CISA confirms Brotli exploited and sets November 10 deadline

CISA confirms active exploitation of Brotli with November 10 deadline

After demonstrations of remote code execution, CISA confirmed active exploitation of the Brotli flaw and listed it in the KEV (CISA's list of flaws already used in attacks), with a deadline of November 10. The code is in Node.js, Bun, Python, Envoy, and PowerShell.

Services that decompress data from external sources can be taken over by attackers without a password, with memory read and remote code execution, already demonstrated by Imperva on an official Node.js image. Lines 20.x, 23.x, and 25.x have no fix and require migration.

Takeaway: A flaw in an embedded library appears in many products at the same time; the dependency inventory defines the speed of the fix.

Sources: Microsoft, The Hacker News, @HacktronAI, @BleepinComputer

ESXi zero-day used against the legal sector enters the KEV

China-linked hackers exploited a VMware ESXi flaw as a zero-day against US organizations, including law firms, according to CrowdStrike. CISA listed the flaw in the KEV, with a fix deadline of November 11.

The flaw leaves administrative actions out of server logs, which delays detection and investigation of intrusions. According to CrowdStrike, the group enters through edge devices exposed to the internet and moves to vCenter. Companies with VMware virtualization should prioritize the fix.

Takeaway: Administrative actions outside logs delay any investigation; validate whether your telemetry covers the hypervisor.

Sources: CISA KEV, The Hacker News, SecurityWeek

Palo Alto confirms PHP2Shell exploited on management interfaces

Palo Alto Networks confirmed active exploitation of the PHP2Shell flaws against management interfaces exposed to the internet. The flaws allow remote code execution without authentication and affect PAN-OS on Siemens RUGGEDCOM. Imperva recorded 482,342 scanning requests in 24 hours.

PHP runs today on about 70% of web software, according to TechCrunch, and exploitation gives control of the server without a password. Cited research reports 25 servers with root access in four countries, including an environment tied to the US government.

Sources: JPCERT/CC, TechCrunch Security, @hakluke

CISA confirms PolyShell in Adobe Commerce with November 10 deadline

CISA added the PolyShell flaw in Adobe Commerce to the KEV on October 27, citing active exploitation, with a federal deadline of November 10. Attacks exploit CVE-2026-48356 and breached hundreds of stores, according to The Hacker News. Adobe already fixed it in July.

Adobe Commerce and Magento stores without the July patches accept file upload without authentication, which leads to code execution and control of the store. After fixing, it is necessary to look for attacker code and injected content blocks, the DailyDarkWeb recommends.

Sources: CISA KEV, The Hacker News, @DailyDarkWeb

GhostAction reaches 22,964 repositories and tokens continue to be reused

The GhostAction campaign is larger than previously known: 22,964 targeted repositories, more than 72,000 malicious commits, and 1,792 compromised accounts with five families of malicious code. Attackers compromise maintainers on GitHub and inject automation routines to steal secrets, according to The Hacker News.

Every credential configured in the repository and any password stored in Git history was offered to the attacker, according to StepSecurity, which recommends treating the finding as a confirmed intrusion. Stolen tokens continue to be reused. The second stage reaches the developer's machine through VS Code.

Takeaway: A secret stored in Git history remains valid to the attacker after removal; revoking is the only fix.

Sources: GitGuardian, StepSecurity, @TheHackersNews, The Hacker News

WordPress 7.1.4 fixes 22 flaws, with RCE during the update

WordPress released version 7.1.4 with fixes for 22 vulnerabilities. The most severe is a race condition in the core update, which could allow remote code execution during the update. WordPress does not indicate active exploitation.

Sites on earlier versions are exposed to code execution on the server. Many flaws are injected script (stored XSS, which steals sessions) and require the Contributor, Author, or Editor role, common on sites with multiple writers. Versions 4.6 and earlier receive no fixes.

Sources: @DarkWebInformer

testmetest hid a 13 MB payload from GitHub search

JFrog Security Research detailed how the npm testmetest campaign works: hidden configurations run malicious code when the project opens in Claude Code, Gemini CLI, Cursor, or VS Code. Files from 12.9 to 13.7 MB escaped GitHub code search.

In total, 42 repositories from 11 legitimate owners were weaponized. The attacker code publishes new malicious npm packages with stolen tokens or GitHub OIDC trusted publishing, which publishes without a token. JFrog recommends auditing repositories through Git tree enumeration.

Takeaway: A trusted publishing credential becomes a propagation vector; the audit must cover the entire Git tree.

Sources: @DailyDarkWeb, @IntCyberDigest

ZDI publishes zero-day in Telegram animated stickers with no fix

The Zero Day Initiative disclosed CVE-2026-111105 (CVSS 7.0), a flaw in the Telegram animated sticker library rlottie that allows code execution inside the app. The final advisory requires user interaction; researcher Saifeldeen Aziz claims a 0-click chain, without a click, with execution on iOS.

Telegram told ZDI that sticker validation on the server mitigates the flaw, and there is no patched version or recorded attacks. The flaw affects clients used by journalists, executives, and government teams, and a malicious sticker would compromise the device and the conversations.

Sources: @DarkWebInformer, @DailyDarkWeb, @IntCyberDigest

KeyDrift stole encryption keys on Cisco SD-WAN networks

Cisco Talos revealed KeyDrift, malware installed in Cisco Catalyst SD-WAN environments compromised through CVE-2026-20127, a maximum severity flaw, CVSS 10.0, fixed in February. The malware copies and stores the keys that encrypt traffic between sites and maintains attacker access.

With the keys captured, attackers can decrypt traffic between sites. Talos assesses with high confidence an infrastructure overlap with the Silent Train network, used by Volt Typhoon. Observed targets include satellite services, defense, aerospace, and policy research. The attacks are historical.

Takeaway: The fix closes the entry vector; old intrusions remain active, so look for persistence after updating.

Sources: The Hacker News, @DailyDarkWeb, @TheHackersNews