UEFI flaw hits almost all servers in the world
One packet hijacks servers during network boot, and PHP2Shell gets a federal deadline.
The 30-second summary
- UEFI firmware flaw affects almost all servers: a single malicious packet hijacks the equipment during network boot, before protections run.
- Brotli already has active scans against x86-64 Node.js installations; CISA (the US cybersecurity agency) requires a patch by November 10.
- PHP2Shell has confirmed exploitation by CISA, with a federal deadline on October 29; 482,342 attempts registered on the first day.
- Malicious code in Convertr (a Brazilian checkout platform) copies card and CPF data in dozens of fashion stores since October 24.
- Adobe Commerce suffers PolyShell attacks: hundreds of stores breached by a flaw already under active exploitation, CISA confirms.
UEFI flaw hijacks servers during network boot
Researchers from Anthropic and Google disclosed a flaw in the boot code (UEFI firmware) present in most servers. A single malicious packet sent over the network hijacks the equipment at boot, before security checks.
According to the researchers, almost all servers in the world are affected. The hijack occurs before the operating system loads, when defenses are not yet working. No fix has been announced; each manufacturer will need to publish a firmware update.
For the technical team
CVE-2026-97631 is in TianoCore EDK II, code present in the UEFI firmware of most servers. A single malicious packet sent during network boot hijacks the server before the Secure Boot check. The disclosure does not mention a fix.
- CVE
- CVE-2026-97631
- Affected
- TianoCore EDK II in UEFI firmware; according to the researchers, almost all servers in the world, with the attack occurring at network boot
- Exploitation
- not reported in the sources
- Fix
- not reported in the sources; track manufacturer firmware updates and disable network boot where it is not needed
Takeaway: Firmware almost never enters the scope of security tests, and flaws there give total control.
Sources: @IntCyberDigest
On the radarFollow this incident live →Node2Shell: scans hit default x86-64 Node.js installations
The Brotli flaw advanced: active scans and first exploitation attempts are hitting factory-default x86-64 Node.js installations; before, the confirmed risk was on arm64. CISA requires a fix by November 10.
Applications that decompress external data are exposed: compressed HTTP requests, responses from external servers, and files can corrupt memory and allow code execution. The reach includes Bun, Python packages, Visual Studio, PowerShell, and the Envoy and Istio proxies.
For the technical team
CVE-2026-111497 is an out-of-bounds write in the Brotli decoder (1.0.3 to 1.2.0, CVSS 9.2). Malicious compressed data corrupts memory and allows unauthenticated RCE in processes that decompress untrusted content. Active scans reported against default x86-64 Node.js installations.
- CVE
- CVE-2026-111497, CVE-2026-105482, CVE-2026-105483, CVE-2026-106069, CVE-2026-105481, CVE-2026-106072, CVE-2026-106074, CVE-2026-106070, CVE-2026-106071, CVE-2026-106073
- Affected
- Node.js 22.x, 24.x, and 26.x before the fixes; EOL lines with no fix; Bun before 1.4.4; Brotli 1.0.3 to 1.2.0; Python Brotli and brotlicffi packages; Envoy and Istio with Brotli decompression; .NET, Visual Studio, and PowerShell before the October 25 updates
- Exploitation
- confirmed active
- Fix
- Node.js 22.23.4, 24.22.1, or 26.12.1; Bun 1.4.4; Brotli 1.0.10, 1.1.1, or 1.2.1; Microsoft updates from October 25; restart services and rebuild containers
Takeaway: A flaw in a base library requires locating every product that embeds it, patching, and verifying one by one.
Sources: Microsoft, The Hacker News, @ethiack, @HacktronAI, @IntCyberDigest, @BleepinComputer
On the radarFollow this incident live →CISA confirms active exploitation of PHP2Shell with deadline on October 29
PHP2Shell received official confirmation: CISA recorded active exploitation on October 26, added the flaws to the KEV (CISA's list of flaws already used in attacks) and set October 29 as the federal deadline. There is already a public exploit and reported breaches.
The scale is large: Imperva registered 482,342 attack requests and 122,311 sessions in the first 24 hours. PHP runs on about 70% of the web, according to TechCrunch. Exposed servers without the update can be breached without a password.
For the technical team
CVE-2026-109618 and CVE-2026-109619 are use-after-free flaws in PHP 5.4 to 8.5.11, with unauthenticated RCE in configurations that serve web requests (PHP-FPM, mod_php, php-cgi, FrankenPHP, LiteSpeed). CISA added them to the KEV on October 26 with a federal deadline on October 29; there is a public PoC and reported successful exploitation.
