pre-compromise controls to reduce the attack surface and increase the difficulty for adversaries to identify weaknesses during reconnaissance and resource development phases. Monitor network traffic for large or iterative quantities of authentication requests from a single source to detect probing for email addresses and usernames.

Limits and watch

The claim that Ragnar Locker stole 1TB of Capcom data is alleged by the attackers, and their assertion that professional negotiators work for law enforcement is attributed to the gang rather than independently verified.

Techniques

  • T1102 Web Service (Command And Control)
  • T1556.006 Multi-Factor Authentication (Defense Impairment)
  • T1583.006 Web Services (Resource Development)
  • T1584.006 Web Services (Resource Development)
  • T1589.002 Email Addresses (Reconnaissance)
  • T1669 Wi-Fi Networks (Initial Access)

Named actors and malware

  • Ragnar Locker (malware)
  • Ragnar Locker ransomware gang (malware)
  • Ragnar Locker gang (malware)

Coverage

12. Glassworm compromises OVHcloud CLI via GitHub account takeover (Segment)

Event first seen in a show

On October 19, an actor exploited a compromised developer GitHub account to replace release assets for ovhcloud-cli versions v0.11.0 through v0.15.0. The malicious files remained available for approximately 93 minutes before a downstream user detected the compromise and OVHcloud deleted them. The incident is verified to have affected only users who installed the CLI between 14h47 and 16h21 UTC+2 on October 19, 2026. OVHcloud has removed the malicious binaries, corrected the repository’s release immutability configuration, and released a clean version v0.16.0 with signed tags.

Although the source code and build chain remained unaffected, the malicious binaries reached users via install[.]sh, brew install, or direct tarball downloads on macOS, Linux, and Windows. Roughly 250 users who downloaded the CLI during the 93-minute window are affected, with the malicious payload targeting secrets and files readable from the compromised machines. The exposure is limited to the specific version range of v0.11.0 through v0.15.0, as the underlying source code and build chain were not compromised. Because the malicious binaries were designed to steal secrets and files, any machine that executed the compromised CLI must be treated as fully compromised, requiring immediate rotation of all credentials and keys accessible from that host.

Implement an AI Bill of Materials to track software provenance, enabling rapid isolation of compromised components like the ovhcloud-cli binaries. Deploy generative AI guardrails and input validation controls to block prompt injections and data exfiltration attempts leveraging compromised supply chain components.

While the source code and build chain were reported as unaffected, the potential for lateral movement or secondary access via the compromised developer account remains an open question that requires further investigation. Watch CI/CD workflow logs for anomalous execution from forked repositories, specifically pull requests triggering insecure triggers like pull_request_target or containing encoded payloads in commit messages. Track unusual artifact generation or excessive API usage of CI/CD secrets in pipeline logs, which may indicate an adversary attempting to exfiltrate credentials through a poisoned pipeline execution.

Techniques

  • AML.T0010 AI Supply Chain Compromise (Initial Access)
  • AML.T0010.005 AI Agent Tool (Initial Access)
  • AML.T0095.000 Code Repositories (Reconnaissance)
  • T1027.008 Stripped Payloads (Stealth)
  • T1059.009 Cloud API (Execution)
  • T1195 Supply Chain Compromise (Initial Access)
  • T1213.003 Code Repositories (Collection)
  • T1593.003 Code Repositories (Reconnaissance)
  • T1677 Poisoned Pipeline Execution (Execution)
  • T1689 Downgrade Attack (Defense Impairment)

Named actors and malware

  • Glassworm (malware)

Indicators

  • 25 indicators on file

Coverage