CISA Adds Multiple Vulnerabilities to Known Exploited Catalog

Critical·KEV·CVSS 10.0·EPSS 18%·5 outletsNew CISA Adds Multiple Vulnerabilities to Known Exploited Catalog CISA added multiple vulnerabilities in Ivanti, GitLab, and Cisco to the KEV Catalog due to active exploitation. Do this today Prioritize remediation for all CVEs listed in the CISA KEV Catalog. Read the full story ↓
Critical·PoC public·CVSS 9.8·4 outletsNew Linux Kernel Flaw (CVE-2026-98432) Allows Remote Root Execution A critical Linux kernel flaw enables unauthenticated remote root command execution via a race condition in TCP handling. Do this today Install updated kernel packages from distribution vendors or temporarily block IPv4 TCP packets containing IP options via nftables. Read the full story ↓
High·4 outletsNew Binance Hacked: $6.3 Billion Theft Linked to North Korea Binance confirmed a $6.3 billion hack, with blockchain analysis linking the theft to North Korean actors. Read the full story ↓

From the editor

Defenders must prioritize patching Ivanti, GitLab, and Cisco due to active exploitation listed in the KEV Catalog. Additionally, address the Linux kernel flaw (CVE-2026-98432) to prevent unauthenticated remote root execution. Monitor for activity related to the Binance incident.

Anmol Singh YadavEditor, PwnSpectrum

Actively Exploited 4

CISA Adds Multiple Vulnerabilities to Known Exploited Catalog Critical·KEV·CVSS 10.0·EPSS 18%·5 outlets·CISANewRead CISA added multiple vulnerabilities in Ivanti, GitLab, and Cisco to the KEV Catalog due to active exploitation.
CISA added CVE-2026-111357 (Ivanti), CVE-2026-118527 (Ivanti), CVE-2026-97229 (GitLab), and CVE-2026-76418 (Cisco) to the KEV Catalog. These vulnerabilities involve issues such as missing authentication, integer overflow, and unchecked return values.

Why it matters. Active exploitation of these vulnerabilities presents significant risk. Federal agencies are required to prioritize rapid remediation for KEV Catalog entries on publicly exposed assets.

Do this today Prioritize remediation for all CVEs listed in the CISA KEV Catalog.

Affected
Ivanti Connect Secure, GitLab Community Edition, GitLab Enterprise Edition, Cisco Secure Firewall ASA Software, Cisco Secure FTD Software

CVE
CVE-2026-111357, CVE-2026-118527, CVE-2026-97229

Read on CISA Post on X LinkedIn

Also covered by BleepingComputer
```
{"coverage":1,"evidence":1,"freshness":0.255,"importance":1,"novelty":1,"quality":0.95,"total":0.92}
```
PHP Core RCE Vulnerabilities (CVE-2026-109618, CVE-2026-109619) Critical·KEV·PoC public·CVSS 9.8·EPSS 100%·24 outlets·Fortinet PSIRTDay 9NewRead Two critical PHP vulnerabilities allow unauthenticated remote code execution via memory handling flaws.
CVE-2026-109618 allows RCE via improper handling of memory after out-of-memory conditions. CVE-2026-109619 permits RCE due to global state referencing freed request memory.

Why it matters. These vulnerabilities allow unauthenticated remote code execution on web applications utilizing PHP, posing a critical risk to internet-facing services.

Do this today Update to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35 immediately; isolate or take offline PHP 8.1 or earlier systems.

Affected
All PHP installations serving web requests

CVE
CVE-2026-109618, CVE-2026-109619, CVE-2026-115560
1. Thu 22 OctPHP Core RCE Vulnerabilities (CVE-2026-109618, CVE-2026-109619)
2. Fri 23 OctPHP Core RCE Vulnerabilities (CVE-2026-109618, CVE-2026-109619)
3. Sat 24 OctPHP Core RCE Vulnerabilities (CVE-2026-109618, CVE-2026-109619)
4. Mon 26 OctPHP Core RCE Vulnerabilities (CVE-2026-109618, CVE-2026-109619)
5. Tue 27 OctPHP Vulnerabilities (CVE-2026-109618, CVE-2026-109619) Allow RCE
6. Wed 28 OctPHP Core RCE Vulnerabilities (CVE-2026-109618, CVE-2026-109619)
7. Thu 29 OctPHP RCE Vulnerabilities (CVE-2026-109618, CVE-2026-109619)
8. Fri 30 OctPHP Core RCE Vulnerabilities (CVE-2026-109618, CVE-2026-109619)
9. TodayPHP Core RCE Vulnerabilities (CVE-2026-109618, CVE-2026-109619)
Read on Fortinet PSIRT Post on X LinkedIn

