cybr.cx — Daily Cybersecurity Intelligence Digest

Monday, 02 November 2026

Critical Vulnerabilities

⚠️ Actively exploited — CVE-2026-118527 & CVE-2026-111357 | Ivanti Connect Secure
These two flaws are being actively chained in the wild alongside a third (CVE-2026-104935), making them a three-link exploitation chain that CISA flagged on October 30th — and one remediation deadline has already passed (November 2nd, today). CVE-2026-118527 allows a remote authenticated attacker to write attacker-controlled files to predictable disk locations; CVE-2026-111357 then lets a local authenticated attacker escalate privileges by bypassing authentication on critical functions. Together, the chain can deliver persistent, elevated footholds on your VPN gateway. If you haven't patched or applied Ivanti's mitigations, treat this as a fire drill.

⚠️ Actively exploited — CVE-2026-97229 | GitLab Community & Enterprise Edition
An integer overflow in GitLab's CI/CD regex validation engine allows an unauthenticated attacker to execute arbitrary code on the GitLab server by submitting a specially crafted regular expression in a pipeline configuration file. The remediation deadline from CISA has technically passed (November 1st), meaning federal agencies were required to act — but any organisation running self-hosted GitLab should treat this as critical. Supply chain exposure is the key risk: a compromised CI/CD server is a direct path into your build artifacts and production deployments.

⚠️ Actively exploited — CVE-2026-76418 | Cisco Secure Firewall ASA & FTD
An unchecked return value leading to a NULL pointer dereference allows an unauthenticated remote attacker to crash Cisco ASA and Firepower Threat Defense devices, triggering a denial-of-service reload loop. Perimeter firewall availability is obviously business-critical, and weaponised DoS against security appliances is a known precursor to broader intrusion activity. CISA's remediation deadline also passed November 1st. Verify your ASA/FTD versions and apply Cisco's advisory patches now.

⚠️ Actively exploited — CVE-2026-109618 & CVE-2026-109619 | PHP
Two separate PHP flaws — an out-of-memory corruption bug and a stale internal request-state vulnerability — both enable unauthenticated remote code execution. Deadlines were October 29th. PHP's ubiquity across web hosting environments makes these high-value targets for mass exploitation. If you're running PHP on any public-facing infrastructure, this is urgent regardless of whether you're in scope for CISA directives.

⚠️ Actively exploited — CVE-2026-111497 | Google Brotli
A missing return-value check in the Brotli decompression library allows a remote unauthenticated attacker to corrupt adjacent decoder state memory via a crafted compressed stream, leading to memory disclosure, denial of service, or potentially arbitrary code execution. Brotli is embedded in browsers, CDNs, web servers, and countless application stacks — the attack surface is enormous and largely invisible to most asset inventories.

⚠️ Actively exploited — CVE-2026-48356 | Adobe Commerce & Magento
Unrestricted file upload vulnerability allows arbitrary code execution in the context of the current user. E-commerce skimming and session hijacking are the obvious downstream risks. CISA deadline is November 10th — patch or apply Adobe's workarounds before that window closes.

⚠️ Actively exploited — CVE-2026-46300 | Linux Kernel
A missing variable initialisation in the Linux kernel's socket buffer coalescing path causes ESP input processing to decrypt shared fragments in place, potentially exposing IPsec-protected traffic or enabling unintended data modification. This one had a CISA deadline of October 31st — already past. Kernel patch or distribution update required immediately.

⚠️ Actively exploited — CVE-2026-41709 | Broadcom VMware ESX
An insufficient logging vulnerability allows an admin-level attacker to perform operations without generating audit log entries. While elevated access is a prerequisite, this is precisely the kind of flaw ransomware and espionage actors exploit post-compromise to maintain deniability and evade forensic timelines on hypervisor infrastructure.

CVE-2026-120232 | Horizon DataSys Reboot Restore Standard ≤ 13.2 — CVSS 8.8
A memory corruption vulnerability in the sub_23908 function of the shield.sys kernel driver is exploitable locally, and a public exploit already exists. The irony of a "restore and protect" product harbouring a kernel-level memory corruption bug is not lost — but more practically, this is a privileged escalation path on any endpoint where the software is deployed. No patch yet; monitor the vendor's next release.

