CISA added two flaws to its Known Exploited Vulnerabilities catalog yesterday. One is the Adobe Commerce file-upload bug known as PolyShell. The other is the Brotli decoder flaw that has driven patches across Node.js, .NET, Python and proxies for a week. Both are due 10 November, and PHP2Shell’s federal deadline is tomorrow. Elsewhere today: ZDI shows the PeopleSoft “zero-day” that ShinyHunters exploited is really three chained flaws, Oracle EBS decoys are drawing probes, MLflow has an unauthenticated RCE, and Anthropic published five working exploit chains built by an unreleased model.

Do today

  • Adobe Commerce and Magento: confirm every store runs the July APSB26-73 builds (2.4.x-2026-jul or later), then search CMS blocks for injected loaders. (Adobe APSB26-73)
  • PHP: the federal KEV deadline for PHP2Shell (CVE-2026-109618, CVE-2026-109619) falls tomorrow, 29 October. Any host not yet on 8.5.12, 8.4.27, 8.3.36 or 8.2.35 is overdue. (CISA KEV feed)
  • Node.js and other Brotli consumers: move to Node.js 22.23.4, 24.22.1 or 26.12.1. On VMware SDDC Manager, where the patch is still pending, limit network access to the appliance. (Node.js October security releases, VMSA-2026-0008)
  • Oracle PeopleSoft: confirm the CVE-2026-35273 patch is installed. If it isn’t, disable or remove PSEMHUB, and look for JSP files or XML files that shouldn’t be there. (Oracle security alert)
  • Oracle E-Business Suite 12.2.3–12.2.15: apply the October CPU for CVE-2026-101767, which decoys are already being probed for. (Horizon3.ai advisory)
  • MLflow: upgrade tracking servers to 3.17.0 and stop exposing them without authentication. (GHSA-26p8-2jq9-3vq9)

