SANS NewsBites Vol. 28 Num. 81 : UK to Consider Software Makers' Liability for Breaches; South Carolina Hospital Cyber Support from Project Lifeline 250; NIST PQC Migration Roadmap
October 30, 2026 Vol. 28, Num. 81
Voting for the SANS Difference Makers Awards is now open. Help us recognize cybersecurity professionals who go above and beyond, including practitioners, educators, researchers, and community builders whose work quietly shapes the field: https://www.sans.org/go/difference-makers-awards-2026
Voting for the SANS Difference Makers Awards is now open. Help us recognize cybersecurity professionals who go above and beyond, including practitioners, educators, researchers, and community builders whose work quietly shapes the field: https://www.sans.org/go/difference-makers-awards-2026
Top of The News
- UK to Consider Placing Liability for Breaches on Software Makers
- Project Lifeline 250 Will Bring Cybersecurity Support to Rural Hospitals in South Carolina
- NIST Publishes Roadmap for Migrating to PQC Standards
The Rest of the Week's News
- CISA Advisory Warns of EPICS Vulnerabilities
- Attempted Exploitation of Oracle E-Business Suite Vulnerability Observed
- Firefox and Chrome Updates
- DHS Data Leak Reveals Agency's Organization
- Japan Airlines Says Third-Party Breach Compromised Customer Data
- 70-Month Prison Sentence for Ransomware Operator
Internet Storm Center Tech Corner
- Claude Finds Linux Kernel Multipath TCP RCE (CVE-2026-98432)
- EDK II UEFI PXE Pre-Boot RCE (CVE-2026-97631)
- PHP RCE Exploited on Palo Alto PAN-OS, and more
Resources
Emergency Livestream Replay | PHP Vulnerabilities: What You Need to Know Today and Do Right Now
Watch the replay of the October 21 emergency livestream, featuring Moses Frost, Senior Instructor at SANS Institute, and Rich Greene, Certified Instructor and Senior Solutions Engineer at SANS Institute, who cut through the noise and explain what we know about these vulnerabilities, which systems may be affected, and exactly what security teams should do now.
SANS CyberThreat 2026 | London Cybersecurity Summit | November 16-17
Speakers include Ivan Kalabashkin (Security Service of Ukraine) on Ukraine’s cyber war playbook, Maciej Siciarek (NASK) on the attack on Poland’s energy sector, James Lyne (SANS Institute) on how AI and geopolitics are reshaping cyber defence, and David Mound (Shinobi Security) on testing an AI red teaming agent against a wind farm.
The EU AI Act: Is It GDPR for the 2020s, or the Limits of the Brussels Effect?
This discussion paper applies the lived lessons of the 2018 GDPR rollout to what the EU AI Act compliance requires in practice. It works through four real similarities and four real differences between the two regulations and argues that compliance here is an ongoing triage exercise. Findings from an accompanying survey will inform a 2027 SANS white paper on EU technology regulation trends.
Free technical content sponsored by Hydrolix
Turn your CDN data into your competitive advantage. Learn how teams use it to hunt attackers across months of history and trust AI agents with production incidents, with advice from leaders at Google Cloud, NVIDIA, IO River, and more. Download the CDN Insights Playbook: https://www.sans.org/info/237200Top of the News
UK to Consider Placing Liability for Breaches on Software Makers
(October 28, 2026)
A bullet point in a UK government policy paper suggests UK lawmakers will consider ways to place liability for breaches caused by unsecure software products with the manufacturers themselves. Section 5.7 of the document includes the following: "Building on the Law Commission’s product liability consultation, the government will consult next year on how to tackle insecure technology at source and consider where liability for cyber breaches should sit." Recorded Future News notes that there is increased concern about the financial repercussions of significant cyberattacks like the Jaguar Land Rover incident, which is "estimated to have cost the British economy £1.9 billion ($2.5 billion)." In 2025, National Cyber Security Centre (NCSC) CTO Ollie Whitehouse wrote "the reality is that ... we know how to build secure products and services ... [but] the business and commercial incentives to encourage adoption and sustainment of secure solutions are not sufficient."
Editor's Note
[Neely]
This is a tough one. We want our suppliers to deliver secure solutions, and they want to deliver and innovate rapidly to meet market demands, often times at the expense of security, and we also need to be on the hook for deploying and maintaining solutions securely. The good news is that despite the large numbers of vulnerabilities discovered using AI, AI tools also make complete testing and remediation a real option, possibly the best move to offset this risk. It's likely the UK will extend existing legislation that covers telecommunication and product security as well as make their National Cyber Security Center’s voluntary software security code of practice legally binding. Overlay the EU Cyber Resilience Act's increase in fines for insecure products, which start in December 2027. This could be very interesting.
[Skoudis]
This is a conversation we've needed for decades. Software customers routinely bear enormous costs from security flaws they had little ability to prevent, so stronger incentives for vendors to build and maintain secure products make sense. But getting the details right will be difficult. How do we distinguish a vendor's preventable security defect from a customer's insecure configuration or failure to patch? How do we protect smaller developers and open-source maintainers from disproportionate liability? Well-designed rules could drive substantial innovation in secure software development while fairly allocating responsibility across the software lifecycle. I hope the UK consultation helps move us in that direction.
[Pescatore]
This issue has always stalled in the US due to resistance from large and politically powerful software vendors. The UK and/or all of Europe making progress on product reliability laws applicable to software would be a good thing for all — rather than "stifling innovation," it could spur major innovation in tools/processes/practices etc., for more "resilient" software and services.
[Dukes]
Liability for cyber incidents is making news headlines again, echoing the heavy US debates from 2024, and it's a trend that's here to stay. Rather than waiting for mandates, software vendors should be proactive. A great first step is self-assessing against the Center for Internet Security’s “Secure by Design: A Guide to Assessing Software Security Practices.” https://www.cisecurity.org/insights/white-papers/secure-by-design-v1-1-a-guide-to-assessing-software-security-practices
[Murray]
It is past time that we apply the idea of merchantability to software. If one wants to sell it, one must ensure that it is suitable for its intended use. Only software has been exempt from this rule. The result is shoddy quality and a fragile infrastructure. It is time for accountability. If we cannot do it, then we should thank Europe.
[Neely]
This is a tough one. We want our suppliers to deliver secure solutions, and they want to deliver and innovate rapidly to meet market demands, often times at the expense of security, and we also need to be on the hook for deploying and maintaining solutions securely. The good news is that despite the large numbers of vulnerabilities discovered using AI, AI tools also make complete testing and remediation a real option, possibly the best move to offset this risk. It's likely the UK will extend existing legislation that covers telecommunication and product security as well as make their National Cyber Security Center’s voluntary software security code of practice legally binding. Overlay the EU Cyber Resilience Act's increase in fines for insecure products, which start in December 2027. This could be very interesting.
