SANS NewsBites Vol. 28 Num. 80 : Patch Now: Brotli Emergency Fixes; HPE AOS 8 & 10 Max-Severity Flaws; Apple OS Updates Plus Backported Fix

October 27, 2026 Vol. 28, Num. 80

Free technical content sponsored by Hydrolix

How 300 Security and IT Leaders Handle AI Bots. AI bots are adding traffic and operational complexity across enterprise environments. See how your peers are gaining visibility into AI-driven traffic, and why real-time analytics at scale is becoming essential to managing it. Download The State of AI Bots in 2026: https://www.sans.org/info/237140

A critical vulnerability in the Brotli compression library has been addressed in patches from Google, Brotli's developer and maintainer, that are being incorporated into downstream emergency patches by developers whose products use Brotli. Aikido Security explains that "the root cause was fixed in the Brotli source code in February [2026], but it wasn't recognized as a security issue at the time and no release shipped with the fix until now. That means every project that bundles Brotli has to ship its own update." CVE-2026-111497, given a CVSS score of 9.2 by Google, allows a remote unauthenticated attacker to "corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code" by causing a buffer overflow in the Brotli decoder using a crafted Brotli-compressed stream. This vulnerability affects Google Brotli versions 1.0.3 through 1.2.0, and users should update any affected Brotli libraries or binaries to the latest available version, which may be 1.0.10, 1.1.1, or 1.2.1. Various names have been given to this vulnerability: "Node2Shell" was coined by Imperva Red Team, referring to Node.js, who first disclosed the flaw on October 21 after it was reported by Khai Tran and Sylvie Mayer at OpenAI Codex Security, affecting Node.js 26.x, 24.x, and 22.x through the bundled Brotli library. "HTTP2Shell" seems to have been coined by Aikido to refer to the broader impact of the flaw on languages and services that use HTTP. "Broccoli2Shell" has also been used, though Brötli is a Swiss German word for a bread roll. Other products that have received security updates addressing CVE-2026-111497 include Python, .NET, Java, PHP, curl/libcurl, Bun, Envoy, Istio, Debian, Alpine, and Amazon Linux. As of this writing, partial fixes are available in Fedora and Red Hat Enterprise Linux (RHEL), and no patches have been released for RHEL nodejs:24 and nodejs:26 modules, Ubuntu, or SUSE, but Aikido has released patched images for platforms with no vendor fix.

Editor's Note

[Ullrich]
Whenever we have a big “crisis” like the PHP vulnerability last week, the big question that comes up is: What other issue did we miss? In this case, I believe the Brotli vulnerability was not given the attention it deserved. Brotli is a widely used compression library for compressing HTML, JavaScript, Font Data (woff), and other data. It first surfaced last week as a Node.js issue, but reaches well beyond Node.js. Microsoft released patches for .NET on Sunday. Even PHP was affected, and PHP had to re-package its Windows binary this weekend to update the included Brotli code. Expect more to come.

[Frost]
While the entire world was focused on PHP last week, Node.js released a patch for its Brotli Decompression Library. It turns out this impacts any system running Brotli decompression, so it extends to other languages like Python and even tools like ffmpeg. Please patch your system and check whether this library exists in your environment. This one is kind of sneaky, and we may have missed it.

[Skoudis]
One of the most revealing details here is that the underlying Brotli bug was reportedly fixed in source code back in February, months before it was recognized as a security issue and included in a release. Now we’re seeing the consequences as emergency patches work their way through software ecosystems. A fix in an upstream library doesn’t automatically protect applications that bundle their own copies. Finding those dependencies, rebuilding affected applications and containers, and verifying that updated code actually reaches production is where the real work happens. The relevant exposure involves decoding attacker-controlled Brotli data, so understanding how applications use the library matters, too. Fixing source code is only the beginning. The job isn’t finished until the fix reaches the systems people depend upon.

[Sanabria]
The biggest challenge with Brotli, which it has in common with PHP, is the long tail of identifying embedded and third party systems that use these components. Organizations are somewhat at the mercy of vendors to ship security advisories and patches, though this is again an argument for shipping SBOMs to customers. Loading vendor SBOMs into a centralized database would allow customers to quickly assess which of their systems are potentially vulnerable to attacks.

[Neely]
A lesson here is that if you’re maintaining packages, think carefully about fixes, and consider categorizing them as security updates to help prioritize the adoption of the updated package as well as increase the visibility of the fix and its needed adoption. The fix is to update both your standalone packages, like Node.js and Python (Brotli and brotlicffi) packages, as well as packages that otherwise embed it. After updating packages, be sure to restart their related processes. Both the Aikido and Broccoli2Shell[dot]com blogs are tracking updated packages/OS distributions.

[Honan]
This story highlights how a vulnerability in a single and widely used component can have a significant impact across multiple products and platforms, many of which organisations may not even be aware are using that component. To better secure your systems it is not enough to simply maintain an inventory of your applications; you also need to understand their components and the dependencies those applications rely upon.

