The sound you are currently experiencing is the sound of a million script kiddies humming “time to do some sketchy shit, doo dah doodah, hope I get away with it, oh doodah day”

So, today’s entry in how #ai is destroying the internet, I give you a bug that affects most servers on earth, so that’s fun! It doesn’t affect home and small office users, or any other users who boot their devices solely from disk drives.

The vulnerability, tracked as #CVE-2026-97631, is a Sev 9.5 memory-corruption flaw in an #ICMP component that attackers can exploit to execute malicious code that runs before the operating system and firmware can implement defenses.

Discovered by teams at #anthropic and #google, it was surfaced by #AMI publishing a pull request with a fix for some of their hardware. Because the bug had been “embargoed“ while manufacturers worked on fixes, this is an unpatched bug in many cases, that has just been announced publicly.

#infosec #sysops #netops

https://arstechnica.com/security/2026/10/code-execution-flaw-in-uefi-firmware-threatens-most-servers-on-planet-earth/

Faille UEFI CVE-2026-97631 : un paquet ICMP suffit pour exécuter du code avant le Secure Boot https://www.it-connect.fr/faille-uefi-edk-ii-pxe-icmp-cve-2026-97631/ #ActuCybersécurité #Cybersécurité #Vulnérabilité

Patch CVE-2026-97631 now. This critical 9.5 CVSS EDK II PXE vulnerability allows unauthenticated pre-boot RCE via crafted ICMP error packets.

#EDKII #TianoCore #UEFI #PXEBoot #CVE202697631 #Cybersecurity #Vulnerability #InfoSec #13302

https://securityonline.info/edk-ii-pxe-vulnerability-pre-boot-rce-cve-2026-97631/?utm_source=mastodon&utm_medium=jetpack_social

A 16-year-old buffer overflow vulnerability, tracked as CVE-2026-97631, affects EDK II open-source code used for UEFI firmware up to edk2-stable202608.

The flaw stems from incorrect size checks in IPv4 and IPv6 network-boot code when copying error messages, allowing code execution during network boot before the operating system and Secure Boot load.

Affected packages include distributions from Red Hat, SUSE, and Debian.

https://en.hacks.gr/sfalma-sto-edk-ii-mporei-na-epitrepsei-ektelesi-kodika-prin-fortothei-to-leitoyrgiko-systima/

#UEFI #Firmware #EDKII #Debian

CVE-2026-97631

pls stop

🚨🇺🇸 Critical 16-year-old EDK II flaw enables code execution before Secure Boot

A critical buffer overflow in TianoCore EDK II, the open-source foundation used to build much of the world’s UEFI firmware, can allow an unauthenticated attacker to run code before the operating system loads.

Tracked as CVE-2026-97631, the vulnerability carries a CVSS score of 9.5 and has existed in the code since November 2010.
⠀
The flaw resides in the PXE network-boot driver, which copies incoming ICMP error messages into a fixed 504-byte buffer without properly limiting their size.
⠀
An attacker who can reach a machine while it is booting over the network can send a crafted ICMP message that:

• Crashes the firmware and prevents the operating system from loading
• Executes attacker-controlled code in the pre-boot environment
• Runs before Secure Boot and measured-boot protections evaluate the operating system
⠀
Reliable code execution requires knowledge of the target’s firmware build. Systems that boot exclusively from local storage are not exposed through this attack path.
⠀
An upstream fix was merged into EDK II on October 15, but no stable EDK II release currently includes it. Server and motherboard vendors must integrate the patch and distribute BIOS or UEFI updates to customers.

Source: https://github.com/tianocore/edk2/security/advisories/GHSA-99cj-7hg9-mp4m

Yet another forever day

CVE-2026-97631 joins a long list of previously discovered vulnerabilities in UEFI or code that works closely with it.

Know now that laughing because all my devices have been on BIOS Boot for years is appropriate.

🧐😱🫣
Critical UEFI Firmware Flaw
CVE-2026-97631

CVE-2026-97631: How a 16-Year-Old EDK II PXE Bug Exposes UEFI Firmware Before the OS Loads

https://thecybersecguru.com/news/cve-2026-97631-edk2-pxe-uefi-vulnerability/

POV: you just finished patching PHP2Shell

then node and python get one too

broccoli2shell, CVE-2026-111497, CVSS 9.2, an out-of-bounds write in google's brotli decoder. reported by openai's codex security

node 22.23.4 / 24.22.1 / 26.12.1
python Brotli 1.2.1, brotlicffi 1.2.1.0
then restart and rebuild images

https://github.com/advisories/GHSA-9v8h-qqgm-4m35

#InfoSec #NodeJS #Python #CVE

Broccoli2shell: Everything You Need To Know About The Critical Brotli Decoder Vulnerability | Wiz Blog #devopsish https://www.wiz.io/blog/cve-2026-111497-brotli-rce-node-js

Microsoft released emergency updates for a severe Microsoft .NET Brotli vulnerability. Learn how to patch CVE-2026-111497 and secure your applications now.

