CISA added two exploited bugs to KEV on Friday, both due Monday: Nextcloud’s built-in Collabora CODE server and the VeloCloud Orchestrator SQL injection. PHP disclosed a third, unpatched session bug with a simple config mitigation, and the Brotli decoder flaw behind Node2Shell turned out to reach Python, Envoy, Istio and Bun too. LiteLLM’s postmortem traces last week’s poisoned release to a key leaked in May and never revoked.

Do today

  • Collabora CODE (Nextcloud built-in): upgrade the richdocumentscode app to 26.4.303 or remove it, then run the Nextcloud integrity check and look for unexpected PHP files. Disabling it is not enough. (Collabora advisory)
  • PHP: set session.upload_progress.enabled=0 in php.ini or the FPM pool and restart workers, and finish PHP2Shell patching on vendor appliances. (php.net)
  • VeloCloud Orchestrator (on-prem): confirm the fix is in and run the forensic triage CISA requires; the KEV deadline is 26 October. (CISA KEV catalog)
  • Python images: upgrade Brotli to 1.2.1 and brotlicffi to 1.2.1.0, and patch Envoy or Istio wherever Brotli decompression is enabled. (PyPA advisory)
  • Okta Access Gateway: upgrade to 2026.10.2; until then, review Admin Console sign-ins by non-admin users. (Okta advisory)
  • Microsoft 365: restrict the device-code flow with Conditional Access and audit Entra for unfamiliar DESKTOP- devices registered from hosting IPs. (Huntress)

AI and agent security7 stories

  • LiteLLM postmortem: a master key leaked in May was never revoked — LiteLLM’s attack-chain write-up fills in the first step that was still unconfirmed on Friday. A master key for its Agent Platform was committed to a public repository on 27 May; the commit was force-pushed away, but the key stayed valid. On 10 October the attacker used it to obtain an org owner’s unscoped GitHub CLI OAuth token, then stole two more maintainers’ tokens through throwaway CI workflows. Release approval had been relaxed that week to “any two engineers”, and on 21 October the attacker pointed the pipeline at a lookalike fork and published 1.107.0. Microsoft’s analysis adds that the payload lives in startup hooks in site-packages (cook.pth, sitecustomize.py), outside the litellm folder, so removing the package doesn’t remove it. LiteLLM published the attacker addresses 69.48.229[.]143 and 199.91.221[.]39.

    • Hunt beyond the package: sweep images, pip and uv caches and internal mirrors for Microsoft’s hashes and the startup files, and investigate from a clean machine.
    • Our take: rewriting git history is not revocation. Search your repositories for committed keys and revoke them at the issuer.

    (LiteLLM attack-chain postmortem, Microsoft Security blog)

  • Outside red team finds ways to blind OpenAI’s agent monitoring — METR and Redwood Research spent three weeks inside OpenAI this summer testing its internal agent monitoring. They estimate only 75–94% of agentic Responses API traffic was eligible for monitoring, and context-compaction events went unwatched, leaving about 10% of internal Codex traffic unmonitored until OpenAI fixed it during the exercise. The monitor fired only when an agent handed control back, so an agent that kept acting could postpone review indefinitely; two client-controllable headers could switch monitoring off for new agents. OpenAI says the production issues are patched, which METR has not verified. This is separate from the monitoring incident covered on 22 October. For anyone running agents: monitor on a schedule, not only at turn end, and reconcile all inference against monitor logs. (METR report)

  • “Skynet” agent hijacks exposed model servers to run its attacks — Symantec caught an autonomous agent that scans for unauthenticated OpenAI-compatible endpoints, including self-hosted model servers, AI gateways and MCP servers, then uses the victim’s own inference to scan, exploit web frameworks, steal secrets and drop XMRig. It carries about 74 tools, is configured for up to 100,000 unattended steps, and uses a jailbreak that frames credential theft as routine work. Symantec’s honeypot logged more than 127,000 requests. Put authentication on every path, including model-listing and health endpoints, restrict egress, and use IMDSv2 with a hop limit of 1. (Symantec)