AI and agent security5 stories

  • Anthropic: an unreleased model built five working exploit chains — Anthropic’s Frontier Red Team says an unreleased internal model, after initial prompting by people, chained bugs into working exploits for Chrome, Safari, Android, Windows and Linux. The Chrome chain escapes the sandbox from a single page visit on stock macOS. Anthropic says it reported 62 Chrome CVEs, all fixed by Chrome 156. The Linux chain is pre-authentication root code execution through multipath TCP (CVE-2026-98432); the Windows one is a remote HTTP/3 crash (CVE-2026-33096). Every bug was fixed before publication, and none was seen in attacks. Our take: the patches and vendor credits can be checked, but the post doesn’t say how much human review went into each chain or how many findings were false positives. Treat it as a measure of what the model can do, not as a new threat to defend against. (Anthropic research post, Chrome 156 release notes)
  • GPT-6.1 Terra system card: Critical cyber rating, more low-severity destructive actions — OpenAI rates GPT-6.1 Terra at Critical in cybersecurity, its highest tier. It reports 24.5% arbitrary-code-execution success on recently disclosed vulnerabilities in an internal benchmark. In internal Codex traffic it logged 22 misalignment flags at severity 3 or above across 48,690 matched tasks, fewer than GPT-6 Sol’s 38. Destructive-action flags at severities 1 and 2 rose against Sol and Astra, but OpenAI gives no numbers for them. In tests with messages from outside agents, Terra carried out the unauthorized action in 11 of 80 samples, against 1.25% for GPT-6.1 Sol. Our take: if you plan to give Terra write access, sandbox it and require approval for destructive commands. All of these results come from simulated environments. (OpenAI GPT-6.1 Terra system card)
  • TrendAI: a 44-agent CyberStrikeAI setup ran intrusions against Japan — TrendAI examined three exposed attacker servers tied to campaigns against Japanese organisations. In the most automated case, an open-source AI pentest platform split the work across what researchers read as 44 agents, covering everything from reconnaissance to exfiltration and reporting. At least 19 organisations were affected, 16 of them in Japan, but deep compromise was confirmed in only a few. A second, human-led operator used an LLM for planning and tooling over 24 days. A third used AI only to write its scripts. Our take: the victim counts are lower bounds taken from the attackers’ own records, and their self-reported successes were not treated as confirmed. Still, all three cases started from known edge-device bugs, default credentials and credentials left in configuration files. (TrendAI research)
  • MLflow 3.17.0 fixes unauthenticated RCE and file read (CVE-2026-116692, CVE-2026-116690) — Third-party scorer deserialization in MLflow 3.12.0rc0 through 3.16.x imports a module path chosen by the caller. An attacker can upload a module as a run artifact and get code execution as the server process. Authentication is off by default, so network access is all that is needed. A separate path-traversal bug lets a prompt-tagged model version serve any local file, including the basic-auth database. A third advisory, CVE-2026-116691, covers CrewAI autologging writing provider API keys into trace spans. Our take: a read-only container filesystem blocks the RCE chain as described. Shared MLflow servers should still be upgraded and placed behind authentication. (GHSA-26p8-2jq9-3vq9, GHSA-m65p-9j7q-6w33, GHSA-j7qq-vr8c-xvw3)
    CVSS 9.8 (v3.1, GHSA) EPSS not yet scored KEV no
  • MCP Python SDK: token audience and redirect leaks fixed in 1.30.0 and 2.2.0 — The SDK’s bearer-auth server never checked a token’s audience. An MCP server could therefore accept a valid token issued for another service on the same authorization server (CVE-2026-116684). The fix adds a validate_token_resource setting that is off by default, so upgrading alone doesn’t close the gap. Its HTTP and SSE clients also followed redirects to any origin, carrying custom API-key headers and, on 307 and 308 responses, the request body (CVE-2026-116685). A third bug fetched server-chosen $ref URLs during schema validation (CVE-2026-116686). The MCP TypeScript SDK’s HTTP transports separately gained request-size and batch limits. Our take: after upgrading, enable audience validation explicitly. (GHSA-w4fh-qvv9-3v23, GHSA-5h93-6whr-6q8j, GHSA-rwrf-2pqf-9j8j)
    CVSS 6.8 (v3.1, GHSA, CVE-2026-116684) EPSS not yet scored KEV no