[Skoudis]
This is a conversation we've needed for decades. Software customers routinely bear enormous costs from security flaws they had little ability to prevent, so stronger incentives for vendors to build and maintain secure products make sense. But getting the details right will be difficult. How do we distinguish a vendor's preventable security defect from a customer's insecure configuration or failure to patch? How do we protect smaller developers and open-source maintainers from disproportionate liability? Well-designed rules could drive substantial innovation in secure software development while fairly allocating responsibility across the software lifecycle. I hope the UK consultation helps move us in that direction.
[Pescatore]
This issue has always stalled in the US due to resistance from large and politically powerful software vendors. The UK and/or all of Europe making progress on product reliability laws applicable to software would be a good thing for all — rather than "stifling innovation," it could spur major innovation in tools/processes/practices etc., for more "resilient" software and services.
[Dukes]
Liability for cyber incidents is making news headlines again, echoing the heavy US debates from 2024, and it's a trend that's here to stay. Rather than waiting for mandates, software vendors should be proactive. A great first step is self-assessing against the Center for Internet Security’s “Secure by Design: A Guide to Assessing Software Security Practices.” https://www.cisecurity.org/insights/white-papers/secure-by-design-v1-1-a-guide-to-assessing-software-security-practices
[Murray]
It is past time that we apply the idea of merchantability to software. If one wants to sell it, one must ensure that it is suitable for its intended use. Only software has been exempt from this rule. The result is shoddy quality and a fragile infrastructure. It is time for accountability. If we cannot do it, then we should thank Europe.
Read more in:
- therecord.media: UK to look at making software companies liable for cyber breaches
- www.gov.uk: Budget 2026 (HTML)
- www.ncsc.gov.uk: Sausages and incentives: rewarding a resilient technology future
Project Lifeline 250 Will Bring Cybersecurity Support to Rural Hospitals in South Carolina
(October 27 & 28, 2026)
The US Office of the National Cyber Director and the governor of South Carolina have announced the launch of Project Lifeline 250, an initiative that will bring cybersecurity support for networks at South Carolina's rural hospitals. Project Lifeline 250 will bring together the Office of the National Cyber Director, South Carolina’s Critical Infrastructure Cybersecurity program, and private sector companies to "focus on strengthening hospital network defenses, providing backup technology to help hospitals maintain operations following a cyberattack, and identifying high-risk medical and other technology devices used in critical care settings." Industry partners include Cisco, Cyera, Microsoft, Trellix, and Zscaler. The six-month pilot program is modeled on Project Watershed 250, a similar initiative launched earlier this year to provide cybersecurity support for water utilities in Texas.
Editor's Note
[Sachs]
I see Project Lifeline 250 as another encouraging sign that we're beginning to recognize the limitations of simply providing cybersecurity guidance to under-resourced critical infrastructure operators. Rural hospitals face many of the same challenges as small water utilities, including limited technical staff, aging equipment, and operational systems that cannot easily be taken offline. I'm particularly interested in whether these six-month pilots can produce affordable, repeatable solutions that remain effective after the initial assistance ends. If they succeed, I believe we could have a practical model for improving cybersecurity and resilience across multiple critical infrastructure sectors.
[Pescatore]
One-time injections of support to small agencies tend not to make lasting gains. Let's wait out the six months to see if long term funding and support is allocated from the Federal budget to enable required staffing and training to make real gains.
[Neely]
This is exciting for South Carolina rural hospitals. I'm worried that since what happens at the end of the program isn't stated, they will hold back from participating. Given the rate of healthcare-related attacks, I'd advise getting signed up for any help to raise the bar is imperative. Watch for information on how to sign up for Project Lifeline 250 and jump in when it comes out.
[Murray]
The states are where we initiate, nurture, and evaluate. What works, we spread.
[Sachs]
I see Project Lifeline 250 as another encouraging sign that we're beginning to recognize the limitations of simply providing cybersecurity guidance to under-resourced critical infrastructure operators. Rural hospitals face many of the same challenges as small water utilities, including limited technical staff, aging equipment, and operational systems that cannot easily be taken offline. I'm particularly interested in whether these six-month pilots can produce affordable, repeatable solutions that remain effective after the initial assistance ends. If they succeed, I believe we could have a practical model for improving cybersecurity and resilience across multiple critical infrastructure sectors.
[Pescatore]
One-time injections of support to small agencies tend not to make lasting gains. Let's wait out the six months to see if long term funding and support is allocated from the Federal budget to enable required staffing and training to make real gains.
[Neely]
This is exciting for South Carolina rural hospitals. I'm worried that since what happens at the end of the program isn't stated, they will hold back from participating. Given the rate of healthcare-related attacks, I'd advise getting signed up for any help to raise the bar is imperative. Watch for information on how to sign up for Project Lifeline 250 and jump in when it comes out.
[Murray]
The states are where we initiate, nurture, and evaluate. What works, we spread.
Read more in:
- cyberscoop.com: National cyber director rolls out latest pilot in South Carolina, this time for rural hospitals
- www.hipaajournal.com: Government Initiative Provides Free Cybersecurity Upgrades and Security Services to Rural Hospitals
- www.nextgov.com: White House takes Texas water cybersecurity model to rural hospitals
- www.govinfosecurity.com: Feds, South Carolina Launch Rural Hospital Cyber Pilot
- governor.sc.gov: Gov. McMaster, White House National Cyber Director Cairncross Launch Project Lifeline 250 To Strengthen Cybersecurity at South Carolina Rural Hospitals
NIST Publishes Roadmap for Migrating to PQC Standards
(October 27 & 28, 2026)
The US National Institute of Standards and Technology (NIST) has published a roadmap to help organizations make the transition to NIST's post-quantum cryptography (PQC) standards. The document "identifies existing quantum-vulnerable cryptographic standards and the quantum-resistant standards that are designed to replace them," and "describes the timelines and migration activities for federal agencies." National Security Memorandum 10, published in May 2022, set 2035 as the deadline for federal systems to complete migration to PQC. The new document, Transition to Post-Quantum Cryptography Standards, is "meant to inform federal agencies, industry partners and standards organizations about what needs to change and when during the migration to PQC standards." NIST mathematician Dustin Moody, who heads the PQC standardization project acknowledges that the agency "understand[s] there’s not one strategy that fits all use cases, and we want to help people handle their migration while staying abreast of what’s changing."
