Vulnerability Watch

Check Point zero-day chained with PHP2Shell to gain root on gateways, then a wiper on VMware hosts (CVE-2026-123039)

Check Point Research and BleepingComputer, November 12-13, 2026 · CVE-2026-123039, CVSS 7.8 · Added to CISA KEV November 13 · Chained with PHP2Shell CVE-2026-109618 and CVE-2026-109619

CISA added CVE-2026-123039 to its Known Exploited Vulnerabilities catalog on November 13, with a fix deadline of Monday, November 16. The flaw sits in the Gaia OS DynamicCLI service: the daemon runs as root and listens on a world-writable local socket without authenticating who connects, so any local user can send it a command and have it run as root. Check Point says attackers chained it to PHP2Shell, two critical PHP flaws that allow unauthenticated remote code execution through the Mobile Access portal. The first wave started October 30 against Israeli organizations, and a second wave on November 2 hit companies in several countries.

Once in, the attackers installed PHP webshells and a backdoor called TSGA, then used SSH from the gateway to reach VMware ESXi hosts and ran a wiper called destroy_v6 that deletes files and leaves a political note named DREAM_ANNEXATION.txt. Check Point says about two dozen customers were compromised. Attribution is uncertain, and a false flag is possible.

UnrealIRCd flaw lets a network user inject server-to-server commands that run with server authority (CVE-2026-114713)

CISA KEV, November 13, 2026 · CVE-2026-114713, CVSS 8.6 · Active exploitation confirmed

CISA added CVE-2026-114713 to its Known Exploited Vulnerabilities catalog on November 13, with a fix deadline of Monday, November 16. UnrealIRCd contains an improper neutralization of delimiters flaw that allows any user on a network with two or more linked servers to inject server-to-server commands that are executed with server authority.

Attackers hijacked ScreenConnect panels and pushed malware to 288 endpoints in 90 minutes (SCKit, RMM+ blank-key flaw)

Huntress and ConnectWise advisory, November 11, 2026 · No CVE assigned · Active exploitation confirmed · Update technician clients to 26.6.5 or later

On November 11, security firm Huntress saw an operator use access to multiple cloud-hosted ConnectWise ScreenConnect panels to push commands to groups of managed endpoints. The commands installed attacker-controlled ScreenConnect clients and a toolkit called SCKit. At least 288 hosts across 48 organizations were hit, all within about 90 minutes. SCKit steals browser and ScreenConnect session tokens and can spread through ScreenConnect sessions, so it can reach a technician's own machine and then every device that technician connects to.

ConnectWise disabled five third-party extensions across about 400 partner environments: Labtech Plus, RMM Plus, RMM+, RMM Plus Password Link, and RMM+ Password Link. The leading theory is a flaw in RMM+ versions 1.0.31 and 1.0.32, which accepted a blank access key when an administrator had never set one, bypassing user accounts, roles, and multi-factor authentication.

A second N-central exploit chain beats the emergency patch, and miners moved in within hours (4EverAble2Shell, CVE-2026-90436)

SecurityWeek and SOCRadar, November 12-13, 2026 · CVE-2026-90436, CVSS 9.8 · Exploited in the wild within hours · Works on N-central 2026.4 HF2

Researcher Sean Bales published proof-of-concept code on November 12 for 4EverAble2Shell, a new N-central exploit chain, and a companion set called Agent2Shell that targets managed Windows endpoints. 4EverAble2Shell chains CVE-2026-90436, a critical flaw in the end-of-life Apache Axis 1.x engine scored 9.8, with a privilege escalation inside N-central, giving an unauthenticated attacker remote code execution as root on the server. It works against servers already running the emergency patch, N-central 2026.4 HF2, and it needs the Legacy API enabled and exposed to the internet.

Researchers report at least 21 servers compromised within hours of the code going public, most of them already on HF2, with the XMRig Monero miner installed. Agent2Shell chains about a dozen flaws to run commands as SYSTEM on managed Windows agents, though no exploitation of it has been reported.

Citrix patched 10 critical NetScaler flaws, including one that needs no login (CVE-2026-107412 and others)

Citrix security bulletins, November 12, 2026 · CVE-2026-107412, CVE-2026-120868, CVE-2026-120869 · No known exploitation yet · Nine critical ADC/Gateway flaws plus one Console flaw

Citrix published patches on November 12 for 28 vulnerabilities in NetScaler ADC and NetScaler Gateway, including nine critical memory flaws, plus a critical authentication bypass in NetScaler Console. The worst, CVE-2026-107412, scores 9.5 and can cause memory corruption on Gateway and AAA virtual servers. CVE-2026-120868, scored 9.3, sits in core packet processing and affects every NetScaler ADC and Gateway deployment, including the default configuration. The NetScaler Console flaw, CVE-2026-120869, scores 9.4 and lets an unauthenticated attacker bypass authentication controls and reach restricted resources.

Citrix says it is not aware of any exploitation of these flaws, and no public proof of concept has been confirmed. NetScaler flaws have been exploited quickly in the past: CISA added six NetScaler CVEs to its exploited list between March and October this year.

Hackers are probing 30-plus N-central zero-days as N-able rushes patches (CVE-2026-125883 and others)

SecurityWeek, November 12, 2026 · CVE-2026-125883, CVE-2026-125881, CVE-2026-125882, CVE-2026-91000 · Exploited in the wild (scanning) · N-central 2026.4 HF2

Security researcher Sean Bales published details and proof-of-concept code for more than 30 vulnerabilities in N-able N-central, which he calls Able2Shell, saying he did not responsibly disclose them because he was unhappy with N-able not patching two flaws he previously reported in another product. On Monday the company took hosted N-central environments offline to investigate and develop fixes, and urged customers to disconnect on-premises deployments as well. The flaws include CVE-2026-125883, multiple XML external entity issues scored 9.3; CVE-2026-125881, a server-side request forgery flaw scored 9.3; CVE-2026-125882, a path traversal flaw that leads to remote code execution, scored 8.6; and CVE-2026-91000, missing authentication leading to privilege escalation, scored 8.4.

N-able says all the vulnerabilities that could be exploited without authentication are now resolved in N-central 2026.4 HF2, with fixes prioritized by severity and exploitability. Attackers are already scanning: cybersecurity firm Defused reports anonymous agent sessions opening, appliance configuration being pulled, and the remote-control endpoint being hit without authentication.

A new Windows privilege escalation has a public proof of concept and no patch (SignDrop, no CVE yet)

MSNightmare proof of concept, November 10, 2026 · No CVE assigned · Not confirmed by Microsoft · No in-the-wild exploitation reported

Researcher MSNightmare published a proof of concept on November 10 for SignDrop, a local privilege escalation in the Windows Common Log File System driver, clfs.sys. The exploit coerces the Microsoft Defender engine through an RPC method to open an attacker-prepared CLFS container, and CLFS then signs the empty container and creates a missing authentication file in a privileged context, giving the attacker SYSTEM privileges. It is a follow-on to CVE-2025-29824, the CLFS zero-day Microsoft patched in April after the Storm-2460 ransomware group used it with PipeMagic to deploy ransomware.

As of November 11 there is no CVE, no advisory, and no patch, Microsoft has not confirmed the claims, and no in-the-wild exploitation has been reported. The proof of concept is public on GitHub, so assume it will be tested against real targets. There is nothing to install yet.

One crafted cookie logs an attacker into Xen Orchestra as an admin, and it is being exploited (VSA-2026-062)

Vates advisory VSA-2026-062, November 10, 2026 · No CVE assigned · Exploited in the wild · Fixed in 6.9.2 (stable) and 6.10.1 (latest)

Vates, the company behind Xen Orchestra, published advisory VSA-2026-062 on November 10 confirming active exploitation of a critical authentication bypass in Xen Orchestra and the Xen Orchestra Appliance. The REST interface parses a cookie named authenticationToken, and the value j:%7B%7D decodes to an empty JSON object, which the token lookup accepts without checking that it is a string. That hands the attacker the session of an existing token owner, with full administrative privileges over the virtualization management layer and the XCP-ng hosts it controls. The flaw was found by Filip Magic and Christoffer Olsen of TDC NET Security.

No CVE has been assigned and no CVSS score published, so do not wait for a scanner to flag it. The fix is in Xen Orchestra 6.9.2 on the stable channel and 6.10.1 on the latest channel. Vates says a successful exploit leaves no log entry, so detection has to come from HTTP monitoring in front of the server: look for the crafted cookie value and for traffic from the campaign infrastructure, including 91.211.251.112 on port 8001 and a Tor onion service.

Apache fixes a critical remote code execution flaw in its web server (CVE-2026-119618)

Apache HTTP Server 2.4.71, November 2026 · CVE-2026-119618 · Critical heap overflow in mod_http2 · No public exploit yet

Apache released HTTP Server 2.4.71, fixing a critical heap overflow in the mod_http2 assign_headers function that can lead to remote code execution. The flaw is tracked as CVE-2026-119618. No public working exploit is available yet, but Apache HTTP Server runs a large share of the web, and a critical remote code execution flaw in it does not stay unexploited for long.

Disabling HTTP/2 can mitigate the issue, though proxies that translate to HTTP/2 still need to watch for HTTP request smuggling.

