In this episode: updates on revoking the compromised eMudhra certificate authority certificates on Windows, macOS, Linux and Python, confirmed exploitation of the PHP vulnerabilities against Palo Alto Networks devices, a token leak in Microsoft Authenticator for Android, and TLS certificate validation flaws in the GoAhead embedded web server.
eMudhra Certificate Revocation Updates for Windows, macOS, Linux and Python
Microsoft released out-of-band updates for Windows 10 and 11 to distrust the compromised eMudhra intermediate certificate authority (CA) certificates, and Apple now blocks them in Safari, Mail and apps that use Apple's networking frameworks. Command-line tools that rely on /etc/ssl/cert.pem, Homebrew, Python's certifi package and Linux CA bundles may still trust them until updated. Because the private keys are known, anyone could issue certificates that appear valid.
https://support.microsoft.com/en-us/servicing/os/windows-11/2026/10/kb5134133-windows-11-24h2-25h2-26h2-update
https://support.microsoft.com/en-us/servicing/os/windows-10/2026/10/kb5134125-windows-10-21h2-22h2-update
https://support.apple.com/en-us/149555
PHP RCE Vulnerabilities Exploited on Palo Alto Networks PAN-OS (CVE-2026-109618, CVE-2026-109619)
Palo Alto Networks has confirmed active exploitation of the critical PHP remote code execution (RCE) flaws against PAN-OS management interfaces exposed to the internet. Some Palo Alto appliances apparently don't always support address space layout randomization (ASLR), which makes exploitation easier, so apply the hotfixes and the advisory's mitigations quickly.
https://security.paloaltonetworks.com/CVE-2026-109618
Microsoft Authenticator for Android Token Theft Flaw (CVE-2026-80097)
Ofek Levin of Enclave.ai found that any other app on the same Android device could obtain authentication tokens from Microsoft Authenticator, breaking a core assumption of using a phone as a second factor. Microsoft has fixed the flaw; versions before 6.2606.4246 are affected.
https://enclave.ai/blog/authmask-we-made-microsoft-authenticator-hand-over-tokens
GoAhead Embedded Web Server TLS Flaws (CVE-2026-115881, CVE-2026-115884)
Researchers from FoxIO found TLS certificate validation flaws in GoAhead, an embedded web server common in IoT devices, including one where certificate revocation lists (CRLs) are loaded but ignored. GoAhead 6.1.1 fixes the bugs, but most users will have to wait for their device vendor to ship an update.
https://foxio.io/blog/choose-your-backend-three-tls-bugs-in-goahead
My Upcoming Classes
https://www.sans.org/profiles/dr-johannes-ullrich
SANS Difference Maker Awards
Dr. Johannes Ullrich is up for the SANS Difference Maker Lifetime Award this year. Please vote:
https://www.sans.org/go/difference-makers-awards-2026

In this episode: Apple's October updates fix 304 vulnerabilities, including an already exploited CoreGraphics flaw now patched for iOS 18; a guest diary shows how to hunt for threat actors in a DShield SIEM honeypot using HTTP language preference headers in Elasticsearch; and Microsoft and PHP ship out-of-band updates for the Brotli decompression vulnerability CVE-2026-111497.
Apple Patches for October 2026: 304 Vulnerabilities Fixed
Apple released updates for all of its operating systems, fixing 304 vulnerabilities. An already exploited CoreGraphics vulnerability (CVE-2026-86950), patched in current iOS versions about a month ago, is now also fixed for iOS 18. Other notable fixes cover a malicious app accessing the camera without user permission (CVE-2026-86990) and a local attacker gaining access to Keychain items (CVE-2026-28864).
https://isc.sans.edu/diary/Apple+Patches+for+October+2026/33458/
Looking for a Language: Threat Hunting in a DShield SIEM Honeypot with ELK
In a guest diary, SANS.edu undergraduate intern Jeffray Spence shows how to use Elasticsearch and Kibana in the DShield SIEM (security information and event management) honeypot to hunt for threats. Filtering on HTTP language preference headers, such as Accept-Language and Accept-Charset values requesting Chinese, isolates related requests and helps identify automated scanning campaigns and the threat actors behind them.
https://isc.sans.edu/diary/Looking%20for%20a%20Language%20%5BGuest%20Diary%5D/33442
More Brotli Updates: .NET Out-of-Band Patch and PHP Windows Builds (CVE-2026-111497)
Microsoft released out-of-band security updates for .NET 8, 9 and 10 and .NET 11 Release Candidate 3 to fix CVE-2026-111497, a buffer overflow in Brotli decompression. PHP rebuilt its Windows binaries with the updated Brotli library without changing the PHP version number, so compare hashes to confirm you run the fixed build. Expect more vendors to release Brotli fixes over the next few weeks.
https://devblogs.microsoft.com/dotnet/dotnet-october-2026-oob-security-updates/
https://www.php.net/archive/2026.php#2026-10-26-1
My Upcoming Classes
https://www.sans.org/profiles/dr-johannes-ullrich

