CISA has added the Brotli vulnerability to the KEV list. While evidence of successful exploitation outside labs is scarce, we have detection opportunities in our thread.

https://ifin.network/t/cve-2026-111497-brotli-out-of-bounds-write-impacts-node-python/929

#ThreatIntel

POV: you just finished patching PHP2Shell

then node and python get one too

broccoli2shell, CVE-2026-111497, CVSS 9.2, an out-of-bounds write in google's brotli decoder. reported by openai's codex security

node 22.23.4 / 24.22.1 / 26.12.1
python Brotli 1.2.1, brotlicffi 1.2.1.0
then restart and rebuild images

https://github.com/advisories/GHSA-9v8h-qqgm-4m35

#InfoSec #NodeJS #Python #CVE

CVE-2026-11497 having a bit of an identity crisis…

- Imperva coined the initial term, “Node2Shell” (https://www.imperva.com/blog/node2shell-from-brotli-data-to-remote-code-execution/)
- Aikido tried to turn it into “HTTP2Shell” (https://www.aikido.dev/blog/python-packages-vulnerable-node2shell-brotli-cve-2026-111497)
- Not satisfied with either of those, someone came up with “Broccoli2Shell” 🥦 (https://broccoli2shell.com)
- And now, super late to the game, humorless Tenable has decided to label it “Brotli2Shell” (https://www.tenable.com/blog/brotli2shell-frequently-asked-questions-for-google-brotli-decoder-cve-2026-111497)

Same vuln, 4 different names (so far). Yeesh…

Node2Shell Brotli vuln (CVE-2026-111497) evolves to HTTP2Shell, as libraries and apps using HTTP are affected. #devopsish https://www.aikido.dev/blog/python-packages-vulnerable-node2shell-brotli-cve-2026-111497

Microsoft patched the .NET Brotli vulnerability across .NET 8, 9, 10, and 11 RC3 to prevent memory corruption and potential denial of service attacks.

#DotNet #Brotli #CVE2026111497 #Cybersecurity #AppSec

https://meterpreter.org/dotnet-brotli-vulnerability-patch/?utm_source=mastodon&utm_medium=jetpack_social

You probably got into #cybersecurity because no two days look the same. This month is taking that a little too literally. 😅

So, yes, we created another new free scanner, this time for #HTTP2Shell: https://pentest-tools.com/network-vulnerability-scanning/http2shell-scanner

▶️ that's the same Brotli bug as #Node2Shell (aka CVE-2026-111497)
▶️ with a slightly wider blast radius
▶️ and with one element no external scanner can see.

We included a diagram of both inbound and outbound paths, fixed versions for every ecosystem, and temporary controls if you can’t patch today.

If this week has you running on coffee and advisories, you’re in good company. Know someone patching right now? Send them the link: https://pentest-tools.com/network-vulnerability-scanning/http2shell-scanner

#offensivesecurity #vulnerabilitymanagement #ethicalhacking

Microsoft released emergency updates for a severe Microsoft .NET Brotli vulnerability. Learn how to patch CVE-2026-111497 and secure your applications now.

#Microsoft #DotNet #Brotli #Cybersecurity #Imperva

https://dailytechnow.com/microsoft-dotnet-brotli-vulnerability/

Broadcom warns of a VMware SDDC Manager vulnerability, CVE-2026-111497 (CVSS 9.8), from the Node.js Brotli vulnerability. Patches pending.

#VMware #Broadcom #SDDCManager #VMwareCloudFoundation #Brotli #CVE2026111497 #NodeJS #RCE

https://securityonline.info/vmware-sddc-manager-vulnerability-cve-2026-111497/?utm_source=mastodon&utm_medium=jetpack_social

CISA adds node2shell (broccoli2shell?) CVE-2026-111497 (Google Brotli Unchecked Return Value) and Adobe Commerce/Magento unrestricted file upload CVE-2026-48356 to the KEV Catalog:

https://www.cisa.gov/news-events/alerts/2026/10/27/cisa-adds-two-known-exploited-vulnerabilities-catalog

#CISA #KEV #node2shell #broccoli2shell #brotli #Adobe #magento #CVE

CISA KEV catalog adds actively exploited Magento flaw CVE-2026-48356 and Brotli vulnerability CVE-2026-111497. Patch before November 10.