Microsoft patches an exploited Outlook zero-day that steals your Windows login (CVE-2026-124194)

Microsoft Patch Tuesday, November 10, 2026 · CVE-2026-124194 · Exploited in the wild · CISA KEV, due Nov 24

Microsoft's November Patch Tuesday fixes 1,235 flaws, 66 of them critical, and the one that matters most is already being exploited. CVE-2026-124194 is a spoofing flaw in Outlook: open a specially crafted message file and Outlook connects to an attacker-controlled server without its usual warning, handing over your NTLMv2 login hash, which the attacker can crack offline or relay to sign in as you. The Preview Pane is not an attack vector, so the file has to be opened, which usually means a phishing email with an attachment. It affects Microsoft 365 Apps for Enterprise and Office LTSC 2021 and 2024, with fixed builds 16.0.14334.21048 for LTSC 2021 and 16.0.17932.21140 for LTSC 2024.

Microsoft rates it Moderate at 6.5, which is the point: the score measures the bug, not the fact that attackers are already using it. The release also includes a critical pre-authentication remote code execution flaw in Windows Schannel, CVE-2026-119952. CISA added the flaw to its exploited list on November 10 with a November 24 deadline.

SAP patches four flaws with perfect 10 scores, and one is broken by default (CVE-2026-89103 and three more)

SAP Patch Day, November 10, 2026 · CVE-2026-120017, CVE-2026-76964, CVE-2026-89103, CVE-2026-89126 · Not yet in CISA KEV

SAP's November Patch Day fixed 38 issues, and four of them carry the maximum CVSS score of 10.0, all exploitable by an unauthenticated attacker over the network with no user action. CVE-2026-89103, nicknamed PROXYGATE, is a broken access control default in SAP Gateway that treats an outside attacker as one of the system's own application servers; the shipped configuration is the vulnerable one. CVE-2026-120017 is a SAML assertion bypass that can let an attacker log in as any user. CVE-2026-76964 is a memory corruption flaw in the Internet Communication Manager, and CVE-2026-89126 is a heap overflow in the Web Dispatcher. Both can lead to remote code execution. Onapsis researchers found three of the four.

SAP has not reported active exploitation, and none of the four is in CISA's exploited list yet, but SAP NetWeaver flaws have a short trip from patch day to exploitation.

CISA adds six exploited flaws: Chrome zero-day joins the list, plus Cisco and Openwave

CISA KEV, November 10, 2026 · CVE-2026-125350, CVE-2026-20320, CVE-2026-111793 · Forensic triage required

CISA added six vulnerabilities to its Known Exploited Vulnerabilities catalog on November 10, each with confirmed exploitation in the wild. Three are covered in the entries above: the exploited Outlook zero-day and the two chained Barracuda flaws. The other three are due November 24. Google Chrome CVE-2026-125350, the use-after-free flaw in the browser's XML component from yesterday's brief, is now in the catalog: update to Chrome 157.0.8103.50 or later. Cisco BroadWorks CVE-2026-20320 is an XML external entity flaw in the Open Client Interface. Openwave Messaging Webtop Media Transcoder CVE-2026-111793 is an incorrect resource transfer flaw that the developer has seen exploited in attacks.

CISA requires forensic triage for the new entries, and says to discontinue use if mitigations are unavailable. None of the six is tied to a known ransomware campaign yet.

Chrome patches its eighth exploited zero-day of 2026: update to 157 now (CVE-2026-125350)

Google Chrome update, November 9, 2026 · CVE-2026-125350 · Exploited in the wild · Not yet in CISA KEV

Google released an emergency Chrome 157 update on November 9 fixing nine flaws, including CVE-2026-125350, a high-severity use-after-free bug in the browser's XML component that is already being exploited in the wild. A malicious page can use the flaw to corrupt memory and run attacker code. An anonymous researcher reported it on November 6, and Google is keeping attack details restricted until most users have the fix. The patch is in Chrome 157.0.8103.50 and .51 for Windows and Mac, 157.0.8103.50 for Linux, and 156.0.8078.96 for Extended Stable.

This is the eighth Chrome zero-day exploited in attacks this year. The update can take days to reach everyone, so do not wait for it to find you.

CISA adds four exploited flaws with a November 12 deadline: OpenSSH, GPUStack, FreeSWITCH, IBM Aspera Faspex

CISA KEV, November 9, 2026 · CVE-2026-123158, CVE-2026-102895, CVE-2026-116779, CVE-2026-123218 · Forensic triage required

CISA added four vulnerabilities to its Known Exploited Vulnerabilities catalog on November 9, each with confirmed exploitation in the wild and a federal remediation deadline of November 12. OpenSSH CVE-2026-123158, the authentication bypass nicknamed sshole, affects some Linux systems using musl libc without PAM; upgrade to OpenSSH 10.6p2 or your distribution's patched package. GPUStack CVE-2026-102895, an improper authentication flaw in the AI model-serving platform, lets an unauthenticated attacker gain admin access, create API keys, and steal cloud secrets; upgrade to GPUStack 2.2.0. SignalWire FreeSWITCH CVE-2026-116779 is a code injection flaw that can leak configuration and credentials and allow arbitrary call control and command execution; upgrade to FreeSWITCH 1.11.3. IBM Aspera Faspex CVE-2026-123218 lets an authenticated user bypass authorization and escalate privileges; upgrade to 5.0.19 PL1.

CISA requires forensic triage for all four, and says to discontinue use if mitigations are unavailable.

Fireworks AI breached again through a hacked cloud provider: billing data and model weights exposed

Fireworks AI disclosure, November 9, 2026 · BleepingComputer · LLMjacking group · No CVE

AI infrastructure startup Fireworks AI disclosed on November 9 that attackers breached a third-party cloud provider hosting its research and development machines on October 23, reached its development machines the next day, and ran an unauthorized workload. The attackers accessed resource metadata, billing information including addresses, invoice and payment history, account balances and credit usage, plus incomplete model weights and datasets for some customers. Fireworks does not store payment card numbers, so those were not exposed. The company links the activity to a financially motivated group that steals large language model access and resells it through illicit routing gateways, a scheme known as LLMjacking, and is working with Palo Alto Networks Unit 42 on the response. Customers include Notion and Cursor.

This is Fireworks' second incident in a month: in early October attackers accessed environment variables holding API keys and tokens for a limited number of accounts.

Northflank tells every customer to assume their secrets were decrypted and rotate all keys (CVE-2026-98432)

Northflank status page, November 6, 2026 · CVE-2026-98432 · Not in CISA KEV · No root cause published

Developer platform Northflank opened a security incident on October 30 after a threat alert from Wiz, and within twenty minutes told customers to assume every environment variable had been decrypted and to disable or rotate all keys. By that evening customers were reporting unauthorized use of AI provider API keys stored on the platform. A November 6 update says the first known decryption of secrets happened between 02:39 and 03:08 UTC on October 30, eight to nine hours before the first alert, and that the flaw, CVE-2026-98432, was patched across the fleet within an hour of the alert. Northflank has not published a root cause or a count of affected customers. Wiz counts Northflank as at least the ninth AI developer platform to disclose an incident in October.

Claude Code "Don't Ask Again" saves passwords into public GitHub files: 1,122 files hold 1,379 secrets

Apiiro research, November 5, 2026 · The Hacker News, November 7, 2026 · No CVE assigned · No vendor fix published

Clicking "Yes, and don't ask again" in Claude Code can save the exact command you approved, password included, into the project's .claude/settings.local.json file. Security firm Apiiro searched public GitHub and found 104,185 copies of that file in 103,617 repositories; 1,122 of them hold at least one secret, 1,379 distinct secrets in total. More than a third open a database directly, including 379 database passwords, plus 122 Supabase service-role keys, 43 SSH logins for public servers, 42 GitHub, GitLab and npm tokens, and 23 AWS keys. Two common secret scanners missed some of them: gitleaks flagged 564 of the 1,122 files and TruffleHog flagged 643, and neither flagged 215. The bug was first reported in August 2025, and Anthropic has not published a product response.

Deleting the file does not undo the leak: older versions stay in git history and in forks, where Apiiro found 734 more secrets.

SonicWall will never patch two flaws in end-of-life GMS, including a critical unauthenticated file read (CVE-2026-109593)

SonicWall advisory SNWLID-2026-0019, November 3, 2026 · CVSS 9.1 and 6.8 · GMS 9.5.2 and earlier · Not in CISA KEV · No exploitation reported

SonicWall published advisory SNWLID-2026-0019 on November 3 disclosing two flaws in Global Management System version 9.5.2 and earlier. The worse one, CVE-2026-109593, is an unauthenticated file read rated 9.1 critical: an attacker with network access can read internal GMS files, potentially exposing configurations, credentials, and keys. The second, CVE-2026-109594, is an authenticated SQL injection rated 6.8. Both were found by researchers at Pentest-Tools. SonicWall says the product has reached end of life, so no remediation or security update will be released for either flaw. Neither flaw has confirmed exploitation, and CISA's assessment listed exploitation as none at publication.

Until then, take GMS off the network where you can and isolate it behind strict access controls. There is no patch coming to wait for.

SonicWall SSL-VPN flaw bypasses SAML and MFA in active attacks (CVE-2026-19868)

SonicWall advisory SNWLID-2026-0014, November 6, 2026 · CVSS 7.1 · SonicOS Gen 7 7.3.3-7015 and earlier, Gen 8 8.2.2-8015 and earlier · In CISA KEV since November 6, 2026 · Due November 20, 2026

SonicWall released updates on November 6 for seven SonicOS firewall flaws. The one that matters most, CVE-2026-19868, lets an attacker who holds valid credentials for an alternate login method bypass SAML authentication controls on SSL-VPN, including multi-factor authentication enforced through SAML. It only affects SSL-VPN services configured to use SAML. SonicWall says its PSIRT investigated a report of potential exploitation, and CISA added the flaw to its Known Exploited Vulnerabilities catalog the same day, confirming exploitation in the wild. The flaw was reported by Ryan Harris of The Electronic Office. The same release also fixes two management interface flaws rated 8.8. No attacker, victim count, or attack details have been published.

