CISA has added the Brotli vulnerability to the KEV list. While evidence of successful exploitation outside labs is scarce, we have detection opportunities in our thread.

https://ifin.network/t/cve-2026-111497-brotli-out-of-bounds-write-impacts-node-python/929

#ThreatIntel

POV: you just finished patching PHP2Shell

then node and python get one too

broccoli2shell, CVE-2026-111497, CVSS 9.2, an out-of-bounds write in google's brotli decoder. reported by openai's codex security

node 22.23.4 / 24.22.1 / 26.12.1
python Brotli 1.2.1, brotlicffi 1.2.1.0
then restart and rebuild images

https://github.com/advisories/GHSA-9v8h-qqgm-4m35

#InfoSec #NodeJS #Python #CVE

CVE-2026-11497 having a bit of an identity crisis…

- Imperva coined the initial term, “Node2Shell” (https://www.imperva.com/blog/node2shell-from-brotli-data-to-remote-code-execution/)
- Aikido tried to turn it into “HTTP2Shell” (https://www.aikido.dev/blog/python-packages-vulnerable-node2shell-brotli-cve-2026-111497)
- Not satisfied with either of those, someone came up with “Broccoli2Shell” 🥦 (https://broccoli2shell.com)
- And now, super late to the game, humorless Tenable has decided to label it “Brotli2Shell” (https://www.tenable.com/blog/brotli2shell-frequently-asked-questions-for-google-brotli-decoder-cve-2026-111497)

Same vuln, 4 different names (so far). Yeesh…

Node2Shell Brotli vuln (CVE-2026-111497) evolves to HTTP2Shell, as libraries and apps using HTTP are affected. #devopsish https://www.aikido.dev/blog/python-packages-vulnerable-node2shell-brotli-cve-2026-111497

You probably got into #cybersecurity because no two days look the same. This month is taking that a little too literally. 😅

So, yes, we created another new free scanner, this time for #HTTP2Shell: https://pentest-tools.com/network-vulnerability-scanning/http2shell-scanner

▶️ that's the same Brotli bug as #Node2Shell (aka CVE-2026-111497)
▶️ with a slightly wider blast radius
▶️ and with one element no external scanner can see.

We included a diagram of both inbound and outbound paths, fixed versions for every ecosystem, and temporary controls if you can’t patch today.

If this week has you running on coffee and advisories, you’re in good company. Know someone patching right now? Send them the link: https://pentest-tools.com/network-vulnerability-scanning/http2shell-scanner

#offensivesecurity #vulnerabilitymanagement #ethicalhacking

Microsoft released emergency updates for a severe Microsoft .NET Brotli vulnerability. Learn how to patch CVE-2026-111497 and secure your applications now.

#Microsoft #DotNet #Brotli #Cybersecurity #Imperva

https://dailytechnow.com/microsoft-dotnet-brotli-vulnerability/

Broadcom warns of a VMware SDDC Manager vulnerability, CVE-2026-111497 (CVSS 9.8), from the Node.js Brotli vulnerability. Patches pending.

#VMware #Broadcom #SDDCManager #VMwareCloudFoundation #Brotli #CVE2026111497 #NodeJS #RCE

https://securityonline.info/vmware-sddc-manager-vulnerability-cve-2026-111497/?utm_source=mastodon&utm_medium=jetpack_social

CISA adds node2shell (broccoli2shell?) CVE-2026-111497 (Google Brotli Unchecked Return Value) and Adobe Commerce/Magento unrestricted file upload CVE-2026-48356 to the KEV Catalog:

https://www.cisa.gov/news-events/alerts/2026/10/27/cisa-adds-two-known-exploited-vulnerabilities-catalog

#CISA #KEV #node2shell #broccoli2shell #brotli #Adobe #magento #CVE

CISA KEV catalog adds actively exploited Magento flaw CVE-2026-48356 and Brotli vulnerability CVE-2026-111497. Patch before November 10.