#CISA #KEV #Magento #AdobeCommerce #Brotli #CVE202648356 #CVE2026111497 #ActiveExploitation

https://securityonline.info/cisa-kev-magento-brotli-vulnerability/?utm_source=mastodon&utm_medium=jetpack_social

You. Had. One. Job.

https://nvd.nist.gov/vuln/detail/cve-2026-96760

Authlib (v1.7.2 and below) contains a signature verification bypass vulnerability. The JsonWebSignature.deserialize_json() method accepts a JSON Serialization JWS object and returns the payload as successfully verified without checking for a signature and without requiring a cryptographic key.

If you're using Python & authlib for a custom autosign solution, you should upgrade ASAP because you may be vulnerable to an authentication bypass in authlib. https://www.cve.org/CVERecord?id=CVE-2026-96760

An #Authlib signature bypass #vulnerability (CVE-2026-96760, CVE-2026-28802, CVE-2026-27962) lets attackers forge #JWS payloads.

Update libraries ASAP!.

#OSS #Authlib #CVE #Cybersecurity #security

Citrix finally released Netscaler patches for PHP2Shell. Netscaler notably has no ASLR so I’d recommend patching.

https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697263&articleTitle=Citrix_Security_Advisory_for_CVE_2026_109618_and_CVE_2026_109619

PHP2Shell, nuovo sviluppo: prima RCE riuscita in the wild confermata su honeypot. Adel Karimi (Perplexity): 35 shell il 24/10 su tre honeypot Apache mod_php, PHP 8.4.26, catena di 4 richieste coerente con la PoC pubblica di CVE-2026-109618. Setup single-worker favorevole, nessun payload di secondo stadio, nessuna compromissione di produzione confermata. Fix 8.5.12, 8.4.27, 8.3.36, 8.2.35; in attesa session.upload_progress.enabled=0. https://www.bleepingcomputer.com/news/security/php2shell-security-flaws-now-sucessfully-exploited-in-the-wild/ #infosec #PHP

Here's a snapshot of the latest global developments:

Last 24 hrs: Critical PHP2Shell flaws (CVE-2026-109618/19) are actively exploited, CISA urges immediate patching. North Korea's Lazarus Group deploys post-quantum crypto malware in South Korea. An Alibaba AI model showed unexpected data upload attempts during security tests. OpenAI announced GPT-6 with quantum-logic AI, and Apple updated iPad mini with A20 Pro and Siri AI. Israeli elections are underway amid heightened Iran tensions.

#Cybersecurity #TechNews #Geopolitics

🚨🇺🇸 CISA confirms critical PHP2Shell flaws are now being exploited in attacks

CISA has added CVE-2026-109618 and CVE-2026-109619 to its Known Exploited Vulnerabilities catalog after confirming active exploitation.
⠀
Known collectively as PHP2Shell, the two memory corruption flaws can allow an unauthenticated attacker to remotely execute code on PHP systems serving web requests.

Affected configurations include PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. The PHP team considers mod_php installations at the highest risk.
⠀
Both vulnerabilities have a CVSS 4.0 score of 9.2.

Fixed versions:

• PHP 8.5.12
• PHP 8.4.27
• PHP 8.3.36
• PHP 8.2.35
⠀
CISA has ordered U.S. federal agencies to remediate the vulnerabilities by October 29.

The PHP team says there are no complete mitigations and that updating is the only safe solution.

Source: https://www.cisa.gov/news-events/alerts/2026/10/26/cisa-adds-two-known-exploited-vulnerabilities-catalog

CISA added CVE-2026-109618 and CVE-2026-109619 to the Known Exploited Vulnerabilities list on Monday night

But the federal cyber defense agency implied in comments to The Record that the PHP2Shell bugs were added because of attempts instead of successful exploitation

https://therecord.media/php-vulnerabilities-cisa-kev

"Responder Guidance for PHP2Shell (CVE-2026-109618 and CVE-2026-109619)":

https://bishopfox.com/blog/responder-guidance-for-php2shell

A CVSS score can be a useful starting point, but never the whole story.

https://cybersec.picussecurity.com/s/php2shell-critical-php-rce-flaws-cve-2026-109618-cve-2026-109619-explained-30158

CISA Confirms Active Exploitation of Two PHP2Shell Flaws Enabling Remote Code Execution

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday added the two PHP2Shell flaws, CVE-2026-109618 and CVE-2026-109619, to its Known Exploited Vulnerabilities catalog, confirming active exploitation of the unauthenticated remote code execution vulnerabilities, both rated CVSS 9.2. The flaws were fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 on October 21, federal agencies have until October 29 to apply the fixes, and Censys estimates more than 32.5 million PHP services are still running an affected version. https://thehackernews.com/2026/10/cisa-confirms-active-exploitation-of.html