SonicWall lists no workaround. Then review VPN login logs for sessions that skipped SAML or MFA.

OpenSSH flaw lets attackers log in with no password on musl Linux systems (CVE-2026-123158)

OpenSSH 10.6p2, November 5, 2026 · CVSS 8.1 · sshd on musl libc without PAM, notably Alpine Linux · Not in CISA KEV

The flaw, nicknamed sshole, affects sshd on Linux systems built against musl libc without PAM, most notably Alpine Linux. When a password longer than 256 bytes is supplied, musl's crypt function returns a single asterisk as an error marker, and an asterisk is also what the password field holds for an account with no password set. Send a password of 257 to 1,024 bytes and sshd mistakes the failed hash for a match, if the system also has an account with a real password hash. The researcher, Ozgun Kultekin of Wakefield, found it using AI agents to run about 17,600 automated login attempts. Public proof of concept code exists, and StepSecurity reproduced the bypass in a lab on November 6. Threat intelligence firm Previdian told The Hacker News on November 6 that it saw the first exploitation attempt less than nine hours after disclosure and confirmed root access on an Alpine honeypot, with eight attempts from 89.116.89.18. Other outlets noted the same day that confirmed in-the-wild exploitation had not been established, so treat this as one vendor's observation. Alpine's official tiny-cloud images ship with an alpine account in exactly the vulnerable state, with passwordless doas privileges. Debian, Ubuntu, RHEL, and other glibc systems are not affected, and neither are PAM configurations.

Updating the package does not restart the running sshd, so restart the service yourself. Then check logs for logins to accounts that should have no password.

Gorbag exploits WinRAR flaw to steal credentials from Ukrainian organizations (CVE-2025-8088)

ESET report November 3, 2026 · CVSS 8.8 · WinRAR before 7.13 · In CISA KEV since August 12, 2025

ESET reported on November 3 that the Russia-aligned group Gorbag has used weaponized RAR archives exploiting CVE-2025-8088, a WinRAR path traversal flaw, since early 2026. The archives show a decoy PDF while placing a shortcut in the Windows Startup folder and a PowerShell loader with an encrypted payload under ProgramData, then deploy BeautyStealer, an infostealer that collects browser credentials, VPN profiles, password databases, documents, and Ukrainian e-signature keys, then deletes itself. All confirmed targets are in Ukraine: justice and law enforcement bodies, local government near the front line, defense organizations, and a transport hub for foreign military aid. The flaw was fixed in WinRAR 7.13 in July 2025; another Russia-aligned group, RomCom, exploited it as a zero-day before the fix.

Hunt the Gorbag hashes and exfiltration IP in the IoC Library.

Apple WebKit flaw joins CISA KEV 18 months after the fix: update the phone you forgot about (CVE-2024-27834)

CISA KEV addition November 4, 2026 · Federal due date November 18, 2026 · CVSS 5.5 · iOS, iPadOS, macOS, Safari, tvOS, watchOS

CISA added Apple CVE-2024-27834 to its Known Exploited Vulnerabilities catalog on November 4, based on evidence of active exploitation. The flaw is an improper authentication issue in WebKit that lets an attacker who already has arbitrary read and write capability bypass Pointer Authentication, the hardware check that stops memory corruption from becoming code execution. Apple fixed it on May 13, 2024 in iOS 17.5, iPadOS 17.5, macOS Sonoma 14.5, tvOS 17.5, watchOS 10.5, and Safari 17.5, with iOS 16.7.8 for older devices. Sekoia links the exploitation to its Poisoned Source campaign, attributed to APT29 with moderate to high confidence: compromised websites, lookalike reverse proxies, and a one week compromise of the Plerdy SEO tracker deliver exploit chains for unpatched iOS and Android phones. Chain A hits iOS 16.7 with CVE-2025-43529 plus CVE-2024-27834 and steals browser cookies; Chain B hits iOS 18.5 with the DarkSword kit and takes full device data. There are no zero-days here, and a fully updated phone is not vulnerable.

Hunt the Poisoned Source domains, IPs, and hashes in the IoC Library.

Metabase perfect 10 flaw still being exploited: the fix is three months old (CVE-2026-72898)

Singapore CSA alert November 4, 2026 · CVSS 10.0 · Metabase 0.58.0 through 0.63.4 · In CISA KEV since August 11, 2026

Singapore's Cyber Security Agency warned on November 4 that attackers are actively exploiting CVE-2026-72898, a CVSS 10.0 SQL injection flaw in Metabase, and that a proof of concept exploit is publicly available. An unauthenticated attacker can inject SQL through the password reset endpoint and gain administrator access to the instance, including the credentials for every connected database. Metabase fixed it on August 6 and confirmed active exploitation at the time; Metabase Cloud customers were patched automatically, but self-hosted installs were not. Fixed releases are 58.24, 59.21, 60.17, 61.11, 62.9, and 63.5.

If you cannot patch yet, block access to the /api/session/reset_password endpoint. After patching, check for compromise: a POST to that endpoint returning 400 followed by a GET to /api/user/current returning 200 means the instance has likely been compromised.

WordPress Core upgrade flaw joins CISA KEV: update before Friday (CVE-2026-119977)

CISA KEV addition November 3, 2026 · Federal due date November 6, 2026 · CVSS 8.1 · Affects WordPress Core 4.7 through 7.1.3

CISA added WordPress Core CVE-2026-119977 to its Known Exploited Vulnerabilities catalog on November 3, based on evidence of active exploitation. The flaw is a time-of-check time-of-use race condition in the full-package core upgrade process: during an update, WordPress stages files in a predictable folder under wp-content/upgrade, and an unauthenticated attacker who reaches the staged installer before cleanup finishes can point the install at a database they control, opening a path to server code execution. Wordfence counted more than 18,500 requests for staged setup-config.php paths in the first 21 hours after the October 28 fix, and its rolling count on November 4 showed 12,289 blocked attempts in 24 hours. Those are blocked attempts, not confirmed compromises, and CISA names no actor.

If you cannot patch yet, block web access to wp-content/upgrade, then review web logs and file integrity for staged installers left behind.

Zyxel GS1900 zero-day: the first patch did not fix it (CVE-2026-107441)

Zyxel advisory November 3, 2026 · Fix shipped October 22, 2026 · CVSS 9.8 (Binarly) / 8.8 (Zyxel) · GS1900 switches

Zyxel confirmed a second flaw in its GS1900 switches on November 3 after Binarly found that the June 16 fix for CVE-2026-7273 left the hole open: all ten firmware releases sold as fixes were still vulnerable when Binarly tested them on September 28. The flaw sits in the dispatcher.cgi web program, with the same weak code in httprestorecfg.cgi and httpupload.cgi, and lets an unauthenticated attacker run commands as root over ordinary HTTP. GreyNoise reports one actor hit 996 GS1900 switches in 48 countries around August 17, stealing device settings, hashed root passwords, and network details, with 564 switches still on factory default logins.

Hunt the JITTERLY and SIXZUT hashes in the IoC Library.

Siemens Node-RED flaw under attack: a login would have stopped it (CVE-2026-58115)

VulnCheck report November 2, 2026 · CVSS 10.0 · Siemens SIMATIC IoT2050 Advanced with Industrial OS before V4.3.4.1 · Not in CISA KEV as of November 3

VulnCheck caught exploitation of a CVSS 10.0 missing authentication flaw in the Node-RED interface on Siemens SIMATIC IoT2050 Advanced gateways on October 30, with 16 attempts from the same source address by November 1. A single POST /flows request deploys a flow that runs system commands with maximum privileges, and VulnCheck observed flows used to fetch a Linux bot binary and stage webshells. Caveat: the attacks hit VulnCheck's honeypot network, the later stage payloads were not retrieved, and no confirmed production compromise has been publicly reported.

If it is needed, turn on its built in authentication, require HTTPS, and take it off the public internet.

Ivanti Connect Secure chain closes: two more flaws join KEV, one due Monday (CVE-2026-111357, CVE-2026-118527)

CISA KEV additions October 30, 2026 · Federal due dates November 2, 2026 (CVE-2026-111357) and November 13, 2026 (CVE-2026-118527) · CISA forensic triage: Yes (CVE-2026-111357)

CISA added CVE-2026-111357, a missing authentication flaw that lets an attacker with a foothold escalate to root, and CVE-2026-118527, a predictable file location flaw for authenticated file uploads, to its Known Exploited Vulnerabilities catalog on October 30. Both chain with CVE-2026-104935, the authentication bypass CISA listed on October 13. Volexity tracks the actor as UTA0576 and says exploitation began by October 3 against a fully patched appliance running 22.8R2.4, reaching root with no login, then stealing stored LDAP credentials, searching Active Directory for LAPS passwords and BitLocker recovery keys, and wiping matching log entries.

If you patched in mid October and stopped, you are not done. If your appliance was exposed since early October, do not trust a clean Integrity Checker result: Volexity and CISA both warn it can miss this compromise. Hunt high volumes of requests to /dana-na/auth/url_default/welcome.cgi, run network and memory forensics on any suspect box, and rotate credentials, certificates, and keys.