Editor's Note
[Neely]
Yeah, lots of folks talking about PQC. Remember that the threat is changing from going after the key to brute forcing the encryption. As if key management wasn't ripe with bad choices already, and our adversaries are already building a collection of encrypted content to decrypt later. You should already have your systems identified and prioritized (go back to NSM-10 below). Don't get distracted by FUD or by the time to Q-Day; you need to be organized, identify where you’re using encryption and digital signatures, and identify what the path forward for these are. Your operating systems, browsers, network devices, and layered products should all have a timeline. Use this document (read section 4 a couple of times) to understand which encryption, digital signature, and key exchange systems are continuing or need to be replaced; modify your plan accordingly. There is also lots of information about what standards apply to which algorithms — use this information to refine your plans, and answer the ever-present "where is it written" questions. Give serious consideration to testing rolling out products which support PQC already. Don’t panic, you got this.
[Skoudis]
The 2035 deadline may sound comfortably far away, but migrating cryptography across a large organization can take years. And some deadlines are closer than you might think: Federal high-value assets and high-impact systems face 2030 requirements for quantum-resistant key establishment and 2031 for digital signatures. Organizations should inventory where they rely on quantum-vulnerable public-key cryptography, including certificates, authentication, software signing, embedded devices, cloud services, and third-party products. Work with vendors on realistic migration plans, and pay particular attention to sensitive information that must remain confidential for many years. Attackers may be collecting encrypted data today for decryption in the future. The sooner we understand our cryptographic dependencies, the more manageable this transition becomes.
[Dukes]
PQC standardization has been a decade-long conversation, but NIST just set a definitive timeline. Eight years until 2035 might sound like plenty of time, but factoring in vendor software library updates and core hardware replacements, the clock is ticking fast. CIOs and CISOs can't afford to wait; PQC transition planning needs to start now.
[Murray]
PQC is more urgent for some than for most of us. If you are using encryption to protect highly sensitive long-lived data, data vulnerable to "store now decypt later" (SNDL) attacks, then PQC is an urgent issue. While solving for a 4096 bit RSA private key, even with a large-scale error correcting quantum computer, may take hours to days and may be very expensive, within the same time we will have generated thousands of such keys. Almost by definition, in cryptography, the advantage is always to the user, never to the adversary. Take time to migrate cautiously.
[Neely]
Yeah, lots of folks talking about PQC. Remember that the threat is changing from going after the key to brute forcing the encryption. As if key management wasn't ripe with bad choices already, and our adversaries are already building a collection of encrypted content to decrypt later. You should already have your systems identified and prioritized (go back to NSM-10 below). Don't get distracted by FUD or by the time to Q-Day; you need to be organized, identify where you’re using encryption and digital signatures, and identify what the path forward for these are. Your operating systems, browsers, network devices, and layered products should all have a timeline. Use this document (read section 4 a couple of times) to understand which encryption, digital signature, and key exchange systems are continuing or need to be replaced; modify your plan accordingly. There is also lots of information about what standards apply to which algorithms — use this information to refine your plans, and answer the ever-present "where is it written" questions. Give serious consideration to testing rolling out products which support PQC already. Don’t panic, you got this.
[Skoudis]
The 2035 deadline may sound comfortably far away, but migrating cryptography across a large organization can take years. And some deadlines are closer than you might think: Federal high-value assets and high-impact systems face 2030 requirements for quantum-resistant key establishment and 2031 for digital signatures. Organizations should inventory where they rely on quantum-vulnerable public-key cryptography, including certificates, authentication, software signing, embedded devices, cloud services, and third-party products. Work with vendors on realistic migration plans, and pay particular attention to sensitive information that must remain confidential for many years. Attackers may be collecting encrypted data today for decryption in the future. The sooner we understand our cryptographic dependencies, the more manageable this transition becomes.
[Dukes]
PQC standardization has been a decade-long conversation, but NIST just set a definitive timeline. Eight years until 2035 might sound like plenty of time, but factoring in vendor software library updates and core hardware replacements, the clock is ticking fast. CIOs and CISOs can't afford to wait; PQC transition planning needs to start now.
[Murray]
PQC is more urgent for some than for most of us. If you are using encryption to protect highly sensitive long-lived data, data vulnerable to "store now decypt later" (SNDL) attacks, then PQC is an urgent issue. While solving for a 4096 bit RSA private key, even with a large-scale error correcting quantum computer, may take hours to days and may be very expensive, within the same time we will have generated thousands of such keys. Almost by definition, in cryptography, the advantage is always to the user, never to the adversary. Take time to migrate cautiously.
Read more in:
- www.nextgov.com: NIST issues roadmap for transition to post-quantum encryption standards
- www.helpnetsecurity.com: NIST starts the countdown to retire quantum-vulnerable encryption
- www.executivegov.com: NIST Finalizes Road Map for Post-Quantum Cryptography Transition
- www.nist.gov: NIST Report Provides Guidelines for Transition to Post-Quantum Cryptography Standards
- nvlpubs.nist.gov: Transition to Post-Quantum Cryptography Standards (PDF)
- csrc.nist.gov: NSM-10 and the Transition to Post-Quantum Cryptography (PDF) (April 2022)
- www.presidency.ucsb.edu: Memorandum on Promoting United States Leadership in Quantum Computing While Mitigating Risks to Vulnerable Cryptographic (May 2022)
Sponsored Links
Webinar | Fall Cyber Solutions Fest | November 17-19 | The 2026 Fall Cyber Solutions Fest brings cyber defense practitioners hands-on sessions across five tracks including emerging technologies, SOC, zero trust, threat intelligence, and AI. https://www.sans.org/info/237180
Webinar | AI Summit Fall Solutions Track | Tuesday, November 3 | Explore real-world approaches to applying AI in cybersecurity programs, focusing on how to move from theory to measurable impact. https://www.sans.org/info/237185
SANS Research | The State of AI Security Maturity Benchmark Survey | Is your AI security keeping pace with adoption? Give SANS 10 minutes to find out and get early access to the benchmark results before anyone else. Take the survey https://www.sans.org/info/237190
Webinar | AI Summit Fall Solutions Track | Tuesday, November 3 | Explore real-world approaches to applying AI in cybersecurity programs, focusing on how to move from theory to measurable impact. https://www.sans.org/info/237185
SANS Research | The State of AI Security Maturity Benchmark Survey | Is your AI security keeping pace with adoption? Give SANS 10 minutes to find out and get early access to the benchmark results before anyone else. Take the survey https://www.sans.org/info/237190
The Rest of the Week's News
CISA Advisory Warns of EPICS Vulnerabilities
(October 27 & 28, 2026)
The US Cybersecurity and Infrastructure Security Agency (CISA) published an Industrial Control System (ICS) advisory regarding four vulnerabilities in the EPICS (Experimental Physics and Industrial Control System) open-source software toolkit. CVE-2026-114595, CVSS score 9.3, is a critical integer overflow vulnerability that could lead to memory corruption, denial of service, or potential remote code execution; CVE-2026-114596, CVSS score 8.8, is a high-severity integer overflow vulnerability that could lead to process instability or denial of service; CVE-2026-114597, CVSS score 8.7, is a high-severity improper handling of length parameter inconsistency issue that could lead to denial of service and exposure of adjacent memory contents; and CVE-2026-114598, CVSS score 8.7, is a high-severity type confusion issue that could lead to denial of service and exposure of adjacent memory contents. The vulnerabilities affect EPICS Base 7.0.10 and earlier; users are urged to update to version 7.0.11.
