The Hot Drop

Oct 29

The Hot Drop for 10-29-2026

Can a single zero-day in Cisco’s SD-WAN grant admin access since 2023? While AI models like Claude are now chaining zero-days into working exploits across Chrome and Linux, Clop has already scanned for unpatched Oracle EBS systems, stealing data from Harvard and The Washington Post before demanding ransom.

Since the last show: 1 new · 5 developing · 1 returning · 7 dropped · 36% overlap with the previous show

Contents

  1. Cisco SD-WAN Zero-Day Exploited Since 2023 by Volt Typhoon-Linked APT to Steal Encryption Keys
  2. Anthropic’s Claude Model Chains Zero-Days into Working Exploits
  3. Clop Scans for Unpatched Oracle EBS Systems After Massive Data Theft Campaign
  4. Storm-0940 uses AI to breach ConnectWise, impacting 2,250 M365 tenants
  5. FBI Arrests Third ShinyHunters Suspect, a Canadian Ransomware Negotiator
  6. Capcom confirms breach of 11.7M CAPCOM ID records
  7. CISA Adds Node2Shell to KEV After Confirmed Exploitation of Brotli Decoder Flaw

1. Cisco SD-WAN Zero-Day Exploited Since 2023 by Volt Typhoon-Linked APT to Steal Encryption Keys (Lead)

No material change since last show

The actor reportedly exploited CVE-2022-20775 before restoring the original software version to gain root access. The flaw is tracked as CVE-2026-20127 and has a CVSS score of 10.0. The vulnerability was reported by the Australian Signals Directorate’s Australian Cyber Security Centre. The PoC contains a deployable WAR file, lowering the barrier for more threat actors to weaponize this critical flaw. The vulnerability is tracked as CVE-2026-20127 and affects core networking components, prompting urgent patching amid active attacks. This detail remains specific to the available reporting: LittleFilch, deployed as libcommon[.]so, supplies KeyDrift’s collection capability by hooking SSL_read inside vdaemon. This detail remains specific to the available reporting: The malware, called KeyDrift, is designed to copy the keys that encrypt traffic between sites and store them for later use. This detail remains specific to the available reporting: CISA has added CVE-2026-20127 to its Known Exploited Vulnerabilities (KEV) catalog and mandated urgent patching for federal agencies. Review patch and exposure state for CVE-2022-20775 against the supported reporting. Confirm the affected product or control state against the available evidence.

Vulnerabilities

  • CVE-2026-20127 — CVSS 10 (Critical) · CISA KEV · CWE-287 · Cisco Cisco Catalyst SD-WAN Manager. A vulnerability in the peering authentication in Cisco Catalyst SD-WAN Controller, formerly SD-WAN vSmart, Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, and Cisco Catalyst SD-WAN Validator, formerly SD-WAN…
  • CVE-2026-20182 — CVSS 10 (Critical) · CISA KEV · CWE-287 · Cisco Cisco Catalyst SD-WAN Controller; Cisco Cisco Catalyst SD-WAN Manager. May 2026: This security advisory provides the details and fix information for a vulnerability that was discovered and fixed after the was disclosed in February 2026.
  • CVE-2026-76418 — CVSS 8.6 (High) · CWE-690 · Cisco Cisco Secure Firewall Adaptive Security Appliance (ASA) Software; Cisco Cisco Secure Firewall Threat Defense (FTD) Software. A vulnerability in the Remote Access SSL VPN service of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote…
  • CVE-2022-20775 — CVSS 7.8 (High) · CISA KEV · CWE-25 · Cisco Cisco Catalyst SD-WAN; Cisco Cisco Catalyst SD-WAN Manager; Cisco Cisco SD-WAN vContainer. A vulnerability in the CLI of Cisco SD-WAN Software could allow an authenticated, local attacker to gain elevated privileges.