#PHP2Shell is a critical wake-up call. Two #PHP flaws (CVE-2026-109618 & CVE-2026-109619), both CVSS 9.2, can enable unauthenticated remote code execution. If you run PHP, don’t wait. Assess exposure, patch now & verify your fixes. HT @PicusSecurity https://cybersec.picussecurity.com/s/php2shell-critical-php-rce-flaws-cve-2026-109618-cve-2026-109619-explained-30169

🚨🇱🇰 Barista Sri Lanka allegedly breached through PHP vulnerabilities, customer information exposed

Barista, one of Sri Lanka's largest café chains with more than 100 outlets, has been targeted by an actor using the handle "secret_solder".

The actor claims to have gained unauthorized server access by exploiting PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619, allegedly achieving remote code execution without authentication.

According to the post, the server was running an outdated PHP 8.1.34 installation with exposed configuration details.

The actor also claims to have extracted customer names, email addresses, phone numbers, and delivery addresses from server memory.

A sample containing customer names and phone numbers was published. The intrusion and vulnerability claims remain independently unverified.

💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing

Citrix finally released Netscaler patches for PHP2Shell. Netscaler notably has no ASLR so I’d recommend patching.

https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697263&articleTitle=Citrix_Security_Advisory_for_CVE_2026_109618_and_CVE_2026_109619

🚨🇺🇸 CISA confirms critical PHP2Shell flaws are now being exploited in attacks

CISA has added CVE-2026-109618 and CVE-2026-109619 to its Known Exploited Vulnerabilities catalog after confirming active exploitation.
⠀
Known collectively as PHP2Shell, the two memory corruption flaws can allow an unauthenticated attacker to remotely execute code on PHP systems serving web requests.

Affected configurations include PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. The PHP team considers mod_php installations at the highest risk.
⠀
Both vulnerabilities have a CVSS 4.0 score of 9.2.

Fixed versions:

• PHP 8.5.12
• PHP 8.4.27
• PHP 8.3.36
• PHP 8.2.35
⠀
CISA has ordered U.S. federal agencies to remediate the vulnerabilities by October 29.

The PHP team says there are no complete mitigations and that updating is the only safe solution.

Source: https://www.cisa.gov/news-events/alerts/2026/10/26/cisa-adds-two-known-exploited-vulnerabilities-catalog

CISA added CVE-2026-109618 and CVE-2026-109619 to the Known Exploited Vulnerabilities list on Monday night

But the federal cyber defense agency implied in comments to The Record that the PHP2Shell bugs were added because of attempts instead of successful exploitation

https://therecord.media/php-vulnerabilities-cisa-kev

"Responder Guidance for PHP2Shell (CVE-2026-109618 and CVE-2026-109619)":

https://bishopfox.com/blog/responder-guidance-for-php2shell

A CVSS score can be a useful starting point, but never the whole story.

https://cybersec.picussecurity.com/s/php2shell-critical-php-rce-flaws-cve-2026-109618-cve-2026-109619-explained-30158

CISA Confirms Active Exploitation of Two PHP2Shell Flaws Enabling Remote Code Execution

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday added the two PHP2Shell flaws, CVE-2026-109618 and CVE-2026-109619, to its Known Exploited Vulnerabilities catalog, confirming active exploitation of the unauthenticated remote code execution vulnerabilities, both rated CVSS 9.2. The flaws were fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 on October 21, federal agencies have until October 29 to apply the fixes, and Censys estimates more than 32.5 million PHP services are still running an affected version. https://thehackernews.com/2026/10/cisa-confirms-active-exploitation-of.html

#PHP2Shell is a critical wake-up call. Two #PHP flaws (CVE-2026-109618 & CVE-2026-109619), both CVSS 9.2, can enable unauthenticated remote code execution. If you run PHP, don’t wait. Assess exposure, patch now & verify your fixes. HT @PicusSecurity https://cybersec.picussecurity.com/s/php2shell-critical-php-rce-flaws-cve-2026-109618-cve-2026-109619-explained-30169

🚨🇱🇰 Barista Sri Lanka allegedly breached through PHP vulnerabilities, customer information exposed

Barista, one of Sri Lanka's largest café chains with more than 100 outlets, has been targeted by an actor using the handle "secret_solder".

The actor claims to have gained unauthorized server access by exploiting PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619, allegedly achieving remote code execution without authentication.

According to the post, the server was running an outdated PHP 8.1.34 installation with exposed configuration details.