Read more in:
- nvd.nist.gov: CVE-2026-111497
- nodejs.org: Node.js Brotli decoder out-of-bounds write permits remote code execution (CVE-2026-111497) - (high)
- www.aikido.dev: Node2Shell evolves to HTTP2Shell. Brotli flaw (CVE-2026-111497) blast radius affects many libraries & apps using HTTP.
- www.securityweek.com: Node2Shell: Brotli Flaw Triggers Patching Across Microsoft, Node.js, Python Packages
- thehackernews.com: Brotli Decoder Flaw Behind Node.js RCE Also Affects Bun, Python and Other Widely Used Software
- www.bleepingcomputer.com: Critical 'HTTP2Shell' Brotli vulnerability triggers emergency patches
- www.theregister.com: Microsoft releases emergency .NET security fixes for Google Brotli bug
- thehackernews.com: PHP Issues Second Windows Security Update in Five Days to Fix Brotli Code Execution Flaw

Hewlett Packard Enterprise (HPE) has published a security advisory addressing 72 vulnerabilities — eight of which carry a CVSS score of 10.0 — that affect HPE Networking Wireless Operating Systems for Mobility Conductors, Controllers, Gateways, and Access Points, specifically ArubaOS (AOS) 8 and 10. HPE notes that "any hardware, Mobility solutions (such as conductors, controllers, and gateways), access points, or virtual machines (VMs) compatible with the affected versions are vulnerable." Of the maximum-severity vulnerabilities, three are authentication bypasses: CVE-2026-79844 allows remote code execution (RCE) in AOS-10, CVE-2026-79850 allows RCE in AOS-8, and CVE-2026-79845 allows unauthorized access and modification of sensitive data through exploitation of the PAPI Protocol in AOS-10. Two of the eight are unauthenticated buffer overflows: CVE-2026-79847 and CVE-2026-79851 both allow RCE in AOS-10. Two more are unauthenticated SQL injection flaws, CVE-2026-79848 and CVE-2026-79849 allow RCE in AOS-8. Finally, CVE-2026-79846 is an unauthenticated command injection vulnerability that allows arbitrary commands to be run on the underlying operating system in AOS-8. 24 of the remaining flaws are critical, ranging from CVSS 9.8 to 9.3, and another 31 are high-severity, ranging from CVSS 8.8 to 7.0. Users should address the flaws by upgrading to the following AOS versions or above: 10.8.1.2, 10.7.2.7, 10.4.1.14, 8.13.3.1, and 8.10.0.24. HPE also notes that users can minimize likelihood of exploitation by restricting CLI and web-based management interfaces to a dedicated layer 2 segment/VLAN and/or controlling them with firewall policies at layer 3 and above, "along with accounting controls for tracking and logging user activities and resource usage."

Editor's Note

[Frost]
Your network infrastructure should be considered critical infrastructure. When I see RCE on a network device, I get highly concerned because we'd lack telemetry if a device like this gets compromised. Most network devices run some type of Unix; in the case of ArubaOS, it’s a Linux kernel. Given that these systems can potentially execute Linux binaries, I would be highly concerned about RCE on these devices. Patch your AOS systems, even if widespread exploitation is not happening right now.

[Neely]
We’re back to apply the updates and make sure the management interfaces are locked down to authorized devices (and make sure that you’ve got monitoring/logging dialed in). I know it’s a pain to have to use remote access to manage infrastructure, let alone isolate it from the main networks for the business, but there is too much shenanigans and discovery is too easy to take a risk your devices won’t be identified. While you’re examining your Aruba infrastructure, make sure that you’re on supported AOS versions — You really need to be on 10.8.1 and above — HPE is not reporting any active exploitation, but you should be reviewing your logs for any suspicious activity; we’ve seen before how that plays out.

[Sanabria]
Some of these critical vulnerabilities are in administrative interfaces that should never be exposed to untrusted parties, but some of the vulnerabilities are in device management protocols, which may have to be exposed to wireless clients. Since Aruba wireless gear is often used for guest access, customer access (like hotel Wi-Fi & public Wi-Fi access points), and other situations that expose them to untrusted parties, the big challenge here for folks is to quickly understand the level of exposure for each of these vulnerabilities and prioritize patching accordingly.

[Ullrich]
It does not explicitly state so in the advisory, but this looks like another AI-assisted patch, fixing a large number of critical vulnerabilities. Remember: AI-assisted exploits are going to follow in short order. Apply this patch quickly.

[Dukes]
Rough day for HPE, especially with over ten percent of these vulnerabilities hitting a CVSS 10.0 severity score. At this point, AI makes automated patch management an absolute necessity. We all know how this plays out if you wait: Patches get reverse-engineered, exploits drop, and attackers move fast. Don't get caught behind.