Editor's Note
[Neely]
These three flaws essentially boil down to improper input handling, which is something developers have been running down for a bit. AI-assisted vulnerability discovery made it possible for these flaws, which are 14.5 and 31.5 years old, to be discovered by Cipher in about 4 hours. Patches for the EPICS toolkit were released in August. While your team is updating, review the security and isolation of their control system. Verify it’s not Internet-facing, and also that it’s isolated from anything not directly authorized to connect to it. Have a conversation about how you would architect remote access if needed, to include a bastion or jump host. Here is another chance to get insight to the production/OT side of your enterprise.
[Dukes]
CISA issuing alerts isn't new, but discovering flaws via autonomous AI in mere hours certainly is. As has been said before in NewsBites, welcome to the new normal. The bottom line for OT environments? Access is everything, and both internet and physical entry points must be aggressively restricted.
[Murray]
Not EPIC (MyChart) electronic healthcare software.
[Neely]
These three flaws essentially boil down to improper input handling, which is something developers have been running down for a bit. AI-assisted vulnerability discovery made it possible for these flaws, which are 14.5 and 31.5 years old, to be discovered by Cipher in about 4 hours. Patches for the EPICS toolkit were released in August. While your team is updating, review the security and isolation of their control system. Verify it’s not Internet-facing, and also that it’s isolated from anything not directly authorized to connect to it. Have a conversation about how you would architect remote access if needed, to include a bastion or jump host. Here is another chance to get insight to the production/OT side of your enterprise.
[Dukes]
CISA issuing alerts isn't new, but discovering flaws via autonomous AI in mere hours certainly is. As has been said before in NewsBites, welcome to the new normal. The bottom line for OT environments? Access is everything, and both internet and physical entry points must be aggressively restricted.
[Murray]
Not EPIC (MyChart) electronic healthcare software.
Read more in:
- www.securityweek.com: Long-Hidden Flaws Patched in EPICS Research Facility Control Software
- www.theregister.com: AI 'hacker' finds 4 severe bugs in popular industrial control software in under 4 hours
- www.cisa.gov: EPICS Base
Attempted Exploitation of Oracle E-Business Suite Vulnerability Observed
(October 28 & 29, 2026)
Attackers are attempting to exploit a known and recently patched critical unauthenticated SQL injection vulnerability in Oracle E-Business Suite. The flaw, CVE-2026-101767, CVSS score 9.8, exists in the Oracle Application Object Library. The vulnerability was detected by Horizon3.ai researchers Brandon Peterson, Jimi Sebree, and Noah King, who reported the issue to Oracle on July 24, 2026. The researchers write that "the vulnerability allows an attacker with network access to the affected Thin Client Framework (TCF) servlet to execute SQL as the APPS database user, then run operating system commands as the EBS application account." Oracle fixed the issue in its most recent Critical Patch Update, which was released on October 20. In a post on X on Tuesday, October 27, Defused writes that their "Oracle E-Business Suite decoys recorded exploratory exploits against CVE-2026-101767, an unauthenticated SQL injection in EBS's Thin Client Framework servlet that chains to remote code execution."
Editor's Note
[Skoudis]
One particularly concerning detail in Horizon3's research: The vulnerable Oracle EBS servlet is permitted through the product's default URL firewall configuration. That means organizations relying on the default rules may have more exposure than they realize. Until patching is complete, Horizon3 recommends removing the vulnerable endpoint from the allowlist and restricting access to the EBS web tier. Review the indicators of compromise they've published, too. With an unauthenticated attack path from SQL injection to operating-system command execution in systems managing financial, HR, and other sensitive enterprise data, this deserves urgent attention.
[Neely]
Short version — SQL Injection flaw in TCF servlet; patch released in the October CPU; attackers are targeting Internet exposed Peoplesoft/Oracle E-Business Suite (EBS); exploitation discovered in May. This gives you three tasks: First, get patched, the fix for the PeopleSoft zero-day came out in June, and CPUs are cumulative, so if you missed that, applying the October update covers it. Second, look for IoCs — you’re expecting to find web shells and possible data exfiltration or modification, cleaning up if you find them. Third, restrict access to your EBS. Here is the difficulty: Since the flaw can be used to modify data, your finance/HR teams are going to need to validate their data; be nice, as this may make them grumpy.
[Murray]
Validating input is harder than it looks.
[Skoudis]
One particularly concerning detail in Horizon3's research: The vulnerable Oracle EBS servlet is permitted through the product's default URL firewall configuration. That means organizations relying on the default rules may have more exposure than they realize. Until patching is complete, Horizon3 recommends removing the vulnerable endpoint from the allowlist and restricting access to the EBS web tier. Review the indicators of compromise they've published, too. With an unauthenticated attack path from SQL injection to operating-system command execution in systems managing financial, HR, and other sensitive enterprise data, this deserves urgent attention.
[Neely]
Short version — SQL Injection flaw in TCF servlet; patch released in the October CPU; attackers are targeting Internet exposed Peoplesoft/Oracle E-Business Suite (EBS); exploitation discovered in May. This gives you three tasks: First, get patched, the fix for the PeopleSoft zero-day came out in June, and CPUs are cumulative, so if you missed that, applying the October update covers it. Second, look for IoCs — you’re expecting to find web shells and possible data exfiltration or modification, cleaning up if you find them. Third, restrict access to your EBS. Here is the difficulty: Since the flaw can be used to modify data, your finance/HR teams are going to need to validate their data; be nice, as this may make them grumpy.
[Murray]
Validating input is harder than it looks.
Read more in:
- www.theregister.com: Oracle celebrates end of Cybersecurity Awareness Month with quadruple trouble
- www.helpnetsecurity.com: Exploitation attempts against recently patched Oracle EBS flaw have begun (CVE-2026-101767)
- horizon3.ai: CVE-2026-101767 | Oracle E-Business Suite TCF SQL Injection and Remote Code Execution
- x.com: @DefusedCyber | October 17, 2026
Firefox and Chrome Updates
(October 27, 28, & 29, 2026)
Mozilla and Google have released updates for their flagship browsers. Firefox version 159 for Windows, Android, macOS, and Linux includes fixes for 167 security issues, 108 of which are high severity; none are rated critical. Nearly 100 of the vulnerabilities addressed in the latest version of Firefox are use-after-free issues, which could be exploited to crash the browser or allow execution of malicious code. The newest versions of Chrome for Windows and macOS (156.0.8078.73/.74) and Linux (156.0.8078.73) address 52 security issues, four of which are rated critical.
