Skip to content
Wednesday, October 28, 2026Oct 28, 2026
Previous issue

Vol. 1, No. 36Composed Oct 28 · 16:52 UTC

SitRep

Cybersecurity, in perspective.

1 critical · 3 elevated4 stories on the wire

Build what earns its place. Keep your judgment close.

You are reading a previous issue. Go to the latest edition →

The situation

CISA Adds NODE2SHELL to KEV

CISA added Node2Shell to KEV after honeypots recorded at least one probe. Multiple high-severity Windows flaws and an active PHP2Shell campaign surface.

3 sources

SecurityWeek, The Hacker News, Cisco Talos Vulnerability Reports

CISA added CVE-2026-111497 (Node2Shell) to the KEV catalog on Oct 27 after honeypots logged exploitation attempts from a US IP and observed malformed Node.js requests. The flaw involves a Brotli decoder out-of-bounds write in versions 1.0.3–1.2.0, with patches pending for several runtimes and appliances.

Context

This matters now because exploitation probes appeared within days of disclosure, expanding the window for potential abuse across runtimes and devices that embed Brotli. Public-facing Node.js services, CDNs, and any systems handling Brotli-compressed input are at elevated risk; blast radius could affect web stacks, CDN edge nodes, and embedded firmware in network appliances.

Contrarian view

SitRep’s judgement from the cited reporting, not reported fact. Written by AI.

NODE2SHELL and PHP2SHELL Flaws Extend Past Web Servers

Node2Shell and PHP2Shell flaws extend into embedded libraries and appliance interfaces, expanding risk to CDNs, runtime ecosystems, and network appliances beyond traditional web servers.

SecurityWeek · The Hacker News

The move

5 things to do today

  1. Hunt for Node2Shell activity: search web, CDN and appliance logs for Node.js 24.22.0 requests, unusual Brotli-compressed payloads, and malformed Brotli decompressions tied to CVE-2026-111497.
  2. Contain and investigate PHP2Shell compromises: isolate hosts showing webshell or unexpected root persistence, collect disk/memory images, and run full credential and lateral-movement hunts across affected segments.
  3. Apply or schedule vendor fixes and mitigations for CVE-2026-80093 and CVE-2026-58613 in your Windows estate; until updates are deployed, monitor Cloud Filter API calls and CfAbortOperation events for anomalous activity.
  4. Enforce managed browser rollouts: validate Chrome 156 and Firefox 159 deployment status across endpoints, block legacy browser binaries, and verify enterprise update channels are enforced.
  5. Block and monitor risky runtime versions: identify and block Node.js 24.22.0 in internal registries and CI pipelines where practicable, and add detections for Brotli decoder errors and unusual decompression failures.

Also drawn on Chrome and Firefox Patch Over 200 Vulnerabilities (SecurityWeek)

On the wire

  • 1critical
  • 3elevated
  • 0moderate
  • 0low
P1Exploit

CISA Adds NODE2SHELL to KEV

CVE-2026-111497 · Brotli 1.0.3–1.2.0

CISA added CVE-2026-111497 (Node2Shell) to the KEV catalog after honeypots and telemetry logged exploitation attempts and malformed Node.js requests; the flaw is an out-of-bounds write in Brotli decoders that can crash or enable code execution.

Previously in SitRep Oct 27: Google Brotli Decoder Flaw Enables Remote Code Execution · CVE-2026-111497

Added to CISA KEV on 27 Oct 2026 (CVE-2026-111497) · CVE-2026-111497: CVSS 9.2, EPSS 0.88 (FIRST), patch listed (GitHub)

SECURITYWEEK · CISA Adds Node2Shell CVE to KEV; Honeypots Log Exploits

Copy link to “CISA Adds NODE2SHELL to KEV”

P0Incident

PHP2SHELL Campaign Roots Servers, Breaches Network

25 servers rooted · government‑affiliated network breached

An active campaign leveraged PHP2Shell vulnerabilities to root at least 25 servers and breach a U.S.-affiliated network, with researchers attributing the operation to a suspected China-nexus actor using automated/AI-assisted tooling.

Previously in SitRep Weekend edition, Oct 24: AWS Publishes WAF Mitigations for PHP2SHELL · CVE-2026-109618, CVE-2026-109619

Timeline

  1. Oct 21Critical PHP RCEs CVE-2026-109618 and CVE-2026-109619 — 22.6M Exposed Instances
  2. Oct 22Patch and Hunt for PHP2SHELL RCE (CVE-2026-109618/CVE-2026-109619)
  3. Weekend, Oct 24AWS Publishes WAF Mitigations for PHP2SHELL
  4. This edition

Added to CISA KEV: CVE-2026-109618 on 26 Oct 2026; CVE-2026-109619 on 26 Oct 2026; CVE-2026-46300 on 28 Oct 2026 · CVE-2026-109618: CVSS 9.2, EPSS 1.00 (FIRST); CVE-2026-109619: CVSS 9.2, EPSS 1.00 (FIRST) and 1 more

THE HACKER NEWS · PHP2Shell Attack Roots 25 Servers, Including US Government

Copy link to “PHP2SHELL Campaign Roots Servers, Breaches Network”

P1Exploit

Windows Cloud Files Driver Contains Type Confusion

CVE-2026-80093 · kernel-mode filesystem driver (cldflt.sys)

Talos disclosed a type confusion in the Windows Cloud Files mini filter driver that can be triggered via Cloud Filter API calls and CfAbortOperation, potentially causing kernel crashes or a write primitive usable in privilege escalation.

