The Hot Drop

Oct 30

The Hot Drop for 10-30-2026

AI built a 9.8 CVSS zero-click root exploit in seconds. Cisco’s SD-WAN zero-day, active since 2023, still lets Volt Typhoon-Linked actors steal AES-256 keys. And the FBI just arrested the third ShinyHunters negotiator. Who’s next?

Since the last show: 4 new · 4 developing · 3 dropped · 36% overlap with the previous show

Contents

  1. Anthropic’s Claude Model Chains Zero-Days Into Working Exploits
  2. Cisco SD-WAN Zero-Day Exploited Since 2023 by Volt Typhoon-Linked Actor
  3. FBI Arrests Third ShinyHunters Suspect, a Canadian Ransomware Negotiator
  4. Hacker ‘Department of Peace’ leaks data on 41,000 DHS employees via Okta breach
  5. Binance Suffers $6.3B Hack via Compromised DevOps Laptop
  6. Polymarket halts trading after DebugBear supply chain breach drains $2.7M from 710 wallets
  7. CISA Adds GitLab CVE-2026-97229 to KEV After Failed Exploit Attempt on Alpine Linux
  8. CISA adds Node2Shell Brotli RCE to KEV as exploitation attempts emerge

1. Anthropic’s Claude Model Chains Zero-Days Into Working Exploits (Lead)

Blast radius expanded: new vendor(s): oracle, suse linux, suse, red hat, mitre, intel; new product(s): ubuntu; 4 new indicator(s) observed; Mentioned in reporting, no attribution: malware SYNACK

Anthropic disclosed a zero-click exploit developed with an unreleased Claude research model that allows an unauthenticated attacker to execute arbitrary commands as root. Ubuntu and Red Hat Enterprise Linux had yet to release patched kernels as of October 30, leaving distribution-specific fixes for the Linux kernel uneven. If you run multipath TCP listeners, prioritize the CVE-2026-98432 fix. Reportedly, anthropic’s unreleased model found a remote crash in Windows HTTP[.]sys, tracked as CVE-2026-33096, which Microsoft patched in April 2026. The vulnerability is rated as CVSS v3.1 9.8 CRITICAL with a vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. According to the source, the exploits were built in the lab after the model was prompted and were not seen in any real attack. While Google, Apple, and Microsoft have patched their respective issues, distribution-specific fixes for the Linux kernel are uneven.

Today, an unreleased Anthropic model chained a Linux kernel race condition into a root-shell exploit rated 9.8, targeting servers with multipath TCP listeners. The flaw is an out-of-bounds read that lets an unauthorized attacker crash a server answering HTTP/3 requests over the network. An unauthorized attacker can trigger this flaw remotely over the network without user interaction, causing a denial of service. An unauthorized attacker can send specific packets to a server handling HTTP/3 requests to trigger the memory error. The vulnerability is resolved by using kfree_rcu() in inet_sock_destruct() and tcp_v4_reqsk_destructor(). Claude discovered a use-after-free vulnerability in JavaScriptCore, Safari’s JavaScript engine, where TypedArray operations wrote through stale pointers to freed memory. A critical Linux kernel flaw, rated 9.8, allows remote root commands without login on eight branches dating back to version 4.4. This specific vulnerability affects SUSE Linux Enterprise Desktop 15 SP7 kernel-default, but not SUSE Linux Enterprise Server 11 SP4 LTSS EXTREME CORE kernel-default. Microsoft assigned CVE-2026-33096 today, rating it 7.5, and confirmed the fix arrived in April 2026 for Windows 11 and Server 2022 versions. The Windows vulnerability affects multiple versions, though the NVD record does not credit a specific finder. Unlike the remote code execution risk, this flaw causes a denial of service, crashing the machine without stealing data or executing code.

The flaw carries a CVSS score of 7.5 and affects millions of internet-facing servers, though no active exploitation is currently recorded. AI models can autonomously chain these flaws, suggesting adversaries could compress the time between discovery and weaponization. Since no real-world exploitation has been confirmed as of today, scan for unpatched Linux kernels and verify that HTTP/3 listeners are disabled or patched, rather than waiting for active alerts on the CISA catalog. Patch all stable branches immediately because the model chained zero-days with minimal human prompting. Verify HTTP[.]sys and QUIC configurations today, since disabling HTTP/3 via registry edits remains the only mitigation until the official patch arrives. Confirm that SUSE Linux Enterprise Server 16.0 deployments run kernel-default version 6.12.0-160000.40.1 or higher to ensure the patch is applied.