Application security5 stories

  • GoAhead 6.1.1: revoked client certificates were accepted (CVE-2026-115881) — FoxIO found three TLS bugs in the GoAhead embedded web server, whose behaviour depends on which crypto backend a build uses. On the default OpenSSL backend, versions 3.4.5 through 6.1.0 loaded the CRL but never enforced it, so revoked client certificates still authenticated. The vendor rates this 9.1. On LibreSSL 3.2.x and 3.3.2–3.3.6, an over-long client chain passes when issuer checking is off (CVE-2026-115884, 7.4). On Mbed TLS, a typo truncated the DH modulus, which makes TLS 1.2 DHE_RSA sessions passively decryptable. EmbedThis shipped 6.1.1 to device makers on 2 August and published it on 12 October. Our take: GoAhead sits inside a great deal of firmware. Expect fixes to reach devices slowly, and don’t rely on client-certificate revocation on these devices until they do. (FoxIO write-up, GoAhead 6.1.1 release)
    CVSS 9.1 (vendor) EPSS not yet scored KEV no
  • Convertr: card skimmer planted in a Plausible analytics script — Sansec says a Brazilian Magecart group modified the self-hosted Plausible tracker on Convertr’s analytics server. That script loads on the checkout pages of the dozens of fashion brands that run on the platform. From 24 October it captured card number, expiry, CVV, name and CPF and sent them to 1x0[.]is, according to Sansec. The skimmer was updated on 26 October to match Convertr’s payment API field names. Sansec suspects the way in was CVE-2026-8467, an unauthenticated command-execution bug in Plausible CE 3.0.0–3.2.0, but hasn’t confirmed it. Convertr removed the skimmer and upgraded Plausible on 27 October. Our take: a self-hosted analytics script that loads on checkout pages is effectively part of your payment page. Patch it and watch it as closely as the checkout code itself. (Sansec research)
    EPSS 0.0211 (CVE-2026-8467) KEV no
  • undici: five advisories, including a TLS identity-check bypass (CVE-2026-109383) — Node’s undici HTTP client fixed five issues in 6.29.1, 7.30.1 and 8.12.2. Agent deep-cloned its options through JSON, which silently dropped a custom checkServerIdentity callback. Servers the callback should have rejected were accepted through fetch, request and the global dispatcher. Other fixes cover cache poisoning and data leaking between users through cross-origin redirects, a TLS 1.2 renegotiation DoS, unbounded WebSocket PONG buffering, and a crash in the decompress interceptor. Our take: only apps that pass a function in the tls option are exposed to the identity bypass, but certificate pinning is often built exactly that way. (GHSA-2m5v-pch6-74hx, GHSA-4w7w-5xrc-9h26)
    CVSS 7.4 (v3.1, GHSA) EPSS 0.0018 KEV no
  • Symfony YAML: one request can crash the parser (CVE-2026-109413) — Symfony’s YAML inline lexer recursed on every bracket without applying the parser’s nesting limit, so deeply nested input exhausts the stack. Endpoints using #[MapRequestPayload] that don’t restrict acceptFormat can be crashed by a single unauthenticated request. Fixed in 5.4.54, 6.4.45, 7.4.18 and 8.1.6. In the same batch, Symfony fixed a ReDoS in HeaderUtils::split() that is reachable through the Cache-Control header (CVE-2026-108082). Our take: these are availability bugs only, so they can wait for the normal patch cycle unless an API parses untrusted YAML. (GHSA-2v3c-qxhr-7vpv, GHSA-r925-mgvr-h9cc)
    CVSS 8.7 (v4.0, GHSA) EPSS 0.0040 KEV no
  • TinyMCE media plugin: stored XSS before sanitization (CVE-2026-116675) — Elements carrying a crafted data-mce-object attribute are created and run before TinyMCE’s sanitizer sees them. That gives stored XSS to any low-privileged author when the media plugin is enabled. Affected versions are 8.5.1 up to 8.9.3, and 7.9.3; the fixes are 8.9.3 and 7.9.4, with no workaround. CKEditor 5’s engine package fixed two XSS bugs the same day (CVE-2026-116687, CVE-2026-116688). Our take: rich-text editors in admin and CMS screens often run with privileged sessions, so update the bundled copies too. (GHSA-mf2p-h6hf-fcwm, GHSA-rh54-vffm-5fvp)
    CVSS 8.5 (v4.0, GHSA) EPSS not yet scored KEV no

