Brotli reaches Node.js and Envoy; AI package stole keys
Compression flaw reaches proxies and runtimes; popular AI gateway version distributed a credential thief for three hours.
The 30-second summary
- The Brotli flaw reaches more products: Envoy, Istio, Bun.NET and Python packages can have memory corrupted with malicious data.
- Report details the compromise of eMudhra (certification authority from India): CA keys were recoverable; certificates revoked on October 18.
- AI package LiteLLM came with a credential thief: version 1.107.0 stole cloud keys; 49 thousand downloads in 3 hours.
- WordPress plugin Bricksforge is exploited: code execution without login since October 7; about 6 thousand sites use the plugin.
- Ransomware The Gentlemen lists SAP Latin America: unverified claim with no details; SAP has not confirmed an incident.
Brotli flaw spreads to Envoy, Istio.NET and Python
The Brotli flaw reached more products: beyond Node.js, the decoder memory corruption affects Bun.NET, Envoy, Istio and Python packages that decompress malicious data.
Why it matters: every service that decompresses content received from the internet, such as proxies and APIs, can have memory corrupted and fall under attacker control. The fix must reach runtimes, packages and container images.
For the technical team
Out-of-bounds write in the Brotli decoder, nicknamed Node2Shell/HTTP2Shell. A malicious compressed payload corrupts process memory, with risk of crash, disclosure and RCE. Exploitation condition: component decompressing untrusted Brotli, including HTTP request bodies.
- CVE
- CVE-2026-111497, CVE-2026-105482, CVE-2026-105483, CVE-2026-106069, CVE-2026-105481, CVE-2026-106072, CVE-2026-106074, CVE-2026-106070, CVE-2026-106071, CVE-2026-106073
- Affected
- Node.js 22.x before 22.23.4, 24.x before 24.22.1 and 26.x before 26.12.1 (EOL lines 20.x, 23.x and 25.x without fix); Bun before 1.4.4; Google Brotli 1.0.3 to 1.2.0; PyPI brotli and brotliscffi up to 1.2.0; Envoy 1.36 to 1.39 with Brotli decompressor configured; Istio before 1.29.9/1.30.6/1.31.2; .NET, Visual Studio and PowerShell before the October 25 updates
- Exploitation
- Public PoC
- Fix
- Node.js 22.23.4/24.22.1/26.12.1; Bun 1.4.4; Brotli 1.2.1/1.1.1/1.0.10; brotli 1.2.1 and brotliscffi 1.2.1.0; Envoy 1.40.0/1.39.3/1.38.6/1.37.8; Istio 1.29.9/1.30.6/1.31.2; .NET 8.0.33/9.0.22/10.0.14 and 11 RC3; WAF rules published in observation mode, no blocking by default
Sources: Microsoft, The Hacker News, @ethiack, @BleepinComputer, @DarkWebInformer
On the radarFollow this incident live →PHP: confirmed exploitation report and Unit 42 withdraws assessment
The PHP picture changed this week: researcher hakluke reports confirmed exploitation of the flaw, and Unit 42 withdrew the assessment that linked an attack on a European government to PHP2Shell; it was an attack in the context of a vulnerable PHP application.
Why it matters: PHP runs about 70% of the world's websites. The new critical flaw CVE-2026-115560 has a published mitigation; the definitive fix comes in the next regular version.
For the technical team
CVE-2026-115560: critical RCE disclosed by PHP on October 23; the project team says exploitation requires an unusual combination of configuration and code. Official mitigation: session.upload_progress.enabled=0 until the next patch version. PHP2Shell exploitation attempts continue in volume, and Unit 42 (Palo Alto Networks) retracted the link between the European case and the flaw.
- Affected
- PHP installations in the specific configuration described; industrial vendors that embed PHP (Siemens, Schneider Electric, ABB and others) confirmed products affected by PHP2Shell
- Exploitation
- Public PoC; researcher reports confirmed exploitation, no details in the sources
- Fix
- mitigation session.upload_progress.enabled=0 until the next regular version; PHP 8.5.12/8.4.27/8.3.36/8.2.35 already cover PHP2Shell
Sources: @hakluke, The Hacker News, @LiveOverflow
On the radarFollow this incident live →Microsoft reissues .NET fixes after incomplete patch
Microsoft reissued .NET updates because the October 13 ones did not fully fix two flaws, including one that allows code execution on the developer's machine during debugging.
Why it matters: updating only the shared .NET runtime leaves a gap open when projects reference affected NuGet packages directly. Teams need to review applications and images, or they believe they are patched and remain exposed.
For the technical team
CVE-2026-102870 (CVSS 8.8): RCE in the Blazor WebAssembly debugger; attacker-controlled data escapes a generated C# string when the developer evaluates an expression, with user interaction. CVE-2026-70197: memory corruption in SocketAsyncEventArgs. The out-of-band releases also cover CVE-2026-111497 (Brotli) and CVE-2026-114148 (Linux build tarball).
