Node.js/Brotli Vulnerabilities Affecting Cisco Products: CVE-2026-105482 to CVE-2026-111497

Critical·KEV·CVSS 9.8·EPSS 83%New Node.js/Brotli Vulnerabilities Affecting Cisco Products: CVE-2026-105482 to CVE-2026-111497 Multiple vulnerabilities in Node.js and Brotli decoder impact Cisco products, risking RCE and traffic interception. Do this today Review Cisco advisories for specific product fix releases related to CVE-2026-111497, CVE-2026-105482, CVE-2026-105483, and CVE-2026-106069. Read the full story ↓
High·CVSS 9.3·4 outletsNew Barracuda ESG: Chained Flaws Allow Root Access via Bypass and Command Injection Chaining an authentication bypass and command injection flaw can grant root access on Barracuda ESG appliances. Do this today Apply security patches for CVE-2026-116606 and CVE-2026-111560 immediately. Read the full story ↓
HighNew Cyberattack Alters Blood Storage Temperature Controls in France A cyberattack altered temperature and defrost settings at French blood service sites via a third-party provider. Read the full story ↓

From the editor

Defenders should prioritize Cisco products affected by Node.js and Brotli vulnerabilities (CVE-2026-105482 to CVE-2026-111497). Additionally, review Barracuda ESG appliances for chained authentication bypass and command injection risks. Monitor for third-party service impacts affecting critical infrastructure controls.

Anmol Singh YadavEditor, PwnSpectrum

Actively Exploited 4

Node.js/Brotli Vulnerabilities Affecting Cisco Products: CVE-2026-105482 to CVE-2026-111497 Critical·KEV·CVSS 9.8·EPSS 83%·Cisco PSIRTNewRead Multiple vulnerabilities in Node.js and Brotli decoder impact Cisco products, risking RCE and traffic interception.
Node.js released fixes for vulnerabilities affecting the Brotli decoder, DNS resolution, and TLS validation. These flaws include an out-of-bounds write in the Brotli decoder and multiple TLS hostname validation bypasses.

Why it matters. The vulnerabilities present risks for remote code execution and traffic interception across affected Cisco systems.

Do this today Review Cisco advisories for specific product fix releases related to CVE-2026-111497, CVE-2026-105482, CVE-2026-105483, and CVE-2026-106069.

Affected
Cisco products utilizing Node.js, Brotli decoder, or DNS resolution

CVE
CVE-2026-105482, CVE-2026-105483, CVE-2026-106069, +1 more

Read on Cisco PSIRT Post on X LinkedIn
```
{"coverage":0.387,"evidence":1,"freshness":0.843,"importance":0.75,"novelty":1,"quality":0.95,"total":0.812}
```
CISA Adds WordPress Core TOCTOU Vulnerability to KEV Catalog Critical·KEV·CVSS 8.1·4 outlets·CISADay 2NewRead CISA added CVE-2026-119977, a WordPress Core TOCTOU race condition, to the KEV catalog due to active exploitation.
CISA added CVE-2026-119977, a Time-of-check Time-of-use (TOCTOU) race condition vulnerability in WordPress Core, to the Known Exploited Vulnerabilities Catalog. Evidence indicates active exploitation of this high-severity flaw. The vulnerability has a maximum CVSS score of 8.1.

Why it matters. Exploitation of this flaw can lead to arbitrary code execution on affected systems. Federal agencies are required to prioritize rapid remediation for KEV vulnerabilities on publicly exposed assets.

Affected
WordPress Core

CVE
CVE-2026-119977
1. Wed 4 NovCISA Adds WordPress Core TOCTOU Vulnerability to KEV Catalog
2. TodayCISA Adds WordPress Core TOCTOU Vulnerability to KEV Catalog
Read on CISA Post on X LinkedIn

Also covered by BleepingComputer, The Hacker News
```
{"coverage":0.898,"evidence":1,"freshness":0.358,"importance":0.75,"novelty":0.6,"quality":0.95,"total":0.801}
```
Zyxel Patches Zero-Day in GS1900 Switches via Web Interface Critical·Exploited·Binarly via BleepingComputerNewRead Zyxel patched an unauthenticated RCE in the GS1900 web interface via an out-of-bounds write flaw.
A zero-day vulnerability, CVE-2026-107441, was found in the GS1900 series web management interface. This flaw allowed unauthenticated attackers with network access to execute OS commands via crafted HTTP requests. Zyxel released updates to mitigate this vulnerability.