Drupal Commerce Core flaw under active attack: patch the storefront and audit orders (CVE-2026-118539)

Drupal advisory October 28, 2026 · Highly critical, 21 out of 25 · Affects Commerce Core 0.0.0 through 2.41 and 3.0.0 through 3.3.13

Drupal warned on October 28 that attackers are actively exploiting a missing authorization flaw in Commerce Core, the module that adds carts, checkout, and sales APIs to Drupal sites. The flaw needs no account, affects every configuration, and runs on more than 42,000 sites. Drupal says it can financially harm the vendor, which in practice means orders and checkout data are the target.

Patching alone does not close the books on orders placed while the flaw was open.

WordPress Core remote code execution flaw draws nearly 63,000 attempts in 24 hours: update to 7.1.4 (no CVE)

Wordfence report October 30, 2026 · CVSS 8.1 · Affects WordPress Core 4.7 through 7.1.3

Wordfence reports attackers tried to exploit a high severity remote code execution flaw in WordPress Core 62,969 times in the 24 hours after patches landed on October 28. The flaw has no CVE identifier and affects WordPress Core versions 4.7 through 7.1.3. Attackers are polling vulnerable upgrade paths, including setup-config.php, trying to catch the brief window during a full package core upgrade when predictable, web accessible staging paths are live.

The attempts started the moment the patch shipped, so this is not a patch when convenient story.

GitLab CVSS 10.0 flaw now in CISA KEV: update GitLab and check Ruby, not just GitLab (CVE-2026-97229)

CISA KEV addition October 29, 2026 · Federal due date November 1, 2026 · CVSS 10.0 · CISA forensic triage: Yes

CISA added CVE-2026-97229, a GitLab Community Edition and Enterprise Edition integer overflow flaw, to its Known Exploited Vulnerabilities catalog on October 29. The flaw sits in Onigmo, the regular expression engine inside Ruby, which GitLab uses to compile regular expressions in CI/CD configuration files. Under certain conditions, a specially crafted regular expression can let an attacker run code on a self-managed GitLab server, and Rapid7 reproduced code execution on an unpatched GitLab 19.4.1 image. Alpine Linux reported the clearest real world attempt: a newly registered account sent crafted CI configurations on October 20 and 21, crashed worker processes eight times, and got partway through the exploit in four of those crashes.

If you cannot patch yet, restrict open registration and untrusted creation of public projects. Hunt worker crashes, 502 errors around CI lint requests, and new accounts since October 12, and treat a suspicious host as compromised: rebuild it, rotate GitLab secrets and runner tokens, and reset passwords, as Alpine did.

Linux kernel flaw now in CISA KEV: chained with PHP2Shell to plant webshells and run commands as root (CVE-2026-46300)

CISA KEV addition October 28, 2026 · Federal due date October 31, 2026 · CISA forensic triage: Yes

CISA added CVE-2026-46300, a Linux kernel missing-initialization flaw, to its Known Exploited Vulnerabilities catalog on October 28. The flaw can lose the shared-fragment marker during socket buffer coalescing, so ESP input processing can decrypt shared fragments in place and modify page-cache-backed data. CISA says it can be chained with the PHP2Shell flaws, CVE-2026-109618 and CVE-2026-109619, to implant PHP webshells and run commands as root.

Patching PHP alone is not enough on a Linux host that runs PHP, and because CISA flags forensic triage, hunt for unknown PHP files and recently modified web files before you call the host clean.

VMware ESX logging flaw now in CISA KEV: exploited as a zero-day to hide admin activity (CVE-2026-41709)

CISA KEV addition October 28, 2026 · Federal due date November 11, 2026 · Fix: Broadcom July 2026 ESXi builds

CISA added CVE-2026-41709, a Broadcom VMware ESX insufficient-logging flaw, to its Known Exploited Vulnerabilities catalog on October 28. An attacker who already has admin access can perform certain operations without being logged. CrowdStrike reports the China-nexus group Warp Panda exploited it as a zero-day in early 2026 during attacks on the US legal sector, after entering through internet-facing edge devices and pivoting into vCenter, where it deployed malware including BRICKSTORM and SharpStorm and stole session tokens to reach Microsoft 365.

Do not let the low 2.7 CVSS score push this to the bottom of the queue: a logging blind spot is exactly what an intruder wants after stealing admin access.

Cisco firewall zero-day exploited to crash SSL VPN devices: patch ASA and FTD now (CVE-2026-76418)

CISA KEV addition October 29, 2026 · Federal due date November 1, 2026 · Cisco advisory October 28, 2026 · CVSS 8.6 · No login required to trigger it

Cisco patched CVE-2026-76418, a denial-of-service zero-day in Secure Firewall ASA and FTD software, on October 28 after its incident response team found active exploitation during October. The flaw comes from logic errors in the Remote Access SSL VPN service when secondary authentication is configured on a tunnel group. An unauthenticated remote attacker can send a crafted request while connecting to the VPN service and force the device to reload, cutting remote access. Cisco reports no confirmed data theft or remote code execution from this flaw.

If you cannot patch immediately, disable secondary authentication on the DefaultWEBVPNGroup tunnel group or on any user-configured tunnel group list, as Cisco advises. Fixed releases include ASA 9.16.4.104, 9.18.4.96, 9.20.4.50, 9.22.3.200, 9.23.1.48, 9.24.1.27, and 9.24.10.1, and FTD 7.0.11, 7.2.13, 7.4.9, 7.6.7, 7.7.14, 10.0.3, and 10.1.1.

KeyDrift: Cisco SD-WAN controllers compromised to steal the keys that encrypt traffic between sites (CVE-2026-20127)

Cisco Talos report October 28, 2026 · Actor: UAT-11473 · Flaw fixed February 2026, CVSS 10.0

Cisco Talos detailed KeyDrift on October 28, a custom implant framework deployed by the actor tracked as UAT-11473 on Cisco Catalyst SD-WAN Controllers after exploiting CVE-2026-20127, a February 2026 authentication bypass rated 10.0. A component called LittleFilch hooks SSL_read inside vdaemon, reads decrypted control traffic, and pulls out the 32-byte AES-256 key material the controller passes between routers, then RSA-encrypts it for exfiltration. Talos calls the observed attacks historical and does not say when they happened or whether stolen keys were sent, and it assesses with high confidence that the actor's infrastructure overlaps Volt Typhoon's Silent Train network.

Patching the controller does not remove an implant that is already there and does not un-steal keys that were already copied, so treat a historically exposed controller as compromised until proven otherwise: hunt the KeyDrift indicators in the IoC Library, rotate SD-WAN keying material, and follow Cisco's SD-WAN hardening guide. Targeting reported so far spans space and satellite services, defense and aerospace technology, and policy research.

Adobe Commerce and Magento file upload flaw now in CISA KEV: PolyShell (CVE-2026-48356)

CISA KEV addition October 27, 2026 · Federal due date November 10, 2026 · Fix: Adobe APSB26-73 July 2026 builds

CISA added the Adobe Commerce and Magento unrestricted upload flaw, CVE-2026-48356, to its Known Exploited Vulnerabilities catalog on October 27. The flaw can allow arbitrary code execution, and Adobe fixed it in July in APSB26-73, so this is not a new patch. It is a new urgency signal: stores still on pre-July builds are now confirmed exploited. Sansec reports exploitation since March 2026 and a loader campaign on 953 online stores, with 471 injected through PolyShell.

Patching does not remove anything already planted, so rotate credentials if you find any of it.

Google Brotli decoder flaw now in CISA KEV: update the library and everything that bundles it (CVE-2026-111497)

CISA KEV addition October 27, 2026 · Federal due date November 10, 2026 · Fix: Brotli v1.2.1

Google Brotli contains an unchecked return value flaw, CVE-2026-111497, that lets a remote unauthenticated attacker use a crafted Brotli-compressed stream to corrupt decoder memory, disclose memory contents, cause a denial of service, or potentially execute code. Because Brotli is a compression library, the risk travels with every product that bundles it, including Node.js, .NET, and PHP builds flagged in the October 27 SANS Stormcast.

If you cannot update a service immediately, restrict it from handling untrusted compressed input until you can.

Apple iOS and macOS 27.2 patch 286 bugs: update current devices now

Apple release October 26, 2026 · iOS and iPadOS 27.2, macOS Golden Gate 27.2

Apple released iOS and iPadOS 27.2 fixing 163 flaws and macOS Golden Gate 27.2 fixing 263 flaws, about 140 shared, for 286 distinct flaws across the two. The fixes cover WebKit and kernel memory corruption, sandbox escapes, privilege escalation, Gatekeeper bypasses, and remotely reachable flaws in Screen Sharing, Remote Management, and SMB, including a Remote Management bug that could allow remote code execution.

This is the current-device release, separate from yesterday's iOS 18.7.11 backport for older iPhones and iPads.

Fake IT desk in Microsoft Teams: 400 incidents, payload in under 15 minutes

Arctic Wolf research, October 26, 2026 · External Teams chat abuse

Arctic Wolf examined more than 400 incidents in which attackers used Microsoft Teams external chat, on by default, to pose as IT support. The pattern often starts with mail bombing, hundreds of newsletter confirmations flooding the inbox, then a Teams message from IT support offering to fix the noise. Once the victim engages, attackers reached payload execution in under 15 minutes, often using remote tools such as Quick Assist or AnyDesk.