Techniques

  • T1003.001 LSASS Memory (Credential Access)
  • T1003.003 NTDS (Credential Access)
  • T1005 Data from Local System (Collection)
  • T1006 Direct Volume Access (Stealth)
  • T1007 System Service Discovery (Discovery)
  • T1010 Application Window Discovery (Discovery)
  • T1012 Query Registry (Discovery)
  • T1016 System Network Configuration Discovery (Discovery)
  • T1016.001 Internet Connection Discovery (Discovery)
  • T1018 Remote System Discovery (Discovery)
  • and 10 more

Named actors and malware

  • Volt Typhoon (actor)

Indicators

  • 8 indicators on file

Coverage

2. Anthropic’s Claude Model Chains Zero-Days into Working Exploits (Segment)

Blast radius expanded: new vendor(s): microsoft; 3 new indicator(s) observed

Anthropic’s Frontier Red Team disclosed that its unreleased research model, Claude, successfully developed working exploit chains for Chrome, Safari, Android, Windows, and Linux. The most severe is a zero-click Linux kernel exploit, CVE-2026-98432, which grants remote root access to servers running multipath TCP listeners. It was patched upstream on October 15. Anthropic’s research model identified a remote denial-of-service flaw in Windows HTTP[.]sys, which Microsoft patched in April 2026. The team reported every flaw to the vendor first, so all issues are patched, including 62 CVEs in Chrome 156 and immediate fixes for Safari flaws. Reportedly, The exploits were built in the lab after the model was prompted and were not seen in any real attack.

Today, Anthropic’s unreleased Claude model chained a race condition into a use-after-free in the Linux kernel’s TCP stack to enable remote root access via multipath TCP listeners. The Linux kernel vulnerability arises because tcp_v4_syn_recv_sock() transfers ownership of ireq->ireq_opt to the child socket without copying it, allowing a concurrent retransmitted SYN to trigger a use-after-free in ip_options_build(). An unauthorized attacker can trigger an out-of-bounds read by sending specific HTTP/3 packets to a listening server, causing a system crash. Today, an unreleased Claude model found a remote out-of-bounds read in Windows HTTP[.]sys that crashes servers answering HTTP/3 requests. An unauthorized attacker can send a few packets to a server answering HTTP/3 requests, triggering a crash that restarts the machine. An unauthorized attacker can trigger this flaw remotely over the network to crash and restart a server that answers HTTP/3 requests. In Chrome, the exploit chain begins with a V8 heap corruption that allows a malicious web page to break out of the memory region sandbox and defeat ASLR using a return-oriented programming chain. Reportedly, CVE-2026-98432 carries a CVSS 9.8 score and affects Linux kernels prior to the October 15 patch across all maintained stable branches. Ubuntu has identified CVE-2026-98432 as affecting multiple Linux kernel versions, including 26.10, 26.04 LTS, 24.04 LTS, and 22.04 LTS. A separate flaw carries a CVSS score of 7.5 and affects millions of internet-facing servers, though it causes denial of service rather than data theft. Microsoft assigned CVE-2026-33096 today, rating it 7.5 and noting that only the HTTP[.]sys driver is affected, not the QUIC code. The findings affect billions of users across major operating systems and browsers, demonstrating the model’s ability to craft sophisticated multi-step exploits in both open-source and proprietary systems.

Chrome 156 contains sixty-two critical and high-severity flaws, while the zero-click Linux kernel exploit CVE-2026-98432 creates immediate, unmitigated exposure for unpatched endpoints and servers. Safari and Chrome attack chains exploit client execution by using browser memory corruption to bypass sandboxing, with the Safari variant disabling the same-origin policy through a data-only attack. Investigations must shift from endpoint detection to network egress monitoring for authenticated requests to unexpected domains, looking for anomalous cross-origin data access in browser logs rather than traditional code execution signatures. A separate flaw carries a CVSS score of 7.5 and affects multiple Windows 11 and Server versions, though it is not currently listed in the CISA catalog of known exploited bugs. Uncertainty remains regarding how quickly similar AI-generated chains might target other client applications, making verification of patch status for Chrome 156 and the latest Safari updates the immediate priority to close the gap. The primary watch item is the emergence of similar AI-generated attack chains targeting other client applications beyond the current browser vectors. Patch Linux kernels immediately and watch for multipath TCP listener traffic to catch silent handshake failures. Patch Windows 11 and Server 2022 now, or disable HTTP/3 via registry edits to stop the denial-of-service. Remove the EnableHttp3 and EnableAltSvc registry values from HTTP service parameters to disable HTTP/3 support. Reportedly, apply upstream patches for CVE-2026-98432 to all maintained stable kernel branches, as the fix was backported to these versions. Deploy Chrome 156 to close sixty-two critical and high-severity vulnerabilities, and prioritize the separate patch for the Linux kernel IPv6 migration issue.