Why it matters. Exploitation could lead to the theft of configuration files and credentials from compromised network switches.

Do this today Install Zyxel firmware updates addressing CVE-2026-107441.

Affected
Zyxel GS1900 series switches

Read the original · Binarly Post on X LinkedIn

Summarised from BleepingComputer.
```
{"coverage":0.387,"evidence":0.9,"freshness":0.894,"importance":0.75,"novelty":1,"quality":0.95,"total":0.792}
```
Flaws in iOS and Android Exploited by Threat Actor Critical·Exploited·Ars TechnicaNewRead Researchers identified exploitation of flaws in both iOS and Android, potentially linked to a state actor.
Researchers discovered that flaws existed in both iOS and Android operating systems. These flaws were exploited by a group suspected of ties to the Kremlin.

Why it matters. This indicates active exploitation of core mobile operating system vulnerabilities. Defense requires immediate assessment of device patch levels.

Affected
iOS, Android

Read on Ars Technica Post on X LinkedIn
```
{"coverage":0.387,"evidence":0.9,"freshness":0.931,"importance":0.75,"novelty":1,"quality":0.9,"total":0.791}
```

If exploited in combination, these vulnerabilities could allow an attacker to bypass authorization controls and obtain root access to the device

Barracuda, via SecurityWeek

Vulnerabilities & Patches 4

Barracuda ESG: Chained Flaws Allow Root Access via Bypass and Command Injection High·CVSS 9.3·4 outlets·Trust via SecurityWeekDay 2NewRead Chaining an authentication bypass and command injection flaw can grant root access on Barracuda ESG appliances.
Two vulnerabilities, CVE-2026-116606 (authentication bypass) and CVE-2026-111560 (command injection), can be chained together. Successful exploitation could allow an attacker to bypass authorization and gain root access.

Why it matters. Root access on an email gateway exposes all inbound and outbound message traffic and associated credentials.

Do this today Apply security patches for CVE-2026-116606 and CVE-2026-111560 immediately.

Affected
Barracuda Email Security Gateway (ESG) versions prior to 9.4.0.030

CVE
CVE-2026-111560, CVE-2026-116606
1. Wed 4 NovBarracuda Vulnerabilities: Chaining Flaws Allows Root Access
2. TodayBarracuda ESG: Chained Flaws Allow Root Access via Bypass and Command Injection
Read the original · Trust Post on X LinkedIn

Summarised from SecurityWeek; also covered by The Hacker News, CSO Online.
```
{"coverage":0.898,"evidence":0.7,"freshness":0.4,"importance":0.75,"novelty":0.6,"quality":0.9,"total":0.725}
```
SonicWall: Unpatchable Flaws in End-of-Life GMS Software High·CVSS 9.1·SonicWall via BleepingComputerNewRead SonicWall confirmed two unpatchable vulnerabilities in end-of-life GMS, allowing file read and database modification.
SonicWall disclosed two security flaws in its Global Management System (GMS) affecting versions 9.5.2 and earlier. These flaws, including CVE-2026-109593, will not receive patches as the product is end-of-life. The vulnerabilities allow unauthenticated file reading and SQL Injection attacks.

Why it matters. Exposure of GMS systems allows network-accessible attackers to steal internal files or modify database records. Immediate migration away from GMS is required.

Do this today Upgrade to SonicWall Network Security Manager (NSM)

Affected
SonicWall GMS 9.5.2 and earlier

CVE
CVE-2026-109593

Read the original · SonicWall Post on X LinkedIn

Summarised from BleepingComputer; also covered by The Hacker News.
```
{"coverage":0.613,"evidence":0.7,"freshness":0.751,"importance":0.5,"novelty":1,"quality":0.95,"total":0.687}
```
SolarWinds Dameware: Command Injection Vulnerability (CVE-2026-28336) High·CVSS 9.9·Solarwinds via GBHackersNewRead Authenticated attackers can achieve remote code execution via a command injection flaw in SolarWinds Dameware.
SolarWinds Dameware contains a critical command injection vulnerability, tracked as CVE-2026-28336. This flaw allows authenticated attackers to remotely compromise controlled hosts. SolarWinds released version 2026.3.1 to address this issue.