  • Ransomware affiliates ran intrusions through AI agents, with a human approving each step — SOCRadar found an exposed server running “Phantom”, a kill-chain framework driven through OpenCode with commercial models reached via OpenRouter. When a model refused, the operators reframed the task as an authorized red-team test. The server listed 62 targeted organizations, 36 in the US, and 46 staged INC encryptor builds. The operators’ own notes cite FortiClient EMS CVE-2026-35616, SimpleHelp CVE-2024-57727 and cPanel CVE-2026-41940; SOCRadar says it didn’t verify those, and The Hacker News’s CVE list differs slightly. Our take: the speed-up is real, but the entry points are old edge bugs, so patching and exposure checks still decide the outcome. (SOCRadar)

  • x402 payment SDKs let a hostile API drain an agent’s wallet — V12 reported 25 issues in the x402 agent-payment SDKs, three critical. By default the client took the first payment option with no spending cap, so a malicious API could charge up to the full token balance. The TypeScript Solana facilitator accepted an approval instruction as if it were a transfer, and the sign-in client would sign login messages for other domains. V12 says the critical fixes landed on 20 August; The Hacker News puts them in the 18 August releases and names @x402/* 2.23.0. There is no CVE or GHSA, so npm audit won’t flag old versions. Upgrade, set explicit spend caps, and check the issuer domain. (V12 research, The Hacker News)

  • Agent-framework fixes: FastMCP, LangGraph checkpoints, MLflow — Several advisories reached the GitHub database on 23 October. None is in KEV, and none needs same-day action.

    • FastMCP: direct calls skipped authorization after server transforms, exposing hidden admin tools; fixed in 3.4.10 and 4.1.2 (GHSA-7xgj-8392-5q4r). A second bug let a malicious MCP server redirect M2M OAuth client secrets; 4.1.2 fixes it only if you also set issuer (GHSA-vqqp-x5qm-5qp4).
    • LangGraph checkpoints (CVE-2026-115883): dotted namespace labels collide, allowing cross-tenant reads and overwrites; fixed in postgres 3.1.3 and sqlite 3.1.2 (GHSA-6hmw-9432-67qq).
    • MLflow (CVE-2026-115886): unauthenticated SSRF through scorer and GenAI evaluate endpoints, only with the optional TruLens packages installed; fixed in 3.17.0 (GHSA-2wqp-q3c6-ccj5).

  • LLM-written proofs formally verify 123 fuzzed libraries — Anthropic’s Frontier Red Team and Theorem used Claude to write about 180 million lines of Rocq proofs covering 239 OSS-Fuzz entry points. The work found hundreds of bugs, including a decompressor out-of-bounds write, and rediscovered libexpat CVE-2026-56132. Some fixes are still going upstream. Our take: this is vendor research about its own model, so treat the scale claims as the lab’s; the useful signal is that proof-backed checks are getting cheap enough for parsers. (Anthropic research)

Application security8 stories

  • Brotli flaw reaches Python, Envoy, Istio and Bun (CVE-2026-111497) — The bug behind Node2Shell sits in Google’s Brotli C decoder, versions 1.0.3 to 1.2.0, so anything that bundles it is in scope. The fix was committed in February but not released until 21 October. Python’s Brotli is fixed in 1.2.1 and brotlicffi in 1.2.1.0; urllib3, requests, httpx, aiohttp and Scrapy use them automatically when installed, so exposure is usually transitive. Envoy is fixed in 1.40.0, 1.39.3, 1.38.6, 1.37.8 and 1.36.12, only where the Brotli decompressor is configured, and Istio in 1.31.2, 1.30.6 and 1.29.9. Aikido did not attempt code execution through the Python extension, Bun’s fix in 1.4.4 rests on press reports, and Envoy’s advisory oddly lists no CVE. Don’t wait for Dependabot: the GitHub advisory lists no affected package, so check versions directly. (PyPA advisory, Envoy advisory, Istio bulletin, Aikido)
    CVSS 9.2 (v4.0, Google CNA) CVSS 8.1 (Red Hat) EPSS 0.0071 KEV no