- CVE
- CVE-2026-109618, CVE-2026-109619
- Affected
- PHP 5.4 to 8.5.11 in configurations that serve web requests; EOL versions 8.1 and earlier with no fix from the PHP project
- Exploitation
- confirmed active
- Fix
- PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35, or vendor backports (Ubuntu, RHEL, IBM, Siemens, Palo Alto, QNAP); restart services and confirm active workers
Sources: JPCERT/CC, TechCrunch Security, @hakluke
On the radarFollow this incident live →Google fixes 52 flaws in Chrome; Anthropic AI escaped the sandbox
Chrome for desktop received an update with 52 flaws fixed, four of them critical. According to The Hacker News, Claude, the Anthropic AI, found dozens of vulnerabilities in the browser and assembled a working exploit chain that escaped the browser sandbox.
In the demonstration, opening a page was enough to run a program on the computer. A malicious page opened by an employee without the update can have the same effect. The sources do not report real attacks; the fix is already available.
For the technical team
The Chrome for desktop update fixes 52 vulnerabilities, 4 of them critical. The Hacker News reports that Claude (Anthropic) identified dozens of flaws and chained multi-stage exploits with a sandbox escape; in a demonstration, loading a page ran the Calculator on macOS. Specific CVEs not cited in the source items.
- Affected
- Chrome for desktop before the new update; specific version not reported in the source items
- Exploitation
- not observed
- Fix
- update Chrome across the entire desktop fleet, restart the browser, and confirm that the automatic update is active
Sources: @TheHackersNews 1, @TheHackersNews 2
On the radarFollow this incident live →Code in Convertr steals card and CPF data in Brazilian fashion stores
Hackers hid malicious code in a statistics file from Convertr, a Brazilian platform that operates online stores and checkouts for dozens of fashion brands. The code copies card number, expiration date, CVV, cardholder name, and CPF since October 24.
Anyone who paid on these sites may have had full card data and CPF copied, which enables financial fraud. Sansec, a Dutch e-commerce security company, discovered the case; it notified Convertr and received no response. The infected file remained online.
For the technical team
Skimming via a Convertr analytics script: a single statistics file hosted by the platform loads on all checkouts and captures card data (number, expiration date, CVV, cardholder) and CPF since October 24. Discovered by Sansec; according to the company, the group is Brazilian and has been monitored since July 2024.
- Affected
- stores and checkouts operated on Convertr (pages with checkout.convertr); number of brands and victims not reported in the sources
- Exploitation
- confirmed active
- Fix
- not reported in the sources; Sansec notified Convertr with no response and the infected file remained online
Takeaway: One compromised third-party script hit all stores at once; reviewing and monitoring these scripts protects the checkout.
Sources: @namcios, @BleepinComputer
On the radarFollow this incident live →CISA confirms exploitation of file-read flaw in Atlassian
CISA recorded active exploitation of a critical flaw in eight Atlassian Data Center products, including Confluence, Jira, and Bitbucket. An attacker without a password can read internal application files. watchTowr published technical details on October 27.
Internal files can contain credentials and secrets that enable larger breaches. Atlassian rates the flaw as critical, score 9.3, and published fixed versions on October 5. Internet-accessible Data Center instances need a patch today.
For the technical team
CVE-2026-21589: pre-authentication arbitrary file read, from the application root directory, in eight Atlassian Data Center products, including Confluence, Jira, and Bitbucket. CVSS 9.3. Added to the KEV on October 26, 2026; watchTowr published technical details on October 27, 2026.
- CVE
- CVE-2026-21589
- Affected
- eight Atlassian Data Center products, including Confluence, Jira, and Bitbucket; specific versions in the vendor advisory
- Exploitation
- confirmed active
- Fix
- fixed versions published by Atlassian on October 5, 2026; Cloud products already fixed; until updated, restrict external access or apply a WAF
Sources: NVD, Atlassian, @luckyhacker43
On the radarFollow this incident live →PeopleSoft zero-day was three chained flaws, ZDI shows
A technical analysis released today shows that the Oracle PeopleSoft zero-day used in recent attacks combines three chained flaws, fixed in a single patch. A diversion of internal requests bypasses access controls and leads to code execution without a password.
PeopleSoft concentrates HR data and internal company processes. With unauthenticated code execution, the attacker takes over the server and that data. The attacks were attributed to the ShinyHunters group by The Hacker News; the fix already exists and must be applied.
For the technical team
CVE-2026-35273: a chain of three flaws in Oracle PeopleSoft, fixed under a single CVE. The ZDI analysis, by Bobby Gould, details an SSRF that bypasses internal access controls and culminates in unauthenticated RCE, with a video demo. Recent attacks attributed to ShinyHunters by The Hacker News.