Read more in:
- support.hpe.com: HPESBNW05162 rev.1 - Multiple Vulnerabilities in HPE Networking Wireless Operating Systems (AOS-10 & AOS-8)
- ccb.belgium.be: Warning: Multiple Critical Vulnerabilities in HPE Networking AOS, Patch Immediately!
- www.bleepingcomputer.com: HPE patches eight max severity RCE and auth bypass AOS flaws

On Monday, October 26, Apple published updates for all its operating systems and for the Safari browser, addressing a total of 304 security vulnerabilities. This release includes a backported fix for a high-severity flaw affecting older versions of iOS and iPadOS, which was already addressed in iOS and iPadOS 26.7.1, macOS Tahoe 26.7.1, and macOS Sequoia 15.8.1 on September 28, and was known to be exploited in targeted attacks at the time of disclosure. CVE-2026-86950, CVSS score 8.8, allows an attacker to achieve arbitrary code execution by exploiting an out-of-bounds write issue when CoreGraphics processes a maliciously crafted file. This flaw has now been fixed in iOS and iPadOS 18.7.11, available for iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generationAir 4th generation and later, iPad 9th generation and later, and iPad mini 6th generation and later. The SANS Internet Storm center also indicates two other notable vulnerabilities addressed in the release: CVE-2026-86990 (CVSS score not yet assigned) allows a malicious app to access the camera without user permission, and CVE-2026-28864 (first disclosed in March 2026, CVSS score 3.3) allows a local attacker to gain access to a user's Keychain items. The software released in this update includes version 27.2 of iOS and iPadOS, macOS Golden Gate, tvOS, watchOS, visionOS, and Safari; iOS and iPadOS 26.7.2 and 18.7.11; macOS Tahoe 26.7.2; and macOS Sequoia 15.8.2.

Editor's Note

[Skoudis]
Kudos to Apple for bringing this security fix to older iPhones and iPads! Backporting patches is hard, important work. We saw that again during last week’s PHP emergency, when the PHP security team supplied fixes for some unsupported versions and third-party maintainers worked to bring protection to even older releases. Moving a complex memory-safety fix into code that has diverged over years takes expertise and careful testing. Mistakes can introduce regressions or leave security gaps. Many maintainers do this exceptionally well, and they deserve our thanks. But a backported fix addresses specific vulnerabilities, not every risk associated with obsolete software. Apply the fixes, verify the patched build, and keep your upgrade plans moving.

[Neely]
Fortunately none of the new flaws are marked already exploited. Take note of the backports to macOS 15 & iOS 18; if you have devices running these old OSes, you really need to get those up to a more recent OS. Apple has updated “everything” — so make sure that you’re checking for updates on all your Apple hardware, remembering that the Safari update is separate from the OS update for anything older than macOS 27. This is the second update to macOS/iOS version 27, so it’s time to make this your minimum version.

Read more in:
- support.apple.com: Apple security releases
- support.apple.com: About the security content of iOS 18.7.11 and iPadOS 18.7.11
- isc.sans.edu: Apple Patches for October 2026
- www.securityweek.com: iOS, macOS 27.2 Patch 286 Bugs; Fix for Exploited Flaw Backported to iOS 18
- www.bleepingcomputer.com: Apple backports CoreGraphics zero-day patches to older iPhones

Sponsored Links

Webinar | AI Summit Fall Solutions Track 2026 | Tuesday, November 3 | Explore real-world approaches to applying AI in cybersecurity programs, focusing on how to move from theory to measurable impact. https://www.sans.org/info/237120

Webinar | Agentic AI Threats & SOC Autonomy | Thursday, November 5 | Explore new survey data on how security teams are responding to this shift, from detecting agentic threats like prompt injection and non-human identity compromise to the barriers still stalling SOC autonomy. https://www.sans.org/info/237145

Webinar | How Predictive AI Is Rewriting the Attacker Timeline | Monday, November 9 | What if your SOC could see the next move before the attacker makes it? https://www.sans.org/info/237150

Quest Diagnostics has published a notice and an FAQ informing providers and patients of a cyber incident in which the company's Quanum Lab Services Manager (LSM) system was accessed without authorization. Quanum LSM is a platform used by healthcare providers to centralize tasks and information related to labs, supplies, specimens, test results, pricing, billing, and other functions. The company's Form 8-K filing with the US Securities and Exchange Commission (SEC) states that Quest Diagnostics became aware of the unauthorized access on October 21, 2026, activated its incident response procedures for containment, assessment, investigation, and remediation, and contacted law enforcement as well as external cybersecurity experts. Personal information and patient records including Protected Health Information (PHI) and Personally Identifiable Information (PII) were accessed by an unauthorized third party, but the full scope of the breach is still under investigation. Access to Quanum LSM was temporarily disabled, but business services were not materially or operationally affected, including direct-customer LIS interfaces and EMRs. Clients that normally use Quanum LSM to order testing can find their local PSC through the Quest Diagnostics website and make requisitions via fax, and providers looking for test results can call the customer services hotline or use eFax. Quest Diagnostics does not believe this incident is related to the critical vulnerabilities in PHP that were patched on October 21. The company will notify those affected as investigation continues, and mentions future offers of credit and identity monitoring. TechCrunch notes that the incident notification page contains a "noindex" tag that hides the page from search engines.