In this episode: why a reliable PHP2Shell exploit is still hard to build, a Node.js Brotli decoder remote code execution flaw, publicly disclosed Tailscale mesh VPN vulnerabilities, and an HPE update fixing 72 vulnerabilities in ArubaOS 8 and 10.
Reliable PHP2Shell Exploitability
Bojan Zdrnja found that building a reliable, universal exploit for the PHP2Shell vulnerabilities is difficult: address space layout randomization (ASLR) requires a second leak to find the base address, a larger PHP memory limit makes exploitation harder, and the offsets depend on the exact PHP version and Linux distribution. Targeted exploitation has been reported, so finish patching and keep session.upload_progress.enabled set to 0 even after applying the update.
https://isc.sans.edu/diary/%28Reliable%29%3F%20php2shell%20exploitability/33452
Node.js Brotli Decoder Out-of-Bounds Write (CVE-2026-111497)
The Node.js October 2026 security releases fix several vulnerabilities, including an out-of-bounds write in the bundled Brotli compression library's decoder that permits remote code execution when an application decompresses attacker-supplied data. OpenAI Codex Security is credited with the discovery; watch for Brotli decoder fixes in other products that use the library.
https://nodejs.org/en/blog/vulnerability/october-2026-security-releases
Tailscale "Tailworm" Vulnerabilities
Researchers made a set of vulnerabilities in the Tailscale mesh VPN public without coordinated disclosure. Exploitation requires access to the tailnet, but critical issues bypass Tailscale's trust model, for example by letting an attacker join their own systems to your tailnet; watch for Tailscale updates.
https://tailworm.com/
HPE Aruba Networking Update for ArubaOS 8 and 10 (AOS-8/AOS-10)
Hewlett Packard Enterprise (HPE) bulletin HPESBNW05162 fixes 72 vulnerabilities in the ArubaOS 8 and 10 wireless operating systems, eight of which allow unauthenticated remote code execution. Apply the update; expect more large updates like this as vendors use AI tools to find vulnerabilities.
https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05162en_us&docLocale=en_US
My Upcoming Classes
https://www.sans.org/profiles/dr-johannes-ullrich

Today's episode covers an update on the PHP2Shell vulnerabilities, a Signal flaw that kept calls alive after hang-up, critical Cisco Snort 3 vulnerabilities, and Linux kernel KSMBD vulnerability reports that were accidentally posted to a public mailing list.
PHP Vulnerability Update
Patches for the PHP remote code execution (RCE) vulnerabilities are now available from many vendors, with notable exceptions such as QNAP. Cloudflare reports a lot of exploit activity, and Amazon saw exploit attempts before public disclosure, but no simple, reliable exploit has surfaced yet. Beware of fake exploits that may attack the person running them.
https://aws.amazon.com/blogs/security/amazon-threat-intelligence-identifies-php2shell-exploitation-prior-to-public-disclosure-in-madpot/
Signal: Flooded Call Event Queue Blocks Local Hang-Up (CVE-2026-113380)
During a call, the other side could flood a Signal client with events and prevent it from hanging up, leaving the connection active so an attacker could keep listening through the microphone. The flaw has been patched; keep Signal updated automatically.
https://github.com/Imahian/Notes/tree/main/docs/CVEs/CVE-2026-113380
Cisco Snort 3 Critical Vulnerabilities
Cisco patched critical Snort 3 vulnerabilities with a base CVSS (Common Vulnerability Scoring System) score of 9.0. The four CVEs group multiple AI-discovered vulnerabilities by shared CWE (Common Weakness Enumeration), making the individual flaws less transparent. Snort is also included in several Cisco appliances.
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-snort3-ybgmhTQe
Linux Kernel KSMBD Vulnerability Reports Leaked
Trend Micro's Zero Day Initiative accidentally posted unpatched Linux kernel vulnerability reports to a public kernel mailing list, including CVSS 9 remote code execution flaws in the kernel's built-in SMB file sharing server (KSMBD). No patches are available yet, and proof-of-concept exploit code was included in some reports.
https://lore.kernel.org/lkml/BYAPR01MB383076AC412E19C48CFBEAE980662@BYAPR01MB3830.prod.exchangelabs.com/
My Upcoming Classes
https://www.sans.org/profiles/dr-johannes-ullrich