Editor's Note
[Neely]
While you're busy updating one browser, such as Chrome, check all your others for updates. Chrome and Chromium-based browsers are a bit more obvious about their having an update, but you really need a cadence of checking everything. Put an event on your calendar. The updates don't take all that long, like less time than a freshly poured cup of coffee to get to a drinkable temperature. And do you really want to have that conversation about how you got tipped while the browser was telling you there was an available update? Be deliberate and methodical, you'll be fine.
[Dukes]
What's newsworthy is the high volume of security fixes rolled out across the two browsers. While you're at it, make it common practice to restart your browser on a daily basis. It takes seconds to do and ensures critical patches take immediate effect.
[Neely]
While you're busy updating one browser, such as Chrome, check all your others for updates. Chrome and Chromium-based browsers are a bit more obvious about their having an update, but you really need a cadence of checking everything. Put an event on your calendar. The updates don't take all that long, like less time than a freshly poured cup of coffee to get to a drinkable temperature. And do you really want to have that conversation about how you got tipped while the browser was telling you there was an available update? Be deliberate and methodical, you'll be fine.
[Dukes]
What's newsworthy is the high volume of security fixes rolled out across the two browsers. While you're at it, make it common practice to restart your browser on a daily basis. It takes seconds to do and ensures critical patches take immediate effect.
Read more in:
- www.zdnet.com: Firefox and Chrome patch 200+ security flaws combined – update both ASAP
- www.securityweek.com: Chrome and Firefox Updates Patch Over 200 Vulnerabilities
- www.malwarebytes.com: Chrome and Firefox updates fix serious security flaws. Install them now
- www.mozilla.org: Mozilla Foundation Security Advisory 2026-118
- chromereleases.googleblog.com: Stable Channel Update for Desktop
DHS Data Leak Reveals Agency's Organization
(October 28 & 29, 2026)
A breach of US Department of Homeland Security (DHS) systems resulted in the leak of searchable records containing personal information of more than 41,000 DHS employees and contractors. WIRED notes that "the records include email addresses, phone numbers, and office addresses [as well as] references to internal systems and sensitive information on undercover and surveillance programs. In all, the leak provides a map of how DHS is organized and how it operates." The leaked records come from DHS and seven of its constituent agencies. The threat actors who stole and leaked the information say it was taken from DHS's Okta login system. An Okta spokesperson told WIRED, "We are aware of this report. Okta is secure, and we have no evidence our data or systems were compromised." A website that was hosting a searchable version of the purloined data has been taken offline.
Editor's Note
[Neely]
Regardless of motivation or intended use, personnel information for 41,000 DHS employees was breached and apparently was made available, albeit some sources have been removed. Not a lot of information about what was breached — was it a DHS system, or a third party such as Okta (which states it was not breached)? DHS is likely heads down investigating and remediating the attack path, and with luck will publish guidance we can learn from. Right now, all we can do is make sure that we're prepared: that our monitoring could detect exfiltration of data, and that our layered defenses are in place and active (it's so tempting to leave a WAF in learning mode, and you must be in active defense mode.) Be ready for management's question of "could this happen to us?" You're going to want to explain what you're doing to prevent it; there is no way you can guarantee it can't happen.
[Dukes]
This is certainly not a good look for the department housing the nation’s primary cybersecurity agency. While details remain sparse beyond the involvement of a third-party identity and access management (IAM) provider, the incident serves as a critical reminder: Every third-party service must be rigorously integrated into your organization's cybersecurity risk management framework.
[Murray]
Twenty or thirty years ago, federated IAM looked like an attractive enterprise solution. Today, not so much.
[Neely]
Regardless of motivation or intended use, personnel information for 41,000 DHS employees was breached and apparently was made available, albeit some sources have been removed. Not a lot of information about what was breached — was it a DHS system, or a third party such as Okta (which states it was not breached)? DHS is likely heads down investigating and remediating the attack path, and with luck will publish guidance we can learn from. Right now, all we can do is make sure that we're prepared: that our monitoring could detect exfiltration of data, and that our layered defenses are in place and active (it's so tempting to leave a WAF in learning mode, and you must be in active defense mode.) Be ready for management's question of "could this happen to us?" You're going to want to explain what you're doing to prevent it; there is no way you can guarantee it can't happen.
[Dukes]
This is certainly not a good look for the department housing the nation’s primary cybersecurity agency. While details remain sparse beyond the involvement of a third-party identity and access management (IAM) provider, the incident serves as a critical reminder: Every third-party service must be rigorously integrated into your organization's cybersecurity risk management framework.
[Murray]
Twenty or thirty years ago, federated IAM looked like an attractive enterprise solution. Today, not so much.
Read more in:
- www.wired.com: Massive Leak Exposes 41,000 Homeland Security Workers—Including Undercover ICE Agents
- www.nextgov.com: DHS personnel leak exposes contact details and sensitive job information
- cyberscoop.com: Leak site publishes data on more than 41,000 DHS employees obtained by hacktivists
- www.securityweek.com: Over 41,000 DHS Employee Records Leaked Online
Japan Airlines Says Third-Party Breach Compromised Customer Data
(October 28 & 29, 2026)
Japan Airlines has disclosed that a breach of a third-party IT provider's systems resulted in the leak of data belonging to 92,000 Japan Airlines and Japan Transocean Air customers, both part of JAL Group. The incident affected the Amadeus IT Group, which manages JAL's reservation, ticketing, and check-in systems. The intruders had access to the Amadeus system between August 10, 2023 and September 23, 2026. The compromised data include largely reservation codes, names, flight dates, flight sectors, and classes of service. For a smaller number of customers, the compromised information also includes email addresses, phone numbers, passport numbers, nationality, frequent flyer numbers. JAL Group plans to contact affected customers, and the company has also established a dedicated inquiry desk for information regarding the breach.
Editor's Note
[Neely]
Did you add your passport to your ID/credit monitoring? It's easy to forget that this is your internationally recognized identification, not your driver's license. If you have a passport card, add that too, as it's a different number. This is a third-party breach, and while the businesses we work with are working to verify they have the security right, we have to prepare for them overlooking something. Make sure that your organization revisits and verifies third-party security annually and after any major update. Getting your information breached, or working someplace which has been breached, is no fun, which is why proactive preparation is key. Not only to limit the likelihood of a successful attack but also limit its blast radius, both on the individual and the enterprise.
[Murray]
Months to years is an unacceptable time to discovery for a mission critical application. Amadeus IT Group's other customers, including other national carriers, had best look to themselves.