Anthropic described the bug as being in QUIC code, but the official NVD record names the HTTP[.]sys driver, and no public source confirms the QUIC attribution. The use-after-free mechanism in ip_options_build() remains a theoretical risk for unpatched kernels, as the specific exploit chain has not been observed in the wild. Track SUSE status updates for this important vulnerability, which remains pending across their product lines.

Vulnerabilities

  • CVE-2026-98432 — CVSS 9.8 (Critical) · Linux Linux; Linux Linux. In the Linux kernel, the following vulnerability has been resolved: ipv4: free inet_opt and ireq_opt after an RCU grace period tcp_v4_syn_recv_sock() transfers ownership of ireq->ireq_opt to the child socket…
  • CVE-2026-33096 — CVSS 7.5 (High) · CWE-125 · Microsoft Windows 11 version 23H2; Microsoft Windows 11 Version 23H2; Microsoft Windows 11 Version 24H2. Out-of-bounds read in Windows HTTP.sys allows an unauthorized attacker to deny service over a network.

Techniques

  • AML.T0016 Obtain Capabilities (Resource Development)
  • AML.T0049 Exploit Public-Facing Application (Initial Access)
  • AML.T0107 Exploitation for Defense Evasion (Defense Evasion)
  • T1055 Process Injection (Stealth)
  • T1068 Exploitation for Privilege Escalation (Privilege Escalation)
  • T1087.003 Email Account (Discovery)
  • T1190 Exploit Public-Facing Application (Initial Access)
  • T1203 Exploitation for Client Execution (Execution)
  • T1210 Exploitation of Remote Services (Lateral Movement)
  • T1212 Exploitation for Credential Access (Credential Access)

Named actors and malware

  • SYNACK (malware)

Indicators

  • 25 indicators on file

Coverage

2. Cisco SD-WAN Zero-Day Exploited Since 2023 by Volt Typhoon-Linked Actor (Segment)

CVE-2026-76418 added to CISA KEV catalog; Event now covered by 3 outlets (was 2); Blast radius expanded: new product(s): secure firewall adaptive security appliance

CVE-2026-76418 added to CISA KEV catalog The actor reportedly exploited CVE-2022-20775 before restoring the original software version to gain root access. The vulnerability, tracked as CVE-2026-76418, is rated 8.6 on the CVSS scoring system. The flaw is tracked as CVE-2026-20127 and has a CVSS score of 10.0. Successful exploitation of CVE-2026-76418 could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial-of-service (DoS) condition. The vulnerability is tracked as CVE-2026-20127 and affects core networking components, prompting urgent patching amid active attacks. This detail remains specific to the available reporting: UAT-11473 exploited CVE-2026-20127 to deploy the KeyDrift malware framework. This detail remains specific to the available reporting: The PoC contains a deployable WAR file, lowering the barrier for more threat actors to weaponize this critical flaw. This detail remains specific to the available reporting: LittleFilch, deployed as libcommon[.]so, supplies KeyDrift’s collection capability by hooking SSL_read inside vdaemon. Review patch and exposure state for CVE-2022-20775 against the supported reporting. Confirm the affected product or control state against the available evidence.

Vulnerabilities

  • CVE-2026-20127 — CVSS 10 (Critical) · CISA KEV · CWE-287 · Cisco Cisco Catalyst SD-WAN Manager. A vulnerability in the peering authentication in Cisco Catalyst SD-WAN Controller, formerly SD-WAN vSmart, Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, and Cisco Catalyst SD-WAN Validator, formerly SD-WAN…
  • CVE-2026-20182 — CVSS 10 (Critical) · CISA KEV · CWE-287 · Cisco Cisco Catalyst SD-WAN Controller; Cisco Cisco Catalyst SD-WAN Manager. May 2026: This security advisory provides the details and fix information for a vulnerability that was discovered and fixed after the was disclosed in February 2026.
  • CVE-2026-76418 — CVSS 8.6 (High) · CISA KEV · CWE-690 · Cisco Cisco Secure Firewall Adaptive Security Appliance (ASA) Software; Cisco Cisco Secure Firewall Threat Defense (FTD) Software. A vulnerability in the Remote Access SSL VPN service of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote…
  • CVE-2022-20775 — CVSS 7.8 (High) · CISA KEV · CWE-25 · Cisco Cisco Catalyst SD-WAN; Cisco Cisco Catalyst SD-WAN Manager; Cisco Cisco SD-WAN vContainer. A vulnerability in the CLI of Cisco SD-WAN Software could allow an authenticated, local attacker to gain elevated privileges.