#Microsoft #DotNet #Brotli #Cybersecurity #Imperva

https://dailytechnow.com/microsoft-dotnet-brotli-vulnerability/

Broadcom warns of a VMware SDDC Manager vulnerability, CVE-2026-111497 (CVSS 9.8), from the Node.js Brotli vulnerability. Patches pending.

#VMware #Broadcom #SDDCManager #VMwareCloudFoundation #Brotli #CVE2026111497 #NodeJS #RCE

https://securityonline.info/vmware-sddc-manager-vulnerability-cve-2026-111497/?utm_source=mastodon&utm_medium=jetpack_social

We've built a scanner to detect the exposure of your website to Node2Shell (CVE-2026-111497). We have emergency remediation measures ready if you need help - just reach out and our team can help.
https://nodejsguard.io/

I built a free, open source scanner for CVE-2026-111497 (Node2Shell / HTTP2Shell / Broccoli2Shell).

It checks the Brotli code inside binaries instead of trusting version numbers, so it finds copies hidden in Node.js, Python, .NET and Bun, and sees fixes that distros backported.

Read-only. For Kubernetes, container images and Linux hosts.

https://github.com/depuschm/brotli-k8s-scan

#Node2Shell #HTTP2Shell #Broccoli2Shell #InfoSec #CyberSecurity #NodeJS #Python #Kubernetes #OpenSource

Más actualizaciones para Broccoli 2Shell (HTTP2Shell - CVE-2026-111497), revisa TODOS tus dispositivos y aplicaciones

Vía: @seguinfo

https://blog.segu-info.com.ar/2026/10/mas-actualizaciones-para-broccoli.html

CISA added two vulnerabilities to its KEV catalog: CVE-2026-48356 (Adobe Commerce/Magento unrestricted file upload, CVSS 9.3) and CVE-2026-111497 (Google Brotli memory corruption, CVSS 9.2).

Sansec noted hundreds of online stores infected via PolyShell, while Wiz warns that 91% of cloud environments have resources exposed to the Brotli issue.

Multiple vendors including Node.js, PHP, have released patches.

https://en.hacks.gr/synagermos-stis-ipa-gia-dyo-sovara-provlimata-asfaleias-poy-axiopoioyntai-se-epitheseis/

#CISA #Magento #Brotli #NodeJS

📰 CISA Adds Exploited Google Brotli and Adobe Commerce Flaws to KEV

📢 CISA adds two actively exploited vulns to its KEV catalog: Node2Shell (CVE-2026-111497) in Google Brotli & a file upload flaw (CVE-2026-48356) in Adobe Commerce. Federal agencies must patch by Nov 10. #PatchNow #CISA #KEV

🔗 https://cyber.netsecops.io/articles/cisa-adds-exploited-google-brotli-and-adobe-commerce-flaws-to-kev-catalog/?utm_source=mastodon&utm_medium=social&utm_campaign=daily

Latest cybersecurity reports highlight critical PHP vulnerabilities being actively exploited globally, necessitating emergency patching. CISA confirmed exploitation of the Node2Shell/Brotli flaw (CVE-2026-111497). China-linked groups leveraged a BeyondTrust zero-day (CVE-2026-102764), and AI agents reportedly compromised live websites during testing (Oct 27-28, 2026). In technology, Amazon Business introduced new agentic AI tools. Geopolitically, Israel's elections are heading towards a coalition deadlock.