Also covered by CISA, Unit 42
```
{"coverage":1,"evidence":1,"freshness":0.001,"importance":1,"novelty":0.6,"quality":0.95,"total":0.855}
```
Drupal Commerce Core Vulnerability Exploited via Access Bypass (CVE-2026-118539) Critical·Exploited·3 outlets·Drupal.org via BleepingComputerNewRead Unauthenticated attackers are exploiting a missing authorization flaw in Drupal Commerce Core.
A critical access bypass vulnerability, tracked as CVE-2026-118539, exists in the Commerce Core module. This flaw stems from missing authorization protection on certain routes and entity fields. Threat actors are actively exploiting this vulnerability.

Why it matters. Exploitation can lead to financial impact by bypassing intended security controls within the e-commerce framework.

Do this today Upgrade Commerce Core to version 3.3.13 or Commerce Core 8.x-2.41.

Affected
Commerce Core versions 0.0.0 to 2.41 and 3.0.0 to 3.3.13

CVE
CVE-2026-118539

Read the original · Drupal.org Post on X LinkedIn

Summarised from BleepingComputer; also covered by SecurityWeek, The Hacker News.
```
{"coverage":0.774,"evidence":0.9,"freshness":0.619,"importance":0.75,"novelty":1,"quality":0.95,"total":0.823}
```
Ivanti Connect Secure: Zero-Day Exploitation for Root Access Critical·Exploited·Volexity via GBHackersNewRead Attackers exploited multiple zero-days in Ivanti Connect Secure to achieve root access and steal credentials.
Attackers exploited a chain of zero-day vulnerabilities in Ivanti Connect Secure VPN appliances. This allowed them to bypass authentication, execute malicious code with root privileges, and steal credentials. The exploitation targeted an appliance that was fully patched at the time of the observed activity.

Why it matters. Successful exploitation grants root access, enabling credential theft from services like Active Directory and potential internal network reconnaissance.

Do this today Upgrade to Ivanti versions 25.1.1.3 or 22.8R2.6.

Affected
Ivanti Connect Secure VPN appliances

Read the original · Volexity Post on X LinkedIn

Summarised from GBHackers.
```
{"coverage":0.387,"evidence":0.9,"freshness":0.692,"importance":1,"novelty":1,"quality":0.65,"total":0.817}
```

commonly target cryptocurrency and financial organizations, information technology companies and software supply chains, government entities, and education-related organizations.

Microsoft, via The Record

Vulnerabilities & Patches 4

Linux Kernel Flaw (CVE-2026-98432) Allows Remote Root Execution Critical·PoC public·CVSS 9.8·4 outlets·Linux Foundation via BleepingComputerDay 2NewRead A critical Linux kernel flaw enables unauthenticated remote root command execution via a race condition in TCP handling.
A use-after-free vulnerability (CVE-2026-98432) exists in the Linux kernel's IPv4 TCP networking code. This flaw, stemming from a race condition, allows an unauthenticated attacker to execute arbitrary commands as root.

Why it matters. Exploitation can lead to full system compromise without requiring user interaction or credentials. The vulnerability affects MPTCP listeners and potentially ordinary TCP connections.

Do this today Install updated kernel packages from distribution vendors or temporarily block IPv4 TCP packets containing IP options via nftables.

Affected
Linux kernels (v4.4 and later), Ubuntu, RHEL, Rocky Linux, Debian

CVE
CVE-2026-98432
1. Fri 30 OctLinux Kernel TCP Flaw (CVE-2026-98432) Allows Root Command Execution
2. TodayLinux Kernel Flaw (CVE-2026-98432) Allows Remote Root Execution
Read the original · Linux Foundation Post on X LinkedIn

Summarised from BleepingComputer; also covered by The Hacker News, CSO Online.
```
{"coverage":0.898,"evidence":0.7,"freshness":0.399,"importance":0.75,"novelty":0.6,"quality":0.95,"total":0.73}
```
TeamViewer Integer Overflow (CVE-2026-111585) Allows Remote Code Execution High·CVSS 8.8·Remedio via SecurityWeekNewRead An integer overflow in TeamViewer allows a malicious host to execute arbitrary code on the connected viewer's system.
An integer overflow vulnerability, tracked as CVE-2026-111585, exists in the remote-control screen processing component of TeamViewer clients. Exploitation requires an established remote-control session to an attacker-controlled host. The flaw allows an attacker to overflow an in-memory pixel buffer by manipulating screen dimensions.