Editor's Note

[Neely]
There are not a lot of details from Quest, but I gotta give them credit for remediating and getting services back online quickly. Now if they can wrap up the investigation and alert affected parties as quickly, that would be precedent-setting. Quest Diagnostics is big — as in, about one in three adult Americans use their services one way or another — similar in scope to the Change Healthcare incident from 2024. For most of us, all we can do is make sure we have ID/credit monitoring dialed in, and be on the lookout for increased social engineering (phishing/vishing) attempts. If you’re in the healthcare business, make sure that you’re doing everything you can for residency for when it’s your turn in the barrel.

[Murray]
Prudent people assume that all personal identifiers are exposed and trafficked in by data brokers. Not so for health information. Moreover, while the information is in the explanation of benefits from our healthcare insurance providers, few of us are aware of what labs are used by our clinicians. Therefore, this is a more sensitive breach than most and may result in some nasty surprises.

[Dukes]
While details regarding this cyber incident remain limited, as is typical in suspected ransomware attacks, it serves as an important reminder to review your credit reports regularly for any signs of identity fraud or unauthorized activity. You don’t need to wait for the company offer of free monitoring.

Read more in:
- www.questdiagnostics.com: An update on an incident involving one of our systems
- www.sec.gov: Form 8-K | Quest Diagnostics Incorporated
- techcrunch.com: Lab testing giant Quest Diagnostics confirms patients’ personal and health data was compromised during breach
- www.hipaajournal.com: Patient Data Likely Accessed in Quest Diagnostics Hack
- therecord.media: Quest Diagnostics warns of potential data theft after attack on lab service system
- www.bleepingcomputer.com: Quest Diagnostics confirms data breach exposed patient records
- www.securityweek.com: Quest Diagnostics Data Breach Exposed ‘Certain Patient Records’

Operations at the University of New Mexico Health System in Albuquerque — which includes the UNM Health Sciences Center (HSC) and more than 30 UNM Health clinics — have been disrupted by a cyber incident that took place on Monday, October 26. Between 12:30pm and 2:30pm MDT, UNM Health was forced to cancel all appointments, divert ambulances, stop accepting new patients, and suspend outpatient surgeries, reportedly coordinating with two other local healthcare providers, Presbyterian Healthcare Services and Lovelace Health System, to redirect patients for care. After 2:30pm, UNM health started restoring systems in phases and gradually resuming operations. All Monday and Tuesday classes on the Health Sciences campus have been cancelled, and the academic and research units of UNM Health Sciences will remain closed on October 27; nonessential employees have been sent home. When the HSC IT security teams became aware of the unspecified cybersecurity event, they took steps to contain it and to protect the network, also notifying state and federal law enforcement and engaging external partners to aid investigation. UNM leadership also activated an Emergency Operations Center "to coordinate the response and provide guidance to HSC employees, students and UNM Health system frontline providers," and will provide updates by Tuesday morning (10/27) about outpatient surgeries and appointments.

Editor's Note

[Neely]
The good news is that UNM Hospitals are open and will resume regularly scheduled appointments and procedures on October 27, and classes are not affected at this time. The UNM news site shows a nice progression of impacts and incident response. It also includes links to social and email contacts relevant to the incident. The downside is the incident shut down the state’s only level 1 trauma center in addition to the UNM hospitals and about 30 clinics. It’s yet another reminder of the criticality of securing essential systems, particularly healthcare; it doesn’t seem like much time goes by between an ever increasing litany of healthcare related breaches. While I understand how we got to this point, that doesn’t diminish the need to actively address improvements across the sector. In the meantime, we all need to double down on protecting our information. Make sure that your family members are all protected; you may have to have direct conversations with both the younger and older generations for this to sink in. Prevention is easier than cleanup/recovery.

[Honan]
Cybersecurity incidents such as this remind us that cybersecurity in healthcare is not just about protecting sensitive patient information. As Ireland experienced in 2021 when the whole national healthcare systems were ransomed, when systems become unavailable, appointments are cancelled, ambulances are diverted, and patients may be unable to receive the care they need. The consequences can be far more serious than financial losses or reputational damage. Healthcare organisations need to ensure their business continuity and incident response plans address how they will continue providing critical patient services when their IT systems are unavailable. Those plans also need to be regularly tested, because the middle of a cyberattack is not the time to discover that your contingency arrangements do not work.

[Pescatore]
“Resiliency” has become an over-used buzzword, but UNM Health Sciences has a serious resiliency problem if one attack took down academic, research and heath delivery/ambulance services.