#Cybersecurity #AnonNews_irc #News

PHP2Shell: CISA ha aggiunto CVE-2026-109618 e CVE-2026-109619 (RCE non autenticate, CVSS 9.2) al catalogo KEV, con scadenza per le agenzie FCEB giovedì 29/10. È la conferma ufficiale dello sfruttamento, dopo le 35 shell ottenute su honeypot Apache mod_php il 24/10 (Adel Karimi, Perplexity). Patch del 21/10: 8.5.12, 8.4.27, 8.3.36, 8.2.35. Su Windows verificare anche il rebuild per Brotli (CVE-2026-111497). https://www.bleepingcomputer.com/news/security/cisa-confirms-php2shell-vulnerabilities-now-exploited-in-attacks/ #infosec #PHP #threatintel

We have finally listed #PHP2Shell as exploited in the wild with the release of a report detailing the compromise of multiple firewall devices, including some used by the US government.

https://ifin.network/t/cve-2026-109618-cve-2026-109619-remote-code-execution-in-php/914

#ThreatIntel

https://dreamgroup.com/blog/chained-php2shell-exploit-roots-25-servers

The affected devices run specific versions of a large vendor’s firewall software. For security purposes, we are not disclosing the vendor or the affected versions, and the vendor has been notified.

https://security.paloaltonetworks.com/CVE-2026-109618

Active exploitation has been observed targeting the Palo Alto Networks management interface exposed to the internet.

:brdThink:

GreyNoise is monitoring exploitation attempts against #php2shell (CVE-2026-109618 and CVE-2026-109619).

On 28 Oct 2026, 05:14:01 UTC we observed the first successful exploitation of php2shell against a vulnerable GreyNoise sensor.

"We’re seeing successful exploitation of these CVEs, but the conditions make it difficult for a threat actor to scale. Fifty different servers in various configurations can be vulnerable to these CVEs, but the same exploit may not work universally against all of them. Actors need to tailor their exploit for each respective configuration which makes mass exploitation challenging."
- Andrew Thompson, SVP of Adversary Operations at GreyNoise

This live activity report is derived from GreyNoise data and updates as we observe new activity: https://php.events.greynoise.io/

“The PHP panic has not turned to patching: And that’s bad news, capital B, as PHP2Shell attacks ramp up.

We know the paired PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, aka PHP2Shell, have a Common Vulnerability Scoring System (CVSS) score of 9.2, which is scary bad. After all, about 70% of websites with an identifiable server-side language run on PHP-based systems like WordPress.

But does that mean people are patching their servers as fast as they can?

To quote Moshe Siman Tov Bustan of Ox security: “The panic hasn’t turned into patching.” Ox reports in a new blog post that of October 26, five days after disclosure, the picture has barely shifted – 93.6% still exposed.“”

https://thenewstack.io/php2shell-unpatched-php-servers/

#CyberSecurity #PHP #PHP2Shell #Programming #SoftwareDevelopment

"Responder Guidance for PHP2Shell (CVE-2026-109618 and CVE-2026-109619)":

https://bishopfox.com/blog/responder-guidance-for-php2shell

🔒 New CSAF advisory published

VDE-2026-137
METTLER TOLEDO: PHP2Shell in Octo Image Server
CVE-2026-109618, CVE-2026-109619

OCTO Image Server contains a vulnerable version of PHP affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619). We strongly recommend to upgrade PHP to version 8.2.35.

HTML: https://certvde.com/en/advisories/VDE-2026-137/
CSAF JSON: https://mettler-toledo.csaf-tp.certvde.com/.well-known/csaf/white/2026/vde-2026-137.json

#OT #Advisory

PHP "php2shell" (CVE-2026-109618/109619) is in CISA KEV and under attack: no-login code execution on PHP web servers. That includes the web UI on OPNsense, pfSense and Unraid, and PHP apps on Synology and QNAP. Update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 (or the vendor update), then restart PHP.

Also: Nextcloud's built-in Collabora CODE app (CVE-2026-110447), update to 26.4.303.

This week's issue:
https://patchorpass.beehiiv.com/p/patchorpass-2-php-php2shell-exploit-patch-now-plus-nextcloud-collabora?utm_source=mastodon&utm_medium=social&utm_campaign=issue-2

#infosec #homelab #selfhosted #nextcloud

PHP2Shell: The 'End of the World' Vulnerability in PHP and How Major Companies Moved to Contain the Disaster

On October 21, 2026, the PHP project disclosed PHP2Shell (CVE-2026-109618 and CVE-2026-109619), two critical flaws in the PHP core affecting every version since 5.4 and allowing unauthenticated rem...

🔗 https://salehgnutux.github.io/GT-NEWSTECH/en/foss/php2shell-critical-vulnerability-response/

#PHP2Shell #Cybersecurity #PHP #Critical_Vulnerabilities #RCE #Linux #Red_Hat #Ubuntu #Cloudflare #gnutux

PHP2Shell Update: Still No Confirmed WordPress Compromises - What we've seen across over 5 million WordPress sites we protect.