Arctic Wolf did not attribute these 400 incidents to a named group. The Teams external chat route has previously been used by ransomware groups including Black Basta, which is lineage, not attribution for this set. Never follow a stranger's remote access instructions in Teams.

PHP2Shell now in CISA KEV: federal patch deadline October 29 (CVE-2026-109618, CVE-2026-109619)

CISA KEV addition October 26, 2026 · Federal due date October 29, 2026 · Patches: 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35

CISA added both PHP2Shell flaws to its Known Exploited Vulnerabilities catalog on October 26, turning yesterday's confirmed exploitation into a federal patch deadline. Both flaws allow unauthenticated remote code execution, and CISA's updated alert names Apache with mod_php as the highest risk deployment, with PHP-FPM, php-cgi, FrankenPHP, and LiteSpeed also in scope.

Hunt for compromise first: CISA's forensic triage note means checking for shells and rogue files before you assume the patch closed the incident.

Apple patches exploited CoreGraphics flaw for older iPhones and iPads: update to iOS 18.7.11 (CVE-2026-86950)

Apple release October 26, 2026 · iOS 18.7.11 and iPadOS 18.7.11

Apple released iOS 18.7.11 and iPadOS 18.7.11 on October 26, bringing the fix for the exploited CoreGraphics out-of-bounds write, CVE-2026-86950, to older devices that cannot run newer iOS versions. Apple says the flaw may have been exploited against specific targeted individuals, and CISA added it to KEV on September 29.

Owners of devices such as the iPhone XS and iPhone XR waited about a month for this branch to be patched, so do not let these devices sit on the backlog.

Cyber incident shuts down New Mexico's only Level I trauma center for a day (Byod claim UNVERIFIED)

UNM Health System, October 26, 2026 · Ambulances diverted, 30+ clinics canceled

A cybersecurity issue forced the University of New Mexico Health System on October 26 to divert ambulances, cancel appointments at more than 30 clinics, and dismiss health sciences students and nonessential staff. UNM Hospital is New Mexico's only Level I trauma center, so other hospitals in the state took on the diverted emergency traffic while UNM worked the incident.

A ransomware group calling itself Byod claimed a sweeping compromise of the university and hospital networks, but UNM has not corroborated that claim and its public notice does not say whether systems were encrypted or patient data was accessed.

Aokigahara infostealer targets AI and developer credentials, not just browsers

Check Point Research, October 23, 2026, resurfaced October 26, 2026 · Claude, ChatGPT Desktop, Codex, Cursor, GitHub Copilot

Check Point Research profiled Aokigahara, an infostealer that collects authentication files, session data, and configuration files for AI applications and developer tools, including Claude, ChatGPT Desktop, Codex, Cursor, Windsurf, and GitHub Copilot. It also goes after Git credentials, SSH files, and AWS, Azure, and Google Cloud configurations, so a single compromised endpoint can hand over a developer's whole working identity.

This is endpoint theft, not a breach of the AI providers themselves, which changes the response: isolate the device, revoke AI sessions and API keys from a clean system, and review connected cloud and repository accounts, because changing passwords alone leaves stolen session tokens usable. Fresh Aokigahara command and control indicators are in the IoC Library.

FortiSIEM flaw now confirmed exploited in the wild: unauthenticated file write on TCP 27918 (CVE-2026-106173)

Canadian Centre for Cyber Security advisory update October 23, 2026 · Fortinet FortiSIEM 7.5.0 · Fortinet advisory FG-IR-26-180

Canada's Cyber Centre updated its Fortinet advisory on October 23 to warn that CVE-2026-106173 is being exploited in the wild, days after Horizon3 published full technical details and a public proof of concept on October 20. The flaw is a path traversal in the phQueryMaster gRPC service: it accepts connections without a client certificate, so an unauthenticated remote client can reach it and steer a file write outside the intended query directory, which researchers showed can lead to code execution.

Fortinet patched it in FortiSIEM 7.5.1, and 7.6 and FortiSIEM Cloud are not affected. Not yet in CISA KEV as of the October 23 catalog.

PHP2Shell exploitation confirmed: honeypot catches successful remote code execution (CVE-2026-109618, CVE-2026-109619)

BleepingComputer report October 26, 2026 · Apache mod_php honeypot on PHP 8.4.26 · Patches: 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35

This is the confirmation the existing PHP2Shell entry was waiting for: a honeypot run by Perplexity detection lead Adel Karimi recorded confirmed remote code execution against an Apache mod_php installation running PHP 8.4.26, and Expel researcher Marcus Hutchins independently called it the highest quality confirmation of in the wild PHP2Shell exploitation he has seen. The response delivered an 800 KiB decoded cookie dump, and a shell command ran about 1.6 milliseconds after the final byte of the execution request.

If you have not patched yet, this removes the last reason to wait: upgrade to 8.5.12, 8.4.27, 8.3.36, or 8.2.35, and hunt Apache mod_php logs for large decoded cookie dumps and PHP worker processes spawning shells. Correction to last week's Unit 42 account: Unit 42 has retracted its assessment that a European government intrusion it described was PHP2Shell initial access, so do not cite that case as PHP2Shell evidence.

Whitearmor claims J.B. Hunt breach and $5 million demand (UNVERIFIED)

Leak site post October 23, 2026, resurfaced October 26, 2026 · Emerging group · No independent confirmation

The emerging group Whitearmor posted a leak site claim naming J.B. Hunt, alleging data theft and demanding $5 million, and a second post on October 26 accused the company of quietly emailing customers to update passwords instead of announcing a breach. The claimed data volumes in the original post are large and specific, but none of them are independently verified, and no confirmation from J.B. Hunt was found in this morning's check.

If J.B. Hunt confirms or denies, this entry gets corrected the same day.

k0t campaign harvested 70,000+ firewall and VPN credentials from exposed edge devices

Group-IB and NyxLab investigation, October 23, 2026 · Fortinet FortiGate/FortiWeb and Palo Alto GlobalProtect · CVE-2025-64446, CVE-2026-0257

Group-IB and NyxLab disclosed a large-scale campaign by a threat actor tracked as k0t, also known as CryptoFeel, Member19, and QazWsxShop, that harvested more than 70,000 credentials from internet-facing Fortinet and Palo Alto appliances. The operator enumerated exposed devices in bulk with FOFA and ZoomEye, then broke in through a FortiWeb path traversal flaw (CVE-2025-64446), a GlobalProtect authentication bypass (CVE-2026-0257), or plain brute force, and stayed in with OpenConnect VPN, MeshCentral agents, and AdaptixC2. Many victims later appeared on Qilin and The Gentlemen ransomware leak sites, which points to an initial access broker role, though Group-IB says the ransomware link is still unconfirmed.

Hunt for rogue admin accounts, unexpected RMM agents (MeshCentral, Atera, Teramind, AnyDesk), and Rclone exfiltration to Wasabi S3 or MEGA. Fresh k0t infrastructure indicators are in the IoC Library. Note that this is a separate dataset from the earlier FortiBleed haul, with negligible overlap, so a clean FortiBleed check does not clear you here.

PwC confirms incident after Everest claims 590 GB of data (claim unverified)

Everest leak-site claim October 22, 2026; PwC confirmation October 23, 2026 · Third-party learning platform

The Everest extortion group claimed on October 22 that it stole 590 gigabytes from PwC, including regional HR and learning exports, integration documentation, and e-learning courses, with a countdown timer threatening release. PwC confirmed on October 23 that an incident hit a third-party vendor hosting employee learning records, but said the affected site holds no client data, sensitive personal data, or financial information, and that its network and operations are unaffected.

The 590 GB figure itself is unverified: PwC declined to confirm the amount or the veracity of the claim. The lesson is about third-party exposure: a vendor learning platform became the doorway to employee employment-history data.

Capcom confirms breach of 11.7 million CAPCOM ID accounts

Capcom confirmation October 24, 2026 · CAPCOM ID membership service

Capcom confirmed on October 24 that hackers breached its CAPCOM ID membership service, exposing more than 11.7 million customer accounts. That scale makes it one of the largest consumer gaming breaches of the year, and gaming account details are prime phishing fuel because players reuse passwords and trust game-related mail.

Organizations should watch for credential-stuffing waves against their own services using this dataset.

BlackX UEFI bootkit used the Baton Drop flaw to bypass Secure Boot in an espionage campaign

BleepingComputer report October 24, 2026 · Espionage campaign, early 2026 · Targets Kaspersky and Avast protections

A UEFI bootkit dubbed BlackX, deployed in an espionage campaign in early 2026, exploited the Baton Drop vulnerability to bypass Secure Boot and load a malicious driver designed to interfere with Kaspersky and Avast security products. Because it runs before the operating system, it can disable endpoint protection and persist across reinstalls.

Bootkits are rare, but they are the persistence mechanism that survives everything else you do.

CISA adds Collabora Nextcloud flaw to KEV: confirmed exploitation, federal deadline October 26 (CVE-2026-110447)

CISA KEV addition October 23, 2026 \u00b7 Collabora Online Built-in CODE Server \u00b7 CVSS 9.2

CISA added CVE-2026-110447 to its Known Exploited Vulnerabilities catalog on October 23, confirming active exploitation of an operating system command injection in the Collabora Online Built-in CODE Server app for Nextcloud. Unauthenticated attackers can reach proxy.php when the built-in CODE server is not running, a state that routine restarts, upgrades, or crashes can create, and run commands as the web server user. Attackers have used it to plant PHP web shells and hunt for credential stores, password manager artifacts, and crypto wallets.