This episode covers the critical PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619, which are already being exploited and moved the Internet Storm Center to Infocon yellow, and a Fortinet security hardening release for multiple products based on an AI-assisted security review.
Critical PHP Vulnerabilities (CVE-2026-109618, CVE-2026-109619) Exploited; Infocon Yellow
Two vulnerabilities in the PHP core, an out-of-memory issue triggered by multipart MIME uploads and a memory-clearing flaw exploited with a second request, can lead to remote code execution and can be chained; exploitation is already underway, and your application code, authentication, and configuration will not protect you. Updates are available for PHP 8 but not for PHP 7 or PHP 5, and vendors such as Cisco, Palo Alto Networks, OPNsense, and pfSense have published advisories or updates for their appliances. If you cannot patch, consider web application firewall (WAF) rules that block multipart MIME uploads or temporarily taking the site offline, and assume compromise for public sites without mitigations.
https://www.dshield.org/diary.html/Critical+PHP+Vulnerability+%28CVE-2026-109618%2C+CVE-2026-109619%29+%5Binfocon+yellow%5D/33440/#comment
Fortinet Security Hardening Release for Multiple Products
Fortinet announced updates across several products after a security review using AI tools, crediting a number of AI vendors but naming no CVEs and providing few details. The release covers FortiOS, FortiManager, FortiAnalyzer, FortiMail, and FortiAuthenticator, and Fortinet customers should review it and update.
https://www.fortinet.com/blog/ciso-collective/fortinet-releases-security-hardening-release-for-multiple-products
My Upcoming Classes
https://www.sans.org/profiles/dr-johannes-ullrich

Today's episode covers eight eMudhra intermediate CA certificates revoked after a key generation error, an accelerated critical PHP security release fixing two core vulnerabilities, Oracle's October 2026 Critical Patch Update with 1,295 fixes including an Oracle E-Business Suite SQL injection, and a proof-of-concept exploit for a FortiSIEM gRPC path traversal leading to remote code execution.
eMudhra Intermediate CA Compromise
Eight intermediate CA certificates from Indian certificate authority eMudhra were revoked after a scripting error during the HSM key ceremony left their private keys one byte long. Browsers now reject them, but software with its own CA bundle, like curl on macOS, may need updating. The post includes a browser test page.
https://emudhra.we-have-a-problem.com/
Upcoming Critical PHP Security Release
PHP fixes two critical vulnerabilities in PHP core, rated CVSS 9.2, affecting versions back to PHP 5. The release was moved up to Wednesday, October 21st at 14:00 UTC (10 a.m. Eastern) after details leaked. Expect exploits soon after the patch.
https://www.php.net/archive/2026.php#2026-10-20-1
Oracle Critical Patch Update Advisory - October 2026
Oracle's quarterly update fixes 1,295 new vulnerabilities. Horizon3 is teasing details of an Oracle E-Business Suite SQL injection, CVE-2026-101767.
https://www.oracle.com/security-alerts/cpuoct2026.html
https://x.com/Horizon3Attack/status/2112651247362658611
FortiSIEM gRPC Path Traversal File Write RCE (CVE-2026-106173)
A proof of concept is out for the FortiSIEM flaw patched October 13th. It requires access to port 27918, so block it at the firewall until you patch.
https://horizon3.ai/attack-research/cve-2026-106173-deep-dive-fortisiem-grpc-path-traversal-file-write-rce/
My Upcoming Classes
https://www.sans.org/profiles/dr-johannes-ullrich

