Skip to content
Thursday, October 29, 2026Oct 29, 2026
Previous issue

Vol. 1, No. 37Composed Oct 30 · 05:02 UTC

SitRep

Cybersecurity, in perspective.

1 critical · 1 elevated3 stories on the wire

Contain the management plane before you contain the breach.
— Senecowitz Draper
ⓘAn invented Stoic/VC pen name, paired with this edition’s AI-written reflection.

You are reading a previous issue. Go to the latest edition →

The situation

PAN-OS Management Interfaces Under Active PHP RCE Pressure

Active exploitation of PAN-OS management interfaces; patches and mitigations available. Review exposure now.

2 sources

Palo Alto Networks Security Advisories, Cisco PSIRT Security Advisories

Palo Alto Networks warns CVE-2026-109618 and CVE-2026-109619 are being actively exploited against PAN-OS management interfaces exposed to the internet; vendor advisories list affected PAN-OS releases and provide patches and mitigations. Unit42 reporting cited roughly 22.6 million likely vulnerable PHP instances industry-wide, indicating a large Internet-facing attack surface.

Context

Palo Alto's advisory ties active exploitation to internet-exposed management interfaces and lists fixed PAN-OS releases and mitigations; defenders with internet-facing management should treat these systems as high risk. The same PAN-OS line also inherits a separate Brotli decoder buffer-overflow (CVE-2026-111497) that can be abused on dataplanes where Brotli inspection is enabled, increasing the potential for chained remote compromise.

Contrarian view

SitRep’s judgement from the cited reporting, not reported fact. Written by AI.

Treating This as Firewall-only Patch Work Will Fail

Most teams will treat this as a vendor firewall patching only issue. That is the wrong read because reporting shows active exploitation against internet-exposed management plus separate dataplane and host-level decoder flaws that enable chaining; defenders must also isolate management planes and sequence OS/hypervisor and dataplane mitigations.

Palo Alto Networks Security Advisories

The move

5 things to do today

  1. Isolate: Remove internet access to PAN-OS management interfaces or place them behind an access-controlled jump host immediately.
  2. Patch: Apply PAN-OS fixes that address CVE-2026-109618 and CVE-2026-109619 per Palo Alto's advisory as the first remediation step.
  3. Mitigate: Disable Brotli inspection on affected PAN-OS dataplanes where Brotli is not required and upgrade Brotli libraries to the vendor-recommended versions to address CVE-2026-111497.
  4. Upgrade: Schedule and apply Cisco fixed releases that resolve CVE-2026-20362 for Finesse, noting Cisco reports no workaround.
  5. Hunt: Search telemetry for signs of management-plane exploitation and unusual process or memory activity on PAN-OS dataplanes and on hosts supporting management/control functions.

On the wire

  • 1critical
  • 1elevated
  • 1moderate
  • 0low
P0Exploit

PAN-OS Management Interfaces Face Active PHP RCE

CVE-2026-109618 · CVE-2026-109619

Palo Alto Networks reports two PHP remote code execution flaws are being actively exploited against PAN-OS management interfaces that are exposed to the internet; the advisory lists affected PAN-OS releases and provides upgrade and mitigation guidance. Internet-facing management interfaces provide direct attacker entry and are the primary operational risk noted by the vendor.

Previously in SitRep Weekend edition, Oct 24: AWS Publishes WAF Mitigations for PHP2SHELL · CVE-2026-109618, CVE-2026-109619

Timeline

  1. Oct 21Critical PHP RCEs CVE-2026-109618 and CVE-2026-109619 — 22.6M Exposed Instances
  2. Oct 22Patch and Hunt for PHP2SHELL RCE (CVE-2026-109618/CVE-2026-109619)
  3. Weekend, Oct 24AWS Publishes WAF Mitigations for PHP2SHELL
  4. This edition

Added to CISA KEV on 26 Oct 2026 (CVE-2026-109618, CVE-2026-109619) · CVE-2026-109618: CVSS 9.2, EPSS 1.00 (FIRST); CVE-2026-109619: CVSS 9.2, EPSS 1.00 (FIRST)

PALO ALTO NETWORKS SECURITY ADVISORIES · Impact of PHP Vulnerabilities CVE-2026-109618/109619 on PAN-OS

Copy link to “PAN-OS Management Interfaces Face Active PHP RCE”

P1Exploit

Brotli Decoder Buffer Overflow Risks PAN-OS Dataplane

CVE-2026-111497

A buffer overflow in Brotli decoders can allow unauthenticated remote code execution or memory disclosure on PAN-OS dataplanes with Brotli inspection enabled.

Previously in SitRep Oct 27: Google Brotli Decoder Flaw Enables Remote Code Execution · CVE-2026-111497

Added to CISA KEV on 27 Oct 2026 (CVE-2026-111497) · CVE-2026-111497: CVSS 9.2, EPSS 0.83 (FIRST), patch listed (GitHub)

PALO ALTO NETWORKS SECURITY ADVISORIES · Palo Alto Networks Addresses Brotli CVE-2026-111497 Impact

Copy link to “Brotli Decoder Buffer Overflow Risks PAN-OS Dataplane”

Known exploited

Added 29 Oct2 vulnerabilities added to CISA’s catalogue of flaws exploited in the wild

CVEVendor and productAddedDue
CVE-2026-76418Cisco Secure Firewall ASA Software and Cisco Secure FTD Software29 Oct1 Nov
CVE-2026-97229GitLab Community Edition and Enterprise Edition29 Oct1 Nov

Source: CISA KEV catalogue, version 2026.11.10 (released 10 Nov 2026; read by SitRep 10 Nov 2026).