This page covered the flaw on October 15-16; the KEV listing changes the urgency, not the fix. Federal agencies face an October 26 deadline under BOD 26-04, and everyone else should treat patching plus a hunt for web shells and persistence as one job, because a patched server is no proof it was never hit.

Arista patches third exploited VeloCloud Orchestrator zero-day this year: read-only logins escalate to superuser (CVE-2026-114625)

Arista Security Advisory 0199, October 22, 2026 · VeloCloud Orchestrator On-Prem · CVSS 9.9

On October 22, Arista disclosed CVE-2026-114625, a critical SQL injection in VeloCloud Orchestrator On-Prem that attackers are already exploiting. An authenticated user with the lowest built-in role, Enterprise Read Only, can escalate to operator privileges and impersonate a local superuser, collapsing the boundary between a tenant who reads dashboards and an operator who controls the whole SD-WAN fabric. This is the third actively exploited VCO zero-day in four months, after CVE-2026-16812 in July and CVE-2026-93952 in September.

Hosted and Dedicated deployments are already fixed. If you cannot patch today, restrict the VCO web interface to trusted admin networks, block the two attacker IPs seen so far (74.82.197.86 and 38.54.50.151), and hunt logs for unusual URL paths, encoded payloads, and unexpected outbound connections before remediating. A leaked read-only credential is no longer a low-severity finding.

A Signal bug could keep your mic and camera on after you hang up (CVE-2026-113380)

Details and proof of concept published October 20, 2026 · RingRTC before 2.72.0 · CVSS 9.3

A critical flaw in RingRTC, the open-source library behind Signal's voice and video calls, lets a malicious caller block your hang-up. The researcher showed that a hang-up is treated as just another event in the call's finite-state-machine queue, with no rate limit on peer-originated events and no priority for hang-ups. Flood the queue with junk and your hang-up waits behind attacker noise, so audio and possibly video keep flowing to the other party while your screen says the call ended. CVE-2026-113380 is rated 9.3, and a conceptual proof of concept is public.

The attacker has to be a participant on the call, so this is not a remote eavesdropping bug for strangers, but it is a sharp reminder that terminating a call should be a kill switch, not a queue entry. Until you update, glance at the call indicator after hanging up to confirm the call actually ended.

BRONZE SANDCASTLE: China-aligned cluster plants encrypted backdoors via Sandboxie DLL sideloading

Sophos research, October 20, 2026 · Active since mid-2025 · Victims in Asia and Africa

Sophos named a previously undocumented China-aligned cluster, BRONZE SANDCASTLE, active since mid-2025 against organizations in the Philippines, Taiwan, Afghanistan, Namibia, and likely South Korea. Its signature move is DLL sideloading through legitimate signed applications: a malicious sbiedll.dll placed next to the real SandboxieWUAU.exe gets loaded when the trusted program runs. The payload stays encrypted on disk in a config.ini file, decrypts in memory at runtime, and collects system data, keystrokes, and screenshots. Operators have used it to enumerate networks and accounts, and to copy the Active Directory ntds.dit database through Volume Shadow copies.

Sophos documented eight sideloading combinations (Sandboxie, Java, Krita, NVDA, LINE, Sysinternals tools), so do not stop at one executable name. Fresh IoCs, including the version 1.1.5 C2 domains, are in the IoC Library.

PHP2Shell: two unauthenticated RCE flaws in PHP itself, exploited four days before the patch (CVE-2026-109618, CVE-2026-109619)

PHP Foundation patches October 21, 2026 · PHP 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35 · Details leaked October 20

Two critical flaws in the PHP interpreter itself, CVE-2026-109618 and CVE-2026-109619, allow unauthenticated remote code execution. Fixes landed October 21 in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35, but the details leaked online October 20 before coordinated disclosure, and AWS honeypots caught exploit attempts starting October 17, four days before the patch. One flaw corrupts memory during out-of-memory handling; the other leaves request state in freed memory, and the upload-progress handler can even hand freed worker memory back to clients inside a PHPSESSID cookie, memory that can hold passwords, session tokens, API keys, or TLS private keys.

The old assumption that you have days after a patch drops no longer holds: AWS says PHP2Shell is now broadly exploited in the wild, and the exploit-development cycle keeps compressing as AI tooling turns patch diffs into working exploits in hours. Not yet in CISA KEV.

Node.js October security release: RCE in the Brotli decoder, TLS hostname-check bypasses (CVE-2026-111497)

Node.js security releases October 21, 2026 · Versions 26.12.1, 24.22.1, 22.23.4 · Ten vulnerabilities, four high severity

The October 21 Node.js security release fixed ten vulnerabilities across the 26.x, 24.x, and 22.x lines. The worst is CVE-2026-111497, an out-of-bounds write in the bundled Brotli decoder that can leak memory or run arbitrary code when a process decodes attacker-controlled Brotli data. The same release fixes three more high-severity flaws: two TLS certificate hostname-check bypasses (CVE-2026-105483 and CVE-2026-106069) and a dns.resolve bug that truncates names containing a NUL character (CVE-2026-105482).

The release also drops the compromised eMudhra intermediate CAs from Node's trust store, so this update closes two problems at once. Only the runtime patch covers the outbound path (a fetched response with crafted Brotli data); WAF rules cover inbound only.

GitLab's October 21 release patches a maximum-severity flaw reaching back to version 7.0 (CVE-2026-110264)

GitLab patch release October 21, 2026 · Self-managed GitLab · No reported exploitation yet

GitLab's October 21 patch release fixed CVE-2026-110264, a maximum-severity flaw that lets an attacker run code on a self-managed GitLab server without logging in, affecting every version back to 7.0 from 2014. If you patched the October 12 CVSS 10.0 bug (CVE-2026-97229), you are not done: that update only covered versions 19.2 through 19.4, and the fixed releases sit one patch above them at 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, and 18.11.13.

GitLab has not said what preconditions an attacker needs, so no configuration rules you out, and there is no interim workaround. No exploitation has been reported so far, but the October 12 flaw showed how fast internet-facing DevOps infrastructure gets attention. GitLab.com and Dedicated are already patched.

LiteLLM 1.107.0 shipped with a credential stealer on PyPI and Docker: supply-chain compromise, confirmed

Disclosed October 21, 2026 · LiteLLM (BerriAI) · PyPI window 11:39 to 13:23 UTC October 21

LiteLLM 1.107.0 was published on October 21 carrying malware in all seven PyPI wheel files and the official Docker images: a credential stealer and a remote code loader. BerriAI says the release came through three engineers' GitHub accounts, apparently via stolen GitHub CLI OAuth tokens, with one account triggering the release and another approving it. The payload uses Python startup hooks, so it activates even if the application never imports LiteLLM, and on Proxy installs it queried the database table where upstream provider keys are stored and pulled up to 500 of them.

The last safe version is 1.106.2. This is the AI-tooling supply chain the industry now depends on, so treat it like a build-system breach, not a bad pip install.

Joint advisory on SafePay ransomware: 600+ victims, edge-device flaws, living-off-the-land tactics

CISA/FBI joint advisory AA26-293A, October 20, 2026 · SafePay ransomware · 600+ victims across North America, South America, Europe, and Australia

The FBI, CISA, the US Secret Service, Germany's Landeskriminalamt Rheinland-Pfalz, and two UK law enforcement agencies published a joint #StopRansomware advisory for SafePay, one of the most active ransomware operations in 2026, with at least 600 separate victims since August 2024. Initial access comes through stolen or guessed credentials, brute-force password attacks, phishing, and exploitation of edge-device flaws: CVE-2020-3259, CVE-2023-20269, CVE-2023-27532, CVE-2024-40711, and CVE-2024-40766. Once inside, the actors live off the land with PsExec, WinRM, RClone, FileZilla, and 7-Zip, halt the Volume Shadow Copy Service, reset backup appliances to factory defaults, then encrypt with a ChaCha20/RSA hybrid scheme. The advisory ships IOCs in STIX format.

Assume account takeover: hunt for newly created admin accounts, LOLBin use in business hours, and backup systems that go offline or get factory-reset right before encryption. The IoC Library carries the published IP and hash indicators.

Qilin and INC ransomware exploit the PAN-OS GlobalProtect auth bypass (CVE-2026-0257)

Unit 42 threat brief, updated October 19, 2026 · CVE-2026-0257 · Spikey Scorpius (Qilin), Tarnished Scorpius (INC), Settra

Palo Alto Networks Unit 42 confirms ransomware operators are still actively exploiting CVE-2026-0257, the authentication bypass in PAN-OS GlobalProtect portal and gateway components that has been in CISA KEV since May 13, 2026. The named actors are Qilin (Spikey Scorpius) and INC (Tarnished Scorpius), with public reporting also tying Settra ransomware to the flaw. Successful sessions generate gateway-connected events that look like legitimate VPN logins and can bypass MFA, giving the attacker a remote-worker-grade foothold. Post-access activity reported includes reconnaissance with RMM tools, RDP and SMB lateral movement, credential harvesting, and ransomware deployment; ReliaQuest warns the flaw has become a reliable ransomware on-ramp about five months after disclosure.

Hunt GlobalProtect logs for successful gateway connections from the Unit 42 attacker IPs and for suspicious host IDs like aa:bb:cc:dd:ee:ff, WINDOWS-LAPTOP-001, and DESKTOP-GP01. Any gateway-connected event from those indicators should trigger incident response, not a shrug.