The Ubuntu entry for CVE-2026-98432 carries a CVSS 3 score of 9.8, which is Critical, but the specific exploitation chain remains unverified in the wild. IPv6 is not affected by the first issue because tcp_v6_syn_recv_sock() duplicates the options, limiting the immediate scope of the kernel vulnerability to IPv4 deployments. Monitor for the cross-platform behavior chain of Exploitation for Client Execution, specifically a client app crash followed by an unexpected child process opening network connections. Watch for Exploitation of Remote Services indicators, such as network service discovery targeting unpatched Linux kernels or Windows HTTP[.]sys, to detect lateral movement attempts.

Vulnerabilities

  • CVE-2026-98432 — CVSS 9.8 (Critical) · Linux Linux; Linux Linux. In the Linux kernel, the following vulnerability has been resolved: ipv4: free inet_opt and ireq_opt after an RCU grace period tcp_v4_syn_recv_sock() transfers ownership of ireq->ireq_opt to the child socket…
  • CVE-2026-33096 — CVSS 7.5 (High) · CWE-125 · Microsoft Windows 11 version 23H2; Microsoft Windows 11 Version 23H2; Microsoft Windows 11 Version 24H2. Out-of-bounds read in Windows HTTP.sys allows an unauthorized attacker to deny service over a network.

Techniques

  • AML.T0016 Obtain Capabilities (Resource Development)
  • AML.T0049 Exploit Public-Facing Application (Initial Access)
  • AML.T0107 Exploitation for Defense Evasion (Defense Evasion)
  • T1055 Process Injection (Stealth)
  • T1068 Exploitation for Privilege Escalation (Privilege Escalation)
  • T1087.003 Email Account (Discovery)
  • T1190 Exploit Public-Facing Application (Initial Access)
  • T1203 Exploitation for Client Execution (Execution)
  • T1210 Exploitation of Remote Services (Lateral Movement)
  • T1212 Exploitation for Credential Access (Credential Access)

Indicators

  • 23 indicators on file

Coverage

3. Clop Scans for Unpatched Oracle EBS Systems After Massive Data Theft Campaign (Segment)

No material change since last show

The State Department has placed a ten million dollar bounty on information linking Clop to a foreign government. Threat intelligence firm Defused reported exploratory exploit attempts against its decoy systems on October 27, 2026. These developments mark a significant escalation in the visibility of the Clop threat landscape. Reportedly, Defused Cyber observed an actor exploiting CVE-2026-46817 on Oracle E-Business honeypots over the weekend. Oracle issued a security alert on October 8, 2025, for CVE-2025-61884, a flaw in the Oracle Configurator Runtime UI. CVE-2025-61882, assigned a critical CVSS score of 9.8, enabled unauthenticated attackers to achieve remote code execution on Oracle EBS versions 12.2.3 through 12.2.14. The weakness affects the Core component of Oracle Application Object Library in EBS versions 12.2.3 through 12.2.15. Clop exploited Cleo Harmony, VLTrader, and LexiCom before version 5[.]8[.]0[.]21 in 2024 to steal data.

Clop gang exploited CVE-2025-61882 in Oracle EBS 12.2.3 through 12.2.14 since early August to run remote code without authentication. Attackers used unauthenticated HTTP access to trigger remote code execution and fully takeover the PeopleSoft Enterprise PeopleTools system. The flaw allows unrestricted file uploads, enabling remote code execution without authentication. Unauthenticated attackers leveraged the Autorun directory to inject arbitrary Bash or PowerShell commands, achieving full system compromise. This unauthenticated HTTP flaw in Oracle Payments 12.2.3 through 12.2.15 allows full system takeover. This unauthenticated HTTP vulnerability allows attackers to access critical data in Oracle E-Business Suite versions 12.2.3 through 12.2.14. The flaw allows attackers to chain SQL injection into remote code execution via the Thin Client Framework servlet without authentication. Attackers exploited unrestricted file upload via CWE-434 to execute arbitrary code without needing initial access. This unauthenticated access path bypasses standard authentication controls to execute arbitrary code within the application environment. Attackers stole HR and financial data from over ten thousand GlobalLogic employees and dozens of other organizations including Harvard and the Washington Post. ShinyHunters gang exploited CVE-2026-35273 in PeopleTools 8.61 and 8.62 to steal data from Nottingham University and Nissan. CISA lists this vulnerability in its Known Exploited Vulnerabilities catalog with a CVSS score of 9.8. The Washington Post confirmed that Clop exploited this specific zero-day to steal employee financial data during its breach. Today Logitech confirmed a breach by Clop gang using Cleo zero-day CVE-2024-50623 before version 5[.]8[.]0[.]21. This command injection flaw carries a CVSS score of 9.8 and is listed in CISA’s catalog. CrowdStrike analysts reported that they had first spotted the Clop ransomware gang exploiting CVE-2025-61882 as a zero-day since early August to steal sensitive documents.