Why it matters. Successful exploitation allows remote control of the host with high impact to confidentiality, integrity, and availability. While authentication is required, the low-privilege requirement increases the attack surface for defenders.

Do this today Upgrade Dameware installations to version 2026.3.1.

Affected
Dameware version 2026.3 and earlier

CVE
CVE-2026-28336

Read the original · Solarwinds Post on X LinkedIn

Summarised from GBHackers.
```
{"coverage":0.387,"evidence":0.7,"freshness":0.575,"importance":0.75,"novelty":1,"quality":0.65,"total":0.681}
```
Quest Foglight for Databases: Unauthenticated RCE via ForgeMBeanServerSupport High·CVSS 9.8·Zero Day InitiativeNewRead Quest Foglight for Databases has an unauthenticated RCE vulnerability via ForgeMBeanServerSupport with a CVSS score of 9.8.
The vulnerability exists in Quest Foglight for Databases and allows remote attackers to execute arbitrary code. Exploitation does not require authentication.

Why it matters. Unauthenticated remote code execution provides a high-impact path for system compromise.

Affected
Quest Foglight for Databases

CVE
CVE-2026-92185, CVE-2026-92186, CVE-2026-92187, +10 more

Read on Zero Day Initiative Post on X LinkedIn
```
{"coverage":0.387,"evidence":0.7,"freshness":0.303,"importance":0.75,"novelty":1,"quality":0.9,"total":0.678}
```

Worth watching

Conference talk Fromage-Gate: Old-School Hacking Tactics vs. French Supermarkets Black Hat · 4 Nov

Malware & Ransomware 2

NIKKE PC Launcher Compromised to Distribute Malware High·BleepingComputerNewRead Hackers tampered with the NIKKE PC launcher scripts to distribute malware stealing credentials and crypto data.
Hackers compromised the NIKKE PC game launcher scripts in a supply-chain attack. The malicious scripts downloaded code from attacker-controlled servers, executing a payload that installed a remote-access agent. This malware could steal credentials and cryptocurrency wallet data.

Why it matters. Defenders should assume the launcher environment is compromised and treat any credentials accessed via the game client as potentially stolen. Immediate credential rotation is required for affected users.

Do this today Run a full system scan using updated antivirus software and change sensitive credentials from a clean device.

Affected
Goddess of Victory: NIKKE PC launcher

Read on BleepingComputer Post on X LinkedIn
```
{"coverage":0.387,"evidence":0,"freshness":0.8,"importance":0.75,"novelty":1,"quality":0.95,"total":0.558}
```
Google Dismantles XCPE Botnet Using 1.3M Android TV Boxes High·11 outlets·Krebs on SecurityDay 2NewRead Industry partners dismantled a botnet using over 1.3 million Android TV boxes for advertising fraud.
Google and industry partners dismantled the XCPE botnet, which utilized over 1.3 million Android TV set-top boxes. The malware was used to rent users' internet connections for advertising fraud and other criminal activities.

Why it matters. Infected devices can serve as proxies for malicious traffic, enabling account takeovers and content scraping for criminal actors.

Do this today Review all connected Android-based IoT devices for unauthorized network activity.

Affected
Android TV set-top boxes, Android-based IoT devices
1. Wed 4 NovGoogle Dismantles XCPE Botnet Using 1.3M Android TV Boxes
2. TodayGoogle Dismantles XCPE Botnet Using 1.3M Android TV Boxes
Read on Krebs on Security Post on X LinkedIn

Also covered by BleepingComputer, The Record
```
{"coverage":1,"evidence":0,"freshness":0.204,"importance":0.75,"novelty":0.6,"quality":1,"total":0.555}
```

Threat Actors & Campaigns 1

APT29 Uses Web Analytics Script for iOS and Android Exploits High·The Hacker NewsNewRead APT29-linked actors are using a compromised web analytics script in watering hole attacks to deliver exploits to mobile devices.
APT29-linked threat actors conducted a watering hole campaign targeting iOS and Android users. The attack utilized a compromised Ukrainian web analytics service, Plerdy SEO Tracker, to inject malicious JavaScript code.

Why it matters. This technique allows threat actors to compromise mobile endpoints by targeting users visiting specific, compromised websites.