Exploited and critical CVEs5 stories

  • Adobe Commerce PolyShell now in KEV (CVE-2026-48356) — CISA added the Adobe Commerce and Magento unrestricted-upload flaw to KEV on 27 October, due 10 November. Adobe fixed it in July (APSB26-73), and NVD carries a CISA SSVC note marking exploitation “active” as of 14 July. The KEV listing follows months of attacks: Sansec links the flaw to a mass attack wave and to the cloaked CMS-block loader on 953 stores reported earlier this week. NVD and Adobe both score it 9.3, with user interaction required. Our take: the flaw is three months old, so any store still unpatched should be investigated for compromise, not just patched. (CISA KEV alert, NVD CVE-2026-48356, Sansec PolyShell research)
    CVSS 9.3 (v3.1, NVD and Adobe) EPSS 0.3058 KEV yes, due 10 Nov
  • Brotli decoder flaw added to KEV (CVE-2026-111497) — CISA listed the Google Brotli unchecked-return-value bug on 27 October, due 10 November, without describing the attacks. ELLIO logged a Node.js 24.22.0 exploit attempt from 94.154.43[.]7. Reports of ELLIO’s analysis disagree: SecurityWeek says the final stage didn’t produce a shell in 50 tests, while The Hacker News describes it as a correct exploit attempt. Previdian logged one attempt on 27 October. Broadcom’s VMSA-2026-0008 adds VMware SDDC Manager to the list of affected products, rating 9.1.1 at 9.8 and older lines at 7.5, with patches still pending. Google’s CNA scores the bug 9.2 under CVSS 4.0, and NVD has no score of its own yet. Our take: failed attempts still kill the process, so treat unpatched internet-facing Node.js as a denial-of-service risk even where code execution is unreliable. (CISA KEV alert, ELLIO analysis, Previdian telemetry, NVD CVE-2026-111497)
    CVSS 9.2 (v4.0, Google CNA) EPSS 0.5548 KEV yes, due 10 Nov
  • PeopleSoft “zero-day” is three chained flaws (CVE-2026-35273) — ZDI’s write-up shows the bug ShinyHunters (UNC6240) exploited before Oracle’s June alert is really a chain of three. An SSRF in the Integration Gateway reaches PSEMHUB over loopback, which PSEMHUB trusts by default. From there, either an arbitrary file write drops a JSP web shell, or an XMLDecoder deserialization runs at the next restart without leaving a web shell. Oracle shipped one patch under one CVE, and ZDI is asking for separate CVEs. Mandiant reported a renewed wave in September that bypassed WAF path rules by URL-encoding one character. Our take: if PSEMHUB was reachable before you patched, look for XML files planted in the environment data directory, since that route leaves no web shell to find. (ZDI analysis, Oracle security alert, Mandiant on the September wave)
    CVSS 9.8 (v3.1, Oracle) EPSS 0.9668 KEV yes, since 12 Jun
  • Oracle EBS: decoys see probes for a week-old pre-auth SQL injection (CVE-2026-101767) — Horizon3.ai reported an unauthenticated SQL injection in the AppsTCFServer servlet of the Application Object Library. The default EBS URL firewall allows that servlet, and the injection can be chained to OS command execution. It affects 12.2.3 through 12.2.15 and was fixed in the October CPU on 20 October. Defused told SecurityWeek its EBS decoys recorded exploratory attempts on 27 October; we couldn’t load Defused’s own post, so treat that claim as press-reported. There’s no KEV entry, and CISA’s SSVC note says exploitation “none”. Our take: EBS was hit hard in 2025, and the EPSS score lags behind this kind of early probing. Horizon3’s interim step is to remove the servlet from the URL firewall allowlist. (Horizon3.ai advisory, NVD CVE-2026-101767, SecurityWeek)
    CVSS 9.8 (v3.1, Oracle) EPSS 0.0061 KEV no
  • KEV deadlines: PHP2Shell tomorrow, Plex and Siemens on 3 November — The 27 October catalog shows CVE-2026-109618 and CVE-2026-109619 (PHP) due 29 October. Two Plex Media Server SSRFs (CVE-2026-96652, CVE-2026-96655) and Siemens Software Center (CVE-2026-110936) are due 3 November. The two new entries are due 10 November. Every listing since 20 October is marked “Unknown” for ransomware use. Our take: PHP2Shell has the highest EPSS on this page (0.99999), so it should be the first thing patched. (CISA KEV feed)
    EPSS 0.99999 (CVE-2026-109618) KEV yes, due 29 Oct