Today's episode covers an actively exploited unauthenticated remote code execution chain in Plex Media Server, unpatched Broadcom eCos Wi-Fi flaws that allow code execution on access points without connecting, an infostealer slipped into the OVHcloud command line tools, Exchange Server instability after the October 2026 Windows updates, how to contain AI agents, and a YARA rule for orphaned VBA projects in AutoCAD DWG files.
Small Agents, Smaller Blast Radius: Controlling What AI Can Do
Mark outlines techniques to restrict what AI agents can do, including limiting permissions, using containers, and planning for AI vendors retiring older models.
https://isc.sans.edu/diary/Small%20Agents%2C%20Smaller%20Blast%20Radius%3A%20Controlling%20What%20AI%20Can%20Do/33430
Orphaned VBA Projects Inside DWG Files: YARA Rule
Didier Stevens follows up on hidden Visual Basic for Applications projects in AutoCAD DWG files with a YARA rule to detect them.
https://isc.sans.edu/diary/Orphaned%20VBA%20Projects%20Inside%20DWG%20Files%3A%20YARA%20Rule/33434
Broadcom eCos Wi-Fi Remote Code Execution Vulnerability
Quentin Kaiser shows that an attacker in Wi-Fi range can execute code on Broadcom eCos access points without WPA authentication and steal the WPA key. Broadcom has not issued a CVE, and many ISP-provided access points are affected.
https://quentinkaiser.be/security/2026/10/16/one-parser-two-bugs/
OVHcloud Command Line Tools Compromised
For a few hours on Friday, compromised versions of the OVHcloud CLI shipped an infostealer. Update to version 0.16.0, released after the compromise, and pin package hashes.
https://github.com/ovh/ovhcloud-cli/issues/300
Plex2Shell Vulnerability (Exploited!)
A chain starting with server-side request forgery (SSRF) to loopback lets attackers steal admin tokens and run code on Plex Media Server without authentication (CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, CVE-2026-96656). It is already exploited; patch now and assume compromise if your server is exposed.
https://zmain.info/blog/plex2shell
Exchange Servers May Become Unstable After the October 2026 Windows Updates
Microsoft recommends a registry change rather than uninstalling the update on on-premises Exchange Server.
https://techcommunity.microsoft.com/blog/exchange/exchange-servers-may-become-unstable-after-installation-of-october-2026-windows-/4565382
NGINX ngx_http_core_module Vulnerability (CVE-2026-15176)
https://my.f5.com/manage/s/article/K000162416
My Upcoming Classes
https://www.sans.org/profiles/dr-johannes-ullrich

Today's episode covers the Panchan crypto mining worm spreading over SSH, plus three actively exploited zero-day vulnerabilities: a root-level remote code execution flaw in Cisco Secure Email Gateway, an authenticated root RCE in Palo Alto Networks' management interface, and a chained Ivanti Connect Secure exploit documented by Volexity.
Panchan's Mining Island [Guest Diary]
SANS.edu intern Zachary Norwood analyzes Panchan, a Golang crypto mining worm that spreads via SSH, steals SSH keys, installs a rootkit and uses Discord for command and control, using FakeNet-NG for dynamic analysis.
https://isc.sans.edu/diary/Panchan%27s%20Mining%20Island%20%5BGuest%20Diary%5D/33426
Cisco Secure Email Gateway 0-Day (CVE-2026-76519)
With the reputation feature enabled, the advanced malware protection feature lets attackers write arbitrary files and execute code as root. The flaw is already exploited and there is no workaround, so patch and review Cisco's indicators of compromise.
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-afw-zqYJkjxp
Palo Alto Networks 0-Day (CVE-2026-0322)
An already exploited, authenticated remote code execution vulnerability that runs code as root. Exploitation requires an exposed management interface.
https://security.paloaltonetworks.com/CVE-2026-0322
Ivanti Connect Secure 0-Day (CVE-2026-104935)
Volexity found three chained vulnerabilities: an authentication bypass, an arbitrary file write leading to remote code execution, and a privilege escalation. Ivanti patched the first two under one CVE; the privilege escalation appears unpatched.
https://www.volexity.com/blog/2026/10/13/a-series-of-unauthenticated-events-chained-exploitation-of-ivanti-connect-secure-zero-days/
https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-CVE-2026-104935?language=en_US
No Podcast on Monday, Oct. 19th.
My Upcoming Classes
https://www.sans.org/profiles/dr-johannes-ullrich

Today's episode covers hidden Visual Basic for Applications (VBA) macros left behind in AutoCAD drawings, Ledger hardware crypto wallets found with LTE implants that steal seed phrases, a Docker Hub account conversion flaw that exposed personal access tokens, and a curl update fixing a remote code execution bug in HTTP/2 uploads.
Orphaned VBA Projects Inside DWG Files
Didier Stevens found AutoCAD DWG files whose VBA projects are no longer referenced but still present inside the file, likely left behind by an AutoLISP delete command, and shows a new way to extract them.
https://isc.sans.edu/diary/Orphaned%20VBA%20Projects%20Inside%20DWG%20Files/33420
Ledger Crypto Wallet Supply Chain Attack: Hardware Implants
Ledger wallets sold through authorized resellers, first in Asia and recently by MediaMarkt in Europe, were found with LTE modules and SIM cards that exfiltrate the seed phrase. Reports put losses at up to $100 million.
https://www.zetter-zeroday.com/who-is-planting-backdoors-in-ledger-crypto-wallets/
Docker Hub Account Migration Bug (CVE-2026-105445)
Converting a personal Docker Hub account to an organization moved the old user's personal access tokens to a target user without confirmation, letting an attacker authenticate as that user. Docker fixed the issue and notified affected users.
https://www.docker.com/blog/docker-hub-security-advisory-cve-2026-105445/
curl Patches HTTP/2 Upload Remote Code Execution Flaw
A new curl release fixes several vulnerabilities, including remote code execution triggered when uploading a file over HTTP/2 to a malicious server. A proof of concept is available.
https://thehackernews.com/2026/10/curl-patches-http2-upload-flaw-after.html
My Upcoming Classes
https://www.sans.org/profiles/dr-johannes-ullrich