Techniques

  • T1003.001 LSASS Memory (Credential Access)
  • T1003.003 NTDS (Credential Access)
  • T1005 Data from Local System (Collection)
  • T1006 Direct Volume Access (Stealth)
  • T1007 System Service Discovery (Discovery)
  • T1010 Application Window Discovery (Discovery)
  • T1012 Query Registry (Discovery)
  • T1016 System Network Configuration Discovery (Discovery)
  • T1016.001 Internet Connection Discovery (Discovery)
  • T1018 Remote System Discovery (Discovery)
  • and 10 more

Named actors and malware

  • Volt Typhoon (actor)

Indicators

  • 8 indicators on file

Coverage

3. FBI Arrests Third ShinyHunters Suspect, a Canadian Ransomware Negotiator (Segment)

Event now covered by 25 outlets (was 23); Blast radius expanded: new product(s): mobile fortify, android application packages

What changed

Investigators allege Dubrovsky helped operate the group’s now-defunct extortion website, shinywire[.]com, which targeted nearly 100 organizations. On April 8, 2026, 7-Eleven discovered that an unauthorized third party had gained access to certain systems. Capcom detected suspicious activity and confirmed the intrusion on October 19. H&M is reportedly investigating claims that it was targeted by the ShinyHunters cybercrime group.

How it works

Reportedly, The Department of Peace accessed the information via a single sign-on service provided by identity company Okta. Reportedly, Okta disputes that its systems were breached, stating it is secure and has no evidence its data or systems were compromised.

What to do

The detention of Saif al-Din Khader and the removal of an unpatched Oracle PeopleSoft contractor at the FBI reveal that ShinyHunters exploits pre-compromise conditions where attackers rely on unmanaged third-party integrations rather than novel exploits. This behavior enables the group to bypass traditional perimeter defenses by leveraging existing supply chain trust, specifically targeting vendors like Accenture and Oracle without needing to discover new vulnerabilities. For defenders, the immediate priority is to audit all third-party integrations and verify that critical patches for platforms like Oracle PeopleSoft are actively applied, as the group’s success stems from the failure to maintain these pre-compromise controls rather than technical ingenuity. ShinyHunters has shifted from purely financial extortion to using AI agents and social engineering to automate the entire attack chain, including targeting recruitment portals and cloud SaaS environments like Snowflake. This behavior creates uncertainty because the group can now operate with minimal human oversight, using stolen credentials and AI-driven tools to exfiltrate data or threaten physical harm without immediate detection. Consequently, defenders must prioritize monitoring for automated credential theft and AI-mediated lateral movement, while acknowledging that the group’s ability to impersonate legitimate IT support or internal services makes traditional signature-based detection insufficient for identifying their evolving tactics. Audit third-party contractor access controls to ensure personnel with failed patch compliance are immediately removed from bureau systems.

Limits and watch

TFG London is still trying to establish whether any personal or sensitive information has been compromised. ShinyHunters alleged that it had stolen more than 600,000 records, a figure that remains unverified by independent forensic analysis. Watch for further arrests of ShinyHunters members, following the detention of a suspect in Jordan who is cooperating with the FBI to identify other group members. Watch for disclosures regarding the European Commission breach, where CERT-EU confirmed ShinyHunters stole approximately 340 GB of data via a Trivy supply chain attack.

Techniques

  • AML.T0006 Active Scanning (Reconnaissance)
  • AML.T0108 AI Agent (Command And Control)
  • EMERGING-0017 Distillation
  • T1003.002 Security Account Manager (Credential Access)
  • T1003.003 NTDS (Credential Access)
  • T1003.004 LSA Secrets (Credential Access)
  • T1003.006 DCSync (Credential Access)
  • T1005 Data from Local System (Collection)
  • T1006 Direct Volume Access (Stealth)
  • T1016 System Network Configuration Discovery (Discovery)
  • and 10 more

Named actors and malware

  • ShinyHunters (actor)
  • Cl0p (malware)
  • Scattered Spider (actor)
  • Clop (malware)
  • Midnight Blizzard (actor)
  • Lapsus$ (actor)
  • TeamPCP (actor)
  • ShinyHunters group (actor)