  • eMudhra distrust reaches Electron and Python — Electron’s advisory blocks the compromised intermediates in Chromium networking and in Node’s tls, https and fetch, fixed in 44.9.1, 43.8.1 and 42.11.16, with no workaround. Each Electron app has to ship a rebuild, so desktop software you didn’t build is now on the clock; MongoDB Compass 1.53.1 is one example (CVE-2026-115929). Python’s 21 October releases bundle updated pip and certifi 2026.10.19, and python.org says to upgrade certifi, pip, uv and sigstore. A separate denylist for the ssl module (CVE-2026-115557, scored 9.4 by the CNA) is not merged yet, so no released Python includes it. Apps using the system trust store still depend on OS updates. (Electron advisory, CPython pull request, python.org downloads)
    CVSS 7.4 (v3.1, Electron) EPSS not yet scored (CVE-2026-115557) KEV no

  • Craft CMS: two separate paths from a control-panel user to code execution (CVE-2026-115938, CVE-2026-115935) — Both need only the accessCp permission. One abuses element-search conditions as an oracle to leak securityKey a character at a time, then forges signed parameters into an unsandboxed template render. The other uses header injection to write an attacker-chosen CRAFT_SECURITY_KEY into .env. Fixing one doesn’t fix the other; upgrade to 5.11.2 or 4.18.9. If you have non-admin control-panel accounts, rotate the security key and check .env for unexpected changes. (Craft advisory, GHSA-gg4p-9c93-5hfp, GHSA-j6hf-w48h-c9f9)
    CVSS 8.8 (v3.1, CNA) EPSS 0.0068 KEV no

  • Postiz: three critical bugs, open to anyone because sign-up is open (CVE-2026-115931, 115932, 115933) — The self-hosted social scheduler exposed internal helpers that read arbitrary files, including the signing secret and database credentials, and had a path traversal in media publishing. One shared secret signed sessions, invites, password resets and provisioning tokens, so a user could mint any valid token. Self-registration is on by default, so no prior account is needed. Upgrade to 2.25.3, turn off open registration, and rotate the signing secret and connected-channel tokens. The advisories don’t state affected ranges and are unreviewed. (GHSA-h5r5-h782-vqvp, GHSA-9j6f-8rw3-93c4, Postiz 2.25.3 release)
    CVSS 9.9 (v3.1, CNA) EPSS 0.0065 (115931) KEV no

  • Ruby fixes the regex-engine bugs behind four GitLab RCEs — Ruby 4.0.9, 3.4.12 and 3.3.13 patch the Onigmo bugs underneath GitLab’s CVE-2026-89078, 93577, 97229 and 110264. GitLab fixed its own exposure on 21 October, but any Ruby app that compiles user-supplied patterns with Regexp.new has the same problem. Ruby 3.3.13 also updates the resolv gem. Self-managed GitLab below 19.5.1 or its matching patch release is still the urgent case; everything else can go in the normal cycle. (Ruby announcement, GitLab 19.5.1 release)
    CVSS 10.0 (v3.1, GitLab, CVE-2026-110264) EPSS 0.0051 KEV no

  • Echo proxy middleware: a refused WebSocket upgrade skips route auth — In the Go framework’s Proxy middleware, any upgrade request switched the connection to a raw tunnel. If the upstream refused the upgrade but kept the connection open, later requests bypassed Echo’s router and route-level auth. It needs an upstream that keeps connections alive and trusts Echo for authorization, and it can’t reach arbitrary hosts. Upgrade to 4.16.1 or 5.4.1, or reject Upgrade requests on proxy routes. No CVE yet. (GHSA-cxf3-9h37-7rr8)
    CVSS 9.1 (v4.0, GitHub) EPSS none (no CVE) KEV no

