Skip to content
Friday, October 30, 2026Oct 30, 2026
Previous issue

Vol. 1, No. 38Composed Oct 30 · 12:52 UTC

SitRep

Cybersecurity, in perspective.

1 critical · 2 elevated3 stories on the wire

Keep the system lean; investigate what money moves.
— Senecowitz Draper
ⓘAn invented Stoic/VC pen name, paired with this edition’s AI-written reflection.

You are reading a previous issue. Go to the latest edition →

The situation

Attackers Exploit Drupal Commerce Core Bypass

Drupal warns of active Commerce Core bypass; upgrade and audit orders now.

3 sources

BleepingComputer, The Hacker News, SecurityWeek

Drupal reports active exploitation of a critical Commerce Core authorization bypass (CVE-2026-118539) that affects Commerce Core 0.0.0–2.41 and 3.0.0–3.3.13. The component powers more than 42,000 sites; vendor advisories list Commerce Core 3.3.13 and 8.x-2.41 as upgrade targets. Reporting warns routes and fields controlling order workflows can be accessed, raising measurable financial-integrity risk until upgrades and audits complete.

Context

BleepingComputer and The Hacker News cite vendor reporting that attackers exploit an authorization bypass in Commerce Core. The vulnerability targets specific web routes and fields that handle orders; organizations using affected Commerce Core releases face direct risk to order integrity and potential financial manipulation until upgrades and post-release audits occur.

Contrarian view

SitRep’s judgement from the cited reporting, not reported fact. Written by AI.

Treating Commerce Fix as Only Web-team Work Risks Loss

Focusing the vulnerability solely as a web-team issue underestimates attacker paths: authorization bypasses against order routes can be leveraged into financial fraud, corrupted backups, and chained supply-chain artifacts requiring cross-team integrity checks.

BleepingComputer

The move

5 things to do today

  1. Upgrade Commerce Core to 3.3.13 (3.x) or 8.x-2.41 to remediate CVE-2026-118539.
  2. Audit orders, refunds, webhooks, backup integrity, and payment-related logs for unauthorized changes and anomalous transactions since the earliest suspected exploitation.
  3. Upgrade Ruby to 3.3.13+ or 4.x+ where Onigmo is inherited; rebuild affected CI/CD instances and rotate credentials after rebuilds.
  4. Rotate administrative passwords, CI tokens, and deploy keys for GitLab and CI/CD systems that may have been targeted; preserve artifacts for forensic analysis.
  5. Deploy detections for anomalous authorization bypass patterns against commerce endpoints and for unusual pipeline job payloads; escalate confirmed integrity failures to incident response.

On the wire

  • 1critical
  • 2elevated
  • 0moderate
  • 0low
P0Exploit

Drupal Commerce Core Faces Active Exploitation

CVE-2026-118539 · affects Commerce Core 0.0.0–2.41 and 3.0.0–3.3.13 · powers 42,000+ sites

Drupal reports attackers are exploiting an authorization bypass in Commerce Core that can expose order-related routes and fields, enabling manipulation of commerce workflows across affected releases.

Previously in SitRep Oct 19: Drupal Issues Emergency Patches for Critical Core Rces · CVE-2026-108097, CVE-2026-108099

Timeline

  1. Weekend, Oct 17Apply Drupal Core and Entity List RCE Fixes or Uninstall Field UI
  2. Oct 19Drupal Issues Emergency Patches for Critical Core Rces
  3. This edition

Added to CISA KEV on 22 May 2026 (CVE-2026-9082) · CVE-2026-118539: CVSS 6.5, EPSS <0.01 (FIRST); CVE-2026-9082: EPSS 0.89 (FIRST) and 2 more

BLEEPINGCOMPUTER · Drupal warns of critical Commerce Core flaw exploited in attacks

Copy link to “Drupal Commerce Core Faces Active Exploitation”

P1Supply Chain

Onigmo Regex Flaw Targeted GitLab Instance

CVE-2026-97229 · max-severity RCE in Onigmo/Ruby · CISA KEV listed

A max-severity vulnerability in the Onigmo regex engine used by Ruby enabled unauthenticated code execution via crafted CI/CD regex; an Alpine Linux GitLab instance was targeted and subsequently rebuilt after the incident.

Previously in SitRep Oct 13: GitLab self‑hosted RCE CVE-2026-97229 in Ci/cd Regex Compiler

Timeline

  1. Oct 12GitLab Regex Compiler CVE-2026-97229 Max‑Severity RCE in Ci/cd
  2. Oct 13GitLab self‑hosted RCE CVE-2026-97229 in Ci/cd Regex Compiler
  3. This edition

Added to CISA KEV on 29 Oct 2026 (CVE-2026-97229) · CVE-2026-97229: CVSS 10.0, EPSS 0.27 (FIRST)

SECURITYWEEK · Max-Severity GitLab Vulnerability Exploited Against Alpine Linux in October 2026

Copy link to “Onigmo Regex Flaw Targeted GitLab Instance”

P1Exploit

Researchers Confirm Commerce Core Exploitation

CVE-2026-118539 · reports corroborate exploitation

Independent reporting corroborates active exploitation of Commerce Core’s authorization bypass and repeats vendor guidance while highlighting risks to order integrity and potential financial impact.