Today Oracle patched CVE-2026-101809, a CVSS 10.0 unauthenticated flaw in the Workflow Notification Mailer of E-Business Suite 12.2.3 through 12.2.15. Unknown actors probed on October 27, 2026, in a style resembling the Clop ransomware group, which has exploited Oracle EBS zero-days to steal data from victims like Harvard University and GlobalLogic. Defended labeled these activities as exploratory without confirming a breach, so we cannot definitively attribute the campaign to Clop or any other group. The uncertainty remains that these actors may be testing for a future attack or scanning for the patched vulnerability. Treat the activity as a signal of active interest in the patched CVE-2026-101767 rather than a confirmed breach. Verify patch status on all internet-facing Oracle EBS instances immediately rather than waiting for a data leak. Apply Oracle’s emergency patch for CVE-2025-61882 immediately after installing the October 2023 Critical Patch Update as a prerequisite. Operators must patch the Workflow Notification Mailer immediately to prevent unauthenticated network attackers from achieving full takeover. Apply the October 20 patch immediately, or restrict HTTP access to the TCF servlet until Oracle releases a definitive fix. Operators must patch Cleo, VLTrader, and LexiCom before 5[.]8[.]0[.]21 and validate uploaded filenames to prevent unauthorized execution. Apply the Oracle Critical Patch Update that fixes CVE-2025-61882 to all Oracle E-Business Suite instances running versions 12.2.3 through 12.2.14 to close the unauthenticated remote code execution vector. Deploy automated static analysis tools to scan source code for command injection patterns, specifically targeting the improper neutralization of special elements in command construction as defined by CWE-77.

The dossier lists eight Oracle Workflow CVEs, but this update only confirms the fix for CVE-2026-101809 without establishing a shared incident. Watch for inbound network access to remote service ports that correlates with near-time service instability, since that pattern signals likely exploitation of remote services for lateral movement. Track the release of new leaked Oracle EBS exploit scripts, which are expected to drive a new wave of attacks against unpatched systems.

Vulnerabilities

  • CVE-2026-101809 — CVSS 10 (Critical) · Oracle Corporation Workflow. Vulnerability in the Workflow product of Oracle E-Business Suite (component: Workflow Notification Mailer).
  • CVE-2024-50623 — CVSS 9.8 (Critical) · CISA KEV · CWE-434 · n/a n/a. In Cleo Harmony before 5.8.0.21, VLTrader before 5.8.0.21, and LexiCom before 5.8.0.21, there is an unrestricted file upload and download that could lead to remote code execution.
  • CVE-2024-55956 — CVSS 9.8 (Critical) · CISA KEV · CWE-77 · n/a n/a. In Cleo Harmony before 5.8.0.24, VLTrader before 5.8.0.24, and LexiCom before 5.8.0.24, an unauthenticated user can import and execute arbitrary Bash or PowerShell commands on the host system by leveraging the default…
  • CVE-2025-61882 — CVSS 9.8 (Critical) · CISA KEV · Oracle Corporation Oracle Concurrent Processing. Vulnerability in the Oracle Concurrent Processing product of Oracle E-Business Suite (component: BI Publisher Integration).
  • CVE-2026-101767 — CVSS 9.8 (Critical) · Oracle Corporation Oracle Application Object Library. Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: Core).
  • CVE-2026-35273 — CVSS 9.8 (Critical) · CISA KEV · Oracle Corporation PeopleSoft Enterprise PeopleTools. Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Updates Environment Management).
  • CVE-2026-46817 — CVSS 9.8 (Critical) · CISA KEV · Oracle Corporation Oracle Payments. Vulnerability in the Oracle Payments product of Oracle E-Business Suite (component: File Transmission).
  • CVE-2025-61884 — CVSS 7.5 (High) · CISA KEV · Oracle Corporation Oracle Configurator. Vulnerability in the Oracle Configurator product of Oracle E-Business Suite (component: Runtime UI).