  • Wasmtime 36.x LTS: index overflow can escape the sandbox (CVE-2026-115889) — Bit-packed value indices in Cranelift overflow silently in release builds, so a very large or crafted function can be miscompiled, with possible sandbox escape. It affects default settings on all architectures, in versions before 36.0.19 and 37.0.0 up to 43.0.0; current mainline was already safe. This is a different bug from the one covered on 23 October. It matters only if you run untrusted Wasm on those lines. (GitHub advisory, Wasmtime 36.0.19)
    CVSS 9.9 (v3.1, GitHub) EPSS 0.0066 KEV no

  • Happy DOM: incomplete fix leaves host code execution open (CVE-2026-115895) — A malformed named-import alias injects JavaScript that runs on the Node host, an incomplete fix for CVE-2026-33943. It requires enableJavaScriptEvaluation: true and attacker-controlled HTML, so server-side rendering, preview and scraping services are the ones exposed. Sources disagree on the fix: the advisory body says no patch, while its metadata and NVD say 21.0.4. Upgrade to 21.0.4 and keep JavaScript evaluation off for untrusted content. (GHSA-834v-8h66-3h79)
    CVSS 8.8 (v3.1) EPSS 0.0056 KEV no

Exploited and critical CVEs4 stories

  • Collabora CODE app for Nextcloud: exploited command injection, KEV due Monday (CVE-2026-110447) — An unauthenticated command injection in the richdocumentscode app’s proxy.php works while the built-in CODE server isn’t running, such as after a restart, upgrade or crash. Standalone, Docker and distro-package Collabora installs are not affected, and the earlier CVE-2025-66208 fix doesn’t cover this path. NVD’s description says it was exploited in September and October, and Nextcloud forum users report web shells. Upgrade to 26.4.303 or remove the app; disabling it is not enough. Then run the integrity check for extra files, look for unexpected PHP under apps/richdocumentscode/, and rotate database and app secrets if you find anything. CISA requires forensic triage under BOD 26-04. (Collabora advisory, Nextcloud forum warning)
    CVSS 9.2 (v4.0, CNA) EPSS 0.0229 KEV yes, due 26 Oct

  • PHP2Shell: a third session bug, and appliance fixes start landing — On 23 October PHP disclosed CVE-2026-115560, an unpatched code-execution bug in session upload progress. It needs an unusual setup, with the serializer switched to php at runtime. The mitigation is session.upload_progress.enabled=0, set in php.ini or the FPM pool, not through ini_set or .user.ini. Vendors are shipping fixes for the original two CVEs:

    • Palo Alto: PAN-OS and Panorama management UI and XML API are affected, GlobalProtect is not. Hotfixes are due 26–30 October, and Palo Alto sees no exploitation of its products.
    • QNAP: fixed QTS and QuTS builds dated 23 October; Note Station 3, QVR and others are still pending.
    • Also: Cisco, HPE ClearPass, Okta Access Gateway and AWS (EMR with Ganglia, Lightsail rebuilds, an updated WAF rule group) published advisories.

    Attempts are widespread but there is still no confirmed compromise, and neither CVE is in KEV. NVD scores 109618 at 9.8 and 109619 at 8.1, while PHP gives both 9.2. (php.net, Palo Alto advisory, QNAP QSA-26-18, AWS bulletin 2026-143)
    CVSS 9.8 / 8.1 (v3.1, NVD) EPSS 0.118 / 0.062 KEV no