Read more in:
- hscnews.unm.edu: Update on Cybersecurity Event at UNM Health Sciences Center
- www.securityweek.com: Cybersecurity Issue Forces a Major New Mexico Hospital to Divert Patients and Close Clinics
- sourcenm.com: University of New Mexico Hospital diverting ambulance traffic due to ‘cybersecurity’ issue

INTERPOL has published an announcement describing the accomplishments of its recent cybercrime crackdown effort throughout Africa known as "Operation Serengeti III," which involved law enforcement from 21 countries and took place between June 29 and August 31, 2026. The operation targeted "cyber-enabled fraud, ransomware, business email compromise (BEC), online scams and digital extortion," and resulted in the disruption of 10,909 malicious networks, the arrest of 1,462 suspects, and the recovery of US$105 million in illicit funds. Investigators from Angola, Benin, Cameroon, Congo, Côte d'Ivoire, Democratic Republic of Congo, Eswatini, Gabon, Gambia, Ghana, Kenya, Mozambique, Nigeria, Rwanda, Senegal, South Africa, Tanzania, Uganda, Zambia, Zimbabwe, and the US began by accumulating intelligence on suspicious domains, IP addresses, and command-and-control infrastructure, and were supported with analysis, operational expertise, and additional intelligence provided by private sector partners. The press release highlights the dismantling of fraud operations in Uganda, illegal cryptocurrency mining centers in Angola, a large-scale phishing and BEC operation and an investment fraud scheme in Nigeria, a malicious loan application scheme in Tanzania, a vehicle import fraud network in Gabon, and an unspecified cybercrime operation in the Republic of Congo. The first Operation Serengeti took place in 2024, and the second in 2025, each also leading to over 1,000 arrests, tens of thousands of takedowns, and tens of millions of dollars in seized funds.

Editor's Note

[Skoudis]
Now THIS is some welcome news! Law enforcement agencies from 21 countries worked together to arrest 1,462 suspects, disrupt nearly 11,000 malicious networks, and recover more than $105 million in illicit funds. That’s a remarkable demonstration of what coordinated investigations, intelligence sharing, and cooperation with the private sector can accomplish. Arrests aren’t convictions, of course, and the long-term impact remains to be seen. But these operations disrupt criminal infrastructure and demonstrate that attackers don’t get to operate with impunity. Congratulations to INTERPOL, the participating law enforcement agencies, and their private-sector partners. We should celebrate excellent defensive work just as enthusiastically as we study the latest attacks.

[Neely]
This is a big deal. The operation was supported by private-sector partners which included Group-IB, Kaspersky, Fortinet, TrendAI, Team Cymru, Uppsala Security, Cybercrime Atlas, Meta, the Global Anti-Scam Alliance, and the Postal and Telecommunications Regulatory Authority of Zimbabwe, as well as funding from the Global Action on Cybercrime Enhanced (GLACY-e) project, which is a joint initiative of the EU and Council of Europe. The message here is that not only does it require international cooperation to shutdown cross-border cybercrime, but INTERPOL has the partnerships and funding to disrupt these operations, recover assets, arrest adversaries, and protect communities.

[Sanabria]
It's always good to see law enforcement having a disruptive impact on cybercrime. I immediately zeroed in on the fact that this operation was named "Serengeti III", suggesting two previous operations had been conducted. Each of the three operations report similar numbers, with ~1,000 arrests, targeting 35k-86k victims, recovering $44M-$105M dollars USD. Each of these operations has been almost exactly one year apart, starting in 2024, which raises the question: Is there any lasting impact? Is law enforcement just scooping up the lower level operators, which can be quickly replaced? Are these operations sustainable? I'm not so sure, but I suppose they're likely worth it for the money recovered, especially if it is being returned to the victims.

[Honan]
Chalk up another win for those on the side of good. While arresting criminals and recovering stolen funds are important outcomes, we should not underestimate the value of disrupting the infrastructure and services they rely upon. Every disruption increases the costs, risks, and difficulties of conducting cybercrime. It also provides law enforcement with lots of data that could be used for future operations.

[Murray]
International organized crime may be best addressed by international organized law enforcement.

Read more in:
- www.interpol.int: Cybercrime crackdown in Africa nets 1,462 arrests, recovers over USD 105 million
- www.bleepingcomputer.com: Authorities disrupt nearly 11,000 cybercrime networks in Africa
- thehackernews.com: INTERPOL Arrests 1,462 Suspects, Disrupts 10,909 Cybercrime Networks in Global Crackdown
- therecord.media: Cybercrime crackdown across Africa leads to 1,462 arrests, $105 million seized

Japanese video game company Capcom has published a notice disclosing a recent breach of its CAPCOM ID membership service. On October 19, the company detected and blocked unauthorized access, implemented emergency measures, and launched an investigation into the cause, scope, and method of attack involved. On October 20, the company reported the incident to the Information Technology Security Oversight Committee and "established an internal incident response headquarters" while investigation continued, revealing that the intruder had accessed customer information registered with CAPCOM ID, including email addresses and "system-specific identifier information" contained in 11,774,247 records, and accessed the date of birth, gender, country/region, and nickname for 43 of that set. Additionally, 196 affected accounts had their CAPCOM ID passwords changed without authorization. These account holders' original passwords do not seem to have been exposed, and the attacker-changed passwords have since been reset, but Capcom published an update on October 23 noting that the intruder accessed the e-Capcom account pages of 19 of those 196 accounts, affecting additional data including “name, name in Japanese phonetic characters, telephone number, postal code, address, gender, date of birth, purchase history, e-Capcom customer inquiry history, [and] saved address book information.” It does not appear that any credit card information has been compromised. On October 21, Capcom filed reports with the Osaka Prefectural Police and Japan’s Personal Information Protection Commission. The company has "identified and addressed the attack method," but has not published further information. CAPCOM ID and the publisher's games are still accessible, but the company recommends users exercise caution and refrain from opening URLs or files in suspicious messages in case stolen information is used to send fraudulent communications. Emergency response measures are now complete, and Capcom has created support hotlines, forms, and email addresses for customers; those affected will be contacted directly.