Burger King Japan confirms breach of 11 million customer records

Confirmed by Burger King Japan, October 20, 2026 · Mobile app customer database · Attackers had access October 2-7

Burger King Japan disclosed that attackers accessed a server holding mobile app customer data between October 2 and October 7, exposing 11 million customer records including names, birth dates, and phone numbers. The company says the breach came through a compromised server tied to its mobile app, not the restaurant ordering network itself. No payment card data is reported exposed so far, but the exposed fields are exactly what fuels account takeover and phishing campaigns.

Consumers should watch for phishing that uses their name, birth date, and phone number together.

Switzerland's state-owned space company Beyond Gravity reports targeted cyberattack

Disclosed by Beyond Gravity, October 20, 2026 · Suspected state-level actor · Chinese involvement suspected internally

Beyond Gravity, Switzerland's state-owned space company, disclosed a targeted cyberattack it described as the work of a highly professional threat actor, with Chinese involvement suspected internally. The company builds satellites and launch-vehicle structures for commercial and government programs, so the target profile fits technology theft rather than ransomware. No details on intrusion vector, duration, or whether the attacker reached engineering data have been disclosed.

Aerospace and space-industry suppliers should read this as a supply-chain warning: segment engineering networks, enforce phishing-resistant MFA on every privileged account, and log the engineering workstations and product repositories as if an espionage actor is already interested. Space programs now carry the same targeting as defense primes.

Canva confirms third-party breach through feedback tool Canny: Salesforce data in criminal hands

Confirmed by Canva, October 18-19, 2026 · The Seven Deadly Sins ransomware group · Third-party supply-chain compromise

Canva confirmed that some enterprise customer records were exposed after attackers compromised Canny, the third-party tool it used to collect product feedback, which held a standing connection into Canva's Salesforce environment. Business contact details and contract documentation were exposed, and Canva says it revoked Canny's access, notified affected customers, and is cooperating with agencies. The group calling itself The Seven Deadly Sins listed Canva on its leak site October 16 and claims it spent over 72 hours inside Canva's Salesforce before selling the data to a "private buyer"; the claimed volumes, including more than 2 million Salesforce records, are UNVERIFIED. Canva says its own platform, accounts, passwords, and designs were not touched.

Then watch for invoice and renewal scams built on the real order and billing documents now in criminal hands, because they will look legitimate.

Apple's first actively exploited zero-day of 2026: a two-decade-old dyld flaw chained in targeted attacks (CVE-2026-20700)

Apple advisory September 29, 2026, in CISA KEV · dyld (Dynamic Link Editor) · chained with two December 2025 WebKit zero-days

CVE-2026-20700 is a memory corruption flaw in dyld, the system component that loads dynamic libraries for every process on iOS and macOS, and it has been there for nearly twenty years. Google's Threat Analysis Group reported it after Apple confirmed it was used in "extremely sophisticated attacks against specific targeted individuals," chained with two WebKit zero-days from December 2025 (CVE-2025-14174 and CVE-2025-43529). An attacker who already has memory write capability can use this flaw for arbitrary code execution at the deepest layer of the operating system, below the sandbox.

If a high-value target also skipped the December 2025 updates, treat the device as potentially compromised and rebuild it from a known-good backup.

Ivanti Connect Secure zero-day chain exploited by UTA0576, even on fully patched appliances (CVE-2026-104935)

Added to CISA KEV October 13, 2026 · Ivanti Connect Secure · Exploited since October 3, 2026

Volexity caught an actor tracked as UTA0576 exploiting Ivanti Connect Secure appliances since October 3, including one running a fully patched 22.8R2.4 build when researchers found the intrusion on October 5. The chain starts with CVE-2026-104935 (CVSS 8.6): an authentication bypass that routes requests to arbitrary CGI files through a manipulated header, then a race condition in the file upload handler for code execution, and finally a privilege escalation to root that was still unpatched at disclosure. The actor deployed no malware and no web shells, ran entirely from memory, reverted configuration changes, selectively deleted logs, and evaded Ivanti's Integrity Checker Tool, then harvested cached domain credentials, queried Active Directory, and hunted LAPS passwords and BitLocker recovery keys. CISA added the CVE to KEV on October 13.

If the appliance faced the internet, assume cached credentials are burned and rotate domain credentials, LAPS passwords, and BitLocker recovery keys.

BlockStrap: CVSS 10.0 pre-auth RCE in Adobe Commerce and Magento, exploits expected within days (CVE-2026-103849)

Adobe bulletin APSB26-153, October 13, 2026 · Adobe Commerce / Magento Open Source · Not yet in CISA KEV

Adobe's October 13 emergency bulletin patched CVE-2026-103849, a CVSS 10.0 pre-authentication remote code execution flaw in the email template engine of Adobe Commerce and Magento Open Source. Attacker-controlled content in a child email template gets signed and then re-scanned at the root level, executing a smuggled {{block}} directive as PHP (CWE-1336). E-commerce security firm Sansec, which named it BlockStrap, reproduced four attack paths within 24 hours of the patch and warns that working exploits are days away, publicly questioning Adobe's Priority 2 rating (patch within 30 days). It is not in CISA KEV, and Sansec had seen no in-the-wild exploitation as of October 15, so the patching window is still open but closing fast.

While you patch, look for web shells, unknown admin accounts, and skimming code in checkout flows, because the first working exploit will turn into Magecart card theft.

BeyondTrust zero-day in Remote Support exploited by Chinese espionage group (CVE-2026-102764)

Added to CISA KEV October 16, 2026 · BeyondTrust Remote Support · Federal deadline October 19, 2026

BeyondTrust disclosed CVE-2026-102764 on October 15: an improper origin validation flaw in internal messaging components of Remote Support (formerly Bomgar) that lets an unauthenticated remote attacker perform file operations on the appliance, which can lead to host-level control and access to every credential it stores or brokers. Mandiant and Google Threat Intelligence attribute exploitation since late August 2026 to ARMORY CASTLE (formerly UNC5221, tracked by CrowdStrike as WARP PANDA), a suspected PRC-nexus espionage actor. The actor planted the SAWFLY PHP web shell, gained root, attempted to dump the appliance secrets vault, and deployed the BARECLAW SOCKS5-over-WebSocket tunnel, with a dwell of roughly seven weeks before disclosure. Every Remote Support version up to 26.2.3 is affected, and the BT26-05-RS patch is available.

Treat every exposed self-hosted appliance as potentially compromised: patch first, then hunt for SAWFLY artifacts, unexpected root SUID shells, boot scripts granting passwordless sudo, HAProxy config changes routing BARECLAW tunnels, Jump Item roles raised to Administrator, and gaps in appliance logs.

Fortinet path traversal feeds stealthy PEERSTITCH implant on firewalls (CVE-2025-61624)

Added to CISA KEV October 16, 2026 · FortiOS / FortiPAM / FortiProxy / FortiSwitchManager · Federal deadline October 19, 2026

CISA added CVE-2025-61624 to KEV on October 16: a path traversal in FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager that lets an authenticated attacker with an admin profile and read-write permissions write or delete arbitrary files through specific CLI commands. Palo Alto Networks Unit 42 reports attackers exploited the flaw in the FortiOS auto-script engine to deploy PEERSTITCH, a memory-resident implant that hooks FortiOS processes, evades detection inside FortiOS memory, and bypasses security checks on tagged VPN sessions. Separately, Unit 42 traced a broader campaign to a telecom provider's FortiManager breached through the FortiJump flaw (CVE-2024-47575), exposing configurations, credentials, and private keys for more than 500 FortiGate firewalls. Federal remediation deadline is October 19.

Patch per Fortinet's FG-IR-26-122 advisory, then hunt for what memory-resident malware leaves behind: rogue FortiGate registrations on FortiManager, unexpected auto-script objects with names like ../../..//setup, attacker C2 traffic to the PEERSTITCH IPs in the IoC library, and forensic gaps such as terminated syslog generation or cleared crash logs.

Trojanized Rank Math SEO PRO plugin backdoored WordPress sites (CVE-2026-111862)

Disclosed October 17, 2026 · Rank Math SEO PRO for WordPress · CVSS 9.8

Attackers compromised a subset of Rank Math SEO PRO 3.0.123 distribution packages served between October 15 at 20:02 UTC and October 16 at 07:12 UTC, embedding malware that executes on plugin activation. The backdoor beacons to a command-and-control domain at rank1cdn[.]com, plants hidden PHP backdoors, creates rogue administrator accounts, drops a fake WordPress core file and PHP-executable .cache files, registers a system cron marker, and harvests WordPress credentials, database passwords, and API keys. The vendor pulled the trojanized packages and released 3.0.124 as the clean replacement. Actively exploited in the wild.

Block rank1cdn[.]com at the edge and audit any site that fetched packages during the window even if activation happened later.

Vishing attack exposes 1.4 million patient records at Central Ohio Primary Care

Acknowledged October 15, 2026 · Central Ohio Primary Care · Attack discovered August 25, 2026

Central Ohio Primary Care, one of the largest primary care organizations in the United States, acknowledged on October 15 that an August cyberattack exposed protected health and personal information of more than 1.4 million current and former patients and employees. The intrusion began with vishing: a threat actor posing as a trusted source talked its way into unauthorized access to files containing protected health information, with no malware needed. COPC says the vishing was not directed at patients. Several class-action law firms investigating the breach say the Chaos ransomware group has taken credit, a claim that remains UNVERIFIED, and describe the group as known for Microsoft Teams vishing attacks.

The uncomfortable lesson: your helpdesk is a privileged attack surface. Rehearse this exact scenario, because the attackers needed no exploit here, just a convincing voice.