Techniques

  • AML.T0072 Reverse Shell (Command And Control)
  • T1003.003 NTDS (Credential Access)
  • T1003.006 DCSync (Credential Access)
  • T1005 Data from Local System (Collection)
  • T1006 Direct Volume Access (Stealth)
  • T1016 System Network Configuration Discovery (Discovery)
  • T1018 Remote System Discovery (Discovery)
  • T1021.001 Remote Desktop Protocol (Lateral Movement)
  • T1021.004 SSH (Lateral Movement)
  • T1021.007 Cloud Services (Lateral Movement)
  • and 10 more

Named actors and malware

  • Clop (malware)
  • Cl0p (malware)
  • ShinyHunters (actor)
  • Cl0p ransomware (malware)
  • LAPSUS$ (actor)
  • Scattered Spider (actor)
  • TA505 (actor)
  • Clop ransomware (malware)
  • Clop ransomware gang (malware)
  • Clop ransomware group (malware)

Indicators

  • 1 indicator on file

Coverage

4. Storm-0940 uses AI to breach ConnectWise, impacting 2,250 M365 tenants (Segment)

Event first seen in a show

Huntress reported sign-in activity from malicious infrastructure across almost 1,000 Entra tenants, with more than 300 sign-ins appearing to succeed. ConnectWise claims backup archives stay encrypted, but Huntress found Global Administrator privileges assigned in at least one partner tenant.

The Cloud Backup application obtained Microsoft Graph access tokens using a credential associated with ConnectWise’s own tenant, enabling cross-tenant access. Microsoft reported that the activity began as early as September 2026 and affected hundreds of organizations across multiple industries. The stolen credential acted as a master key, allowing the group to authenticate from IP 144[.]172[.]64[.]128 and sweep over 300 Entra tenants without triggering user MFA. Hermes AI agent activity in unattended YOLO mode and automated tenant GUID scanning indicate high-tempo reconnaissance that leaves broad sign-in trails.

Reportedly, Storm-0940 exploited a compromised ConnectWise Cloud Backup OAuth application to access over 2,250 Microsoft 365 tenants, exposing mail, OneDrive, and SharePoint data. Disabling the compromised application stops new tokens but does not erase prior data exfiltration, forcing defenders to treat all connected environments as potentially compromised. Defenders must preserve audit logs immediately because legitimate backup traffic noise can obscure specific data reads, and uncertainty remains regarding potential directory role modifications or added credentials to trusted applications like Huntress. Revoke the ConnectWise Cloud Backup application consent and rotate all associated service principal credentials to cut off the access tokens that enabled unauthorized sign-ins in 173 partner and customer tenants.

The compromised application permits read and write access to mail, attachments, and Teams chats, but the full extent of data exfiltration remains unconfirmed beyond observed sign-in activity. Attribution to Storm-0940 relies on reported researcher tracking, and the initial compromise timeline is only known to have begun as early as September 2026. Monitor for high volumes of authentication failures using a single password across many different user accounts within a defined time window, a pattern indicative of distributed password spraying. Track new OAuth application registrations and unexpected consent grants in Microsoft 365 to identify persistence mechanisms where adversaries leverage cloud application integrations to maintain access.

Techniques

  • AML.T0006 Active Scanning (Reconnaissance)
  • AML.T0010 AI Supply Chain Compromise (Initial Access)
  • AML.T0053 AI Agent Tool Invocation (Execution)
  • AML.T0091.000 Application Access Token (Lateral Movement)
  • AML.T0108 AI Agent (Command And Control)
  • AML.T0112 Machine Compromise (Impact)
  • T1005 Data from Local System (Collection)
  • T1021.007 Cloud Services (Lateral Movement)
  • T1027.003 Steganography (Stealth)
  • T1036.005 Match Legitimate Resource Name or Location (Stealth)
  • and 10 more

Named actors and malware

  • TeamPCP (actor)

Indicators

  • 5 indicators on file

Coverage

5. FBI Arrests Third ShinyHunters Suspect, a Canadian Ransomware Negotiator (Segment)

No material change since last show

What changed

Federal investigators made the third arrest in the ShinyHunters investigation, following suspects detained in Jordan and the Netherlands. The original attack exploited an unpatched Oracle PeopleSoft vulnerability to steal data from the FBI’s recruitment portal. H&M is reportedly investigating claims that it was targeted by the ShinyHunters cybercrime group.