Editor's Note

[Neely]
Not to diminish the impact to affected users, but 43 out of nearly 12 million exposed records containing sensitive information, let alone only 196 accounts affected by password changes, are some pretty good numbers. Capcom has setup dedicated customer support channels based on region — Japan; North, Central and South America; Europe, Middle East and Africa (EMEA); Asia (excluding Japan) and Oceania — and is starting to notify affected users. They have identified the attack vector but are still working on preventing recurrence. Given the rapid response and details already known, Capcom had very good visibility into their environment, highlighting the value of good logging and analysis capabilities. This is a good story to leverage for strengthening your argument for cyber resilience.

[Sanabria]
I doubt any of the data compromised is being leaked for the first time here, but this is an opportunity to highlight the missed opportunity to allow the general public to learn from this incident. "The company has ‘identified and addressed the attack method,’ but has not published further information." This is increasingly disappointing. The best way for the cybersecurity industry to improve collectively is to understand how breaches happen. Our ability to do so is constrained every time a company decides not to release breach details.

[Murray]
Except for the small number of users whose passwords were reset, users need to exercise caution but need not take any other remedial action. The recommended cautions are ones that users should be exercising in any case. However, were I a gamer, I think that I would want a stronger and more convenient authentication option than a password.

Read more in:
- www.capcom.co.jp: Update to Notice and Apology Regarding Customer Information Affected Through Unauthorized Access
- www.capcom.co.jp: Notice and Apology Regarding Customer Information Affected Through Unauthorized Access
- www.helpnetsecurity.com: Capcom data breach exposes 11.7 million account records
- www.securityweek.com: 11 Million Impacted by Capcom Data Breach
- www.bleepingcomputer.com: Capcom confirms data breach affecting 11.7 million accounts

The UK Government's Department for Digital, Culture, Media and Sport is calling for an overhaul of the legislation protecting critical undersea infrastructure (CUI), proposing modernizations for existing laws that "[have] not been updated to reflect technological advances, the growing importance of undersea infrastructure, or the evolving threat environment." The proposal's section on criminal penalties notes that "the Submarine Telegraph Act 1885 (‘STA’) remains the UK’s principal piece of legislation designed specifically to protect subsea cables from harm," and that this law's scope and penalties are no longer applicable. The proposal points to recent submarine activity allegedly targeting CUI, and mentions growing demand for and reliance on many forms of "high-capacity international connectivity" as motivators for ensuring the infrastructure's security and resilience beyond "commercial incentives and voluntary arrangements alone." A recent government review concluded that existing UK legislation fails to deter of harmful conduct affecting CUI, fails to strengthen security and resilience duties performed by subsea telecom cable owners and operators, fails to grant the government sufficient power to address threats to these cables, and fails to both manage national security risks and realize potential benefits of "new fibre-optic sensing technologies." New maximum sentences are proposed for different levels of harmful actions, including up to 14 years in prison for intentional conduct. Courts would be given flexibility to impose fines across all categories without limitations, allowing the scale to apply to corporate offenders as well as to individuals. Further chapters cover legally mandated duties for security and resilience, government powers to direct industry to take certain actions, and the implementation and security of sensing technologies such as Distributed Acoustic Sensing (DAS) and Distributed Temperature Sensing (DTS). Consultation on this proposal will be open until January 14, 2027.

Editor's Note

[Honan]
While it is good to finally see governments take on the threat to the physical infrastructure that the Internet relies on, those governments need to realise more laws by themselves are not enough to manage the threat. We need to ensure that there are appropriate monitoring, detection, and response capabilities in place, along with sufficient redundancy so that the loss of a cable does not result in the loss of critical services.

[Neely]
Updating legislation based on updated use cases and evolving threats is important for it to remain relevant and an effective deterrent. The issues with undersea cables over the last year or two highlight the need for updated legislation, protections, and consequences for this critical infrastructure. While the choice of CUI as an acronym is unfortunate for those of us working with sensitive US government data, creating an easy label like that has advantages which may outweigh the use of an existing acronym. The proposed modernization of legislation is available in both HTML and PDF form from the UK.gov site. If you are an owner or operator of undersea infrastructure, or highly dependent on it, complete their consultation questionnaire as well as the online cost impact survey.

[Murray]
Media coverage seems focused on the possible 14 year prison sentence for sabotage. While CUI is often breached, sabotage is rare. Comment will likely focus on the OT responsibilities imposed upon operators.