- CVE
- CVE-2026-102870, CVE-2026-70197, CVE-2026-111497, CVE-2026-114148
- Affected
- .NET 8, 9, 10 and 11 after the October 13 updates; projects that directly reference Microsoft.AspNetCore.Components.WebAssembly.Server and DevServer
- Exploitation
- not observed
- Fix
- out-of-band updates of October 25 for .NET 8, 9, 10 and 11 (e.g. 10.0.14) and updated Blazor NuGet packages
Takeaway: A patch applied without retesting leaves a false sense of being fixed.
Sources: @DarkWebInformer
On the radarFollow this incident live →Report details compromise of eMudhra CAs
The eMudhra incident report (digital certification authority from India) shows that private keys of eight intermediate authorities were recoverable from the public certificates. The certificates were revoked on October 18.
Why it matters: whoever has these keys issues certificates that unpatched systems accept as genuine and intercepts connections, including reading credentials. Java does not check revocation by default; Docker images with embedded Java require their own fix.
For the technical team
Private keys of eight eMudhra (emSign) TLS ECC intermediates demonstrated recoverable from the public certificates on October 17, 2026; revocation on October 18. Go, Electron, Node.js, Python (certifi, pip, uv), NSS, Java and Deno published removal of trust. No exploitation reported, according to Web3Signer and Teku. Tensorust counted 403 Indian government sites still serving revoked certificates.
- CVE
- CVE-2026-111943, CVE-2026-91403, CVE-2026-115557, CVE-2026-114820
- Affected
- clients that trust eMudhra ECC intermediates before the blocks of October 17 to 21; Go before 1.27.3/1.26.10; Electron before 44.9.1/43.8.1/42.11.16; certifi before 2026.10.19; pip before 26.2.2; uv before 0.13.4
- Exploitation
- not observed
- Fix
- Go 1.27.3/1.26.10; Electron 44.9.1/43.8.1/42.11.16; Node.js 22.23.4/24.22.1/26.12.1; Python 3.15.2/3.14.10/3.13.18/3.12.16/3.11.18; certifi 2026.10.19; NSS 3.131.1; OpenJDK updated; pip 26.2.2; uv 0.13.4; update ca-certificates and rebuild Docker images with embedded Java
Takeaway: Inherited system trust is only reviewed when someone tests what it accepts.
Sources: Besu, Tensorust, Consensys (Web3Signer), Python Software Foundation (Hugo van Kemenade), Keytos
On the radarFollow this incident live →LiteLLM 1.107.0 distributed a credential thief
Version 1.107.0 of LiteLLM shipped infected: the publishing pipeline was taken over with stolen GitHub tokens, and the package installed a credential thief. It stayed up for about three hours, with more than 49 thousand downloads.
Why it matters: LiteLLM routes calls to more than 100 AI providers and runs on development machines, CI and production with cloud keys. Wiz saw stolen credentials in use 4.5 hours later, including queries to Amazon Bedrock.
For the technical team
litellm 1.107.0, published on October 21 on PyPI and in the official Docker/GHCR images (tags v1.107.0, latest, main-latest, main-stable), installed an info-stealer after the release pipeline was hijacked with a leaked master key and stolen GitHub tokens. It stole browser passwords, AWS/GCP/Azure keys, SSH, GPG, environment variables and AI API keys, with exfiltration to litellm[.]dev. Active for about 3 hours; Wiz reported credentials in use about 4.5 hours later.
- Affected
- litellm==1.107.0; Docker/GHCR images v1.107.0, latest, main-latest and main-stable in the October 21, 2026 window
- Exploitation
- confirmed active
- Fix
- pin litellm 1.106.2 (last known safe version); 1.107.0 removed from PyPI, Docker Hub and GHCR; rotate all reachable credentials, block litellm.dev and scan the machine
Takeaway: A key exposed in May compromised the pipeline in October; an old credential without rotation remains useful to attackers.
Sources: OSV, The Record, The Hacker News, BleepingComputer
On the radarFollow this incident live →CISA confirms Collabora exploitation and adds flaw to KEV
CISA added the flaw to the KEV (the US cybersecurity agency's list of flaws already used in attacks): Collabora exploitation on Nextcloud servers is confirmed, with backdoors since September.
Why it matters: the flaw allows executing commands without login on the server. Reports show searches for password vaults and cryptocurrency wallets; companies with Nextcloud may have server secrets compromised.
For the technical team
CVE-2026-110447 (CVSS 9.2): unauthenticated command execution, as the web server user, in the richdocumentscode app (Collabora Online Built-in CODE Server). Exploited since September 10, 2026 with webshells; reports cite searches for .kdbx files, wallet.dat, bitwarden and 1Password. Added to CISA's KEV; disabling the app is insufficient.