  • VeloCloud Orchestrator SQL injection now in KEV (CVE-2026-114625) — CISA added the exploited on-prem VeloCloud Orchestrator bug covered on 23 October to KEV on Friday, with a 26 October deadline and a forensic-triage requirement. If you patched, still run the triage: patching doesn’t remove access an attacker already had. (CISA KEV catalog, Arista advisory 0199)
    EPSS 0.0081 KEV yes, due 26 Oct

  • ArubaOS: 72 fixes, eight rated CVSS 10 — HPE’s bulletin covers Mobility Conductors, Controllers, Gateways and Instant APs on AOS-8 and AOS-10. The eight top-rated bugs (CVE-2026-79844 to 79851) are unauthenticated: auth bypass to code execution, a PAPI auth bypass, command and SQL injection, and buffer overflows. Fixed releases are 10.8.1.2, 10.7.2.7, 10.4.1.14, 8.13.3.1 and 8.10.0.24. HPE found most internally and knows of no public exploit; EPSS is low and NVD hasn’t scored them. Our take: low exploitation odds today, but management and PAPI exposure is the deciding factor, so check that first and patch in the next window. (HPE CSAF HPESBNW05162)
    CVSS 10.0 (v3.1, HPE) EPSS 0.004–0.014 KEV no

Cloud and infrastructure5 stories

  • Okta Access Gateway: any signed-in user can reach the Admin Console, then run commands (CVE-2026-115546, CVE-2026-115547) — OAG didn’t verify the chosen authentication source at sign-on, so anyone with a valid session on any source could tamper with it and get a SAML assertion for the Admin Console. A second bug lets an admin inject configuration values that run system commands as the OAG service account. Chained, an ordinary session becomes command execution on the gateway. All versions before 2026.10.2 are affected, there is no workaround, and Okta doesn’t state exploitation status. Okta also published a PHP2Shell advisory for OAG the same day. (Okta CVE-2026-115546, Okta CVE-2026-115547)
    CVSS 8.1 / 9.1 (v3.1, Okta) EPSS 0.0042 / 0.0044 KEV no

  • GKE ships node images without the compromised eMudhra CAs; Ubuntu nodes still waiting — Google’s GCP-2026-071 says unpatched TLS clients and container runtimes on every supported GKE Standard and Autopilot version trust the compromised certificates; internal control-plane and node mTLS is not affected. Fixed Container-Optimized OS versions include 1.36.5-gke.1817000, 1.35.9-gke.1390000 and 1.34.12-gke.1508000, with older minors listed in the bulletin. Google recommends a manual upgrade even with auto-upgrade on; Ubuntu node fixes are not out. It also says to set an explicit caBundle on every external admission webhook, pin images by digest and rebuild application images on patched bases. Google rates it High on the GKE page and Medium on the Cloud-wide page, which lists about 19 affected products. (GKE security bulletins, Google Cloud bulletins)
    EPSS 0.0015 KEV no

  • AWS Multi Model Server is end of life and its RCE won’t be fixed (CVE-2026-115812, CVE-2026-115813) — AWS disclosed a path traversal during model archive extraction that leads to code execution, and an SSRF through model downloads. Both sit on the management interface, which has no authentication, and every release through 1.1.11 is affected. AWS says to migrate off MMS; until then, bind management to loopback, don’t pass external URLs, and restrict the serving port where the two can’t be split. Older inference images may still carry it, so search images for multi-model-server. (AWS bulletin 2026-148)
    CVSS 9.8 (v3.1, AWS) EPSS 0.0073 KEV no

  • AWS fixes a sandbox bypass in its managed MCP Server (CVE-2026-115845) — The Python validator for the run_script tool used an incomplete blocklist, so an authenticated user could run arbitrary code, but only inside their own isolated session. AWS fixed it on its side, and no customer action is needed. Our take: blocklist validators for code tools keep failing; isolation did the real work here. (AWS bulletin 2026-149)
    CVSS 6.4 (v3.1, AWS) EPSS 0.0038 KEV no