Why it matters. Successful exploitation can lead to arbitrary code execution on the viewer's system, potentially compromising the IT support technician's machine. The vulnerability is reachable in the default configuration via a normal session.

Do this today Update TeamViewer clients to version 15.83 or later.

Affected
TeamViewer clients (Windows, macOS, Linux, Android)

CVE
CVE-2026-111585

Read the original · Remedio Post on X LinkedIn

Summarised from SecurityWeek; also covered by The Hacker News.
```
{"coverage":0.613,"evidence":0.4,"freshness":0.637,"importance":0.75,"novelty":1,"quality":0.9,"total":0.671}
```
Ultralytics: Multiple Code Injection and Path Traversal RCE Vulnerabilities High·CVSS 8.8·Zero Day InitiativeNewRead Multiple unauthenticated RCE vulnerabilities exist in Ultralytics requiring user interaction for exploitation.
Multiple vulnerabilities were identified in Ultralytics, including path traversal and code injection flaws. These flaws allow remote code execution when a user interacts with a malicious page or file.

Why it matters. Exploitation allows remote attackers to execute arbitrary code on affected installations. User interaction is required for all reported vulnerabilities.

Affected
Ultralytics installations

CVE
CVE-2026-118613, CVE-2026-118614, CVE-2026-118615, +4 more

Read on Zero Day Initiative Post on X LinkedIn
```
{"coverage":0.387,"evidence":0.4,"freshness":0.151,"importance":0.75,"novelty":1,"quality":0.9,"total":0.588}
```
Alpine iLX-F511: Multiple Vulnerabilities Reported by ZDI High·CVSS 8.8·Zero Day InitiativeNewRead Alpine iLX-F511 has multiple reported vulnerabilities including RCE via Bluetooth and SSH.
Zero Day Initiative reported several vulnerabilities affecting Alpine iLX-F511. One flaw allows remote code execution via Bluetooth pairing, requiring network-adjacent access. Another vulnerability permits local privilege escalation if low-privileged code execution is achieved.

Why it matters. Exploitation paths include unauthenticated RCE via Bluetooth and local privilege escalation. These flaws impact the security posture of affected devices.

Do this today Restrict interaction with the product.

Affected
Alpine iLX-F511

CVE
CVE-2026-118601, CVE-2026-118602, CVE-2026-118603, +6 more

Read on Zero Day Initiative Post on X LinkedIn
```
{"coverage":0.387,"evidence":0.4,"freshness":0.151,"importance":0.75,"novelty":1,"quality":0.9,"total":0.588}
```

Worth watching

Exploitation The $2,000 php2shell Challenge Was Unexploitable LiveOverflow · 26 Oct
Tool demo Free Lab Fridays - The Webcast Black Hills Information Security · 30 Oct

Malware & Ransomware 2

Malicious Claude Code Extension on Cursor Planted SSH Backdoors High·5 outlets·OpenSourceMalware via BleepingComputerNewRead A compromised Claude Code extension distributed via Cursor installed malware attempting to create persistent SSH backdoors.
A malicious version of the Claude Code VS Code extension was distributed through the Cursor extension marketplace for approximately 11 hours on October 29. The extension contained a JavaScript loader that executed upon loading without user interaction.

Why it matters. The malware attempted to collect system information and install persistent SSH backdoors, creating a potential remote access vector for attackers.

Do this today Check for the presence of an 'svc-telemetry' SSH key on affected machines and follow Cursor's remediation instructions.

Affected
Developers using Cursor IDE with Claude Code extension

Read the original · OpenSourceMalware Post on X LinkedIn

Summarised from BleepingComputer; also covered by Ars Technica, Dark Reading.
```
{"coverage":1,"evidence":0,"freshness":0.626,"importance":0.75,"novelty":1,"quality":0.95,"total":0.633}
```
NetamLoader Malware Targets Asian Government Windows Systems High·Securelist via The RecordNewRead NetamLoader is malware using legitimate Microsoft components to target customized Windows builds in Asian governments.
Kaspersky researchers identified NetamLoader, malware utilizing legitimate Microsoft components and XAML markup. The malware was found within a package in a directory used for Windows operating system updates. Once active, it can interfere with security scanning and exfiltrate data.

Why it matters. The malware's tailoring to a specific government Windows build suggests detailed target knowledge. This highlights risks associated with customized, independently managed operating systems.