As of Oct 28, 2026, Wordfence is not aware of any WordPress site compromised through PHP2Shell (CVE-2026-109618, CVE-2026-109619).

Here's what we've seen so far:

https://www.wordfence.com/blog/2026/10/php2shell-update-still-no-confirmed-wordpress-compromises-and-answers-to-the-questions-were-hearing-most/

PHP2Shell: CISA ha aggiunto CVE-2026-109618 e CVE-2026-109619 (RCE non autenticate, CVSS 9.2) al catalogo KEV, con scadenza per le agenzie FCEB giovedì 29/10. È la conferma ufficiale dello sfruttamento, dopo le 35 shell ottenute su honeypot Apache mod_php il 24/10 (Adel Karimi, Perplexity). Patch del 21/10: 8.5.12, 8.4.27, 8.3.36, 8.2.35. Su Windows verificare anche il rebuild per Brotli (CVE-2026-111497). https://www.bleepingcomputer.com/news/security/cisa-confirms-php2shell-vulnerabilities-now-exploited-in-attacks/ #infosec #PHP #threatintel

We have finally listed #PHP2Shell as exploited in the wild with the release of a report detailing the compromise of multiple firewall devices, including some used by the US government.

https://ifin.network/t/cve-2026-109618-cve-2026-109619-remote-code-execution-in-php/914

#ThreatIntel

GreyNoise is monitoring exploitation attempts against #php2shell (CVE-2026-109618 and CVE-2026-109619).

On 28 Oct 2026, 05:14:01 UTC we observed the first successful exploitation of php2shell against a vulnerable GreyNoise sensor.

"We’re seeing successful exploitation of these CVEs, but the conditions make it difficult for a threat actor to scale. Fifty different servers in various configurations can be vulnerable to these CVEs, but the same exploit may not work universally against all of them. Actors need to tailor their exploit for each respective configuration which makes mass exploitation challenging."
- Andrew Thompson, SVP of Adversary Operations at GreyNoise

This live activity report is derived from GreyNoise data and updates as we observe new activity: https://php.events.greynoise.io/

“The PHP panic has not turned to patching: And that’s bad news, capital B, as PHP2Shell attacks ramp up.

We know the paired PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, aka PHP2Shell, have a Common Vulnerability Scoring System (CVSS) score of 9.2, which is scary bad. After all, about 70% of websites with an identifiable server-side language run on PHP-based systems like WordPress.

But does that mean people are patching their servers as fast as they can?

To quote Moshe Siman Tov Bustan of Ox security: “The panic hasn’t turned into patching.” Ox reports in a new blog post that of October 26, five days after disclosure, the picture has barely shifted – 93.6% still exposed.“”

https://thenewstack.io/php2shell-unpatched-php-servers/

#CyberSecurity #PHP #PHP2Shell #Programming #SoftwareDevelopment

"Responder Guidance for PHP2Shell (CVE-2026-109618 and CVE-2026-109619)":

https://bishopfox.com/blog/responder-guidance-for-php2shell

🔒 New CSAF advisory published

VDE-2026-137
METTLER TOLEDO: PHP2Shell in Octo Image Server
CVE-2026-109618, CVE-2026-109619

OCTO Image Server contains a vulnerable version of PHP affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619). We strongly recommend to upgrade PHP to version 8.2.35.

HTML: https://certvde.com/en/advisories/VDE-2026-137/
CSAF JSON: https://mettler-toledo.csaf-tp.certvde.com/.well-known/csaf/white/2026/vde-2026-137.json

#OT #Advisory

PHP2Shell: The 'End of the World' Vulnerability in PHP and How Major Companies Moved to Contain the Disaster

On October 21, 2026, the PHP project disclosed PHP2Shell (CVE-2026-109618 and CVE-2026-109619), two critical flaws in the PHP core affecting every version since 5.4 and allowing unauthenticated rem...

🔗 https://salehgnutux.github.io/GT-NEWSTECH/en/foss/php2shell-critical-vulnerability-response/

#PHP2Shell #Cybersecurity #PHP #Critical_Vulnerabilities #RCE #Linux #Red_Hat #Ubuntu #Cloudflare #gnutux

PHP2Shell Update: Still No Confirmed WordPress Compromises - What we've seen across over 5 million WordPress sites we protect.

As of Oct 28, 2026, Wordfence is not aware of any WordPress site compromised through PHP2Shell (CVE-2026-109618, CVE-2026-109619).