  • GitHub: a SCIM bug deleted about 12,285 managed-user accounts in June — From 1 to 13 June, a new deprovisioning path didn’t check whether an account was an Enterprise Managed User, so SCIM deprovisioning deleted accounts instead of suspending them. About 12,285 accounts were hit, 76 of them active, and they showed up as “ghost” users in issues, pull requests and audit logs. GitHub disabled the path on 13 June and restored the accounts in October, and reports no unauthorized access. No action is needed, but if attribution in audit logs from June matters to you, check for user.delete events in that window. (GitHub changelog)

Crypto and Web32 stories

  • Initia halts its chain after an attacker mints bridged tokens and moves about $2.7M to Ethereum — Minting began at 14:59 UTC on 23 October and the chain was halted at 15:41, five seconds before the attacker moved 1,135.5 ETH to a new wallet, as Blockscout records show. Agora froze the attacker’s AUSD about 50 minutes later, after the ETH had gone. The loss is disputed: Initia’s co-founder says about $2.7M, Bitquery $2.73M and D2 Finance about $2.65M, and Initia hasn’t confirmed a figure. The root cause is disputed too: the co-founder blames a zero-day in the MoveVM, while D2 Finance points at LayerZero bridge adapters that paid out against unbacked tokens. There is no restart date or postmortem yet, and KuCoin has suspended INIT deposits and withdrawals. Bridges should reconcile burns against backed supply, and users should ignore “recovery” links. (Blockscout transfer, Blockscout freeze, Bitquery investigation, The Block)

  • Extradition in a $36.9M crypto investment scam — The US Justice Department says Zheng Zhao, extradited from the Netherlands, was arraigned in Los Angeles on a money-laundering conspiracy charge. Prosecutors say victims found through social media, dating sites and texts were steered to fake trading platforms, and more than $36.9M from 174 US victims went through one Bahamas bank account, was converted to USDT and sent to a wallet controlled in Cambodia. Eight co-conspirators have pleaded guilty. (DOJ press release)

Incidents and industry10 stories

  • Quest Diagnostics takes its lab-ordering portal offline after intruders reach patient records — Quest found unauthorized access to Quanum Lab Services Manager, which clinicians use to order tests and view results, on 21 October. It believes certain patient records were accessed, likely including health and personal information, but doesn’t yet know how many people are affected. The portal is paused, along with two related tools as a precaution; EMR and direct lab interfaces are not affected. Quest says the incident is unrelated to PHP2Shell, and no group has claimed it. Its filing came under Item 8.01, not the material-incident item, and says operations were not materially disrupted. Expect phishing that uses the outage as a lure. (Quest 8-K, Quest notice)

  • Huntress: replayed session tokens got into 79 Microsoft 365 organizations — From 14 July to 22 September, attackers replayed tokens collected through adversary-in-the-middle relays, device-code phishing and social engineering, with 497 successful sign-ins out of more than 200,000 attempts. They registered at least 48 rogue Entra devices named DESKTOP- plus eight hex characters, and at 19 organizations wiped and replaced MFA methods within three hours, then used hidden inbox rules for payroll fraud. Huntress attributes the infrastructure to AS210558 (1337 Services GmbH). On compromise, revoke sessions as well as resetting the password: a password reset alone leaves replayed tokens working. (Huntress)

  • Capcom says 11.77 million accounts were exposed — The exposed data is email addresses plus account creation time, last login time and IP, and login counts; 43 accounts also exposed date of birth, gender, country and nickname. Attackers changed passwords on 196 accounts, which Capcom has reset. No passwords or card data leaked. Capcom detected the intrusion on 19 October and reported it to police and Japan’s privacy regulator, but hasn’t said how attackers got in. (Capcom statement (Japanese))