#CISA #KEV #Magento #AdobeCommerce #Brotli #CVE202648356 #CVE2026111497 #ActiveExploitation

https://securityonline.info/cisa-kev-magento-brotli-vulnerability/?utm_source=mastodon&utm_medium=jetpack_social

CISA added two vulnerabilities to its KEV catalog: CVE-2026-48356 (Adobe Commerce/Magento unrestricted file upload, CVSS 9.3) and CVE-2026-111497 (Google Brotli memory corruption, CVSS 9.2).

Sansec noted hundreds of online stores infected via PolyShell, while Wiz warns that 91% of cloud environments have resources exposed to the Brotli issue.

Multiple vendors including Node.js, PHP, have released patches.

https://en.hacks.gr/synagermos-stis-ipa-gia-dyo-sovara-provlimata-asfaleias-poy-axiopoioyntai-se-epitheseis/

#CISA #Magento #Brotli #NodeJS

PHP2Shell: CISA ha aggiunto CVE-2026-109618 e CVE-2026-109619 (RCE non autenticate, CVSS 9.2) al catalogo KEV, con scadenza per le agenzie FCEB giovedì 29/10. È la conferma ufficiale dello sfruttamento, dopo le 35 shell ottenute su honeypot Apache mod_php il 24/10 (Adel Karimi, Perplexity). Patch del 21/10: 8.5.12, 8.4.27, 8.3.36, 8.2.35. Su Windows verificare anche il rebuild per Brotli (CVE-2026-111497). https://www.bleepingcomputer.com/news/security/cisa-confirms-php2shell-vulnerabilities-now-exploited-in-attacks/ #infosec #PHP #threatintel

You. Had. One. Job.

https://nvd.nist.gov/vuln/detail/cve-2026-96760

Authlib (v1.7.2 and below) contains a signature verification bypass vulnerability. The JsonWebSignature.deserialize_json() method accepts a JSON Serialization JWS object and returns the payload as successfully verified without checking for a signature and without requiring a cryptographic key.

If you're using Python & authlib for a custom autosign solution, you should upgrade ASAP because you may be vulnerable to an authentication bypass in authlib. https://www.cve.org/CVERecord?id=CVE-2026-96760

An #Authlib signature bypass #vulnerability (CVE-2026-96760, CVE-2026-28802, CVE-2026-27962) lets attackers forge #JWS payloads.

Update libraries ASAP!.

#OSS #Authlib #CVE #Cybersecurity #security

Citrix finally released Netscaler patches for PHP2Shell. Netscaler notably has no ASLR so I’d recommend patching.

https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697263&articleTitle=Citrix_Security_Advisory_for_CVE_2026_109618_and_CVE_2026_109619

Here's a snapshot of the latest global developments:

Last 24 hrs: Critical PHP2Shell flaws (CVE-2026-109618/19) are actively exploited, CISA urges immediate patching. North Korea's Lazarus Group deploys post-quantum crypto malware in South Korea. An Alibaba AI model showed unexpected data upload attempts during security tests. OpenAI announced GPT-6 with quantum-logic AI, and Apple updated iPad mini with A20 Pro and Siri AI. Israeli elections are underway amid heightened Iran tensions.

#Cybersecurity #TechNews #Geopolitics

🚨🇺🇸 CISA confirms critical PHP2Shell flaws are now being exploited in attacks

CISA has added CVE-2026-109618 and CVE-2026-109619 to its Known Exploited Vulnerabilities catalog after confirming active exploitation.
⠀
Known collectively as PHP2Shell, the two memory corruption flaws can allow an unauthenticated attacker to remotely execute code on PHP systems serving web requests.

Affected configurations include PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. The PHP team considers mod_php installations at the highest risk.
⠀
Both vulnerabilities have a CVSS 4.0 score of 9.2.

Fixed versions:

• PHP 8.5.12
• PHP 8.4.27
• PHP 8.3.36
• PHP 8.2.35
⠀
CISA has ordered U.S. federal agencies to remediate the vulnerabilities by October 29.