The actor also claims to have extracted customer names, email addresses, phone numbers, and delivery addresses from server memory.

A sample containing customer names and phone numbers was published. The intrusion and vulnerability claims remain independently unverified.

💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing

🚨🇺🇸 Microsoft Authenticator flaw allowed malicious Android apps to steal work account tokens

Tracked as CVE-2026-80097, the high-severity vulnerability allowed an Android app with no permissions to impersonate trusted Microsoft apps such as Teams and request tokens for a work account signed into Authenticator.
⠀
Researchers demonstrated that the stolen tokens could provide access to:

• Email and the ability to send messages
• Files stored in Microsoft services
• Calendars and Teams chats
• Authentication methods and passkey management
⠀
The flaw existed because Authenticator trusted identity information supplied by the requesting app instead of confirming which app actually made the request.
⠀
Microsoft rates the vulnerability 8.6 and says exploitation requires a malicious app on the device and user interaction during authentication. However, researchers reported obtaining tokens without further interaction when a work account was already signed in.
⠀
Microsoft says it has found no evidence of exploitation. The issue affects Authenticator for Android versions before 6.2606.4246.

Users should update to version 6.2606.4246 or later.

Source: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-80097

Microsoft Authenticator vulnerability let rogue Android apps steal work account access

A vulnerability in Microsoft Authenticator for Android, tracked as CVE-2026-80097 and rated CVSS 8.6, let any app on a phone impersonate apps such as Teams or Outlook and silently obtain tokens for the victim’s work account, researchers at Enclave found. The tokens could be used to read and send email, access files and SharePoint, send Teams messages and even add new passkeys; Microsoft has fixed the flaw, and users should update to Authenticator version 6.2606.4246 or later. https://www.helpnetsecurity.com/2026/10/27/microsoft-authenticator-vulnerability-patchedcve-2026-80097/

Microsoft addressed a security flaw in Authenticator for Android, tracked as CVE-2026-80097, that allowed a malicious app without special permissions to impersonate trusted apps like Teams and harvest work account sign-in tokens.

The vulnerability stems from an exposed component, AccountChooserActivity, where a signature check failed when Teams was installed.

Researchers tested that tokens granted full access to email,…

https://en.hacks.gr/i-microsoft-diorthonei-sovaro-provlima-sto-authenticator-gia-android-poy-afine-efarmoges-na-klepsoyn-psifiaka-kleidia/

#Microsoft #Android #Authenticator #CVE202680097

Microsoft tracks the flaw as CVE-2026-80097 and fixed it in Authenticator for Android version 6.2606.4246, so anyone using the app should update. https://thehackernews.com/2026/10/microsoft-authenticator-flaw-let.html

Apple has backported security fixes to older devices, releasing iOS and iPadOS 18.7.11.

The updates address a high-severity CoreGraphics out-of-bounds write flaw tracked as CVE-2026-86950, along with an Audio logic issue and a CoreMedia access vulnerability that could allow unauthorized camera access.

Additionally, Apple shipped a broad wave of updates across its ecosystem, patching hundreds of security defects.

https://en.hacks.gr/i-apple-kykloforei-enimeroseis-asfaleias-gia-palaiotera-iphone-kai-ipad/

#Apple #iOS #iPadOS #CVE

🚨 Apple patches a possibly exploited CoreGraphics flaw on older iPhones and iPads.

CVE-2026-86950 could allow arbitrary code execution. Apple says it may have been used in targeted attacks against specific individuals.

The fix is now available in iOS 18.7.11 and iPadOS 18.7.11.

Details → https://thehackernews.com/2026/10/apple-backports-fix-for-exploited.html

Apple aktualisiert alles 2026-10

Puh - das hat ja gerade noch vor Ende des Monats geklappt! Im Oktober veröffentlicht Apple Flicken gegen 304 Sicherheitslücken. Die Zahl ist recht hoch, aber bleibt im Rahmen (anders als MS). Die CVE-2026-86950, die als bereits ausgenutzt bekannt ist, wurde jetzt endlich auch für das ältere iOS 18 geflickt. Die neueren (26 und 27) waren ja schon vor einem Monat abgesichert worden. Wer ein so altes System (18) verwendet, muss halt damit leben, einen Monat länger ungeschützt angreifbar zu sein - ja und? Zwei weitere Sicherheitslücken sind "interessant": CVE-2026-86990 erlaubt es Apps, unerkannt und ohne Erlaubnis die Kamera zu benutzen; ... Weiterlesen:

https://www.pc-fluesterer.info/wordpress/2026/10/27/apple-aktualisiert-alles-2026-10/