Do this today Monitor network traffic for unusual JavaScript execution patterns originating from web analytics services.

Affected
iOS and Android users visiting compromised websites

Read on The Hacker News Post on X LinkedIn
```
{"coverage":0.387,"evidence":0,"freshness":0.746,"importance":0.75,"novelty":1,"quality":0.8,"total":0.538}
```

Breaches & Incidents 4

Cyberattack Alters Blood Storage Temperature Controls in France High·Presse via The RecordNewRead A cyberattack altered temperature and defrost settings at French blood service sites via a third-party provider.
Temperature and defrost settings were raised at three national blood service sites in France. The attack reportedly reached the service through a third-party refrigeration equipment provider.

Why it matters. The incident demonstrates the potential for third-party industrial control system compromise within critical healthcare infrastructure.

Read the original · Presse Post on X LinkedIn

Summarised from The Record; also covered by BleepingComputer.
```
{"coverage":0.613,"evidence":0,"freshness":0.731,"importance":0.75,"novelty":1,"quality":0.95,"total":0.585}
```
Crédit Mutuel Arkéa Confirms Cyber Heist via Supplier Compromise High·The RecordNewRead A French bank confirmed a sophisticated attack involving transfers made after compromising an unnamed supplier.
Crédit Mutuel Arkéa confirmed an attack where transfers were made using the bank’s own account. The attackers gained access through the platform of a service provider, not the online banking subsidiary.

Why it matters. The incident demonstrates the risk of third-party vendor compromise leading to direct access to core banking functions.

Read on The Record Post on X LinkedIn
```
{"coverage":0.387,"evidence":0,"freshness":0.845,"importance":0.75,"novelty":1,"quality":0.95,"total":0.563}
```
Binance Reports $6.3B Crypto Theft Linked to Compromised DevOps Laptop High·5 outlets·Ars TechnicaDay 2NewRead Binance attributed a $6.3 billion crypto theft to a compromised DevOps laptop, highlighting systemic control failures.
Binance reported a theft of $6.3 billion in cryptocurrency. The preliminary investigation pointed to a compromised employee device that provided access to a service container used for withdrawals.

Why it matters. The incident demonstrates how weak system separation and inadequate internal controls can lead to systemic financial loss from a single breach point.

Do this today Review access controls and system separation between development, operations, and production environments.

Affected
Binance
1. Tue 3 NovBinance Breach Linked to Compromised DevOps Laptop
2. TodayBinance Reports $6.3B Crypto Theft Linked to Compromised DevOps Laptop
Read on Ars Technica Post on X LinkedIn

Also covered by Dark Reading, CSO Online
```
{"coverage":1,"evidence":0,"freshness":0.186,"importance":0.75,"novelty":0.6,"quality":0.9,"total":0.544}
```
Binance Theft: Attack Used Compromised Engineers and Internal AI Tool High·SecurityWeekNewRead A months-long campaign compromised three engineers, leading to the theft of assets from Binance's hot wallets.
The theft involved a multi-stage campaign targeting three engineers. Initial access was gained via a tampered Homebrew installation and later through a malicious coding assignment. Attackers used the compromised machines and an internal AI tool to gain control of wallet signing systems.

Why it matters. The incident demonstrates the risk of supply chain compromise, insider access, and the potential misuse of internal development tools in financial infrastructure. Unauthorized access to wallet signing services was exploited to move assets.

Read on SecurityWeek Post on X LinkedIn
```
{"coverage":0.387,"evidence":0,"freshness":0.67,"importance":0.75,"novelty":1,"quality":0.9,"total":0.54}
```

CVE spotlight

CVE	Affects	CVSS	EPSS	Status
CVE-2026-119977	WordPress CoreWordPress Core is vulnerable to Remote Code Execution in versions 4.7 through 7.1.3. This is due to predictable, web-accessible staging path…	8.1	1%	Exploited (KEV)CISA due 6 Nov
CVE-2026-111497	Google BrotliA buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows…	9.8	83%	Exploited (KEV)CISA due 10 Nov
CVE-2026-116606	—An authentication bypass in Barracuda Email Security Gateway versions earlier than 9.4.0.030 allows an unauthenticated remote attacker to in…	9.3	1%	Not in KEV
CVE-2026-109593	—An unauthenticated attacker with network access to the SonicWall GMS 9.5.2 and earlier versions may be able to read internal GMS files, pote…	9.1	1%	Not in KEV
CVE-2026-111560	—Improper neutralization of shell metacharacters in the timezone configuration field in certain Barracuda appliance products using common Bar…	8.6	0%	Not in KEV
CVE-2026-105482	—A flaw in Node.js DNS resolution allows hostnames containing a NUL byte to be silently truncated by the dns.resolve*() functions and dns.rev…	7.4	0%	Not in KEV