Cloud and infrastructure5 stories

  • Tailscale 1.104.4 fixes the “Tailworm” SSH and serve flaws — Tailscale published four bulletins, TS-2026-014 to 017, and shipped fixes in 1.104.4 two days after the uncoordinated disclosure. The most serious: Tailscale SSH socket forwarding ran as root, so a peer with policy access to a node could reach the Docker socket or the tailscaled local API. The fix runs forwarding as the logged-in user. The other bulletins cover a memory-exhaustion crash, tailscale serve Unix-socket backends reaching privileged sockets, and an HTTP/2 race that sent one mount’s capability headers to another. There are no CVEs or severity ratings yet. Our take: upgrade, or set TS_SSH_DISABLE_FORWARDING=1 until you can. Headscale users should note the reporting that its 0.29.5 release doesn’t address these. (Tailscale security bulletins, Tailscale v1.104.4 release)
  • Microsoft drops six eMudhra roots from Windows, Edge follows — An out-of-band update on 26 October (KB5134133 for Windows 11, KB5134125 for Windows 10) removed six eMudhra G3 roots and an AAA Certificate Services cross-sign from the Windows trust list. Edge removed the same seven certificates on 27 October. Machines that receive automatic CTL updates already got the earlier blocks of the eight compromised intermediates. The KBs are meant for offline machines and ones with CTL updates turned off. Microsoft is still reviewing the remaining eMudhra roots. Our take: air-gapped Windows fleets are the ones most likely to miss this, so check which client certificates and private PKI chains still terminate at those roots. (MSRC blog, KB5134133)
  • VMware SDDC Manager affected by Brotli RCE, no patch yet (VMSA-2026-0008) — Broadcom says SDDC Manager in VMware Cloud Foundation is affected by CVE-2026-111497 because it runs on Node.js. It rates 9.1.1.x critical (9.8) and 9.0.x, 9.1.0 and 5.2.x important (7.5). All fixed versions show “patch pending”, with KB460732 and KB460734 referenced. The advisory text says workarounds exist, but the response matrix lists none, so check the KBs. Our take: SDDC Manager controls the whole private cloud. Until the patch ships, keep it off user networks. (VMSA-2026-0008)
    CVSS 9.8 (v3.1, Broadcom, 9.1.1.x) EPSS 0.5548 KEV yes (Brotli), due 10 Nov
  • Atlantis: a pull request can run commands during plan (CVE-2026-116676) — Atlantis 0.4.0 through 0.47.0 puts the Terraform workspace name from a PR’s atlantis.yaml into a shell command without escaping it. Any contributor who can trigger atlantis plan can run commands as the service account. That needs no custom workflow and no apply rights. Fork PRs are exposed only with --allow-fork-prs. Fixed in 0.47.1. Our take: Atlantis usually holds cloud admin credentials, so upgrade, then rotate anything its environment exposed if untrusted contributors could open PRs. (GHSA-rjh2-4xgw-p2hj)
    CVSS 8.8 (v3.1, GHSA) EPSS not yet scored KEV no
  • CISA ships ScubaGear 2.0 and ScubaGoggles 1.1.0 — CISA’s Microsoft 365 assessment tool now calls REST APIs directly across all supported services and adds Power BI coverage. It merges the Defender, Purview, Exchange Online and Teams controls into one Security Suite baseline. Release notes add a new Entra ID policy (MS.AAD.9.1v1) to block risky AI agents, which needs Entra ID P2. ScubaGoggles for Google Workspace drops its dependence on admin log events and adds Gemini controls and a simpler “assured controls” baseline. Our take: free and worth running quarterly; BOD 25-01 baseline changes mean earlier passing results may now fail. (CISA announcement, ScubaGear releases)

Crypto and Web32 stories

  • Virtualine bulletproof host’s domain seized; bitcoin payments laundered, DOJ says — US prosecutors in the Eastern District of Virginia and the FBI seized virtualine[.]net with German, Dutch and UK police. Chainalysis says the DOJ alleges Virtualine took bitcoin straight to unhosted addresses so customers avoided exchange compliance checks, then laundered the proceeds. Chainalysis’s analysis ties those flows to ransomware operators, infostealer infrastructure, Russian-language forums and scam addresses. No amounts were disclosed. Our take: a domain seizure doesn’t take down the hosting itself, and bulletproof hosts tend to reappear on new ASNs, so keep blocking on network ranges rather than the brand name. (Chainalysis on the seizure, DOJ release)
  • TRM: Russian-language markets now take about 95% of darknet crypto — TRM Labs says Russian-language darknet markets received more than $1.2 billion of nearly $1.3 billion in market receipts from January to September 2026. Kraken Market alone took over $900 million. Total darknet receipts were $1.7 billion in 2025 and are projected to be about the same this year. Russia is prosecuting Hydra and Kraken figures, but no Russian-language market has been seized since Hydra in April 2022. TRM’s own figures for the third-quarter change differ slightly between the body and the FAQ (within 4% versus 3% below). Our take: arrests haven’t reduced the volume, which points to cash-out services, not individual markets, as the useful place to apply pressure. (TRM Labs report)