#zeroday #apple #ios #macos #sicherheit #smartphone #UnplugApple #UnplugTrump

Apple Patches for October 2026, (Mon, Oct 26th)

Apple has released its October 2026 security updates, covering 304 vulnerabilities across iOS, iPadOS, macOS, tvOS, watchOS, visionOS and Safari, according to the SANS Internet Storm Center. No new vulnerability in this release is marked as already exploited, but the update delivers iOS 18 patches for CVE-2026-86950, an already-exploited CoreGraphics flaw first patched a month ago; other notable fixes include CVE-2026-86990, which let a malicious app access the camera without permission, and CVE-2026-28864, which let a local attacker access a user’s Keychain items. https://isc.sans.edu/diary/rss/33458

Apple załatało 329 unikalnych luk w zabezpieczeniach – co warto wiedzieć?

Wraz z premierą systemów z rodziny 27.2 Apple załatało co najmniej 329 unikalnych luk bezpieczeństwa, a na iPhone’ach i iPadach ponad 160. Wśród poprawek są dostęp do kamery bez zgody, wyciek danych z Apple Intelligence i błąd Hide My Email. Poniżej lista aktualizacji.

Wydanie systemów 27.2 przyniosło nie tylko nowości, ale też rekordowo długą listę poprawek bezpieczeństwa. Jak podaje 9to5Mac, Apple zaktualizowało stronę z informacjami o zabezpieczeniach i wyliczyło w sumie 329 unikalnych luk, które wiele systemów dzieli ze sobą, co daje łącznie 1265 wpisów CVE. Liczby mogą jeszcze wzrosnąć, bo Apple regularnie uzupełnia swoje biuletyny po ich publikacji.

Które aktualizacje dotyczą zabezpieczeń?

W powyższej tabeli odsyłamy do dokumentów Wsparcia Apple w języku angielskim, ponieważ ich polskojęzyczne wersje pojawiają się z opóźnieniem.

Co zostało załatane?

Według 9to5Mac wśród najważniejszych poprawek jest błąd w CoreMedia, który pozwalał złośliwej aplikacji uzyskać dostęp do kamery na iPhonie, iPadzie, Macu lub Apple Vision Pro bez zgody użytkownika (CVE-2026-86990), oraz luka w Apple Intelligence umożliwiająca zdalnemu atakującemu dostęp do wrażliwych danych na obsługiwanych iPhone’ach i iPadach (CVE-2026-86987). Apple załatało też lukę w Siri na macOS Tahoe, pozwalającą aplikacji dotrzeć do wrażliwych danych (CVE-2026-43736), oraz kilka błędów w WebKit, przez które spreparowana strona mogła wykonać dowolny kod.

MacRumors skupia się na iOS i iPadOS 27.2, w których poprawiono ponad 160 luk. Poza błędem w Apple Intelligence naprawiono także usterkę w Hide My Email, która mogła ujawniać prawdziwy adres e-mail użytkownika. Są też ponad 30 poprawek w WebKit i około 15 w jądrze systemu. Sześć wpisów CVE przypisano zespołowi Calif, który w dniu premiery zdołał włamać się do iPhone’a Duo i pokazał jailbreak iOS 27.0.1 bez konieczności ponownego uruchamiania. Stefan Esser z tego zespołu mówił niedawno, że „większość” luk użytych w jailbreaku jest naprawiona w iOS 27.2.

Apple nie podało, by którakolwiek z luk była aktywnie wykorzystywana, ale MacRumors przypomina, że po publikacji szczegółów nieaktualizowane urządzenia mogą stać się celem ataków, więc aktualizację warto zainstalować jak najszybciej. Użytkownicy, którzy nie przeszli jeszcze na iOS 27, mogą zainstalować iOS 26.7.2, który zawiera wiele z tych samych poprawek.

Starsze iPhone’y

Ciekawy jest też wątek starszych urządzeń. Do iOS i iPadOS 18 trafiła poprawka w CoreGraphics (CVE-2026-86950), która pozwalała spreparowanemu plikowi wywołać wykonanie dowolnego kodu. Apple naprawiło ją po raz pierwszy we wcześniejszych aktualizacjach, ostrzegając, że mogła zostać wykorzystana w niezwykle wyrafinowanym ataku na wybrane osoby korzystające z wersji iOS sprzed 27. Wcześniej w tym roku Apple łatało też luki wykorzystywane przez zestawy exploitów Coruna i DarkSword, które w łańcuchach ataków używały błędów w WebKit i infekowały iPhone’y ze starszymi wersjami iOS.