[Neely]
Did you add your passport to your ID/credit monitoring? It's easy to forget that this is your internationally recognized identification, not your driver's license. If you have a passport card, add that too, as it's a different number. This is a third-party breach, and while the businesses we work with are working to verify they have the security right, we have to prepare for them overlooking something. Make sure that your organization revisits and verifies third-party security annually and after any major update. Getting your information breached, or working someplace which has been breached, is no fun, which is why proactive preparation is key. Not only to limit the likelihood of a successful attack but also limit its blast radius, both on the individual and the enterprise.
[Murray]
Months to years is an unacceptable time to discovery for a mission critical application. Amadeus IT Group's other customers, including other national carriers, had best look to themselves.
Read more in:
- therecord.media: Japan Airlines warns of data breach as country grapples with multiple cyber incidents
- www.bleepingcomputer.com: Japan Airlines suffers third-party data breach exposing passenger info
- www.jal.co.jp: Regarding Unauthorized Access to Amadeus Passenger Service System
70-Month Prison Sentence for Ransomware Operator
(October 27, 28, & 29, 2026)
A US District Judge in New York sentenced Artem Stryzhak to 70 months in prison for his role in several ransomware schemes. Court documents say Stryzhak joined the Nefilim ransomware operation in June 2021 and used the malware to launch attacks against organizations in the US, Canada, and Australia during that year. He joined the Hive operation later that same year; that malware was used in ransomware attacks against hospitals, businesses, and governments between October 2021 and January 2023. One of those attacks led to a hospital being unable to admit new patients. Stryzhak, who is a Ukrainian citizen, was arrested in Spain in 2024 and extradited to the US in April 2025. In December 2025, pleaded guilty to charges of conspiracy to commit fraud, extortion, and related activity in connection with computers. A co-conspirator, Volodymyr Tymoshchuk, remains at large.
Editor's Note
[Neely]
Score one for the good guys! Styzhak was a Nefilim affiliate, paying the Nefilim administrators 20% of ransom collected, and later moving to be a full member of the Hive ransomware gang. That he was sentenced recently, for crimes of four to five years ago, shows these things take time, but they do happen. Recall he had to be arrested, extradited to the US, plead, tried, and sentenced. This was supported by a multi-year multi-jurisdictional investigation which held up in court. I would love to hear a presentation on what that took and how lessons learned there will help aid future investigations.
[Murray]
Extortion is no longer the zero-risk crime that it used to be. That said, risk is still too low. The risk may be deterring it some, but it is far from having eliminated it. We need to learn from our successes and build on them.
[Neely]
Score one for the good guys! Styzhak was a Nefilim affiliate, paying the Nefilim administrators 20% of ransom collected, and later moving to be a full member of the Hive ransomware gang. That he was sentenced recently, for crimes of four to five years ago, shows these things take time, but they do happen. Recall he had to be arrested, extradited to the US, plead, tried, and sentenced. This was supported by a multi-year multi-jurisdictional investigation which held up in court. I would love to hear a presentation on what that took and how lessons learned there will help aid future investigations.
[Murray]
Extortion is no longer the zero-risk crime that it used to be. That said, risk is still too low. The risk may be deterring it some, but it is far from having eliminated it. We need to learn from our successes and build on them.
Read more in:
- therecord.media: Nefilim, Hive ransomware operator given five-year-plus sentence after guilty plea
- www.theregister.com: Serial ransomware crook gets 70 months behind bars for Nefilim, Hive roles
- www.hipaajournal.com: Hospital Ransomware Attacker Receives 70 Month Jail Term
- www.securityweek.com: Ukrainian Hive and Nefilim Ransomware Affiliate Gets 70 Months in US Prison
- www.justice.gov: Ukrainian National Sentenced to 70 Months in Prison for Multi-Million Dollar Ransomware Conspiracies
Internet Storm Center Tech Corner
SANS Internet Storm Center StormCast Friday, October 30, 2026
Local Ghidra Server for Malware Analysis Labs; Claude Finds Linux Kernel Multipath TCP RCE (CVE-2026-98432); Hugging Face Cryptomining Malware Campaign
https://isc.sans.edu/podcastdetail/10158
Today's episode covers deploying a local Ghidra Server so malware analysis work survives virtual machine snapshot reverts, a Claude-discovered zero-click Linux kernel remote code execution flaw in Multipath TCP, and a returning Hugging Face malware campaign that abuses trust_remote_code to mine cryptocurrency on GPU hosts.
Deploying a Local Ghidra Server for Your Malware Analysis Lab
Xavier Mertens shows how to set up Ghidra Server, which ships free with Ghidra, so reverse engineering projects are stored and versioned outside the analysis virtual machine and survive a revert to a clean snapshot. A small Linux VM with about 4 GB of RAM is enough; keep it inside the malware lab network, since it holds every imported sample, and never expose it to the internet.
https://isc.sans.edu/diary/33470
Claude Discovers Zero-Click Linux Kernel Multipath TCP Remote Code Execution (CVE-2026-98432)
Anthropic's Frontier Red Team used Claude to find and exploit a race-condition use-after-free in the Linux kernel networking stack that lets an unauthenticated remote attacker run commands as root on servers with a Multipath TCP (MPTCP) listener, defeating kernel address space layout randomization (KASLR) along the way. Exploitation is slow: the proof of concept needed about 48 minutes to leak a kernel pointer plus five minutes to reach code execution. The fix is upstream and backported to stable kernels, but not every distribution has shipped it yet, including Ubuntu at recording time.
https://www.anthropic.com/research/discovering-vulnerabilities-with-claude
Hugging Face Malware Campaign Returns to Hijack GPUs for Crypto Mining
Pluto Security tracked 31 malicious Hugging Face repositories across seven accounts posing as small Qwen2 models; loading one with trust_remote_code=True runs the repository's Python code, which installs a disguised fileless cryptocurrency miner, a watchdog and, in some builds, reverse shells. The campaign targets GPU hosts running self-hosted inference such as Xinference and GPUStack, returned within days of a takedown, and passed 32,000 downloads including linked models.
https://pluto.security/blog/hugging-face-malware-campaign-load-mine/
Local Ghidra Server for Malware Analysis Labs; Claude Finds Linux Kernel Multipath TCP RCE (CVE-2026-98432); Hugging Face Cryptomining Malware Campaign
https://isc.sans.edu/podcastdetail/10158
Today's episode covers deploying a local Ghidra Server so malware analysis work survives virtual machine snapshot reverts, a Claude-discovered zero-click Linux kernel remote code execution flaw in Multipath TCP, and a returning Hugging Face malware campaign that abuses trust_remote_code to mine cryptocurrency on GPU hosts.