Incidents and industry5 stories

  • GMO Desktop Cloud: ¥8 billion demand refused, $1M bounty offered — GMO Internet says the attackers behind the Onamae.com Desktop Cloud intrusion demanded about ¥8 billion and threatened customers’ trading accounts. It won’t pay, and it launched a bounty of up to US$1 million in total on 28 October for tips leading to an arrest. The attackers posted what they claim is customer data on 27 October; GMO shut that leak site down. OANDA Japan reported unauthorized trades using ID and password pairs it believes came from the GMO servers. GMO is paying every user ¥5,000, plus ¥10,000–25,000 per data category for confirmed leaks, and won’t restart the breached systems. Our take: rotate broker credentials that were ever typed on these hosted desktops. (GMO incident report and bounty, OANDA Japan statement)
  • So-net: 2.59 million member records taken, 54,401 email passwords exposed — Sony Network Communications says an attacker reached the So-net member database on 19 October. The data covers 2,141,986 So-net records and 443,495 plala records: names, phone numbers, email addresses, user IDs and dates of birth. Account login passwords weren’t taken. Mail passwords for 54,401 addresses across four services were, and those were reset on 27 October. Sixteen bank-account records were also exposed. Our take: expect targeted phishing in Japanese that uses real user IDs, and watch for credential stuffing with the leaked mail passwords. (So-net notice)
  • University of Copenhagen: 525,000 people exposed from a test environment — UCPH says attackers broke into a test environment and took names, Danish national ID numbers, phone numbers and personal email addresses for about 525,000 people. PINs for about 20,000 ID cards were compromised and reissued. A suspected second attack on 26 October turned out to be internal activity linked to the first. Several systems are still closed to outside access. Our take: this is another breach where test environments held real national ID numbers. Use synthetic data or masked copies. (UCPH operational updates)
  • UNM Health back to normal; a group claims 36,000 machines — UNM Health Sciences Center says critical systems are back, all hospitals are open, and ambulance traffic was normal by 27 October. It says the attack hit some end-user devices but not core systems or servers. Help Net Security reports that an extortion outfit called BYOD claims 36,000 machines, Oracle HR and payroll data, student records and the Entra tenant. None of that is confirmed, and we couldn’t find the claim in any primary source. Our take: the hospital’s statement and the group’s claim are far apart, so until UNM’s investigation is done, treat the claim as unproven, not as false. (UNM HSC updates, Help Net Security)
  • F6: ZloyRAT spread as fuel-finder, drone-alert and “state VPN” apps in Russia — F6 says a dropper posing as a traffic-police and fuel-availability radar installs the ZloyRAT Android trojan. The same operators push drone-attack tracker and GosuVPN lures, all promoted from a .online domain registered on 4 October. ZloyRAT reads SMS and notifications, makes calls and USSD requests, and watches more than 60 banking, government, marketplace and Telegram apps. The operator is unknown, and F6 gave no download or loss figures. Our take: these lures play on wartime shortages and fear, which works anywhere people install APKs from chat links. (F6 report)

Bottom line

  1. KEV now covers PolyShell and Brotli, with PHP2Shell due tomorrow. The three have EPSS scores between 0.31 and 0.99999 and all are confirmed exploited, so patch them before anything else on this page.
  2. Oracle’s enterprise stack is under steady pressure. PeopleSoft’s chain has an XML-file route that leaves no web shell, and the new EBS SQL injection is already drawing probes a week after the CPU.
  3. AI tooling is now a target in its own right. MLflow and the MCP SDK both shipped insecure defaults, and the Anthropic and OpenAI disclosures show exploit-building capability rising faster than the safeguards around it.