CVE-2026-80093: EPSS <0.01 (FIRST)

CISCO TALOS VULNERABILITY REPORTS · Microsoft Windows Cloud Files Mini Filter Driver Type Confusion Vulnerability

Copy link to “Windows Cloud Files Driver Contains Type Confusion”

P1Exploit

Windows Cloud Files Driver Contains Use-after-free

CVE-2026-58613 · affects cldflt.sys

Talos and Microsoft describe a use-after-free in the CldiStreamCompleteRequest function of the Cloud Files mini filter driver that an attacker can leverage for privilege escalation when a vulnerable driver is present.

CVE-2026-58613: EPSS <0.01 (FIRST)

CISCO TALOS VULNERABILITY REPORTS · Microsoft Windows Cloud Files Mini Filter Driver Use-After-Free

Copy link to “Windows Cloud Files Driver Contains Use-after-free”

Known exploited

Added 28 Oct2 vulnerabilities added to CISA’s catalogue of flaws exploited in the wild

CVEVendor and productAddedDue
CVE-2026-41709Broadcom VMware ESX28 Oct11 Nov
CVE-2026-46300Linux Kernel28 Oct31 Oct

Source: CISA KEV catalogue, version 2026.11.10 (released 10 Nov 2026; read by SitRep 10 Nov 2026).

Due dates are CISA’s deadlines for US federal civilian agencies (BOD 22-01).

The full catalogue at cisa.gov

The wire, last 30 days

This edition has 4 stories rated critical or elevated (P0 or P1); the 21 daily editions from 29 Sep to 27 Oct averaged 3.8. 8 of the 29 earlier days have no bar: no daily edition with rated stories.

The figures as a table
EditionP0P1P2P3
28 Oct (this edition)1300
27 Oct1310
26 Oct1111
23 Oct0320
22 Oct1400
21 Oct2200
20 Oct2210
19 Oct2300
16 Oct1210
15 Oct1310
14 Oct2111
13 Oct1300
12 Oct2200
9 Oct1310
8 Oct2300
7 Oct1310
6 Oct1310
5 Oct2210
2 Oct1220
1 Oct2201
30 Sep1300
29 Sep1121

Source: SitRep’s daily editions; stories without a severity are not counted.

Elsewhere in the edition

Chromium Information Leak in Animation CVE-2026-79293 Security Advisory

Chromium vulnerability causes an information leak in the Animation component. Microsoft Security Response Center advisory page confirms the CVE; no patch details or timelines are provided in the text.

5 reports

Ukrainian Hive and Nefilim Ransomware Affiliate Sentenced to 70 Months

Artem Stryzhak, a Ukrainian national, was sentenced to 70 months for conspiracy to commit computer fraud after joining Nefilim as an affiliate in June 2021 and later affiliating with Hive. He targeted US and international victims, including seven Hive and an oil and gas firm, sharing 20% of ransom with Nefilim admins. FBI cites over $100 million in losses.

4 reports

Hackers Exploit Critical CVE-2026-101767 in Oracle E-Business Suite

Attackers probe a just-patched critical flaw in Oracle E-Business Suite (EBS). CVE-2026-101767 carries a 9.8 CVSS. It is an unauthenticated SQL injection in the Thin Client Framework servlet enabling remote code execution via the APPS user. Data such as financial, payroll, HR, and procurement may be affected. Patch released in the last Critical Patch Update; exploitation observed Oct 27, 2026.

3 reports

GMO Internet Urges Disconnect after Onamae.com Breach

GMO Internet's Onamae[.]com service was breached and suspended on Oct 21 after malicious programs were found in some customers' server environments. Up to 26,739 servers may have been impacted and hackers may have accessed trading accounts. An extortion email demanded about eight billion yen. GMO refused to pay; attackers warned of ransomware on Oct 27.

3 reports

CVE-2026-111497 Brotli Vulnerability Impact on Palo Alto Networks

Palo Alto Networks details CVE-2026-111497, a Brotli decoder buffer overflow affecting PAN-OS and related products. An unauthenticated remote attacker could corrupt memory, disclose data, cause DoS, or execute code. Affected PAN-OS versions require updates to 1.0.10/1.1.1/1.2.1 Brotli; mitigations include disabling Brotli inspection.

2 reports

Also reported

End of the Wednesday, October 28, 2026 edition.

Colophon

SitRep · Vol. 1, No. 36

Publisher
Published and funded by its independent maintainer. No advertising or sponsors.
AI disclosure
SitRep uses AI to prepare its editions from cited reporting; editions are not reviewed by a person before they are published.
Editorial standards
Read our editorial standards.
Corrections
brief@sitrepit.com or the contact page.