The PHP team says there are no complete mitigations and that updating is the only safe solution.

Source: https://www.cisa.gov/news-events/alerts/2026/10/26/cisa-adds-two-known-exploited-vulnerabilities-catalog

CISA added CVE-2026-109618 and CVE-2026-109619 to the Known Exploited Vulnerabilities list on Monday night

But the federal cyber defense agency implied in comments to The Record that the PHP2Shell bugs were added because of attempts instead of successful exploitation

https://therecord.media/php-vulnerabilities-cisa-kev

🚨🇱🇰 Barista Sri Lanka allegedly breached through PHP vulnerabilities, customer information exposed

Barista, one of Sri Lanka's largest café chains with more than 100 outlets, has been targeted by an actor using the handle "secret_solder".

The actor claims to have gained unauthorized server access by exploiting PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619, allegedly achieving remote code execution without authentication.

According to the post, the server was running an outdated PHP 8.1.34 installation with exposed configuration details.

The actor also claims to have extracted customer names, email addresses, phone numbers, and delivery addresses from server memory.

A sample containing customer names and phone numbers was published. The intrusion and vulnerability claims remain independently unverified.

💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing

"Responder Guidance for PHP2Shell (CVE-2026-109618 and CVE-2026-109619)":

https://bishopfox.com/blog/responder-guidance-for-php2shell

#PHP2Shell is a critical wake-up call. Two #PHP flaws (CVE-2026-109618 & CVE-2026-109619), both CVSS 9.2, can enable unauthenticated remote code execution. If you run PHP, don’t wait. Assess exposure, patch now & verify your fixes. HT @PicusSecurity https://cybersec.picussecurity.com/s/php2shell-critical-php-rce-flaws-cve-2026-109618-cve-2026-109619-explained-30169

PHP2Shell: CISA ha aggiunto CVE-2026-109618 e CVE-2026-109619 (RCE non autenticate, CVSS 9.2) al catalogo KEV, con scadenza per le agenzie FCEB giovedì 29/10. È la conferma ufficiale dello sfruttamento, dopo le 35 shell ottenute su honeypot Apache mod_php il 24/10 (Adel Karimi, Perplexity). Patch del 21/10: 8.5.12, 8.4.27, 8.3.36, 8.2.35. Su Windows verificare anche il rebuild per Brotli (CVE-2026-111497). https://www.bleepingcomputer.com/news/security/cisa-confirms-php2shell-vulnerabilities-now-exploited-in-attacks/ #infosec #PHP #threatintel

Citrix finally released Netscaler patches for PHP2Shell. Netscaler notably has no ASLR so I’d recommend patching.

https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697263&articleTitle=Citrix_Security_Advisory_for_CVE_2026_109618_and_CVE_2026_109619

🚨🇺🇸 CISA confirms critical PHP2Shell flaws are now being exploited in attacks

CISA has added CVE-2026-109618 and CVE-2026-109619 to its Known Exploited Vulnerabilities catalog after confirming active exploitation.
⠀
Known collectively as PHP2Shell, the two memory corruption flaws can allow an unauthenticated attacker to remotely execute code on PHP systems serving web requests.

Affected configurations include PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. The PHP team considers mod_php installations at the highest risk.
⠀
Both vulnerabilities have a CVSS 4.0 score of 9.2.

Fixed versions:

• PHP 8.5.12
• PHP 8.4.27
• PHP 8.3.36
• PHP 8.2.35
⠀
CISA has ordered U.S. federal agencies to remediate the vulnerabilities by October 29.

The PHP team says there are no complete mitigations and that updating is the only safe solution.

Source: https://www.cisa.gov/news-events/alerts/2026/10/26/cisa-adds-two-known-exploited-vulnerabilities-catalog

CISA added CVE-2026-109618 and CVE-2026-109619 to the Known Exploited Vulnerabilities list on Monday night

But the federal cyber defense agency implied in comments to The Record that the PHP2Shell bugs were added because of attempts instead of successful exploitation

https://therecord.media/php-vulnerabilities-cisa-kev

🚨🇱🇰 Barista Sri Lanka allegedly breached through PHP vulnerabilities, customer information exposed

Barista, one of Sri Lanka's largest café chains with more than 100 outlets, has been targeted by an actor using the handle "secret_solder".