  • More than 70,000 credentials tied to a firewall and VPN break-in campaign — Group-IB links an actor it tracks as k0t to intrusions through FortiWeb CVE-2025-64446 and PAN-OS GlobalProtect CVE-2026-0257, using the old FortiOS default-key bug CVE-2019-6693 to decrypt configs and noPac to reach Domain Admin. Many compromises date from February to June. Victims overlap with Qilin and The Gentlemen leak sites, but the relationship is unconfirmed, and the operators may be access brokers. Enable private-data-encryption on FortiGates, and treat any exported config as leaked credentials: rotate LDAP and AD bind accounts. (Group-IB)

  • BlackX bootkit gets past Secure Boot on patched Windows — Kaspersky found a UEFI bootkit using the 2022 Baton Drop flaw (CVE-2022-21894) against diplomatic agencies in Tajikistan, Uzbekistan and Turkmenistan. Victims had the patch but had never applied the manual revocation of the “Windows Production PCA 2011” certificate. That certificate expired on 19 October, but expiry alone doesn’t block vulnerable boot managers. Kaspersky attributes it to APT41 with medium confidence. Check whether the PCA 2011 revocation steps have actually been applied across your Windows fleet. (Kaspersky Securelist)

  • ESET: one Russian group broke in, Sandworm wiped — ESET describes UAC-0099 phishing its way into a Ukrainian grain logistics firm in July 2025 and deploying a new Go backdoor, MythicRatatoskr, whose command server sat inside the Yggdrasil mesh network. In September 2025 the data was wiped with SDelete pushed through Group Policy, which ESET attributes to Sandworm. ESET says this is the first documented state-aligned use of Yggdrasil, but it couldn’t tell which group operated the backdoor. Alert on SDelete launched through Group Policy. (ESET WeLiveSecurity)

  • Iran’s Prince of Persia group is back, now using US shared hosting — Semperis says the group went quiet for about three months after a February report, returned on 27 May, and took more than 1,800 files from one victim in its first week back. It moved a command server onto US shared hosting, then built a new one behind Cloudflare in August. SecurityWeek calls this the first US-hosted command server since 2016; Semperis’s own report stresses the first use of shared hosting instead. (Semperis)

  • Researchers neutralize Popcorn Time’s updater with 2 million updates — Eye Security found that the Time4Popcorn updater installs unsigned updates over HTTP with SYSTEM or root rights (CVE-2026-30612), and no fix is coming. Working with Shadowserver, which sinkholed the domains, Eye pushed more than 2 million updates that disabled the updater, and described the operation publicly on 22 October. The disclosure itself dates from June. Uninstall the app wherever it turns up. (Eye Security)
    CVSS 9.8 (v3.1, CISA ADP) EPSS 0.0042 KEV no

  • Toronto Crime Stoppers pauses tips after 176,859 were stolen — The stolen tips date from January 2022 to November 2025 and include 14,973 names. The breach was at vendor Navigate360 and its P3 tip software in March; a hacktivist group claimed it, and the data was later published. A national figure of about 1.5 million tips comes from press reports only. (Toronto Crime Stoppers)

  • UK proposes up to 14 years in prison for damaging undersea cables — A UK government consultation proposes new offences for damaging subsea cables and pipelines: up to 14 years for intentional damage, 10 for reckless and 2 for grossly negligent, plus unlimited fines. It would replace an 1885 offence and add security duties for operators. Some press described it as sentencing guidelines; it is proposed legislation. Responses close on 14 January 2027. (GOV.UK consultation)

Bottom line

  1. KEV caught up on Friday, and both new entries are due Monday. Collabora CODE and VeloCloud need patching and forensic triage this weekend, not next sprint.
  2. Shared libraries turn one bug into many. Brotli and the eMudhra distrust both arrived through Node first and are now landing in Python, Envoy, Electron and GKE, where scanners don’t yet flag them. Check versions directly.
  3. Rewriting history is not revocation. LiteLLM’s breach started with a key force-pushed away in May, and Huntress’s victims reset passwords while replayed tokens kept working. Revoke at the issuer.