Indicators

  • 25 indicators on file

Coverage

4. Hacker ‘Department of Peace’ leaks data on 41,000 DHS employees via Okta breach (Segment)

Event first seen in a show

What changed

The transparency nonprofit DDoSecrets published a data archive titled Icepick on Wednesday containing personal and operational records for over 41,000 Department of Homeland Security employees and contractors. The leaked records, which span DHS and seven component agencies including ICE and CBP, were last updated on August 19, 2026, and were reportedly obtained from the agency’s Okta single sign-on system by a group calling itself the Department of Peace. TechCrunch verified the records were copied from DHS’s Okta single sign-on system around mid-August.

How it works

The data was reportedly stolen from DHS’s Okta single sign-on system, which manages access to internal applications and user identities across the department. The extracted records include email addresses, phone numbers, office addresses, and references to internal systems, providing a detailed map of DHS organizational structure and operational workflows. The leak exposes personal and operational details for over 41,000 DHS employees and contractors, including names, job titles, and contact information for personnel across multiple agencies. The dataset includes sensitive information on undercover and surveillance programs, as well as details on approximately 10,000 employees of Immigration and Customs Enforcement and its Homeland Security Investigations unit.

What to do

The leak of 41,000 DHS records from Okta exposes identity weaknesses, letting adversaries map structures and identify undercover agents. This exposure enables attackers to target high-value individuals, shifting priority to validating permission groups and verifying Okta’s integrity. Detailed contact info for over 40,000 employees suggests attackers have moved beyond initial access to prepare targeted social engineering. Okta claims its systems are secure, but leaked data indicates adversaries may use credentials to create fake profiles, creating uncertainty about containment. The Okta spokesperson’s assertion that systems were not compromised creates an attribution gap, forcing defenders to treat this as credential theft. DHS confirms awareness of the breach, elevating risk of targeted social engineering against federal personnel in sensitive roles. To respond, audit Okta API logs for anomalous bulk export requests or permission group enumeration to identify the specific access path used to extract the employee data. Implement detection rules for large, iterative quantities of authentication requests from single sources to catch active probing for valid usernames and email addresses.

Limits and watch

The exact vector of the data exfiltration remains unconfirmed, as Okta denies a system breach while DHS acknowledges a potential incident, leaving the specific compromise point unclear. The full extent of the operational impact on ongoing investigations is unknown, though the leak includes sensitive details on undercover programs and surveillance tools. Watch for suspicious network traffic that probes for email addresses and usernames, specifically large iterative authentication requests from single sources. Track social media and public-facing data sources for passive harvesting of employee roles and locations, which adversaries use to refine targeting for initial access.

Techniques

  • T1003.001 LSASS Memory (Credential Access)
  • T1003.003 NTDS (Credential Access)
  • T1005 Data from Local System (Collection)
  • T1006 Direct Volume Access (Stealth)
  • T1007 System Service Discovery (Discovery)
  • T1010 Application Window Discovery (Discovery)
  • T1012 Query Registry (Discovery)
  • T1016 System Network Configuration Discovery (Discovery)
  • T1016.001 Internet Connection Discovery (Discovery)
  • T1018 Remote System Discovery (Discovery)
  • and 10 more

Named actors and malware

  • Volt Typhoon (actor)
  • ShinyHunters (actor)
  • Salt Typhoon (actor)

Indicators

  • 3 indicators on file

Coverage

5. Binance Suffers $6.3B Hack via Compromised DevOps Laptop (Segment)

Event first seen in a show

Cryptocurrency exchange Bybit detected unauthorized activity involving its Ethereum cold wallets, leading to a major security breach. The attack, attributed to the TraderTraitor unit, likely began with a compromised DevOps engineer’s laptop and utilized EIP-7702 to delegate control over Binance’s hot wallet. Lazarus Group hackers used anonymous trading platforms such as eXch and THORChain to swap funds.

The hackers exploited a free storage software product used by ByBit to move Ethereum. On Ethereum, the attackers leveraged EIP-7702, a mechanism through which a standard wallet can delegate its behavior to a smart contract by signing a permission. The incident concerns Binance[.]com, while Binance[.]US said its platform is not affected by the issue. Binance has halted withdrawals and pledged to reimburse all losses using company funds and its Secure Asset Fund for Users (SAFU).