Here's what we've seen so far:

https://www.wordfence.com/blog/2026/10/php2shell-update-still-no-confirmed-wordpress-compromises-and-answers-to-the-questions-were-hearing-most/

PHP2Shell: CISA ha aggiunto CVE-2026-109618 e CVE-2026-109619 (RCE non autenticate, CVSS 9.2) al catalogo KEV, con scadenza per le agenzie FCEB giovedì 29/10. È la conferma ufficiale dello sfruttamento, dopo le 35 shell ottenute su honeypot Apache mod_php il 24/10 (Adel Karimi, Perplexity). Patch del 21/10: 8.5.12, 8.4.27, 8.3.36, 8.2.35. Su Windows verificare anche il rebuild per Brotli (CVE-2026-111497). https://www.bleepingcomputer.com/news/security/cisa-confirms-php2shell-vulnerabilities-now-exploited-in-attacks/ #infosec #PHP #threatintel

We have published a report on a security incident on gitlab.alpinelinux.org. An attacker tried to exploit CVE-2026-97229. We found no evidence it succeeded but can't rule it out, so we rebuilt
GitLab from scratch.

Alpine packages and releases were not affected, and no signing keys were exposed.

All GitLab passwords have been reset. If you reused yours elsewhere, change it there.

https://alpinelinux.org/posts/GitLab-security-incident-CVE-2026-97229.html

#AlpineLinux #security

An attacker targeted GitLab vulnerability CVE-2026-97229 (CVSS 10 RCE) on Alpine Linux's server. Alpine rebuilt GitLab and reset all passwords.

#GitLab #AlpineLinux #CVE202697229 #RCE #Ruby #Onigmo #ActiveExploitation #SupplyChainSecurity

https://securityonline.info/alpine-linux-gitlab-cve-2026-97229/?utm_source=mastodon&utm_medium=jetpack_social

🚨🇺🇸 Hackers begin targeting critical Oracle E-Business Suite flaw

Threat actors are scanning for systems vulnerable to CVE-2026-101767, a critical unauthenticated SQL injection flaw in Oracle E-Business Suite that can be chained to remote code execution.
⠀
The vulnerability carries a CVSS score of 9.8 and affects E-Business Suite versions 12.2.3 through 12.2.15.
⠀
An attacker with HTTP access to the Thin Client Framework servlet can execute SQL with the privileges of the APPS database user and then run operating-system commands as the EBS application account.
⠀
Depending on the deployment, compromised systems may expose financial, payroll, human resources and procurement information.
⠀
Defused recorded exploratory exploitation attempts against its Oracle EBS decoys on October 27, one week after Oracle released patches. Shadowserver currently tracks more than 670 internet-exposed EBS instances, although it is unknown how many remain vulnerable.
⠀
Oracle has not classified the flaw as actively exploited, and successful compromises have not been publicly confirmed.

Administrators should immediately apply Oracle’s October 2026 Critical Patch Update. If patching is delayed, restrict the EBS web tier to trusted networks and remove /OA_HTML/AppsTCFServer from the URL firewall allowlist.

Source: https://www.oracle.com/security-alerts/cpuoct2026.html

Hackers Target Critical Oracle E-Business Suite RCE Flaw Days After Security Patch

Threat actors have begun probing for a newly patched critical vulnerability in Oracle E-Business Suite, according to threat intelligence firm Defused Cyber, The Hacker News reports. The flaw, CVE-2026-101767 (CVSS 9.8) in the Oracle Application Object Library, was patched by Oracle last week as part of its Critical Patch Update. https://thehackernews.com/2026/10/hackers-target-critical-oracle-e.html

The vulnerability in question is CVE-2026-101767 (CVSS score: 9.8) in the Oracle Application Object Library of Oracle E-Business Suite. It was patched by Oracle last week as part of its Critical Patch Update. https://thehackernews.com/2026/10/hackers-target-critical-oracle-e.html

🚨 Rapid Response: CVE-2026-101767 (CVSS 9.8) could allow unauthenticated takeover of Oracle E-Business Suite.

Censys identified 2,246 exposed web properties. Exposure does not confirm vulnerability.

Patch and investigate: https://censys.com/advisory/cve-2026-101767/

#CensysARC #Cybersecurity #VulnerabilityManagement #Oracle #InfoSec

RE: https://infosec.exchange/@AmmarSpaces/117316856064853890

Turns out, the vulnerabilities exploited by ShinyHunters at Oracle's Peoplesoft software are not a single flaw, but a chain of 3 flaws.