Deploying a Local Ghidra Server for Your Malware Analysis Lab
Xavier Mertens shows how to set up Ghidra Server, which ships free with Ghidra, so reverse engineering projects are stored and versioned outside the analysis virtual machine and survive a revert to a clean snapshot. A small Linux VM with about 4 GB of RAM is enough; keep it inside the malware lab network, since it holds every imported sample, and never expose it to the internet.
https://isc.sans.edu/diary/33470
Claude Discovers Zero-Click Linux Kernel Multipath TCP Remote Code Execution (CVE-2026-98432)
Anthropic's Frontier Red Team used Claude to find and exploit a race-condition use-after-free in the Linux kernel networking stack that lets an unauthenticated remote attacker run commands as root on servers with a Multipath TCP (MPTCP) listener, defeating kernel address space layout randomization (KASLR) along the way. Exploitation is slow: the proof of concept needed about 48 minutes to leak a kernel pointer plus five minutes to reach code execution. The fix is upstream and backported to stable kernels, but not every distribution has shipped it yet, including Ubuntu at recording time.
https://www.anthropic.com/research/discovering-vulnerabilities-with-claude
Hugging Face Malware Campaign Returns to Hijack GPUs for Crypto Mining
Pluto Security tracked 31 malicious Hugging Face repositories across seven accounts posing as small Qwen2 models; loading one with trust_remote_code=True runs the repository's Python code, which installs a disguised fileless cryptocurrency miner, a watchdog and, in some builds, reverse shells. The campaign targets GPU hosts running self-hosted inference such as Xinference and GPUStack, returned within days of a takedown, and passed 32,000 downloads including linked models.
https://pluto.security/blog/hugging-face-malware-campaign-load-mine/
SANS Internet Storm Center StormCast Thursday, October 29, 2026
ClickFix Campaign Targets macOS and Windows; EDK II UEFI PXE Pre-Boot RCE (CVE-2026-97631); Qwen AI Model Data Exfiltration; LiteLLM Master Key Leak
https://isc.sans.edu/podcastdetail/10156
Today: A new ClickFix campaign using fake Cloudflare verification pages, a pre-boot remote code execution flaw in the EDK II UEFI PXE network boot driver, Cohere research on the Qwen AI model trying to send data to Alibaba Cloud, and a CVSS 10 LiteLLM file read flaw that leaks the proxy master key.
Yet Another ClickFix Campaign Uses Fake Cloudflare Verification Pages
Brad Duncan captured a previously unseen ClickFix campaign that uses fake Cloudflare verification pages and targets both macOS and Windows. The final malware could not be retrieved, but the diary lists the URLs and indicators of compromise (IOCs) for threat hunting.
https://isc.sans.edu/diary/33466
EDK II UEFI PXE Driver Pre-Boot Remote Code Execution (CVE-2026-97631)
An unauthenticated attacker at any network distance can send oversized ICMP error messages to a system while it network boots via PXE (Preboot Execution Environment), corrupting memory in the UEFI firmware and executing code before Secure Boot checks the operating system. The attack window is limited to the boot, but attackers may send ICMP errors continuously or force a reboot; organizations that PXE-boot servers should patch quickly. The advisory lists a fix in edk2 pull request #13302 but marks the issue "Not patched currently."
https://github.com/tianocore/edk2/security/advisories/GHSA-99cj-7hg9-mp4m
Qwen Open-Weight AI Model Caught Attempting Data Exfiltration to Alibaba Cloud
Researchers at Cohere found that a locally run Alibaba Qwen model (Qwen3.8-Flash-Next) occasionally inventoried its host and tried to upload a probe file with curl to an Alibaba Cloud storage bucket in Beijing. The behavior is rare, and Cohere cannot say whether it is deliberate or a leftover from training, but it shows that self-hosting a model does not guarantee your data stays local.
https://cohere.com/blog/concerning-behaviour-popular-open-weight-ai-model
LiteLLM Unauthenticated File Read Leaks Master Key on Enterprise Proxy
A CVSS 10 vulnerability in the LiteLLM AI proxy lets unauthenticated attackers read local files, exposing the LITELLM_MASTER_KEY and the API keys for the AI providers it connects to. Only deployments with an Enterprise license are affected; it is fixed in versions 1.103.10, 1.104.8, 1.105.6 and 1.106.5.
https://github.com/BerriAI/litellm/security/advisories/GHSA-w4c7-34wj-hqm8
ClickFix Campaign Targets macOS and Windows; EDK II UEFI PXE Pre-Boot RCE (CVE-2026-97631); Qwen AI Model Data Exfiltration; LiteLLM Master Key Leak
https://isc.sans.edu/podcastdetail/10156
Today: A new ClickFix campaign using fake Cloudflare verification pages, a pre-boot remote code execution flaw in the EDK II UEFI PXE network boot driver, Cohere research on the Qwen AI model trying to send data to Alibaba Cloud, and a CVSS 10 LiteLLM file read flaw that leaks the proxy master key.
Yet Another ClickFix Campaign Uses Fake Cloudflare Verification Pages
Brad Duncan captured a previously unseen ClickFix campaign that uses fake Cloudflare verification pages and targets both macOS and Windows. The final malware could not be retrieved, but the diary lists the URLs and indicators of compromise (IOCs) for threat hunting.
https://isc.sans.edu/diary/33466
EDK II UEFI PXE Driver Pre-Boot Remote Code Execution (CVE-2026-97631)
An unauthenticated attacker at any network distance can send oversized ICMP error messages to a system while it network boots via PXE (Preboot Execution Environment), corrupting memory in the UEFI firmware and executing code before Secure Boot checks the operating system. The attack window is limited to the boot, but attackers may send ICMP errors continuously or force a reboot; organizations that PXE-boot servers should patch quickly. The advisory lists a fix in edk2 pull request #13302 but marks the issue "Not patched currently."
https://github.com/tianocore/edk2/security/advisories/GHSA-99cj-7hg9-mp4m
Qwen Open-Weight AI Model Caught Attempting Data Exfiltration to Alibaba Cloud
Researchers at Cohere found that a locally run Alibaba Qwen model (Qwen3.8-Flash-Next) occasionally inventoried its host and tried to upload a probe file with curl to an Alibaba Cloud storage bucket in Beijing. The behavior is rare, and Cohere cannot say whether it is deliberate or a leftover from training, but it shows that self-hosting a model does not guarantee your data stays local.
https://cohere.com/blog/concerning-behaviour-popular-open-weight-ai-model
LiteLLM Unauthenticated File Read Leaks Master Key on Enterprise Proxy
A CVSS 10 vulnerability in the LiteLLM AI proxy lets unauthenticated attackers read local files, exposing the LITELLM_MASTER_KEY and the API keys for the AI providers it connects to. Only deployments with an Enterprise license are affected; it is fixed in versions 1.103.10, 1.104.8, 1.105.6 and 1.106.5.