ByBit’s exploitation of free storage software shows that third-party utility gaps can bypass perimeter defenses to enable direct asset exfiltration. Audit developer endpoints for unauthorized outbound connections to cryptocurrency nodes and detect curl or wget activity targeting financial application credentials. Implement detection rules for sudden Outlook rule changes by financial staff and clipboard data exfiltration tied to cryptocurrency wallet addresses to intercept social engineering attempts.

The specific social engineering channels used in the current incident remain unconfirmed, as historical patterns cite LinkedIn, Telegram, and Discord but do not establish the exact vector for this breach. Attribution of the attack to TraderTraitor is based on blockchain analysis and analyst assessment rather than direct forensic confirmation of the initial access vector. Watch for Windows endpoints accessing financial apps or enterprise ERP systems in ways that break historical user behavior patterns. Track suspicious inbound messages that trigger quick sensitive actions like OAuth consent or financial approvals to catch active social engineering campaigns.

Techniques

  • T1001.003 Protocol or Service Impersonation (Command And Control)
  • T1005 Data from Local System (Collection)
  • T1008 Fallback Channels (Command And Control)
  • T1010 Application Window Discovery (Discovery)
  • T1012 Query Registry (Discovery)
  • T1016 System Network Configuration Discovery (Discovery)
  • T1021.001 Remote Desktop Protocol (Lateral Movement)
  • T1021.002 SMB/Windows Admin Shares (Lateral Movement)
  • T1021.004 SSH (Lateral Movement)
  • T1027.002 Software Packing (Stealth)
  • and 10 more

Named actors and malware

  • Lazarus Group (actor)
  • Lazarus (actor)
  • APT38 (actor)

Indicators

  • 2 indicators on file

Coverage

6. Polymarket halts trading after DebugBear supply chain breach drains $2.7M from 710 wallets (Segment)

Event first seen in a show

Polymarket confirmed it identified and fixed a security issue affecting its international platform, Polymarket[.]com, after traders reported missing funds and unauthorized position closures. This incident occurred on the same day as a massive Binance hack, but no source links the two events. Researchers linked the theft to malicious code served from DebugBear, a UK-based website performance monitoring firm, which communicated with data[.]debugbear[.]com to receive instructions. According to CNBC, an account on Polymarket withdrew at least $2.7 million across 710 other wallets, while the company’s separate United States platform was not compromised.

The malicious JavaScript, distributed through cdn[.]debugbear[.]com/C7xcKKrjUnXK[.]js, searched for active trading sessions and reused existing authority within authenticated applications to move assets. It read browser storage for account details and trading API credentials, then attempted to sell positions or transfer tokens directly to an attacker-set address via Polymarket’s relayer. The incident exposed users of Polymarket’s international platform to wallet theft, while the company pledged to reimburse affected traders and referred the matter to law enforcement.

Attackers targeted the authenticated application’s relayer and trading tools to execute unauthorized transfers, creating uncertainty about whether all users were compromised or if the theft was limited to specific account types. This behavior dictates that the most useful investigation focus is verifying the exact number of impacted wallets and the precise timing of the script’s execution relative to trading activity, while the decision priority is ensuring that all affected traders are reimbursed through official channels rather than unsolicited recovery links, acknowledging that the exact financial loss remains unconfirmed despite estimates ranging from $2.19 million to $2.71 million. Remove the DebugBear snippet from your websites immediately, as the vendor has urged users to do so in response to the ongoing security incident. Review recent orders and wallet transactions through trusted channels, and save transaction hashes for support claims to verify unauthorized activity.

Hudson Rock has not determined how the script was tampered with or how many users were hit. The exact exposure window and the initial method used to compromise the provider remain unresolved. Track the restoration of funds for users with less than ten thousand dollars stolen, which Polymarket said would be completed by October thirty. Watch for the release of the form required for larger claims to receive restoration, as these users must sign it to be made whole.