Due dates are CISA’s deadlines for US federal civilian agencies (BOD 22-01).

The full catalogue at cisa.gov

The wire, last 30 days

This edition has 2 stories rated critical or elevated (P0 or P1); the 21 daily editions from 30 Sep to 28 Oct averaged 3.8. 8 of the 29 earlier days have no bar: no daily edition with rated stories.

The figures as a table
EditionP0P1P2P3
29 Oct (this edition)1110
28 Oct1211
27 Oct1310
26 Oct1111
23 Oct0320
22 Oct1400
21 Oct2200
20 Oct2210
19 Oct2300
16 Oct1210
15 Oct1310
14 Oct2111
13 Oct1300
12 Oct2200
9 Oct1310
8 Oct2300
7 Oct1310
6 Oct1310
5 Oct2210
2 Oct1220
1 Oct2201
30 Sep1300

Source: SitRep’s daily editions; stories without a severity are not counted.

Elsewhere in the edition

DHS Employee Records Leaked From Okta SSO System

A threat actor leaked a database with over 41,000 DHS employee records, allegedly stolen from an Okta single sign-on system used by DHS staff and contractors. The hacker, ‘Department of Peace’, says the data includes names, work emails, phone numbers, job titles, and office locations, plus which systems accounts can access.

5 reports

Hackers exploit Cisco SD-WAN flaw to deploy KeyDrift malware

An APT group tracked as UAT-11473 exploited CVE-2026-20127 in Cisco Catalyst SD-WAN Controllers to deploy a custom malware framework named KeyDrift, with PolyFlame and LittleFilch components designed for long-term access and data exfiltration of control-plane data.

5 reports

CVE-2026-41216: vtkPNGReader Denial of Service via Invalid Pointer

Talos reports a vulnerability in vtk 9.6 in vtkPNGReader[:][:]ExecuteInformation causing a denial of service via an invalid pointer dereference when processing malformed PNGs. The flaw stems from a dangerous longjmp path and a freed FILE pointer, potentially exploitable by crafted PNG content. CVSSv3.1 score 7.5. Confirmed vulnerable versions: vtk 9.6. Product URLs include vtk[.]org.

4 reports

Google Unveils Gemini 4 Carbon for Cyber Defense

Google unveils Gemini 4 Carbon, a frontier AI model for vulnerability research, scoring 88.2% on SEC-bench Pro, 54.8% on ExploitGym, and 71.0% on CWE-bench patching, ahead of GPT-6 Astra and Claude Opus 5.5/Claude Fable 5.1. Access begins with vetted cyber defenders via the Fairwind Program (over 650 organizations). Pricing starts at $2 input / $10 output tokens, rising to $4 / $20 later.

3 reports

Cisco Firewall Zero-Day Exploited to Crash SSL VPN Devices

A DoS zero-day in Cisco ASA/FTD with SSL VPN enabled (CVE-2026-76418) allows unauthenticated remote attackers to crash devices via crafted requests. Exploitation was observed in the wild earlier in October 2026. Cisco PSIRT urges upgrading to fixed software; workarounds include disabling secondary authentication on DefaultWEBVPNGroup.

3 reports

Cisco Talos Reports TALOS-2026-2418 FUXA Information Disclosure

Cisco Talos details TALOS-2026-2418 for FUXA, showing unauthenticated access to /nodered/fuxa/scripts leaks script IDs and names due to missing authorization filtering. Affected FUXA 1.3.2-2809; Node-RED integration is optional. The chain includes TALOS-2026-2419 (token bypass) and TALOS-2026-2417 (authorization bypass). Vendor response notes Node-RED changes in v1.3.3 to reduce exposure.

3 reports

Binance Probes Potential $5.8 Billion Crypto-Theft Hack

Binance is investigating a potential security issue involving up to $5.8 billion in digital assets. Tether froze over $1.5 billion in USDT linked to the incident. Circle froze over $800 million in USDC linked to the incident. Binance hot wallets reportedly moved about $2.53 billion across 64 tokens, with further USDC transfers totaling about $3.48 billion.

2 reports

Fake AI Apps Abuse Signed Executables to Deploy Miners

Threat actors lure users with fake OpenAI Claude and Anthropic ChatGPT desktop apps on GitHub, delivering YobaLoader via DLL sideloading alongside signed executables. The dropper YobaDropper uses anti‑analysis checks (Sleep 5500 for 200,000 iterations) and country locks; YobaLoader uses DoH DoH-based domain generation to fetch a payload that injects the XMRig miner.

2 reports

Also reported

End of the Thursday, October 29, 2026 edition.

Colophon

SitRep · Vol. 1, No. 37

Publisher
Published and funded by its independent maintainer. No advertising or sponsors.
AI disclosure
SitRep uses AI to prepare its editions from cited reporting; editions are not reviewed by a person before they are published.
Editorial standards
Read our editorial standards.
Corrections
brief@sitrepit.com or the contact page.