CVE-2026-120241 | Ruijie RG-ES Series Switches — CVSS 7.5
A buffer overflow in the httpupg.cgi local firmware upgrade interface affects multiple Ruijie managed switch models running ESW_1.0(1)B1P48. The attack is remotely exploitable and a public PoC exists. Network infrastructure firmware bugs are perennially under-patched — check your switch inventory.

CVE-2026-120191 | Presenton ≤ 0.9.11-beta — CVSS 7.3
Missing authentication on the Presenton API allows unauthenticated remote access. A public exploit is available. The fix is in 0.9.12-beta (patch 44c8a61). Small footprint, but unauthenticated API exposure is trivially weaponisable — update immediately if this is in your stack.

Headline News

TCP Use-After-Free (CVE-2026-98432) Drops with CVSS 9.8
A critical use-after-free vulnerability in the Linux IPv4 TCP stack has been disclosed with a CVSS score of 9.8, placing it at the top of the severity scale. The flaw exists in TCP connection state management and can be triggered remotely, potentially enabling arbitrary code execution in kernel context — the worst possible outcome for any networked Linux system. Given how foundational the Linux TCP stack is to virtually every internet-facing server, container runtime, and embedded device, the blast radius here is substantial. Practitioners should monitor their distribution's security advisories closely and be prepared to fast-track kernel updates; given the existing KEV activity against Linux this week, threat actors are clearly paying attention to kernel-level targets.

Name.com Domain Hijacking Disrupts at Least 12 DeFi Front Ends
Attackers compromised accounts at domain registrar Name.com and hijacked DNS records for at least twelve decentralised finance platforms, redirecting users to malicious front ends likely designed to drain connected wallets. Name.com has since restored the affected domains, but the window of exposure was sufficient for significant financial harm to users who interacted with the poisoned sites. The incident is a textbook demonstration of how DeFi's "trustless" smart contract layer is only as secure as the traditional centralised internet infrastructure sitting in front of it — registrar account compromise, weak MFA, or DNS poisoning can completely undermine on-chain security guarantees. For practitioners: domain registrar credentials and DNS change alerting deserve the same attention as your cloud IAM posture, particularly for any service where domain integrity has direct financial consequences.

Linode Security Incident Under Investigation
Akamai-owned cloud provider Linode has disclosed a security incident, with details still emerging at time of publication. The scope and nature of the breach have not been fully confirmed, but any cloud infrastructure provider incident warrants immediate attention from customers running workloads on the platform — particularly regarding credential exposure, data access, and potential lateral movement into customer environments. Practitioners with Linode-hosted assets should rotate API keys and review access logs as a precautionary measure while the investigation continues. Cloud provider incidents are high-leverage events for attackers; even limited access to provider-side infrastructure can yield significant downstream compromise across customer tenants.

Schrödinger's Feed

The MIT-IBM Computing Research Lab has launched a postdoctoral fellowship designed to accelerate the translation of quantum computing theory into production-ready systems — a meaningful step in closing the gap between academic quantum research and real-world deployment. The focus on rigorous theory meeting production constraints is notable precisely because that gap is where cryptographic relevance lives: a quantum system that works reliably enough to execute Shor's algorithm at scale looks very different from current NISQ-era hardware. Progress here doesn't change today's threat landscape, but it compresses the timeline on which post-quantum cryptography transitions from "good practice" to "urgent necessity." Practitioners who haven't mapped their PKI and long-lived key material against NIST's finalised PQC standards should treat this kind of institutional momentum as a scheduling nudge.

/dev/random

Researchers demonstrated that air-gapped computers — the ones physically isolated from networks precisely because they're supposed to be unreachable — can be covertly exfiltrated by manipulating RAM access patterns to emit radio frequency signals that spell out data, receivable by a nearby SDR antenna. The attack works by carefully timing memory read/write operations to modulate electromagnetic emissions from the RAM bus itself, effectively turning your DDR modules into an unintentional transmitter. It's slow, it requires physical proximity, and it demands prior compromise of the target — but the fact that the data physically leaves the machine as radio waves, with no network interface involved, is the kind of thing that makes Faraday cage procurement budgets suddenly seem reasonable. Air gap fans: it's complicated.