- CVE
- CVE-2026-110447
- Affected
- richdocumentscode before 26.4.303 on Nextcloud servers
- Exploitation
- confirmed active
- Fix
- update to 26.4.303 or later (most recent 26.4.502) or uninstall the app; hunt for shx*.php files and review access logs
Sources: NVD, The Hacker News, Collabora, Nextcloud community forum
On the radarFollow this incident live →Linux kernel VM escape validated in Vercel challenge
A flaw in the Linux kernel networking allows a guest virtual machine to escape isolation, read physical server memory or take it over completely. The technique was validated in Vercel's $1 million challenge.
Why it matters: cloud providers isolate customers in this same layer. Those running their own virtualization hosts need to update the host kernel; according to Vercel, no challenge submission accessed customer data.
For the technical team
CVE-2026-99999 (PwnEscape): flaw on the host side of the Linux kernel network stack. Packets forged by the guest allow continuous host memory reads, DoS of the sandboxes or execution with root privileges. Discovered by Paulos Yibelo (pwn.ai), validated in Vercel's KVM/Firecracker sandbox challenge.
- CVE
- CVE-2026-99999
- Affected
- host kernels older than the stable backports 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.57 and 7.2.11 (check distributor packages)
- Exploitation
- Public PoC
- Fix
- upstream commit 6785011f8b16 and corresponding stable backports; update the kernel of virtualization hosts
Keycloak fixes unauthenticated account takeover
Keycloak fixed an account takeover flaw: an attacker without a password forces the credential reset of any user and bypasses email verification. Red Hat rates the risk as critical, with a score of 9.1.
Why it matters: the attacker acts over the network, without credentials and without any action from the victim, and takes over accounts including administrative ones. Every login protected by an affected version is exposed, and there is a public proof of concept.
For the technical team
CVE-2026-18963 (CVSS 9.1): bypass in the keycloak-services reset-credentials flow allows resetting a password without authentication and without user interaction. Public PoC on Exploit-DB (EDB-52699). Temporary mitigation: disable password recovery in all realms.
- CVE
- CVE-2026-18963
- Affected
- org.keycloak:keycloak-services 26.0.0 to 26.4.14; 26.5.0 to 26.6.5; 26.7.0 to 26.7.1 (includes Red Hat Build of Keycloak)
- Exploitation
- Public PoC
- Fix
- 26.4.15, 26.6.6, 26.7.2, 26.8.0 or later; mitigation: Realm settings, Login, Forgot password disabled
Takeaway: The password recovery flow is an attack surface almost nobody tests.
Sources: GitHub Advisory Database, NVD, Red Hat, Exploit-DB
On the radarFollow this incident live →Bricksforge: unauthenticated RCE exploited since October 7
The Bricksforge plugin is under active exploitation: the flaw allows executing code on the site without login since October 7, according to Patchstack. About 6 thousand sites use the plugin.
Why it matters: the vendor says every site with the Pro Forms feature active is affected, even without upload fields. Exploitation gives full control of the site; updating does not remove files already planted.
For the technical team
CVE-2026-85097 (CVSS 10.0): unauthenticated RCE in the WordPress plugin Bricksforge via Pro Forms, exploited in the wild since October 7, 2026 according to Patchstack. Review upload directories for unexpected PHP files and access logs; a WAF rule blocking form submission with an image path and PHP destination serves as temporary mitigation.
- CVE
- CVE-2026-85097
- Affected
- Bricksforge <= 3.1.8.9 (WordPress)
- Exploitation
- confirmed active
- Fix
- 3.1.8.10 or higher (current line 4.0.x, most recent 4.0.1)
Takeaway: An active form plugin is enough to expose the site; an app inventory is basic defense.
Sources: SecurityWeek, The Hacker News, SOCRadar, Bricksforge
On the radarFollow this incident live →The Gentlemen claims attack on SAP Latin America
The Gentlemen ransomware group claimed an attack on SAP Latin America and Caribbean, the regional arm that operates in about 10 countries, with Brazil as the largest market. The claim appeared on the leak site on October 26.
Why it matters: the group did not report volume or type of data, and SAP has not confirmed an incident. If the claim holds, customers and integrators in the region should expect themed phishing and fake support invoices.
For the technical team
Listing on The Gentlemen group's leak site on October 26, 2026 (UTC) describing the victim as SAP Latin America and Caribbean, with no details on volume or type of data. Unverified claim; SAP has not publicly confirmed an incident. A separate actor, in a separate and unrelated listing, claimed a 31 GB leak linked to SAP operations in Ecuador.
- Affected
- not reported in the sources
- Exploitation
- not reported in the sources
- Fix
- not reported in the sources
Sources: @DailyDarkWeb
On the radarFollow this incident live →Wrapping up
The pattern of the day is shared dependency: a compression flaw hit Node.js, proxies.NET and Python, and a compromised certification authority forced updates in Go, Java, Python and other runtimes. In two cases the first fix failed and had to be redone. Knowing where each component appears, and checking afterwards that the flaw is gone, became part of the work of patching.
How many shared components in your stack are still unpatched?
Most of these flaws only show up when someone tests the same path as the attacker.
Talk to us