- CVE
- CVE-2026-35273
- Affected
- Oracle PeopleSoft; specific versions not reported in the source items
- Exploitation
- confirmed active
- Fix
- the three flaws were fixed under CVE-2026-35273; apply the patch and review logs from before the fix
Sources: @thezdi, @TheHackersNews
On the radarFollow this incident live →Apple brings fix for exploited zero-day to older iPhones and iPads
Apple released iOS 18.7.11 and iPadOS 18.7.11, which bring the fix for a flaw already used in real attacks to older devices. The flaw, in graphics file processing, already had a fix in newer systems since the end of September.
Apple described the attacks as extremely sophisticated and, according to The Hacker News, said they may have hit specific individuals. A malicious file processed by the device can run code without authorization. Older devices without the update remain exposed.
For the technical team
CVE-2026-86950 (CVSS 8.8): out-of-bounds write in CoreGraphics with arbitrary code execution when processing a maliciously crafted file. Exploited as a zero-day in an attack that Apple describes as extremely sophisticated, possibly targeted at specific individuals. Fix backported to iOS and iPadOS 18.7.11.
- CVE
- CVE-2026-86950
- Affected
- older iPhones and iPads on versions before 18.7.11; specific models not reported in the source items
- Exploitation
- confirmed active
- Fix
- iOS 18.7.11 and iPadOS 18.7.11; newer systems already fixed since September
Sources: @BleepinComputer, SecurityWeek, @TheHackersNews, The Hacker News
On the radarFollow this incident live →testmetest campaign weaponized 42 legitimate GitHub repositories
JFrog reports that the campaign of testmetest npm packages compromised 42 GitHub repositories from 11 legitimate owners, including one organization. The malicious code runs when a developer opens the project in tools such as Claude, Gemini, Cursor, and VS Code.
When opening a contaminated project, the developer's machine runs code that steals tokens and publishes new malicious packages in the owner's name. Files too large for GitHub search made detection in common audits difficult. Rotating GitHub and npm credentials is urgent.
For the technical team
JFrog (October 26): the testmetest campaign weaponized 42 repositories from 11 legitimate owners. Hidden hooks for Claude, Gemini, Cursor, and VS Code run .github/init.js when the project is opened. Polymorphic wrappers of 12.9 to 13.7 MB exceed the GitHub code search limit; new payloads use a native addon (.napi_cache, XOR 0x96) and refuse execution in CI, containers, and debuggers. The publisher uses stolen npm tokens or GitHub OIDC trusted publishing.
- Affected
- 42 GitHub repositories from 11 legitimate owners, including one organization; npm packages from the testmetest campaign
- Exploitation
- confirmed active
- Fix
- not reported in the sources; rotate GitHub and npm credentials and audit repositories by Git tree enumeration, not by code search
Takeaway: A repository from a known owner can be compromised; reviewing files and configurations before opening protects the developer.
Sources: @DailyDarkWeb
On the radarFollow this incident live →PolyShell: hundreds of Adobe Commerce stores breached in active exploitation
Attacks dubbed PolyShell breached hundreds of Adobe Commerce and Magento stores, according to The Hacker News. CISA added the exploited flaw to the KEV on October 27 and set November 10 as the federal deadline.
The flaw allows uploading a dangerous file to the server, with code execution and possible control of the store account and session, according to CISA. Every Adobe Commerce or Magento store without mitigation is at risk, with a deadline of November 10.
For the technical team
CVE-2026-48356: unrestricted upload of a file with a dangerous type in Adobe Commerce and Magento, with arbitrary code execution in the context of the current user and possible elevated access or control of the account and session. Added to the KEV on October 27, 2026, federal deadline on November 10, 2026. PolyShell attacks breached hundreds of stores, according to The Hacker News.
- CVE
- CVE-2026-48356
- Affected
- Adobe Commerce and Magento; specific versions not reported in the source items
- Exploitation
- confirmed active
- Fix
- apply vendor fixes and mitigations per BOD 26-04 and the CISA forensic triage requirements; without mitigation, suspend use of the product
Takeaway: Malicious file upload is a classic attack; testing this input and fixing quickly prevents a breached store.
Sources: CISA KEV, The Hacker News
On the radarFollow this incident live →Wrapping up
Flaws in base components dominated the day: from server firmware to the decoder embedded in dozens of products. Between disclosure and active exploitation, days passed, sometimes hours. Patching, restarting, and confirming the fix remains the defense that works.
How many systems are still running unpatched versions at this moment?
Most exploitable flaws only appear when someone looks for them.
Talk to us