Previously in SitRep Oct 29: PAN-OS Management Interfaces Face Active PHP RCE · CVE-2026-109618, CVE-2026-109619

Timeline

  1. Oct 21Critical PHP RCEs CVE-2026-109618 and CVE-2026-109619 — 22.6M Exposed Instances
  2. Oct 22Patch and Hunt for PHP2SHELL RCE (CVE-2026-109618/CVE-2026-109619)
  3. Weekend, Oct 24AWS Publishes WAF Mitigations for PHP2SHELL
  4. Oct 29PAN-OS Management Interfaces Face Active PHP RCE
  5. This edition

Added to CISA KEV on 26 Oct 2026 (CVE-2026-109618, CVE-2026-109619) · CVE-2026-118539: CVSS 6.5, EPSS <0.01 (FIRST); CVE-2026-109618: CVSS 9.2, EPSS 1.00 (FIRST) and 1 more

THE HACKER NEWS · Attackers Exploit Critical Drupal Commerce Core Authorization Flaw

Copy link to “Researchers Confirm Commerce Core Exploitation”

Known exploited

Added 30 Oct2 vulnerabilities added to CISA’s catalogue of flaws exploited in the wild

CVEVendor and productAddedDue
CVE-2026-111357Ivanti Connect Secure30 Oct2 Nov
CVE-2026-118527Ivanti Connect Secure30 Oct13 Nov

Source: CISA KEV catalogue, version 2026.11.10 (released 10 Nov 2026; read by SitRep 10 Nov 2026).

Due dates are CISA’s deadlines for US federal civilian agencies (BOD 22-01).

The full catalogue at cisa.gov

The wire, last 30 days

This edition has 3 stories rated critical or elevated (P0 or P1); the 21 daily editions from 1 Oct to 29 Oct averaged 3.7. 8 of the 29 earlier days have no bar: no daily edition with rated stories.

The figures as a table
EditionP0P1P2P3
30 Oct (this edition)1200
29 Oct1110
28 Oct1211
27 Oct1310
26 Oct1111
23 Oct0320
22 Oct1400
21 Oct2200
20 Oct2210
19 Oct2300
16 Oct1210
15 Oct1310
14 Oct2111
13 Oct1300
12 Oct2200
9 Oct1310
8 Oct2300
7 Oct1310
6 Oct1310
5 Oct2210
2 Oct1220
1 Oct2201

Source: SitRep’s daily editions; stories without a severity are not counted.

Elsewhere in the edition

Binance links $6.3B theft to compromised DevOps laptop

Binance links about $6.3B stolen to a compromised DevOps laptop. The attacker used valid credentials to submit unauthorized withdrawal transactions after accessing a service container. Binance suspended deposits and withdrawals and revokes authorizations while tracing funds with law enforcement. TRM attributes TraderTraitor to Lazarus Group/APT38; Chainalysis supports this.

5 reports

Cisco Advisories PHP Vulnerabilities Affect Cisco Products October 2026

Cisco warns of two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, disclosed by the PHP Foundation and nicknamed PHP2shell. Attacker needs admin authentication for some products. Affected Cisco products include Duo Access Gateway, Expressway series, URWB, and Unified Industrial Wireless Software, with fixed releases and workarounds available. No public exploitation reported.

4 reports

Malicious Claude Code Extension Planted SSH Backdoors

Malicious Claude Code extension on Cursor distributed for about 11 hours on Oct 29, 2026, affecting up to 5,000 developers with malware that installs a persistent SSH backdoor. Attackers injected a loader, collects host data, adds SSH keys, creates a reverse tunnel, and persists via LaunchAgent or Windows tasks, sending data to 134.209..

4 reports

Trezor Flags Suspected Crypto-Theft Implant in Safe 5

Trezor warns of a suspected crypto-theft implant inside a Safe 5 hardware wallet sold by CryptoBilis in Southeast Asia. An Indonesian user found an extra circuit board with a cellular module that could read the screen and transmit data when plugged in. Ledger faced a similar implant incident earlier.

2 reports

TeamViewer Flaw Lets Remote Attackers Target Connected Users

A flaw in TeamViewer (CVE-2026-111585) lets a malicious or compromised host in a remote session crash the viewer and may run code on the viewer, depending on platform. Affects Full Client on Windows, Linux, macOS, Windows Portable, and Android Remote Control prior to 15.83. No password required; fixed in 15.83. No confirmed wild exploits reported.

2 reports

WordPress RCE Flaw Triggers Nearly 63,000 Attacks, Patch Issued

WordPress Core versions 4.7–7.1.3 are vulnerable to a remote code execution flaw with CVSS 8.1. Patches arrived October 28, 2026. Over 24 hours, 62,969 attacks were blocked as threat actors exploited a race window during full-package core upgrades. Update to 7.1.4 and monitor for requests to wp-content/upgrade, unfamiliar admin accounts, plugins, or PHP files.

2 reports

Syrian Hacker Sentenced Over AP Twitter Hack Causing Market Drop

Ahmad Umar Agha, a Syrian Electronic Army hacker known as Th3Pr0, received 42 months in prison for leading a hacking conspiracy against Western outlets. The group hijacked the Associated Press Twitter account on April 23, 2013, posting a false Obama injury report that triggered a $136 billion drop in the Dow Jones Industrial Average.

2 reports

CVE-2026-80093: Windows Cloud Files Mini Filter Driver Type Confusion

Talos warns of a type confusion in Windows Cloud Files Mini Filter Driver (cldflt.sys) enabling kernel crashes and potential write primitives. Affected: Windows Cloud Files Mini Filter Driver v10.0.26100.8457 and 10.0.26100.8655. Exploit via specially crafted Cloud Filter API sequences and CfAbortOperation can trigger race conditions across hydration requests.

2 reports

Also reported

End of the Friday, October 30, 2026 edition.

Colophon

SitRep · Vol. 1, No. 38

Publisher
Published and funded by its independent maintainer. No advertising or sponsors.
AI disclosure
SitRep uses AI to prepare its editions from cited reporting; editions are not reviewed by a person before they are published.
Editorial standards
Read our editorial standards.
Corrections
brief@sitrepit.com or the contact page.