[Dukes]
DCMS is correct: The current law is outdated and lacks meaningful punitive teeth. However, other statutes enacted over the past century have proven effective in prosecuting these types of cases. Ultimately, legislative updates like this often feel more like lawmakers looking for something to do than filling a genuine enforcement gap.

[Sanabria]
I don't think the Russian-chartered ships "accidentally" dragging anchors care about UK laws.

Read more in:
- www.gov.uk: Critical Undersea Infrastructure Security and Resilience: Proposals for modernising the UK’s legislation (White Paper)
- www.theregister.com: UK threatens subsea cable saboteurs with 14 years behind bars
- therecord.media: UK proposes 14-year prison terms for undersea cable sabotage
- www.helpnetsecurity.com: UK proposes 14-year jail terms for subsea cable saboteurs

The US Cybersecurity and Infrastructure Security Agency (CISA) has published an agency strategy document titled, "CISA 2030: Defend, Harden, Prevail." The guidance is structured around these three pillars, and is motivated by a need to "transform [CISA's] operational model to advance collective cyber defense, harden infrastructure most essential to [US] national and economic security, and mobilize [CISA] partnerships to strengthen collective resilience." The key objectives for "Defend" assert CISA's responsibility to lead national cyber defense by integrating cyber defense capabilities across all levels of government, industry, and other stakeholders; by improving visibility, anomaly detection, and supply chain integrity in an effort to modernize and secure operational technology (OT); by establishing data-driven guidance and best practices for developing secure software and maintaining a transparent supply chain; and by assessing and securing emerging technologies. The objectives for "Harden" are to invest in and mature the "intelligence-to-operations pipeline" by improving technology, decision making and alerts, and operational response; to support security prioritization by maintaining and analyzing infrastructure data and helping to develop the National Risk Register; to "advance infrastructure security through localized action" in a network of partnerships; and to reinforce domestic critical infrastructure. "Prevail" focuses on spreading capability through CISA advisors and through its ten regional offices; on strengthening interoperability and continuity of national security/emergency preparedness (NS/EP) communications; on continuously assessing readiness and joint planning efforts; and on "investing in scalable, encrypted, and resilient infrastructure," also prioritizing interoperability and continuity. CISA sets three milestones for this strategy: Within 60 days, the agency will begin a preparatory review of its services and capabilities; within 180 days, the agency will deliver a plan for implementation and for measuring outcomes; and within 365 days, the agency will provide an update on its progress.

Editor's Note

[Dukes]
The new strategy says all the right things, but the deliverables lack urgency. Spending a year just to deliver a plan for implementation and then waiting on congressional funding virtually guarantees this framework will be obsolete before it's ever funded.

[Neely]
The strategy is a 12 page PDF, the bulk of which is on pages 6-10 and worth a read; meeting this strategy will increase the value of CISA to all of us. My concern is whether their current budget and staffing levels will enable them to achieve the level of success needed, particularly for transitions of roles and responsibilities which typically have a peak during the process before settling into the long-term norm.

[Pescatore]
Not much new here, especially if CISA budgets continue to be cut.

[Sanabria]
I feel like I can best express my thoughts on CISA 2030 through poetry:
Three pillars guide us
Too few staff to take action
Winter is coming

Read more in:
- www.cisa.gov: CISA 2030: Defend, Harden, Prevail
- cyberscoop.com: CISA publishes strategy with eye on the next four years

The State Bank of India (SBI) has filed a legally mandatory disclosure with India's National Stock Exchange and BSE Limited, describing a recent "incident involving data loss." On October 16, SBI was notified by CERT-In and by the Defense Cyber Agency, SBI's threat intelligence service provider, that SBI customer information may have been exposed on the dark web. Analysis confirmed that "of approximately 375,000 records available on the dark web, 3,897 customer records containing Personally Identifiable Information (PII) were identified," which included mobile number, date of birth, name, gender, email address, residential address, branch and CIF identifiers, lead IDs, and metadata and files associated with loan/lead records. SBI activated protocols for incident response and containment, and engaged a cybersecurity agency empaneled by CERT-In to assist with assessment of the incident. SBI states that the bank's business, operations, and financials have not been materially impacted nor disrupted, and assessment is continuing alongside remedial and preventive measures. SBI's official notice addressing customers on social media emphasizes that "the incident has impacted a very very small number of customers," and states that "customer balances are completely safe."

Editor's Note

[Neely]
For context, SBI has about 530 million customers, making 375,000 records less than one percent. SBI is still validating the extent and legitimacy of the breach and claims of the data exfiltrated, so expect some change in the numbers, but their current processes have contained the incident. You may recall that India enacted disclosure laws with very short timeframes, which SBI is following, so it’ll be interesting to see how the story changes as the investigation progresses, as well is whether the involvement of CERT-In security auditors helps or hinders the process.

