Security Community

❓What:

• On October 21, Node.js released security updates for CVE-2026-111497, nicknamed Node2Shell.

• Node.js is another widely used behind-the-scenes web technology. It powers many websites, apps, and online services.

• The flaw is in the Brotli decoder, the component that unpacks compressed data. A specially crafted file could let an attacker run code, crash the service, or read memory.

• It’s rated high severity. Public proof-of-concept code exists, but published exploits are unreliable and depend heavily on the environment.

❓What:

• PHP has released security updates for two critical vulnerabilities that can allow unauthenticated remote code execution. Public reporting calls the vulnerabilities PHP2Shell. patchstacksecurityweek

• They are tracked as CVE-2026-109618 and CVE-2026-109619, and the PHP security team rates both Critical (CVSS v4.0 9.2). patchstack

• Details leaked online on October 20, before coordinated disclosure and before patches were available. PHP moved the release up from October 22 in response. huntressrescana

• PHP released 8.5.12, 8.4.27, 8.3.36 and 8.2.35 on October 21 to fix both flaws. huntress

❓What:

• Frontline says its security team identified a vulnerability in a third-party software product on August 14, 2026, which allowed unauthorized access to part of its environment. infosecurity-magazine

• Exposed data includes Social Security numbers, email addresses, and physical addresses. Bleeping Computer

• In at least one district, all employees were affected. Another district’s notice listed 1,210 affected employees. Bleeping Computer

• It is unclear how many districts or individuals were affected in total. Bleeping Computer

❓What:

• Comparitech counted an average of 3.33 ransomware attacks per day on healthcare in Q3 2026. That is up 40 percent from Q2 and more than double the same period last year. itnerd

• Of 192 total attacks, 40 were confirmed and 152 unconfirmed. itnerd

• The Gentlemen (18) and INC (14) made the most claims against healthcare providers. itnerd

• A separate Proofpoint and Ponemon report found 74 percent of U.S. healthcare organizations hit by cyberattacks in the past year reported disruptions to patient care. que

❓What:

• The FBI and US Secret Service issued a warning on October 6 that the FortiBleed campaign against Fortinet FortiGate firewalls and SSL VPN gateways is still ongoing. infosecurity-magazine

• The notice cites SOCRadar figures of 86,644 compromised devices across 194 countries. infosecurity-magazine

• The advisory cites no CVE. Fortinet believes attackers are reusing previously stolen credentials and brute-forcing devices with weak passwords and no MFA. dailysecurityreviewcybersecuritydive

• Attackers create new accounts and, in some cases, delete existing ones to block organizations from their own devices. helpnetsecurity

❓What:

• Proofpoint released its 2026 Voice of the CISO report, surveying 1,600 CISOs worldwide and comparing five years of results.

• 78% of CISOs now call GenAI a security risk, up from 54% in 2024.

• 78% say their organization blocks or restricts employee GenAI use, up from 59% in 2025.

• 79% name human risk as their biggest cyber vulnerability.

❓What:

• Attackers are exploiting two critical flaws in Citrix NetScaler ADC and NetScaler Gateway, and both were exploited before a patch existed. thenextweb

• CVE-2026-88771 lets an attacker run commands without logging in and affects all NetScaler ADC and Gateway deployments, including the default setup. thenextweb

• CVE-2026-88772 is a memory overflow that can lead to remote code execution or a crash; it requires DTLS, which is enabled by default on VPN servers. thenextweb

• Both flaws carry CVSS 4.0 scores of 9.5. bankinfosecurity

❓What:

• F5 Labs disclosed an automated mass-scanning campaign, observed in August 2026, exploiting CVE-2026-39364 (CVSS 8.2), a high-severity Vite vulnerability

• The flaw lets an unauthenticated attacker bypass Vite's server.fs.deny protections using query parameter manipulation (e.g., ?raw, ?import&raw, ?import&url&inline) appended to /@fs/ requests

• Exploitation requires three conditions: the dev server is exposed to the network (via --host or server.host), the target file exists within server.fs.allow directories, and it's a file normally blocked by server.fs.deny

• Under default config, Vite binds to localhost only — exposure typically results from developers passing --host, setting server.host, or misconfigured Docker port mappings

❓What:

• Arctic Wolf is tracking an active cluster (PREY-0058) using voice phishing to compromise Microsoft 365 and connected SaaS platforms — no software vulnerability involved

• Actors impersonate IT/Helpdesk staff via phone calls or texts, directing victims — primarily Directors, VPs, and executives — to Adversary-in-the-Middle (AiTM) phishing pages

• AiTM pages capture credentials and MFA tokens in real time, defeating standard MFA

• Static residential proxy infrastructure (NodeMaven, seen in the majority of cases) is used to mimic legitimate login behavior and evade detection