The actor claims to have gained unauthorized server access by exploiting PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619, allegedly achieving remote code execution without authentication.

According to the post, the server was running an outdated PHP 8.1.34 installation with exposed configuration details.

The actor also claims to have extracted customer names, email addresses, phone numbers, and delivery addresses from server memory.

A sample containing customer names and phone numbers was published. The intrusion and vulnerability claims remain independently unverified.

💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing

"Responder Guidance for PHP2Shell (CVE-2026-109618 and CVE-2026-109619)":

https://bishopfox.com/blog/responder-guidance-for-php2shell

#PHP2Shell is a critical wake-up call. Two #PHP flaws (CVE-2026-109618 & CVE-2026-109619), both CVSS 9.2, can enable unauthenticated remote code execution. If you run PHP, don’t wait. Assess exposure, patch now & verify your fixes. HT @PicusSecurity https://cybersec.picussecurity.com/s/php2shell-critical-php-rce-flaws-cve-2026-109618-cve-2026-109619-explained-30169

PHP2Shell: CISA ha aggiunto CVE-2026-109618 e CVE-2026-109619 (RCE non autenticate, CVSS 9.2) al catalogo KEV, con scadenza per le agenzie FCEB giovedì 29/10. È la conferma ufficiale dello sfruttamento, dopo le 35 shell ottenute su honeypot Apache mod_php il 24/10 (Adel Karimi, Perplexity). Patch del 21/10: 8.5.12, 8.4.27, 8.3.36, 8.2.35. Su Windows verificare anche il rebuild per Brotli (CVE-2026-111497). https://www.bleepingcomputer.com/news/security/cisa-confirms-php2shell-vulnerabilities-now-exploited-in-attacks/ #infosec #PHP #threatintel

CVE-2026-97631 has a severity rating of 9.5/10. The memory-corruption flaw is in the ICMP component of TianoCore EDK II’s PXE-Base Code driver. It affects servers, storage equipment and devices using EDK II with PXE enabled to boot from a local network.

The flaw can allow malicious code to run early in the boot process, before Secure Boot and TPM defenses load. Exploitation requires low-level local-network or insider access;…

https://en.hacks.gr/sovaro-provlima-asfaleias-se-logismiko-ekkinisis-epaggelmatikon-systimaton-pagkosmios/

#EDKII #PXE #UEFIFirmware #MemoryCorruption

Yet another forever day

CVE-2026-97631 joins a long list of previously discovered vulnerabilities in UEFI or code that works closely with it.

Know now that laughing because all my devices have been on BIOS Boot for years is appropriate.

🚨🇺🇸 Microsoft Authenticator flaw allowed malicious Android apps to steal work account tokens

Tracked as CVE-2026-80097, the high-severity vulnerability allowed an Android app with no permissions to impersonate trusted Microsoft apps such as Teams and request tokens for a work account signed into Authenticator.
⠀
Researchers demonstrated that the stolen tokens could provide access to:

• Email and the ability to send messages
• Files stored in Microsoft services
• Calendars and Teams chats
• Authentication methods and passkey management
⠀
The flaw existed because Authenticator trusted identity information supplied by the requesting app instead of confirming which app actually made the request.
⠀
Microsoft rates the vulnerability 8.6 and says exploitation requires a malicious app on the device and user interaction during authentication. However, researchers reported obtaining tokens without further interaction when a work account was already signed in.
⠀
Microsoft says it has found no evidence of exploitation. The issue affects Authenticator for Android versions before 6.2606.4246.

Users should update to version 6.2606.4246 or later.