Microsoft-led takedown dismantles a billion-message phishing network: Storm-3119 and Storm-2990

Announced October 14-15, 2026 · Microsoft / Health-ISAC / JC3 and partners · Court-ordered seizure

Microsoft, Health-ISAC, Japan's Cybercrime Control Center (JC3), and partners including Resecurity, Cloudflare, Oracle, Proofpoint, and TRM Labs disrupted the YAM Store marketplace and the three Chinese-language phishing platforms behind it: CoGUI (also known as NX or FA), Haozi (also Phoenix), and Iron Man. Microsoft tracks the marketplace as Storm-3119 and the kit developers as Storm-2990, assessed with high confidence as Chinese-speaking actors, with no claim of state sponsorship. The kits have supported more than one billion messages since January 2026 against 75,000-plus organizations in 150 countries, with over 750 million aimed at Microsoft customers. Backed by a federal court order, Microsoft seized and redirected domains, disabled more than 20,000 accounts, and blocked over 100,000 fraud domains.

The TTP blueprint matters more than the takedown itself: device-code phishing to steal tokens, fake CAPTCHA gates, geofencing, IP filtering, and tenants rebuilt on expired domains to look legitimate. Expect the operators to rebuild: the 2,300-plus impersonation templates did not disappear with the domains.

Cisco email gateway zero-day: one malicious attachment to root (CVE-2026-76519)

Added to CISA KEV October 14, 2026 · Cisco Secure Email Gateway · Federal deadline October 17, 2026

Cisco disclosed CVE-2026-76519 on October 14: a relative path traversal in the Advanced Malware Protection feature of Secure Email Gateway that mishandles email attachments. An unauthenticated, remote attacker only has to send a crafted attachment through an unpatched appliance to write arbitrary files and run commands as root on the underlying OS. This is the second SEG zero-day Cisco has patched in a month, after CVE-2026-76461 in September, and CISA's new BOD 26-04 schedule gives federal agencies just three days to remediate, with the deadline set at October 17.

Hunt for Cisco's own self-check alerts ("Suspected compromise indicator was found"), and check firewall and network logs for unusual uploads or downloads to external IPs around your SEG boxes, because the attackers can wipe evidence once they have root. If Cisco contacted you about a potential compromise, rotate credentials and crypto material as the advisory directs.

PAN-OS management interface hands root to authenticated attackers (CVE-2026-0322)

Added to CISA KEV October 14, 2026 · Palo Alto Networks PAN-OS · Federal deadline October 17, 2026

Palo Alto Networks disclosed CVE-2026-0322 on October 14: a code injection flaw in the PAN-OS management interface that lets an authenticated attacker with network access execute arbitrary code as root on the firewall. The vendor reports "very limited exploitation" has already been observed, and CISA added it to the KEV catalog with a three-day federal remediation deadline of October 17 under the new BOD 26-04 schedule. Affected products are PA-Series and VM-Series firewalls and Panorama; Cloud NGFW and Prisma Access are not impacted.

Start with the obvious: the management interface should only be reachable from trusted internal IP addresses, per Palo Alto's own deployment guidance. Then audit management-plane logs for authenticated sessions you cannot explain, and treat any session from an untrusted IP as suspect.

Ivanti Connect Secure zero-day chain gives root without a login: CVE-2026-104935

Added to CISA KEV October 13, 2026 · Ivanti Connect Secure · Federal deadline October 16, 2026

An unknown actor Volexity tracks as UTA0576 chained three zero-days on Ivanti Connect Secure appliances to reach root code execution without a login: an authentication bypass in welcome.cgi, a file-write race in wu.cgi (both folded into CVE-2026-104935), and a privilege escalation through the dsinvoked broker that is still unpatched. Once in, the actor stole LDAP domain credentials, hunted Active Directory for LAPS administrator passwords and BitLocker recovery keys, and wiped entries from Ivanti debug logs and Linux audit logs.

This one is hard to detect because the actor never dropped a backdoor: it re-ran the full exploit chain for every command and only patched code in memory, which Ivanti's own Integrity Checker Tool cannot see.

October Patch Tuesday: an exploited zero-day steals Windows' download warnings (CVE-2026-96951)

Patched October 13, 2026 · Windows Shell · CVSS 8.8 · CISA KEV, federal deadline October 16, 2026

Microsoft fixed more than 1,400 flaws in this month's Patch Tuesday, and one was already being exploited in the wild: CVE-2026-96951, a Windows Shell command injection that bypasses Mark of the Web, the mechanism that flags files downloaded from the internet. Strip that flag and a malicious download loses its warnings and safety prompts when a user opens it. Microsoft says large language models drove this month's record volume of vulnerability discoveries.

Two other zero-days were publicly disclosed with no confirmed exploitation yet: CVE-2026-108398 (a .NET Framework bypass of Windows Defender Application Control, found by Google Project Zero's James Forshaw) and CVE-2026-92707 (a MessagePack-CSharp denial of service).

Microsoft rushed an Exchange fix before Patch Tuesday: CVE-2026-96940

Fixed out-of-band October 2, 2026 · Exchange Server · CVSS 8.8

Microsoft broke its normal patch rhythm on October 2 with an out-of-band Exchange Server update. CVE-2026-96940 is an elevation-of-privilege flaw (CVSS 8.8) that lets an authenticated attacker read other users' mailboxes inside the same organization. No exploitation has been observed yet, but Microsoft tagged it "Exploitation More Likely," which is the closest Redmond gets to saying weaponization is a matter of time.

Today's October Patch Tuesday is unusually quiet, so there is no excuse to skip this one. Note that Windows 11 24H2 Home and Pro also receive their final security update today, so plan the move to 26H2 or 25H2.

GitLab CVSS 10.0 RCE in CI/CD regex compiler: CVE-2026-97229

Disclosed October 12, 2026 · Added to CISA KEV October 29, 2026 · Self-managed GitLab CE/EE · CVSS 10.0

An integer overflow in GitLab's CI/CD Regular Expression Compiler lets an unauthenticated attacker run arbitrary code on the server via a crafted regular expression in a CI/CD configuration. Discovered by researcher joaxcar through GitLab's HackerOne program. A compromised GitLab server puts source code, pipeline secrets, and builds at risk, which makes this a supply-chain incident waiting to happen.

GitLab.com is already patched and Dedicated customers need no action. No confirmed exploitation yet and not in CISA KEV as of this morning, but unauthenticated RCE on internet-facing DevOps infrastructure does not stay unexploited for long.

Citrix NetScaler SAML memory overflow: CVE-2026-107406

Disclosed October 8, 2026 · NetScaler ADC/Gateway · CVSS 9.5

A memory overflow in NetScaler ADC and Gateway that can lead to remote code execution or denial of service. Only appliances configured as a SAML Service Provider or Identity Provider are affected. Citrix says it is not aware of exploitation, and CISA urged patching on October 9.

This is the third NetScaler patch round in under two weeks, after the September 27 zero-days (CVE-2026-88771, CVE-2026-88772) and the October 4 SAML zero-day (CVE-2026-88779). If you patched for the earlier rounds you are still affected: upgrade to 14.1-73.46+, 13.1-64.29+, or the corresponding FIPS builds.

Flax Typhoon: federal deadline passed, FBI seizes campaign infrastructure

KEV added October 8, 2026 · Federal deadline October 11, 2026 (expired)

The five CVEs tied to China-linked Flax Typhoon (CVE-2015-3306 ProFTPD, CVE-2015-5477 BIND, CVE-2016-3081 Apache Struts, CVE-2021-3199 ONLYOFFICE, CVE-2023-22894 Strapi) carried an October 11 federal remediation deadline. That date has passed. Separately, the FBI seized seven domains tied to the campaign's MicroScan scanner and FishHub spear-phishing malware: c0cc.cc, 98aicai.com, 98aicode.com, outlook3650.com, youtubecard.com, linkedinns.net, and 98aiblog.com. Several mimic Microsoft, LinkedIn, and YouTube branding.

Patching alone is not the ask here. CISA calls for forensic triage (log, shell, and credential review) on any exposed instances of all five products, not just a patch.

Ransomware groups exploiting Palo Alto VPN flaw: CVE-2026-0257

Reported October 11-12, 2026 · PAN-OS GlobalProtect / Prisma Access · CVSS 7.8

ReliaQuest reports Qilin and Settra ransomware groups are actively exploiting CVE-2026-0257, an authentication bypass in PAN-OS, five months after Palo Alto's May patch. Attackers establish unauthorized VPN sessions, then deploy Cobalt Strike, BloodHound, and SharpHound for domain-wide movement. The nasty part: they enter through your own VPN and look like legitimate remote workers, which delays detection. ReliaQuest expects attempts to continue for at least three months.

Flax Typhoon campaign: five exploited flaws, three-day federal deadline

Added to CISA KEV October 8, 2026 · Federal deadline October 11, 2026

A joint advisory from the US, UK, Canada, Australia, New Zealand, Japan, and Spain attributes active exploitation to actors tied to Integrity Technology Group, a China-based company. The five CVEs: CVE-2015-3306 (ProFTPD), CVE-2015-5477 (ISC BIND), CVE-2016-3081 (Apache Struts), CVE-2021-3199 (ONLYOFFICE Docs), CVE-2023-22894 (Strapi). Four date from 2015 to 2021. Patches have existed for years.

The lesson for defenders: the attackers do not need zero-days. They need you to leave internet-facing services unpatched.