How it works

The group exploited a third-party integration to access Rockstar Games’ internal Snowflake data warehouse.

What to do

ShinyHunters breached the FBI recruitment portal using an unpatched Oracle PeopleSoft flaw, proving attackers weaponize known third-party HR vulnerabilities to bypass perimeter defenses. Verify all Oracle PeopleSoft instances are patched and remove unauthorized contractor access, as missing updates exposed sensitive personnel data to a group coordinating global arrests. The group’s gadget chain of zero-days and old flaws, alongside negotiator arrests in Jordan and the Netherlands, signals a shift toward high-impact, politically motivated attacks. Audit GTG-20006 agent deployments to confirm they are not actively modifying tools to evade detection, since source reports show these agents monitored security products and altered tools when detection occurred.

Limits and watch

TFG London is still trying to establish whether any personal or sensitive information has been compromised. ShinyHunters alleged that it had stolen more than 600,000 records, a figure that remains unverified by independent forensic analysis. Watch

Techniques

  • AML.T0006 Active Scanning (Reconnaissance)
  • AML.T0108 AI Agent (Command And Control)
  • EMERGING-0017 Distillation
  • T1003.002 Security Account Manager (Credential Access)
  • T1003.003 NTDS (Credential Access)
  • T1003.004 LSA Secrets (Credential Access)
  • T1003.006 DCSync (Credential Access)
  • T1005 Data from Local System (Collection)
  • T1006 Direct Volume Access (Stealth)
  • T1016 System Network Configuration Discovery (Discovery)
  • and 10 more

Named actors and malware

  • ShinyHunters (actor)
  • Cl0p (malware)
  • Scattered Spider (actor)
  • Clop (malware)
  • Midnight Blizzard (actor)
  • Lapsus$ (actor)
  • TeamPCP (actor)
  • ShinyHunters group (actor)

Indicators

  • 25 indicators on file

Coverage

6. Capcom confirms breach of 11.7M CAPCOM ID records (Segment)

No material change since last show

Capcom confirmed on October 19, 2026, that a third party gained unauthorized access to its CAPCOM ID account system. The breach exposed 11.7 million CAPCOM ID records, including email addresses, account creation dates, last login timestamps, login counts, and last-login IP addresses. Unauthorized password changes occurred on 196 accounts, which Capcom has since reset. For a subset of 43 accounts, the exposed data also included dates of birth, gender, nicknames, and countries.

Capcom stated that no user passwords were stolen during the incident, indicating the credential changes were an active manipulation rather than a passive data exfiltration of the password database. The compromised data set did not include credit card information, limiting the direct financial exposure of the breach.

Exposing CAPCOM ID login timestamps and IP addresses gives attackers a high-confidence fingerprint to bypass behavioral defenses and target specific user sessions. This data enables highly convincing phishing messages that mimic legitimate account activity, significantly increasing credential harvesting success rates compared to generic spam. Prioritize correlating these exposed IPs and timestamps with current network traffic logs to identify ongoing unauthorized sessions or anomalous logins from compromised client locations. Focus on the CAPCOM ID authentication service and its third-party integrations, as these are the entry points for the next phase of the attack. Verify if attackers are currently using these fingerprints to initiate new phishing campaigns against the affected user base. Instruct users to verify account status by manually navigating to cid[.]capcom[.]com rather than clicking links in unsolicited emails, as the exposed data facilitates targeted phishing. Enable two-factor authentication using an authenticator app on the CAPCOM ID account page to add a layer of protection against credential reuse, as recommended by Capcom.

It remains unconfirmed whether the 196 unauthorized password changes were the only form of account manipulation or if other unauthorized activity occurred on those specific accounts. The 11.7 million figure represents affected records rather than unique individuals, so the exact number of distinct users impacted by the breach is not yet established. Watch for unsolicited emails impersonating Capcom that leverage the exposed IP and login data to create urgency, as these are the primary vector for follow-on credential theft.