Source: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-80097

Microsoft addressed a security flaw in Authenticator for Android, tracked as CVE-2026-80097, that allowed a malicious app without special permissions to impersonate trusted apps like Teams and harvest work account sign-in tokens.

The vulnerability stems from an exposed component, AccountChooserActivity, where a signature check failed when Teams was installed.

Researchers tested that tokens granted full access to email,…

https://en.hacks.gr/i-microsoft-diorthonei-sovaro-provlima-sto-authenticator-gia-android-poy-afine-efarmoges-na-klepsoyn-psifiaka-kleidia/

#Microsoft #Android #Authenticator #CVE202680097

Microsoft tracks the flaw as CVE-2026-80097 and fixed it in Authenticator for Android version 6.2606.4246, so anyone using the app should update. https://thehackernews.com/2026/10/microsoft-authenticator-flaw-let.html

A severe Microsoft Authenticator vulnerability on Android allowed rogue apps to steal access tokens. Learn how CVE-2026-80097 was patched and secure devices.

#MicrosoftAuthenticator #Cybersecurity #Android #CVE202680097 #InfoSec

https://dailytechnow.com/microsoft-authenticator-vulnerability-patched/

RE: https://infosec.exchange/@AmmarSpaces/117316856064853890

Turns out, the vulnerabilities exploited by ShinyHunters at Oracle's Peoplesoft software are not a single flaw, but a chain of 3 flaws.

Full chain writeup:
https://www.zerodayinitiative.com/blog/2026/10/20/cve-2026-35273-ssrf-to-rce-in-oracle-peoplesoft

#cybersecurity #infosec #vulnerability #Oracle #Peoplesoft

CVE-2026-35273: SSRF to RCE in Oracle PeopleSoft. ZDI's Bobby Gould provides a deep dive into the bug(s) used in the recent PeopleSoft attacks. His analysis includes root cause and video demo. https://www.zerodayinitiative.com/blog/2026/10/20/cve-2026-35273-ssrf-to-rce-in-oracle-peoplesoft

CVE-2026-35273: SSRF to RCE in Oracle PeopleSoft https://www.thezdi.com/blog/2026/10/20/cve-2026-35273-ssrf-to-rce-in-oracle-peoplesoft

Research into Oracle PeopleSoft Enterprise PeopleTools versions 8.61 and 8.62 revealed that the security advisory tracked as CVE-2026-35273 actually involves three chained flaws rather than a single vulnerability.

Threat intelligence reports attribute exploitation waves to UNC6240, known as ShinyHunters, affecting multiple global sectors.

https://en.hacks.gr/pos-oi-shinyhunters-chtypisan-systimata-panepistimion-kai-etaireion/

#Oracle #PeopleSoft #Vulnerability #Patch

Apple has backported security fixes to older devices, releasing iOS and iPadOS 18.7.11.

The updates address a high-severity CoreGraphics out-of-bounds write flaw tracked as CVE-2026-86950, along with an Audio logic issue and a CoreMedia access vulnerability that could allow unauthorized camera access.

Additionally, Apple shipped a broad wave of updates across its ecosystem, patching hundreds of security defects.

https://en.hacks.gr/i-apple-kykloforei-enimeroseis-asfaleias-gia-palaiotera-iphone-kai-ipad/

#Apple #iOS #iPadOS #CVE

🚨 Apple patches a possibly exploited CoreGraphics flaw on older iPhones and iPads.

CVE-2026-86950 could allow arbitrary code execution. Apple says it may have been used in targeted attacks against specific individuals.

The fix is now available in iOS 18.7.11 and iPadOS 18.7.11.

