Updates to records and advisories reviewed this time · 23
15:30 JST (GHSA publication)
2 npm packages: mining during installation
GitHub malware advisories describe mining programs and persistence mechanisms run through postinstall in dsh-plugin-blender-3d 0.2.1 and @walknpm/todo-cli 2.0.1. Behavior differs depending on whether root access or passwordless sudo is available. This does not mean that all npm packages or Blender itself have been compromised.
What to check: Check installation records for the affected versions. If they have run, isolate the environment, investigate persistence, external communications, and access to credentials, and revoke any necessary keys from a safe environment.
Primary sources and references: GitHub malware勧告 / GitHub malware勧告 / OpenSSF原記録
16:33 JST (GHSA publication)
@worca/app: malware advisory for affected RC versions
GitHub classifies @worca/app 1.14.0-rc.2 / 1.14.0-rc.4 as malware and advises treating devices on which it was run or installed as compromised. The public record does not specify the number of affected organizations or when the intrusion began.
What to check: Isolate and investigate environments where the affected versions were installed. Rotate keys and secrets from another safe device, and do not consider recovery complete simply because the package has been removed.
Primary sources and references: GitHub malware勧告
18:31 JST (GHSA publication)
npm publish-poc packages: publishing permissions in the installation environment
The 7 affected versions of publish-poc-test3 reportedly attempt to publish using the environment's npm credentials during postinstall. publish-poc-base 1.0.7 prepares a temporary file containing a README fragment and credentials, but the description states that this version deletes it before publishing or communicating externally. Do not count both as successful external transmission.
What to check: Check the affected versions, CI installation logs, and npm publishing history. If suspicious publications are found, revoke the relevant tokens and review dependencies and publishing permissions.
Primary sources and references: test3勧告 / base勧告 / OpenSSF原記録
21:30 JST (GHSA publication)
PyPI netweavex: fetching remote code on import
The affected versions are netweavex 1.1.0 / 1.1.1 / 1.1.2. The original analysis describes copying a legitimate package, obfuscation, and fetching and executing code from GitHub on import. It also states that the retrieval destination was a placeholder at the time of analysis, and does not confirm successful theft of any specific information.
What to check: Check installation records without running the affected versions. If they have run, investigate external communications and execution history, and revoke secrets and rebuild as appropriate to the exposure.
Primary sources and references: GitHub malware勧告 / OpenSSF原記録
18:31 JST (GHSA publication)
2 PyPI cases: transmission of basic device information and analysis classifications
zagents-framework 6.25.30.10b5 / 99.25.30.10b5 and changes-lxc-wrapper 0.0.0 / 0.1.0 are recorded as sending basic device information during installation or import. GitHub categorizes them as malware, while the original analysis classifies them as PROBABLY_PENTEST. Do not equate them with large-scale credential theft incidents.
What to check: Check their intended use and how they were installed, and exclude unnecessary affected packages. If they have run, investigate the destinations and actual impact.
Primary sources and references: zagents勧告 / changes-lxc-wrapper勧告 / OpenSSF原記録
14:58 JST (developer advisory), 21:17 JST (NVD inclusion)
Frappe Builder: SSRF in image retrieval and permissions for AI use
The developer published 3 advisories at 14:58 JST. They cover authenticated users controlling image retrieval destinations, reaching internal destinations through redirects and DNS re-resolution, and insufficient authorization for improve_prompt, which uses an AI provider key. They do not describe compromise of every server by any unauthenticated user.
What to check: Check the requirements for Builder 1.36.1 or later and Frappe v16.36.1 or later. Review image retrieval destinations, publicly stored content, and AI usage logs. If updating is not possible, consider restricting the affected APIs and temporarily removing AI keys.
Primary sources and references: 画像取得勧告 / AI利用権限勧告 / redirect対策勧告
18:16 JST (NVD inclusion)
MISP Guard: check sharing policy evaluation
CVE-2026-116372 allows distribution filters to be bypassed through successful responses other than 200; 116469 allows bypasses through letter casing in tags, categories, and sharing group UUIDs. The developer addressed these in commits at 16:53 / 18:25 JST. This does not confirm compromise of all of MISP itself or disclosure of all feed data.
What to check: Check that the running code includes both fixes, and review permission settings such as TLP and distribution history. The earliest distributed release containing the fixes has not been established in this review.