Techniques

  • T1195 Supply Chain Compromise (Initial Access)
  • T1593.001 Social Media (Reconnaissance)

Indicators

  • 3 indicators on file

Coverage

7. CISA Adds GitLab CVE-2026-97229 to KEV After Failed Exploit Attempt on Alpine Linux (Hot)

Event first seen in a show

CISA added CVE-2026-97229 to its Known Exploited Vulnerabilities catalog on October 29, 2026, confirming active exploitation of a GitLab flaw that allows unauthenticated remote code execution. This is a CVSS ten integer overflow in GitLab’s CI/CD regex compiler, and the bug lives in Onigmo, Ruby’s regex engine. Rapid7 published proof-of-concept code on October 13, following a newly registered account that began probing a GitLab instance on October 20 and 21 while it ran unpatched version 19.3.4. Standard GitLab updates didn’t fix it. If you are on 19.2, 19.3, or 19.4, you need the specific fixed releases from October 12th or 21st. The vulnerability is confirmed to affect GitLab Community and Enterprise Editions, with CISA warning that attackers are actively exploiting the flaw to achieve code execution without authentication. The supplied catalog entry lists November 1, 2026, as the remediation deadline for federal civilian agencies, while the flaw stems from insufficient regular expression validation in Onigmo, Ruby’s regular expression engine.

CISA confirmed attackers exploited CVE-2026-110264 on GitLab servers by forcing an integer overflow during regex compilation. The exploit chain requires write access to a public project, then sends a crafted CI lint request that triggers the overflow. An unauthenticated attacker manipulates a CI configuration to force the overflow during regex compilation, causing arbitrary code execution. This vulnerability triggers when the server compiles a specially crafted regular expression, leading to arbitrary code execution. The exploit path was demonstrated in a failed attack against Alpine Linux’s instance one week after disclosure, where the attacker downloaded the GitLab container image to tune the exploit to the specific build. An unauthenticated attacker can execute arbitrary code on GitLab servers by sending a crafted regular expression, a risk that persists if you run GitLab with standard Ruby rather than GitLab’s patched packages. This flaw allows unauthenticated code execution on GitLab servers running versions before 19.5.1, whereas the Alpine Linux incident required self-compiled Ruby to succeed. According to earlier reporting, the vulnerability affects GitLab versions 19.2 before 19.2.8, 19.3 before 19.3.4, and 19.4 before 19.4.2, requiring only permission to push a branch to a public project to trigger the exploit. GitLab released fixed versions 19.2.8, 19.3.5, and 19.4.2 on October 12, 2026, explicitly distinguishing this issue from the separate CVE-2026-110264 which affects a broader range of versions. Applying the patch for the previously exploited CVE-2026-97229 does not fix this new vulnerability, so teams must upgrade to the latest releases to close both code execution paths.

Self-compiled GitLab instances require a Ruby upgrade to 3.3.13 or later, not just the GitLab package, to stop the code execution. Operators must verify their Ruby version and apply the October 21 fixes, since upgrading GitLab alone does not resolve the underlying Onigmo engine vulnerability; you must update Ruby to version 3.3.13, 3.4.12, or 4.0.9 to close the gap if you run custom builds. GitLab Dedicated customers do not need to take action, as GitLab[.]com is already running a patched version of the software.

The initial attack against Alpine Linux only partially succeeded by crashing worker processes, and the full extent of data exfiltration or persistent access remains unconfirmed. The attacker used a newly registered account to probe the server on October 20 and 21, but the specific identity or attribution of the actor behind this activity is not established. Watch for large iterative quantities of authentication requests from a single source, which signal reconnaissance for the Poisoned Pipeline Execution technique. Deploy automated static analysis tools with data flow analysis to identify integer overflow weaknesses in CI/CD configuration parsers, as this method minimizes false positives compared to black-box fuzzing.

Vulnerabilities

  • CVE-2026-110264 — CVSS 10 (Critical) · CWE-190 · GitLab GitLab. An issue has been discovered in GitLab CE/EE affecting all versions from 7.0 before 18.11.13, 19.0 before 19.0.10, 19.1 before 19.1.9, 19.2 before 19.2.9, 19.3 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1…
  • CVE-2026-97229 — CVSS 10 (Critical) · CISA KEV · CWE-190 · GitLab GitLab. GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an unauthenticated user to…

Techniques

  • T1136 Create Account (Persistence)
  • T1190 Exploit Public-Facing Application (Initial Access)
  • T1210 Exploitation of Remote Services (Lateral Movement)
  • T1589.002 Email Addresses (Reconnaissance)
  • T1677 Poisoned Pipeline Execution (Execution)