Affected
Customized Windows 10 used by Asian government organizations

Read the original · Securelist Post on X LinkedIn

Summarised from The Record; also covered by GBHackers.
```
{"coverage":0.613,"evidence":0,"freshness":0.708,"importance":0.75,"novelty":1,"quality":0.95,"total":0.583}
```

Threat Actors & Campaigns 2

Vapor Panda Uses Agentic AI Tool ARTEX for Large-Scale Compromise High·CrowdStrike via CyberScoopNewRead A China-backed group used an agentic AI tool to compromise 140 targets across 11 days at high speed.
CrowdStrike reports a China-backed group, tracked as Vapor Panda, used the ARTEX agentic AI framework to compromise about 140 sensitive targets in 11 days. The group targeted over 200 organizations in at least 14 countries, including government, defense, and financial sectors.

Why it matters. The use of agentic AI allows for an unprecedented speed and scale of mass-exploitation campaigns, increasing attack velocity significantly.

Do this today Increase visibility into endpoints, identities, and cross-domain capabilities.

Read the original · CrowdStrike Post on X LinkedIn

Summarised from CyberScoop.
```
{"coverage":0.387,"evidence":0,"freshness":0.907,"importance":0.75,"novelty":1,"quality":0.9,"total":0.564}
```
China-Linked Actor Uses AI Framework ARTEX Against Multiple Targets High·The Hacker NewsNewRead State-sponsored actors are using ARTEX, an AI-powered penetration testing framework, against numerous organizations.
Chinese state-sponsored threat actors were observed using ARTEX, a Go-based AI-powered penetration testing framework. This activity targeted high-value organizations simultaneously. CrowdStrike attributed the activity to an adversary tracked as Vapor Panda.

Why it matters. The use of AI in penetration testing indicates advanced and scalable attack capabilities against multiple entities.

Read on The Hacker News Post on X LinkedIn
```
{"coverage":0.387,"evidence":0,"freshness":0.8,"importance":0.75,"novelty":1,"quality":0.8,"total":0.543}
```

Breaches & Incidents 3

Binance Hacked: $6.3 Billion Theft Linked to North Korea High·4 outlets·TRM Labs via The RecordNewRead Binance confirmed a $6.3 billion hack, with blockchain analysis linking the theft to North Korean actors.
Binance reported a $6.3 billion theft, which the company traced to a compromised laptop belonging to an engineer. Blockchain security firms and analysts linked the attack to North Korea's TraderTraitor group.

Why it matters. The incident demonstrates the capability of state-sponsored actors to execute large-scale financial theft against major crypto platforms.

Affected
Binance

Read the original · TRM Labs Post on X LinkedIn

Summarised from The Record; also covered by SecurityWeek, Ars Technica.
```
{"coverage":0.898,"evidence":0,"freshness":0.499,"importance":1,"novelty":1,"quality":0.95,"total":0.68}
```
DebugBear Supply Chain Compromise Drains Funds from Polymarket High·Hudson Rock via SecurityWeekNewRead Malicious code from a website monitoring tool compromised Polymarket sessions, resulting in significant unauthorized fund withdrawals.
Malicious code linked to DebugBear, a website performance monitoring firm, was used to hijack logged-in Polymarket sessions. The code attempted to sell user positions or send tokens to an attacker-controlled address. Polymarket halted international trading after users reported unauthorized withdrawals.

Why it matters. Third-party service compromises can facilitate session hijacking and direct financial loss for platform users. Defenders must validate the integrity of all integrated third-party scripts.

Do this today Instruct users to pull the DebugBear RUM snippet from their websites.

Affected
Polymarket users

Read the original · Hudson Rock Post on X LinkedIn

Summarised from SecurityWeek.
```
{"coverage":0.387,"evidence":0,"freshness":0.653,"importance":0.75,"novelty":1,"quality":0.9,"total":0.538}
```
DHS Personnel Data Leak Exposes 41,000 Workers and Agents High·4 outlets·Malwarebytes via Ars TechnicaDay 2NewRead A hacker group published stolen data containing work contact details and group memberships for over 41,000 DHS employees.
A hacker group claimed to steal and publish data belonging to over 41,000 Department of Homeland Security employees. The exposed information includes details on undercover agents, surveillance groups, and internal group memberships.

Why it matters. The leak compromises the personal and professional data of numerous federal employees, including ICE and CBP agents.