AI pomaga znajdować luki

Rosnąca liczba poprawek ma związek z tym, że modele AI coraz lepiej wyszukują podatności. 9to5Mac zauważa, że Apple od miesięcy łata WebKit w tempie, które częściowo wynika z użycia narzędzi AI, a w dzisiejszych aktualizacjach docenia zarówno takie narzędzia, jak i zespoły badawcze. Według MacRumors Anthropic Research jest wymienione przy trzech poprawkach, a OpenAI przy czterech.

Co z tego wynika?

Praktyczny wniosek jest prosty: kto jeszcze nie zainstalował wersji 27.2 (lub odpowiednika dla swojego systemu), powinien to zrobić. A dla tych, którzy nie chcą przechodzić na nowe systemy, Apple przygotowało równoległe wydania z łatami: iOS 26.7.2, macOS Tahoe 26.7.2 i macOS Sequoia 15.8.2.

Aktualizacje systemów do wersji 27.2

CVE-2026-35273: SSRF to RCE in Oracle PeopleSoft. ZDI's Bobby Gould provides a deep dive into the bug(s) used in the recent PeopleSoft attacks. His analysis includes root cause and video demo. https://www.zerodayinitiative.com/blog/2026/10/20/cve-2026-35273-ssrf-to-rce-in-oracle-peoplesoft

CVE-2026-35273: SSRF to RCE in Oracle PeopleSoft https://www.thezdi.com/blog/2026/10/20/cve-2026-35273-ssrf-to-rce-in-oracle-peoplesoft

CVE-2026-97631 has a severity rating of 9.5/10. The memory-corruption flaw is in the ICMP component of TianoCore EDK II’s PXE-Base Code driver. It affects servers, storage equipment and devices using EDK II with PXE enabled to boot from a local network.

The flaw can allow malicious code to run early in the boot process, before Secure Boot and TPM defenses load. Exploitation requires low-level local-network or insider access;…

https://en.hacks.gr/sovaro-provlima-asfaleias-se-logismiko-ekkinisis-epaggelmatikon-systimaton-pagkosmios/

#EDKII #PXE #UEFIFirmware #MemoryCorruption

Hey gang, the #infosec datascape is on fire again. And do *you* have any #IoT devices?

Critical vulnerabilities were disclosed in the #GoAhead embedded web server, affecting devices from major manufacturers like Palo Alto Networks, #Siemens, and #Boeing. The vulnerability impacts hundreds of millions of IoT, industrial control, and network devices, as many vendors have not yet issued firmware updates to address these specific flaws.

The most severe flaw, CVE-2026-115881 (CVSS 9.1), allows revoked client certificates to bypass security checks in OpenSSL, a critical risk for mutual-TLS (mTLS) configurations.

Also a weak key exchange in the Mbed TLS backend (CVSS 5.9) that can enable passive session decryption, and a certificate chain bypass in LibreSSL builds (CVSS 7.4).

Additionally, a login bypass vulnerability allows authentication with any password if the user's password is stored in the newer Blowfish format.

https://cybersecuritynews.com/goahead-tls-vulnerabilities/

GoAhead embedded web server version 6.1.1 fixes 11 advisories, including a critical OpenSSL revocation check bypass tracked as CVE-2026-115881 and rated 9.1.

The server loaded certificate revocation lists into its default TLS backend but never enabled checking, allowing revoked client certificates to pass login on mutual-TLS setups.

Mbed TLS builds are unaffected.

A LibreSSL legacy verifier issue (CVE-2026-115884) is als…

https://en.hacks.gr/sovara-provlimata-asfaleias-se-ekatommyria-syskeyes-logo-logismikoy-goahead/

#GoAhead #OpenSSL #CVE_2026_115881 #EmbedThis

📰 Arista Patches Exploited VeloCloud Orchestrator Zero-Day

🚨 CRITICAL ZERO-DAY: Arista patches actively exploited SQL injection vulnerability (CVE-2026-114625) in on-prem VeloCloud Orchestrator. Flaw allows superuser control. Patch immediately! #ZeroDay #CVE #Arista #CyberSecurity #SDWAN

🔗 https://cyber.netsecops.io/articles/arista-patches-actively-exploited-velocloud-orchestrator-zero-day-cve-2026-114625/?utm_source=mastodon&utm_medium=social&utm_campaign=daily