Primary sources and references: 成功応答の修正 / 大文字小文字の修正
20:16 JST (NVD inclusion)
Mendix SAML: reusing IdP-initiated responses
CVE-2026-89209 is an authentication bypass under conditions involving reuse of a valid SAML response in IdP-initiated SSO. It affects module versions below 3.6.29 for Mendix 9 and below 4.2.4 for 10/11. It does not state that merely creating an arbitrary SAML response is sufficient.
What to check: Update the SAML module in use to 3.6.29 or 4.2.4 or later. If an immediate update is not possible, consult the developer's guidance on disabling IdP-initiated SSO.
Primary sources and references: Siemens公式勧告
20:16 JST (NVD inclusion)
Additional WordPress issues: check privileges and individual fixed versions
The original sources confirm privilege requirements of Contributor for SQL injection in JetEngine 3.9.0 and earlier, Author for SQL injection in Media Library Assistant 3.42 and earlier, and Contributor for insufficient authorization in AI Engine 3.8.6 and earlier. These and the other XSS and CSRF entries are not all treated as unauthenticated RCE or confirmed exploitation.
What to check: Check for JetEngine 3.9.0.1, Media Library Assistant 3.43, and AI Engine 3.8.7 or later, and review contributor privileges and installed plugins. For the remaining individual records, use the NVD index to check product-specific fixes.
Primary sources and references: JetEngine原報告 / Media Library Assistant原報告 / AI Engine原報告
20:16 JST (NVD inclusion)
libimobiledevice: protocol responses from connected peers
CVE-2026-116258–116262 are CNA entries concerning memory handling in AFC, Web Inspector, and other components through version 1.4.0. The device info entries also include issues with local conditions. Official code was checked, but details could not be retrieved from the researcher's dynamically rendered site, so the full connection and pairing requirements and earliest fixed version remain undetermined.
What to check: Check device management tools, bundled versions, and the devices trusted for connection. Do not interpret this as all iPhones being vulnerable to compromise merely by browsing any website; isolate processing of suspicious devices and protocol responses.
Primary sources and references: CVE-2026-116258 / CVE-2026-116262 / 公式AFCコード / 研究者サイト・本文制限
16:17 JST (NVD inclusion)
libgsf: boundary checks in OLE2 file parsing
CVE-2026-116124 is a CNA entry concerning the OLE2 parser through version 1.14.60. A 9/26 commit fixing an out-of-bounds write was confirmed in GNOME's official mirror. The original GitLab page returned a challenge screen despite HTTP success, so its body could not be read. This is not a newly issued fix, and the earliest distributed fixed version remains undetermined.
What to check: Inventory libgsf bundled with document parsing and conversion processes, and check which distributions include the fix. Restrict the environments and privileges used to process untrusted OLE2 documents.
Primary sources and references: CVE-2026-116124 / GNOME公式mirrorの修正
21:17 JST (NVD inclusion)
Qt: denial of service caused by a malicious HTTP/2 peer
CVE-2026-96432 concerns QNetworkAccessManager stopping while processing a sequence of responses from a malicious or compromised HTTP/2 server. The official table lists affected versions as 6.8.0–6.8.9 and 6.9.0–6.11.2. It does not confirm code execution through applications using Qt or compromise of all Qt products.
What to check: Check the applicable release branches, such as Qt 6.8.10 / 6.11.3, and update applications and bundled libraries. Also review control over connection destinations and restart monitoring.
Primary sources and references: Qt公式脆弱性一覧 / Qt修正
19:16 JST (NVD inclusion)
BRAIN2: service credentials left in installation logs
CVE-2026-112250 concerns plaintext passwords left in setup logs in BRAIN2 3.09 and earlier when SQL Server Integrated Security is combined with a specified Windows service account. The logs are usually in the installing administrator's temporary directory; the description does not say they are unconditionally exposed to standard users.
What to check: Update to 3.10 or later, and check secure removal and access permissions for the relevant setup logs. Change credentials for service accounts suspected of exposure.
Primary sources and references: Bizerba公式勧告PDF
21:17 JST (NVD inclusion)
Image uploads: temporary files and deletion permissions
PictShare CVE-2026-116263 involves a race caused by predictable temporary filenames that allows content to be replaced after inspection. A fix dated 10/18 and the v3.7.2 tag were confirmed, but the GitHub Release API returned 404. EasyImage CVE-2026-116223 concerns deletion permissions, with a related hardening commit confirmed on 10/24. The conditions differ between the two products.
What to check: For PictShare, check the tag corresponding to 3.7.2 and inclusion of the fix; for EasyImage, check the relevant fix and authentication and storage destination settings. Do not infer an arbitrary version number as a new earliest fixed version.