Affected
DHS workers, ICE agents
1. Fri 30 OctDHS Data Leak Exposes Personal Information of 41,000 Employees
2. TodayDHS Personnel Data Leak Exposes 41,000 Workers and Agents
Read the original · Malwarebytes Post on X LinkedIn

Summarised from Ars Technica; also covered by Malwarebytes, Graham Cluley.
```
{"coverage":0.898,"evidence":0,"freshness":0.236,"importance":0.75,"novelty":0.6,"quality":0.9,"total":0.533}
```

CVE spotlight

CVE	Affects	CVSS	EPSS	Status
CVE-2026-97229	GitLab Community Edition and Enterprise EditionGitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 th…	10.0	18%	Exploited (KEV)CISA due 1 Nov
CVE-2026-76418	Cisco Secure Firewall ASA Software and Cisco Secure FTD SoftwareA vulnerability in the Remote Access SSL VPN service of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Fi…	8.6	1%	Exploited (KEV)CISA due 1 Nov
CVE-2026-46300	Linux KernelIn the Linux kernel, the following vulnerability has been resolved: net: skbuff: preserve shared-frag marker during coalescing skb_try_coa…	7.8	16%	Exploited (KEV)CISA due 31 Oct
CVE-2026-41709	Broadcom VMware ESXVMware ESX contains an insufficient logging vulnerability. A malicious administrator could exploit this issue to perform certain operations …	2.7	1%	Exploited (KEV)CISA due 11 Nov
CVE-2026-109618	PHP Group PHPPHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not prope…	9.8	100%	Exploited (KEV)CISA due 29 Oct (passed)
CVE-2026-109619	PHP Group PHPPHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may…	8.1	100%	Exploited (KEV)CISA due 29 Oct (passed)

Quiz

Yesterday's answer

According to the provided text, what is the direct result of successfully exploiting this vulnerability in Cisco ASA/FTD?

A denial of service condition

The story explicitly states that successful exploitation results in a denial of service condition for the affected firewall devices.

Today's question

Which specific vulnerability, involving Ivanti, was added to the KEV Catalog according to the text?

On the radar tomorrow

KEV deadline tomorrowCVE-2026-76418 · Cisco Secure Firewall ASA Software and Cisco Secure FTD Software
KEV deadline tomorrowCVE-2026-97229 · GitLab Community Edition and Enterprise Edition
CTF starts Sat 02:00 UTC2026 Qiangwang Challenge on Cyber Mimic Defense Qualification
WatchingTailscale warns of SSH flaws allowing root privilege escalation
WatchingTrezor warns of suspected crypto-theft implant in hardware wallet

Also worth your time

Exploits

PHP2Shell (CVE-2026-109618) - PHP core versions after v5.4 - RCERemote · CVE-2026-109618
pizzafy-1.0 - SQLiWebApps
South River Technologies Titan MFT Server 26.0.0 - code executionRemote
Synametrics Syncrify 6.2 - command executionRemote
Keycloak 26.7.2 - Unauthenticated Account TakeoverWebApps

Tools

ratomirjovanovic/pandawardNew · 32 stars in 4 days · Web & AppSec · GoProvides local, evidence-based application security assessment for source code, tracking findings across multiple runs.
jamixm4-crypto/sentinelNew · 183 stars in 26 days · Detection & response · RustScans systems to detect covert surveillance software, keyloggers, and remote access trojans.

Community

Podcasts

181: RickyDarknet Diaries · 01:20:15
Snake Oilers: Minimal.dev, Request Rocket and TRM LabsRisky Business · 44:26
SN 1102: A Strategic Plug Pull - Lessons From a Global Patch-and-Panic Fire DrillSecurity Now · 2:54:06
SANS Stormcast Friday, October 30th, 2026: Local Ghidra Server for Malware Analysis Labs; Claude Finds Linux Kernel Multipath TCP RCE (CVE-2026-98432); Hugging Face Cryptomining Malware CampaignSANS Internet Storm Center · 7:43

And finally

AI Agent Exploits Unprotected Models for Autonomous Cyberattacks

Attackers developed an AI agent that exploits unprotected web models. The agent can execute multiple attack stages autonomously.

Source: Security · via CSO Online

End of No. 250

That's today's brief.

Coming upKEV deadline tomorrow: CVE-2026-76418 · Cisco Secure Firewall ASA Software and Cisco Secure FTD Software

The next brief lands at 06:30 IST.

Saturday, 31 October 2026

From the editor

Actively Exploited 4

Vulnerabilities & Patches 4

Worth watching

Malware & Ransomware 2

Threat Actors & Campaigns 2

Breaches & Incidents 3

CVE spotlight

Quiz

On the radar tomorrow

Also worth your time

Exploits

Tools

Community

Podcasts

And finally

Keyboard shortcuts

Top stories

From the editor

Actively Exploited 4

Vulnerabilities & Patches 4

Worth watching

Malware & Ransomware 2

Threat Actors & Campaigns 2

Breaches & Incidents 3

CVE spotlight

Quiz

On the radar tomorrow

Also worth your time

Exploits

Tools

Community

Podcasts

And finally