Details → https://thehackernews.com/2026/10/apple-backports-fix-for-exploited.html

Apple aktualisiert alles 2026-10

Puh - das hat ja gerade noch vor Ende des Monats geklappt! Im Oktober veröffentlicht Apple Flicken gegen 304 Sicherheitslücken. Die Zahl ist recht hoch, aber bleibt im Rahmen (anders als MS). Die CVE-2026-86950, die als bereits ausgenutzt bekannt ist, wurde jetzt endlich auch für das ältere iOS 18 geflickt. Die neueren (26 und 27) waren ja schon vor einem Monat abgesichert worden. Wer ein so altes System (18) verwendet, muss halt damit leben, einen Monat länger ungeschützt angreifbar zu sein - ja und? Zwei weitere Sicherheitslücken sind "interessant": CVE-2026-86990 erlaubt es Apps, unerkannt und ohne Erlaubnis die Kamera zu benutzen; ... Weiterlesen:

https://www.pc-fluesterer.info/wordpress/2026/10/27/apple-aktualisiert-alles-2026-10/

#zeroday #apple #ios #macos #sicherheit #smartphone #UnplugApple #UnplugTrump

Apple Patches for October 2026, (Mon, Oct 26th)

Apple has released its October 2026 security updates, covering 304 vulnerabilities across iOS, iPadOS, macOS, tvOS, watchOS, visionOS and Safari, according to the SANS Internet Storm Center. No new vulnerability in this release is marked as already exploited, but the update delivers iOS 18 patches for CVE-2026-86950, an already-exploited CoreGraphics flaw first patched a month ago; other notable fixes include CVE-2026-86990, which let a malicious app access the camera without permission, and CVE-2026-28864, which let a local attacker access a user’s Keychain items. https://isc.sans.edu/diary/rss/33458

Apple załatało 329 unikalnych luk w zabezpieczeniach – co warto wiedzieć?

Wraz z premierą systemów z rodziny 27.2 Apple załatało co najmniej 329 unikalnych luk bezpieczeństwa, a na iPhone’ach i iPadach ponad 160. Wśród poprawek są dostęp do kamery bez zgody, wyciek danych z Apple Intelligence i błąd Hide My Email. Poniżej lista aktualizacji.

Wydanie systemów 27.2 przyniosło nie tylko nowości, ale też rekordowo długą listę poprawek bezpieczeństwa. Jak podaje 9to5Mac, Apple zaktualizowało stronę z informacjami o zabezpieczeniach i wyliczyło w sumie 329 unikalnych luk, które wiele systemów dzieli ze sobą, co daje łącznie 1265 wpisów CVE. Liczby mogą jeszcze wzrosnąć, bo Apple regularnie uzupełnia swoje biuletyny po ich publikacji.

Które aktualizacje dotyczą zabezpieczeń?

W powyższej tabeli odsyłamy do dokumentów Wsparcia Apple w języku angielskim, ponieważ ich polskojęzyczne wersje pojawiają się z opóźnieniem.

Co zostało załatane?

Według 9to5Mac wśród najważniejszych poprawek jest błąd w CoreMedia, który pozwalał złośliwej aplikacji uzyskać dostęp do kamery na iPhonie, iPadzie, Macu lub Apple Vision Pro bez zgody użytkownika (CVE-2026-86990), oraz luka w Apple Intelligence umożliwiająca zdalnemu atakującemu dostęp do wrażliwych danych na obsługiwanych iPhone’ach i iPadach (CVE-2026-86987). Apple załatało też lukę w Siri na macOS Tahoe, pozwalającą aplikacji dotrzeć do wrażliwych danych (CVE-2026-43736), oraz kilka błędów w WebKit, przez które spreparowana strona mogła wykonać dowolny kod.

MacRumors skupia się na iOS i iPadOS 27.2, w których poprawiono ponad 160 luk. Poza błędem w Apple Intelligence naprawiono także usterkę w Hide My Email, która mogła ujawniać prawdziwy adres e-mail użytkownika. Są też ponad 30 poprawek w WebKit i około 15 w jądrze systemu. Sześć wpisów CVE przypisano zespołowi Calif, który w dniu premiery zdołał włamać się do iPhone’a Duo i pokazał jailbreak iOS 27.0.1 bez konieczności ponownego uruchamiania. Stefan Esser z tego zespołu mówił niedawno, że „większość” luk użytych w jailbreaku jest naprawiona w iOS 27.2.