Primary sources and references: PictShare修正 / PictShare v3.7.2タグ / EasyImage関連修正
16:17 JST (NVD inclusion)
agent-teams-ai: boundaries of the local HTTP service
CVE-2026-116228 is a CNA entry concerning insufficient authentication in the Local HTTP Service through version 2.17.10. Official code confirmed default handling of localhost origins, CORS conditions that broaden depending on configuration, and listening on the specified host. Unconditional compromise from an external webpage under every configuration has not been verified.
What to check: Check the local HTTP service's listening address, CORS_ORIGIN, execution user, and local users' privileges. The earliest fixed version remains undetermined.
Primary sources and references: CVE-2026-116228 / 公式HTTPコード
17:17 JST (NVD inclusion)
Game and desktop utilities: handling external input
FFXIV Teamcraft CVE-2026-116229 concerns clipboard IPC in the renderer; Plague Inc Evolved CVE-2026-116230 concerns deserialization of Workshop scenarios. Teamcraft 11.4.32 was published on 10/13 and is not a new fix issued tonight. Avoid generalizing these issues to every part of the games or to ordinary browsing alone.
What to check: Compare fix guidance for Teamcraft 11.4.32, Plague Inc Evolved 1.24.0.4, and other applicable versions with your environment, and restrict untrusted scenarios and renderer input.
Primary sources and references: Teamcraft公式release / Plague Inc公式更新 / CVE-2026-116230
16:25 / 18:00 JST (official feeds)
JPCERT/CC: PHP update and Japanese Brotli alert
At 16:25 JST, JPCERT/CC added information on PHP demonstrations, environment-dependent conditions, and upload progress mitigation, and published a Brotli alert. JVN also listed Brotli at 18:00. These are updates to guidance for Japan, not separate new PHP/Brotli CVEs.
What to check: For PHP, continue updating to fixed versions and investigating compromise, and check session.upload_progress.enabled=0 for CVE-2026-115560 and restart all workers. For Brotli, check branch-specific fixes in 1.0.10 / 1.1.1 / 1.2.1 and guidance for products that bundle it.
Primary sources and references: JPCERT PHP / JPCERT Brotli / JVN Brotli
17:17–19:16 JST (NVD inclusion)
Oray X5 Pro: newline and file handling through configuration values
CVE-2026-116231–116237 are CNA entries concerning configuration processing for Ser2net, SNMP, Dnsmasq, IPsec, L2TP, PPPoE, and other components in Pugongying X5 Pro 7.6.1. Newline injection and uploads should not collectively be generalized as unauthenticated external intrusion; access to administrative operations and privilege requirements need further confirmation.
What to check: Check the model, firmware, management interface exposure, and configuration change history. The earliest fixed version remains undetermined, so review vendor guidance and restrictions on unnecessary administrative access.
Primary sources and references: CNA/NVD / CNA/NVD
21:17 JST (NVD inclusion)
Logsign SIEM / Liman MYS: product-specific administrative paths
The CNA records path traversal in Logsign SIEM from 6.4.120 up to but excluding 6.4.122, and password recovery in Liman MYS from 2.3.4-1124 up to but excluding 2.3.5-1131, as separate issues. The national authority's original notification pages were dynamically rendered and their bodies could not be retrieved, so exploit conditions and actual exploitation were not independently confirmed in this review.
What to check: Compare distributor guidance for Logsign 6.4.122, Liman 2.3.5-1131, and other applicable versions with the release branch in use, and review exposure of administrative paths, recovery procedures, and related logs.
Primary sources and references: Logsign CNA/NVD / Liman CNA/NVD / トルコ当局・本文取得制限
21:00 JST (reference time for the 6th report)
GMO: check linked services and browser sync as well as all sessions
The guidance advises signing out all devices and all sessions from another safe device, changing passwords for FX, securities, email, Google, and other services, and using MFA. It also adds removal of unfamiliar linked apps, forwarding settings, extensions, and registered devices, and keeping browser sync off until checks are complete. This does not confirm infection of every connected device.
What to check: Check guidance through official support channels, revoke all sessions, and review newly added authentication methods and integrations. Run a full scan and keep a disconnected backup; for optional PC investigations, check the scope of the prior confirmation document.