In today's episode: Microsoft's October 2026 Patch Tuesday fixes 1,417 vulnerabilities, including an exploited Mark of the Web bypass, plus Ivanti patches an exploited Connect Secure flaw and Adobe fixes critical ColdFusion and Adobe Commerce vulnerabilities.
October 2026 Microsoft Patch Tuesday
Microsoft patched 1,417 vulnerabilities, 76 rated critical. CVE-2026-96951, an already exploited Windows Shell security feature bypass, skips the Mark of the Web warning. CVE-2026-108398, a publicly disclosed .NET Framework flaw, bypasses application control. Also patched: 10 remote code execution flaws in Windows DHCP Server (five critical), an Exchange Server RCE triggered by a crafted email (CVE-2026-70571), and many Microsoft Office RCE vulnerabilities.
https://isc.sans.edu/diary/October%202026%20Microsoft%20Patch%20Tuesday/33422
Ivanti October 2026 Security Update
Ivanti fixed an Ivanti Connect Secure vulnerability already exploited in limited attacks, plus two Ivanti Neurons vulnerabilities that can leak the credentials used to connect to Microsoft Intune. Patch, then rotate those Intune credentials.
https://www.ivanti.com/blog/october-2026-security-update
Adobe Patch Tuesday: ColdFusion and Adobe Commerce
Adobe fixed 110 vulnerabilities across 11 products. Adobe Commerce has critical arbitrary code execution flaws, and ColdFusion has CVSS 10.0 server-side request forgery (SSRF) and unrestricted file upload vulnerabilities. Prioritize these two products.
https://www.adobe.com/trust/security/bulletins-and-advisories.html
My Upcoming Classes
https://www.sans.org/profiles/dr-johannes-ullrich

In today's episode: a critical GitLab integer overflow that allows unauthenticated code execution, Let s Encrypt moving to 64-day TLS certificates in February 2027, Midnight Mimosa malware pre-installed on cheap Android phones, and Progress MarkLogic security updates.
CVE-2026-97229 - Integer Overflow Issue in CI/CD Regular Expression Compiler Impacts GitLab CE/EE
An integer overflow in GitLab's CI/CD regular expression compiler lets unauthenticated users execute arbitrary code on self-managed GitLab servers. It was reported responsibly through HackerOne, and no public exploit is known yet. Patch on-premises installations quickly.
https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-2-released/#cve-2026-97229---integer-overflow-issue-in-cicd-regular-expression-compiler-impacts-gitlab-ceee
Let s Encrypt 64-Day Certificate Lifetimes Coming Feb 2027
Let s Encrypt staging certificates drop to 64 days on October 14th, and all new production certificates follow on February 10th, 2027. Test your automation now, and adjust certificate expiration alerts for shorter-lived certificates.
https://letsencrypt.org/2026/10/07/64-day-certs.html
Midnight Mimosa: Malware Pre-Installed on Android Phones
Bitdefender found Midnight Mimosa malware pre-installed on cheap Android phones sold under flagship-like names such as S25 Ultra and i17 Pro. The malware disables the Google Play Store to evade detection and supports clickjacking, a proxy botnet, and ad fraud.
https://www.bitdefender.com/en-us/blog/labs/midnight-mimosa-malware
Progress MarkLogic Critical Security Alert Bulletin October 2026
Progress released October 2026 updates for the MarkLogic data management platform and NoSQL database, with some vulnerabilities rated CVSS 9.9. The most severe let users with low-level query privileges execute arbitrary code, partly through a legacy API that is still enabled.
https://community.progress.com/s/article/Marklogic-Critical-Security-Alert-Bulletin-October-2026
My Upcoming Classes
https://www.sans.org/profiles/dr-johannes-ullrich