Apple nie podało, by którakolwiek z luk była aktywnie wykorzystywana, ale MacRumors przypomina, że po publikacji szczegółów nieaktualizowane urządzenia mogą stać się celem ataków, więc aktualizację warto zainstalować jak najszybciej. Użytkownicy, którzy nie przeszli jeszcze na iOS 27, mogą zainstalować iOS 26.7.2, który zawiera wiele z tych samych poprawek.

Starsze iPhone’y

Ciekawy jest też wątek starszych urządzeń. Do iOS i iPadOS 18 trafiła poprawka w CoreGraphics (CVE-2026-86950), która pozwalała spreparowanemu plikowi wywołać wykonanie dowolnego kodu. Apple naprawiło ją po raz pierwszy we wcześniejszych aktualizacjach, ostrzegając, że mogła zostać wykorzystana w niezwykle wyrafinowanym ataku na wybrane osoby korzystające z wersji iOS sprzed 27. Wcześniej w tym roku Apple łatało też luki wykorzystywane przez zestawy exploitów Coruna i DarkSword, które w łańcuchach ataków używały błędów w WebKit i infekowały iPhone’y ze starszymi wersjami iOS.

AI pomaga znajdować luki

Rosnąca liczba poprawek ma związek z tym, że modele AI coraz lepiej wyszukują podatności. 9to5Mac zauważa, że Apple od miesięcy łata WebKit w tempie, które częściowo wynika z użycia narzędzi AI, a w dzisiejszych aktualizacjach docenia zarówno takie narzędzia, jak i zespoły badawcze. Według MacRumors Anthropic Research jest wymienione przy trzech poprawkach, a OpenAI przy czterech.

Co z tego wynika?

Praktyczny wniosek jest prosty: kto jeszcze nie zainstalował wersji 27.2 (lub odpowiednika dla swojego systemu), powinien to zrobić. A dla tych, którzy nie chcą przechodzić na nowe systemy, Apple przygotowało równoległe wydania z łatami: iOS 26.7.2, macOS Tahoe 26.7.2 i macOS Sequoia 15.8.2.

Aktualizacje systemów do wersji 27.2

"PwnEscape" CVE-2026-99999, severity critical, disclosed October 15th, and #Ubuntu is once again still dragging their feet. "Ubuntu Priority: Medium"

smh

https://ubuntu.com/security/CVE-2026-99999

Hey gang, the #infosec datascape is on fire again. And do *you* have any #IoT devices?

Critical vulnerabilities were disclosed in the #GoAhead embedded web server, affecting devices from major manufacturers like Palo Alto Networks, #Siemens, and #Boeing. The vulnerability impacts hundreds of millions of IoT, industrial control, and network devices, as many vendors have not yet issued firmware updates to address these specific flaws.

The most severe flaw, CVE-2026-115881 (CVSS 9.1), allows revoked client certificates to bypass security checks in OpenSSL, a critical risk for mutual-TLS (mTLS) configurations.

Also a weak key exchange in the Mbed TLS backend (CVSS 5.9) that can enable passive session decryption, and a certificate chain bypass in LibreSSL builds (CVSS 7.4).

Additionally, a login bypass vulnerability allows authentication with any password if the user's password is stored in the newer Blowfish format.

https://cybersecuritynews.com/goahead-tls-vulnerabilities/

GoAhead embedded web server version 6.1.1 fixes 11 advisories, including a critical OpenSSL revocation check bypass tracked as CVE-2026-115881 and rated 9.1.

The server loaded certificate revocation lists into its default TLS backend but never enabled checking, allowing revoked client certificates to pass login on mutual-TLS setups.

Mbed TLS builds are unaffected.

A LibreSSL legacy verifier issue (CVE-2026-115884) is als…

https://en.hacks.gr/sovara-provlimata-asfaleias-se-ekatommyria-syskeyes-logo-logismikoy-goahead/

#GoAhead #OpenSSL #CVE_2026_115881 #EmbedThis