Full chain writeup:
https://www.zerodayinitiative.com/blog/2026/10/20/cve-2026-35273-ssrf-to-rce-in-oracle-peoplesoft

#cybersecurity #infosec #vulnerability #Oracle #Peoplesoft

Research into Oracle PeopleSoft Enterprise PeopleTools versions 8.61 and 8.62 revealed that the security advisory tracked as CVE-2026-35273 actually involves three chained flaws rather than a single vulnerability.

Threat intelligence reports attribute exploitation waves to UNC6240, known as ShinyHunters, affecting multiple global sectors.

https://en.hacks.gr/pos-oi-shinyhunters-chtypisan-systimata-panepistimion-kai-etaireion/

#Oracle #PeopleSoft #Vulnerability #Patch

ShinyHunters-Exploited Oracle PeopleSoft Zero-Day Turns Out to Be Three Chained Flaws

The critical Oracle PeopleSoft flaw that ShinyHunters has exploited since May is not one vulnerability but three chained together, according to the Zero Day Initiative researchers who reported it. Oracle patched all three in June under the single identifier CVE-2026-35273 (CVSS 9.8): a server-side request forgery in the Integration Gateway reaches the internal Environment Management Hub because PeopleSoft trusts its own loopback address by default, from which attackers can write a web shell or a malicious XML file for unauthenticated remote code execution; Mandiant attributes the exploitation, first against universities and later across many sectors, to ShinyHunters (UNC6240). https://thehackernews.com/2026/10/shinyhunters-exploited-oracle.html

📰 Citrix Zero-Days and Oracle PeopleSoft Flaw Under Active Exploit

🚨 CRITICAL THREAT: Two Citrix zero-days (CVE-2026-88771, CVE-2026-88772) and an Oracle PeopleSoft flaw (CVE-2026-35273) are under active exploitation for RCE. CISA KEV updated. Patch immediately! #CyberSecurity #ZeroDay #CVE #PatchNow

🔗 https://cyber.netsecops.io/articles/citrix-zero-days-and-oracle-peoplesoft-flaw-actively-exploited/?utm_source=mastodon&utm_medium=social&utm_campaign=daily

Cisco zero-day: CVE-2026-76418 (8.6 high)
Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software Remote Access SSL VPN Tunnel Denial of Service Vulnerability

In October 2026, the Cisco PSIRT became aware of active exploitation of this vulnerability.

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-tunnel-dos-s6mgkb75

#cisco #zeroday #eitw #CVE

Patch CVE-2026-76418 now. This high-severity Cisco Secure Firewall vulnerability is exploited in the wild to trigger SSL VPN DoS reloads on ASA and FTD.

#Cisco #CiscoASA #CiscoFTD #CVE202676418 #SSLVPN #ZeroDay #Cybersecurity #Vulnerability

https://securityonline.info/cisco-secure-firewall-vulnerability-exploited-ssl-vpn/?utm_source=mastodon&utm_medium=jetpack_social

What. The. Fuck.

https://access.redhat.com/security/cve/cve-2026-117574

A flaw was found in ai-gateway-payload-processing. An authenticated remote attacker can exploit this vulnerability by submitting a request specifying another tenant's model identifier in the request body or header. Because the service does not verify authorization before retrieving credentials from the shared store, it injects the target tenant's application programming interface (API) keys into the request. This flaw allows an attacker to perform unauthorized requests and consume another tenant's large language model (LLM) resources and quotas.

Authenticator от Microsoft сливал ваши токены авторизации в сервисах Microsoft вообще любым приложениям, которые их запрашивали. Скорее всего, сторонние приложения этим не особо грешили, но с помощью тестовой приложухи исследователям удалось зайти в чужую почту, отредактировать календарь, написать сообщения в Teams и даже изменить ключи доступа в самом аутентификаторе. Уязвимость получила оценку в 8.6 и вроде бы уже закрыта.

🔗 • https://helpnetsecurity.com/2026/10/27/microsoft-authenticator-vulnerability-patchedcve-2026-80097
🔗 • https://cve.org/CVERecord?id=CVE-2026-80097

A severe Microsoft Authenticator vulnerability on Android allowed rogue apps to steal access tokens. Learn how CVE-2026-80097 was patched and secure devices.

#MicrosoftAuthenticator #Cybersecurity #Android #CVE202680097 #InfoSec

https://dailytechnow.com/microsoft-authenticator-vulnerability-patched/

Microsoft Authenticator Flaw Scores 8.6: Android Users Must Update https://www.esecurityplanet.com/threats/news-microsoft-authenticator-android-flaw-cve-2026-80097/