Techniques

  • T1087.003 Email Account (Discovery)
  • T1102 Web Service (Command And Control)
  • T1583.006 Web Services (Resource Development)
  • T1584.006 Web Services (Resource Development)
  • T1585.002 Email Accounts (Resource Development)
  • T1586.002 Email Accounts (Resource Development)
  • T1589.002 Email Addresses (Reconnaissance)

Named actors and malware

  • Ragnar Locker (malware)
  • Ragnar Locker ransomware gang (malware)
  • Ragnar Locker ransomware (malware)

Indicators

  • 2 indicators on file

Coverage

7. CISA Adds Node2Shell to KEV After Confirmed Exploitation of Brotli Decoder Flaw (Hot)

No material change since last show

Python brotlicffi versions 1.2.0.x and earlier are affected, with a fix in version 1[.]2[.]1[.]0. The flaw appears when the decoder encounters an invalid transition between block types within a Brotli stream and continues processing with an invalid internal state. The vulnerability is tracked as CVE-2025-55182 and is a remote code execution vulnerability. The WAF update introduces two detection rules for the Brotli vulnerability tracked as CVE-2026-111497. CISA added the flaw to its Known Exploited Vulnerabilities (KEV) Catalog and ordered US government agencies to patch their systems by November 10. This detail remains specific to the available reporting: The attack complexity for the vulnerability is High. This detail remains specific to the available reporting: Microsoft announced on October 25 that it was rolling out updates for supported runtimes and SDKs. This detail remains specific to the available reporting: nodejs on jammy and higher uses the system brotli and is marked as not-affected. Review patch and exposure state for CVE-2025-55182 against the supported reporting. Confirm the affected product or control state against the available evidence.

Vulnerabilities

  • CVE-2025-55182 — CVSS 10 (Critical) · CISA KEV · CWE-502 · Meta react-server-dom-webpack; Meta react-server-dom-turbopack; Meta react-server-dom-parcel. A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel…
  • CVE-2026-111497 — CVSS 9.8 (Critical) · CISA KEV · CWE-787, CWE-252 · Google Brotli. A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory…
  • CVE-2026-48356 — CVSS 9.3 (Critical) · CWE-434 · Adobe Adobe Commerce; Adobe Adobe Commerce B2B; Adobe Magento Open Source. Adobe Commerce is affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or…
  • CVE-2026-105482 — CVSS 7.4 (High) · CWE-284 · nodejs node. A flaw in Node.js DNS resolution allows hostnames containing a NUL byte to be silently truncated by the dns.resolve*() functions and dns.reverse().
  • CVE-2026-105483 — CVSS 7.4 (High) · CWE-295 · nodejs node. A flaw in Node.js TLS hostname verification allows a certificate without a matching IP address SAN to authenticate a connection to an IPv4 address when the host is written with non-ASCII characters, such as fullwidth…
  • CVE-2026-106069 — CVSS 7.4 (High) · CWE-295 · nodejs node. A flaw in Node.js TLS hostname verification can cause a server certificate to be validated against a different IP address than the one the client connected to, when the host is a non-canonical IPv4 literal with a…
  • CVE-2025-1338 — CVSS 6.9 (Medium) · CWE-77, CWE-74 · NUUO Camera. A vulnerability was found in NUUO Camera up to 20250203.
  • CVE-2026-106072 — CVSS 6.7 (Medium) · CWE-295 · nodejs node. A flaw in Node.js TLS hostname verification allows a certificate with only a DNS SAN to authenticate an IP endpoint when the client connects using a non-canonical IPv4 spelling, such as 0177.0.0.1, 0x7f.0.0.1…
  • CVE-2026-105481 — CVSS 6.5 (Medium) · CWE-367 · nodejs node. A flaw in Node.js HTTP Agent connection reuse can cause a client to accept as valid a response that was sent before the client has sent the request.
  • CVE-2026-106074 — CVSS 4.8 (Medium) · CWE-330 · nodejs node. A flaw in Node.js crypto causes the internal entropy caches used by crypto.randomUUID(), crypto.randomUUIDv7(), and crypto.randomInt() to be saved into user-land startup snapshots (--build-snapshot) and single…
  • and 4 more

Techniques

  • AML.T0072 Reverse Shell (Command And Control)
  • AML.T0105 Escape to Host (Privilege Escalation)
  • T1021.007 Cloud Services (Lateral Movement)
  • T1078.001 Default Accounts (Stealth)
  • T1102 Web Service (Command And Control)
  • T1190 Exploit Public-Facing Application (Initial Access)
  • T1203 Exploitation for Client Execution (Execution)
  • T1204.002 Malicious File (Execution)
  • T1210 Exploitation of Remote Services (Lateral Movement)
  • T1497 Virtualization/Sandbox Evasion (Stealth)
  • and 8 more

Indicators

  • 25 indicators on file

Coverage