Read more in:
- www.bseindia.com: Disclosure under Regulation 30 of SEBI (LODR) Regulations, 2015 – Incident involving Data Loss (Archived)
- x.com: @TheOfficialSBI | October 21, 2026
- www.darkreading.com: State Bank of India Suffers a Customer PII Data Leak
- thehackernews.com: State Bank of India Confirms Data Leak After 3,897 Customer Records Found on Dark Web

SANS Internet Storm Center StormCast Tuesday, October 27th, 2026
Apple Patches 304 Vulnerabilities Incl. Exploited CoreGraphics Flaw; Threat Hunting in DShield SIEM with ELK; .NET and PHP Brotli Fixes (CVE-2026-111497)

https://isc.sans.edu/podcastdetail/10152

In this episode: Apple's October updates fix 304 vulnerabilities, including an already exploited CoreGraphics flaw now patched for iOS 18; a guest diary shows how to hunt for threat actors in a DShield SIEM honeypot using HTTP language preference headers in Elasticsearch; and Microsoft and PHP ship out-of-band updates for the Brotli decompression vulnerability CVE-2026-111497.

Apple Patches for October 2026: 304 Vulnerabilities Fixed
Apple released updates for all of its operating systems, fixing 304 vulnerabilities. An already exploited CoreGraphics vulnerability (CVE-2026-86950), patched in current iOS versions about a month ago, is now also fixed for iOS 18. Other notable fixes cover a malicious app accessing the camera without user permission (CVE-2026-86990) and a local attacker gaining access to Keychain items (CVE-2026-28864).
https://isc.sans.edu/diary/33458/

Looking for a Language: Threat Hunting in a DShield SIEM Honeypot with ELK
In a guest diary, SANS.edu undergraduate intern Jeffray Spence shows how to use Elasticsearch and Kibana in the DShield SIEM (security information and event management) honeypot to hunt for threats. Filtering on HTTP language preference headers, such as Accept-Language and Accept-Charset values requesting Chinese, isolates related requests and helps identify automated scanning campaigns and the threat actors behind them.
https://isc.sans.edu/diary/33442

More Brotli Updates: .NET Out-of-Band Patch and PHP Windows Builds (CVE-2026-111497)
Microsoft released out-of-band security updates for .NET 8, 9 and 10 and .NET 11 Release Candidate 3 to fix CVE-2026-111497, a buffer overflow in Brotli decompression. PHP rebuilt its Windows binaries with the updated Brotli library without changing the PHP version number, so compare hashes to confirm you run the fixed build. Expect more vendors to release Brotli fixes over the next few weeks.
https://devblogs.microsoft.com/dotnet/dotnet-october-2026-oob-security-updates/
https://www.php.net/archive/2026.php#2026-10-26-1

SANS Internet Storm Center StormCast Monday, October 26th, 2026
PHP2Shell Exploit Reliability; Node.js Brotli Decoder RCE (CVE-2026-111497); Tailscale "Tailworm" Vulnerabilities; HPE ArubaOS 8/10 Patches 72 Flaws

https://isc.sans.edu/podcastdetail/10150

In this episode: why a reliable PHP2Shell exploit is still hard to build, a Node.js Brotli decoder remote code execution flaw, publicly disclosed Tailscale mesh VPN vulnerabilities, and an HPE update fixing 72 vulnerabilities in ArubaOS 8 and 10.

Reliable PHP2Shell Exploitability
Bojan Zdrnja found that building a reliable, universal exploit for the PHP2Shell vulnerabilities is difficult: address space layout randomization (ASLR) requires a second leak to find the base address, a larger PHP memory limit makes exploitation harder, and the offsets depend on the exact PHP version and Linux distribution. Targeted exploitation has been reported, so finish patching and keep session.upload_progress.enabled set to 0 even after applying the update.
https://isc.sans.edu/diary/33452

Node.js Brotli Decoder Out-of-Bounds Write (CVE-2026-111497)
The Node.js October 2026 security releases fix several vulnerabilities, including an out-of-bounds write in the bundled Brotli compression library's decoder that permits remote code execution when an application decompresses attacker-supplied data. OpenAI Codex Security is credited with the discovery; watch for Brotli decoder fixes in other products that use the library.
https://nodejs.org/en/blog/vulnerability/october-2026-security-releases

Tailscale "Tailworm" Vulnerabilities
Researchers made a set of vulnerabilities in the Tailscale mesh VPN public without coordinated disclosure. Exploitation requires access to the tailnet, but critical issues bypass Tailscale's trust model, for example by letting an attacker join their own systems to your tailnet; watch for Tailscale updates.
https://tailworm.com/

HPE Aruba Networking Update for ArubaOS 8 and 10 (AOS-8/AOS-10)
Hewlett Packard Enterprise (HPE) bulletin HPESBNW05162 fixes 72 vulnerabilities in the ArubaOS 8 and 10 wireless operating systems, eight of which allow unauthenticated remote code execution. Apply the update; expect more large updates like this as vendors use AI tools to find vulnerabilities.
https://support.hpe.com/hpesc/public/


My Upcoming Classes
https://www.sans.org/profiles/dr-johannes-ullrich