Indicators

  • 4 indicators on file

Coverage

8. CISA adds Node2Shell Brotli RCE to KEV as exploitation attempts emerge (Hot)

Event now covered by 5 outlets (was 3); 2 new indicator(s) observed

Python brotlicffi versions 1.2.0.x and earlier are affected, with a fix in version 1[.]2[.]1[.]0. The vulnerability is tracked as CVE-2025-55182 and is a remote code execution vulnerability. The flaw appears when the decoder encounters an invalid transition between block types within a Brotli stream and continues processing with an invalid internal state. The WAF update introduces two detection rules for the Brotli vulnerability tracked as CVE-2026-111497. CISA added the flaw to its Known Exploited Vulnerabilities (KEV) Catalog and ordered US government agencies to patch their systems by November 10. This detail remains specific to the available reporting: The attack complexity for the vulnerability is High. This detail remains specific to the available reporting: Microsoft announced on October 25 that it was rolling out updates for supported runtimes and SDKs. This detail remains specific to the available reporting: nodejs on jammy and higher uses the system brotli and is marked as not-affected. Review patch and exposure state for CVE-2025-55182 against the supported reporting. Confirm the affected product or control state against the available evidence.

Vulnerabilities

  • CVE-2025-55182 — CVSS 10 (Critical) · CISA KEV · CWE-502 · Meta react-server-dom-webpack; Meta react-server-dom-turbopack; Meta react-server-dom-parcel. A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel…
  • CVE-2026-111497 — CVSS 9.8 (Critical) · CISA KEV · CWE-787, CWE-252 · Google Brotli. A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory…
  • CVE-2026-48356 — CVSS 9.3 (Critical) · CWE-434 · Adobe Adobe Commerce; Adobe Adobe Commerce B2B; Adobe Magento Open Source. Adobe Commerce is affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or…
  • CVE-2026-102870 — CVSS 8.8 (High) · CWE-94 · Microsoft .NET 10.0 installed on Linux; Microsoft .NET 10.0 installed on Mac OS; Microsoft .NET 10.0 installed on Windows. Improper control of generation of code (‘code injection’) in ASP.NET Core allows an unauthorized attacker to execute code over a network.
  • CVE-2026-114148 — CVSS 7.8 (High) · CWE-276 · Microsoft .NET 10.0 installed on Linux; Microsoft .NET 10.0 installed on Mac OS; Microsoft .NET 10.0 installed on Windows. Incorrect default permissions in ASP.NET Core allows an authorized attacker to elevate privileges locally.
  • CVE-2026-105482 — CVSS 7.4 (High) · CWE-284 · nodejs node. A flaw in Node.js DNS resolution allows hostnames containing a NUL byte to be silently truncated by the dns.resolve*() functions and dns.reverse().
  • CVE-2026-105483 — CVSS 7.4 (High) · CWE-295 · nodejs node. A flaw in Node.js TLS hostname verification allows a certificate without a matching IP address SAN to authenticate a connection to an IPv4 address when the host is written with non-ASCII characters, such as fullwidth…
  • CVE-2026-106069 — CVSS 7.4 (High) · CWE-295 · nodejs node. A flaw in Node.js TLS hostname verification can cause a server certificate to be validated against a different IP address than the one the client connected to, when the host is a non-canonical IPv4 literal with a…
  • CVE-2025-1338 — CVSS 6.9 (Medium) · CWE-77, CWE-74 · NUUO Camera. A vulnerability was found in NUUO Camera up to 20250203.
  • CVE-2026-106072 — CVSS 6.7 (Medium) · CWE-295 · nodejs node. A flaw in Node.js TLS hostname verification allows a certificate with only a DNS SAN to authenticate an IP endpoint when the client connects using a non-canonical IPv4 spelling, such as 0177.0.0.1, 0x7f.0.0.1…
  • and 6 more

Techniques

  • AML.T0072 Reverse Shell (Command And Control)
  • AML.T0105 Escape to Host (Privilege Escalation)
  • T1021.007 Cloud Services (Lateral Movement)
  • T1078.001 Default Accounts (Stealth)
  • T1102 Web Service (Command And Control)
  • T1190 Exploit Public-Facing Application (Initial Access)
  • T1203 Exploitation for Client Execution (Execution)
  • T1204.002 Malicious File (Execution)
  • T1210 Exploitation of Remote Services (Lateral Movement)
  • T1497 Virtualization/Sandbox Evasion (Stealth)
  • and 8 more

Indicators

  • 25 indicators on file

Coverage