Quiz

Yesterday's answer

According to the news story, what is the primary impact of the CVE-2026-58115 vulnerability?

The vulnerability allows unauthenticated remote code execution.

The story explicitly states that the flaw permits unauthenticated remote code execution.

Today's question

According to the provided text, which specific flaw was found within the Brotli decoder?

On the radar tomorrow

KEV deadline tomorrowCVE-2026-119977 · WordPress Core
Patch Tuesday in 5 daysTuesday 10 November
CTF starts Fri 10:00 UTCHKCERT CTF 2026 (Qualifying Round)
WatchingMalicious Claude Code extension on Cursor planted SSH backdoors
WatchingmSecure password manager hack prompts password reset warnings

Also worth your time

Exploits

PHP2Shell (CVE-2026-109618) - PHP core versions after v5.4 - RCERemote · CVE-2026-109618
pizzafy-1.0 - SQLiWebApps
South River Technologies Titan MFT Server 26.0.0 - code executionRemote
Synametrics Syncrify 6.2 - command executionRemote
Keycloak 26.7.2 - Unauthenticated Account TakeoverWebApps

Tools

MotherSphere/NIKKE-Launcher-CheckNew · 73 stars in 1 day · Detection & response · RustReads system traces to check for indicators of compromise related to a specific PC launcher compromise across multiple o…
zgsfsec/Full-Chain-Sentinel-SystemNew · 670 stars in 20 days · Web & AppSec · TypeScriptProvides an agent framework for automated security testing across web, mobile, and network environments.
yorkeccak/globalhackmapNew · 59 stars in 2 days · Web & AppSec · TypeScriptAggregates publicly reported security incidents, vulnerabilities, and active exploits onto an interactive global map.
0x45dd/pwnerNew · 56 stars in 2 days · Network · PythonThis agent plans and executes network penetration tests by driving standard security tools based on user prompts.
chu0119/PojunNew · 60 stars in 26 days · Exploitation · GoAutomates penetration testing workflows using multiple AI agents for reconnaissance, vulnerability discovery, and post-e…
chaenmasahiro0425/claude-security-scanNew · 41 stars in 22 days · Cloud & containers · PythonScans local machine, repositories, and multiple cloud platforms for misconfigurations and exposed secrets.

Community

Podcasts

182: BlackshadesDarknet Diaries · 39:17
Risky Business #858 -- The $6.3b laptopRisky Business · 1:01:21
SN 1103: Exposing Bad Consumer Crypto - AI vs. Encrypted DrivesSecurity Now · 2:48:35
Weev, Part 2Malicious Life · 28:49

And finally

Researchers Uncover Prompt Adware Hidden in OpenAI Codex Jailbreak Toolkit

Researchers found prompt adware in an OpenAI Codex jailbreak toolkit that inserts third-party advertisements.

Source: The Hacker News · via The Hacker News

End of No. 255

That's today's brief.

Coming upKEV deadline tomorrow: CVE-2026-119977 · WordPress Core

The next brief lands at 06:30 IST.

Thursday, 5 November 2026

From the editor

Actively Exploited 4

Vulnerabilities & Patches 4

Worth watching

Malware & Ransomware 2

Threat Actors & Campaigns 1

Breaches & Incidents 4

CVE spotlight

Quiz

On the radar tomorrow

Also worth your time

Exploits

Tools

Community

Podcasts

And finally

Keyboard shortcuts

Top stories

From the editor

Actively Exploited 4

Vulnerabilities & Patches 4

Worth watching

Malware & Ransomware 2

Threat Actors & Campaigns 1

Breaches & Incidents 4

CVE spotlight

Quiz

On the radar tomorrow

Also worth your time

Exploits

Tools

Community

Podcasts

And finally