https://github.com/BerriAI/litellm/security/advisories/GHSA-w4c7-34wj-hqm8
SANS Internet Storm Center StormCast Wednesday, October 28, 2026
eMudhra CA Revocation for Windows, macOS, Linux; PHP RCE Exploited on Palo Alto PAN-OS; Microsoft Authenticator Android Token Leak; GoAhead TLS Bugs
https://isc.sans.edu/podcastdetail/10154
In this episode: Updates on revoking the compromised eMudhra certificate authority certificates on Windows, macOS, Linux and Python, confirmed exploitation of the PHP vulnerabilities against Palo Alto Networks devices, a token leak in Microsoft Authenticator for Android, and TLS certificate validation flaws in the GoAhead embedded web server.
eMudhra Certificate Revocation Updates for Windows, macOS, Linux and Python
Microsoft released out-of-band updates for Windows 10 and 11 to distrust the compromised eMudhra intermediate certificate authority (CA) certificates, and Apple now blocks them in Safari, Mail and apps that use Apple's networking frameworks. Command-line tools that rely on /etc/ssl/cert.pem, Homebrew, Python's certifi package and Linux CA bundles may still trust them until updated. Because the private keys are known, anyone could issue certificates that appear valid.
https://support.microsoft.com/en-us/servicing/os/windows-11
https://support.microsoft.com/en-us/servicing/os/windows-10
https://support.apple.com/en-us/149555
PHP RCE Vulnerabilities Exploited on Palo Alto Networks PAN-OS (CVE-2026-109618, CVE-2026-109619)
Palo Alto Networks has confirmed active exploitation of the critical PHP remote code execution (RCE) flaws against PAN-OS management interfaces exposed to the internet. Some Palo Alto appliances apparently don't always support address space layout randomization (ASLR), which makes exploitation easier, so apply the hotfixes and the advisory's mitigations quickly.
https://security.paloaltonetworks.com/CVE-2026-109618
Microsoft Authenticator for Android Token Theft Flaw (CVE-2026-80097)
Ofek Levin of Enclave.ai found that any other app on the same Android device could obtain authentication tokens from Microsoft Authenticator, breaking a core assumption of using a phone as a second factor. Microsoft has fixed the flaw; versions before 6.2606.4246 are affected.
https://enclave.ai/blog/authmask-we-made-microsoft-authenticator-hand-over-tokens
GoAhead Embedded Web Server TLS Flaws (CVE-2026-115881, CVE-2026-115884)
Researchers from FoxIO found TLS certificate validation flaws in GoAhead, an embedded web server common in IoT devices, including one where certificate revocation lists (CRLs) are loaded but ignored. GoAhead 6.1.1 fixes the bugs, but most users will have to wait for their device vendor to ship an update.
https://foxio.io/blog/choose-your-backend-three-tls-bugs-in-goahead
My Upcoming Classes
https://www.sans.org/profiles/dr-johannes-ullrich
SANS Difference Maker Awards
Dr. Johannes Ullrich is up for the SANS Difference Maker Lifetime Award this year. Please vote: https://www.sans.org/go/difference-makers-awards-2026
eMudhra CA Revocation for Windows, macOS, Linux; PHP RCE Exploited on Palo Alto PAN-OS; Microsoft Authenticator Android Token Leak; GoAhead TLS Bugs
https://isc.sans.edu/podcastdetail/10154
In this episode: Updates on revoking the compromised eMudhra certificate authority certificates on Windows, macOS, Linux and Python, confirmed exploitation of the PHP vulnerabilities against Palo Alto Networks devices, a token leak in Microsoft Authenticator for Android, and TLS certificate validation flaws in the GoAhead embedded web server.
eMudhra Certificate Revocation Updates for Windows, macOS, Linux and Python
Microsoft released out-of-band updates for Windows 10 and 11 to distrust the compromised eMudhra intermediate certificate authority (CA) certificates, and Apple now blocks them in Safari, Mail and apps that use Apple's networking frameworks. Command-line tools that rely on /etc/ssl/cert.pem, Homebrew, Python's certifi package and Linux CA bundles may still trust them until updated. Because the private keys are known, anyone could issue certificates that appear valid.
https://support.microsoft.com/en-us/servicing/os/windows-11
https://support.microsoft.com/en-us/servicing/os/windows-10
https://support.apple.com/en-us/149555
PHP RCE Vulnerabilities Exploited on Palo Alto Networks PAN-OS (CVE-2026-109618, CVE-2026-109619)
Palo Alto Networks has confirmed active exploitation of the critical PHP remote code execution (RCE) flaws against PAN-OS management interfaces exposed to the internet. Some Palo Alto appliances apparently don't always support address space layout randomization (ASLR), which makes exploitation easier, so apply the hotfixes and the advisory's mitigations quickly.
https://security.paloaltonetworks.com/CVE-2026-109618
Microsoft Authenticator for Android Token Theft Flaw (CVE-2026-80097)
Ofek Levin of Enclave.ai found that any other app on the same Android device could obtain authentication tokens from Microsoft Authenticator, breaking a core assumption of using a phone as a second factor. Microsoft has fixed the flaw; versions before 6.2606.4246 are affected.
https://enclave.ai/blog/authmask-we-made-microsoft-authenticator-hand-over-tokens
GoAhead Embedded Web Server TLS Flaws (CVE-2026-115881, CVE-2026-115884)
Researchers from FoxIO found TLS certificate validation flaws in GoAhead, an embedded web server common in IoT devices, including one where certificate revocation lists (CRLs) are loaded but ignored. GoAhead 6.1.1 fixes the bugs, but most users will have to wait for their device vendor to ship an update.
https://foxio.io/blog/choose-your-backend-three-tls-bugs-in-goahead
My Upcoming Classes
https://www.sans.org/profiles/dr-johannes-ullrich
SANS Difference Maker Awards
Dr. Johannes Ullrich is up for the SANS Difference Maker Lifetime Award this year. Please vote: https://www.sans.org/go/difference-makers-awards-2026
The Editorial Board of SANS NewsBites
SANS Institute
11200 Rockville Pike, Suite 200, North Bethesda, MD, 20852
To create a SANS Portal Account visit create new account.
To change your email preferences or unsubscribe visit manage subscriptions.
Privacy Policy.
This mailbox is not monitored. Please email [email protected] or call 301-654-7267 for assistance.
11200 Rockville Pike, Suite 200, North Bethesda, MD, 20852
To create a SANS Portal Account visit create new account.
To change your email preferences or unsubscribe visit manage subscriptions.
Privacy Policy.
This mailbox is not monitored. Please email [email protected] or call 301-654-7267 for assistance.