Primary sources and references: GMO第6報
17:00 JST (operator's displayed update time)
Blastmail: total rises to 345 contracts; resumption time remains undetermined
An external investigation newly confirmed exposure of information other than subscriber information for 1 additional contract. The operator states that the total is 345 contracts and that individual notifications to all 345 have been completed. This does not mean exposure involving 345 people or all recipients. The management interface, API, and delivery remain suspended; the next report is scheduled for around 10/27 12:00.
What to check: Compare the information affected under each contract with the latest notification, and continue alternative delivery arrangements, inquiry handling, and vigilance against fraudulent emails. Do not treat completion of notifications as the end of the investigation or authorization to resume.
Primary sources and references: 運営元17:00更新
15:37:47 JST (page update metadata)
Hotel Tavinos: beware of payment links even from someone who knows your booking
Suspicious messages affected some bookings at the 3 Hamamatsucho, Asakusa, and Kyoto properties that met both conditions: made by 9/21 and with a stay date on or after 9/21. The notice explains that booking information may have been viewed and obtained through TEMAIRAZU. It does not confirm disclosure of all bookings or a new intrusion at this time.
What to check: Even if a message contains accurate booking details, do not enter information or transfer money through its URL; verify through the property's or booking site's official support channel. If you have already entered card information, contact your card issuer.
Primary sources and references: ホテル公式続報
Additional measures and conditions for existing cases · 12
14:32 JST (developer advisory), 17:17 JST (NVD inclusion)
Ash: tenant boundaries in upsert
The developer advisory for CVE-2026-96581 was published at 14:32 JST, before the previous cutoff. It describes conditions under attribute multitenancy in which a create action with upsert that accepts primary keys or similar values can update or retrieve another tenant's records. Not every create action or Ash application has this configuration.
What to check: Check for Ash 3.37.2 or later, and review cross-tenant upserts and record movement history. Also note the exception that the temporary upsert_condition workaround does not work with Mnesia.
Primary sources and references: 開発元勧告
Published 10/22; included in NVD 10/26
Apache Camel: Docling configuration is still needed after updating
5 advisories published on 10/22 have been supplemented to reflect their inclusion in NVD. Docling input and output paths, expiration of Keycloak introspection results, expression evaluation in AWS2-S3 object names, and information disclosure in CoAP errors involve distinct conditions. The Keycloak issue applies when token introspection is enabled, which is not the default.
What to check: Update to versions such as 4.18.5 / 4.22.2 / 4.23.0, as applicable. Where external input can specify a Docling output destination, configure outputBaseDirectory even after updating. Check handling of S3 headers and expired tokens.
Primary sources and references: Docling出力先 / Docling引数 / Keycloak期限 / S3式評価 / CoAPエラー
Advisory dated 9/21; included in NVD 10/26
SOEM: device responses on the same EtherCAT network
RT-Labs documentation dated 9/21 describes 6 issues affecting SOEM 2.0.0 and earlier. They require a malicious or compromised EtherCAT device to return invalid responses to the master. Insufficient validation of lengths, cumulative quantities, array indices, and similar values may cause memory corruption, information disclosure, or shutdown. General internet reachability alone is not sufficient.
What to check: Check with the product vendor whether SOEM 2.0.1 or later is integrated. Review device additions to the EtherCAT segment, maintenance connections, and master privileges, and update in accordance with equipment shutdown procedures and a validation plan.
Primary sources and references: RT-Labs原勧告PDF
Original reports published 10/23; 16:17 JST (NVD inclusion)
WooCommerce payment integrations: payment notifications and order status
6 issues published on 10/23 have been supplemented to reflect their inclusion in NVD. They affect individual plugins for CCAvenue, nexi Alpha Bank, Eurobank, iKhokha, OPay, and Mintpay, involving changes to states such as paid or canceled due to notification authenticity issues or a secret that is empty by default. They do not represent compromises of the banks themselves or WooCommerce itself.
What to check: For iKhokha, check for version 3.0.4 or later. The original sources list no known fixed versions for the other 5, so consider suspending or replacing affected integrations and reconciling payments against payment provider records.
Primary sources and references: CCAvenue原報告 / nexi Alpha Bank原報告 / Eurobank原報告 / iKhokha原報告 / OPay原報告 / Mintpay原報告
Developer publication 10/23; included in NVD 10/26
Pleasanter: rechecking the previously reported LDAP authentication issue
Following NVD inclusion of CVE-2026-113438, the developer's explanation from 10/23 was reviewed again. The affected conditions combine LDAP authentication on Linux/Docker or with the Windows Novell provider with AD or an LDAP server permitting anonymous binds. This is not an authentication bypass for all users, including those using local authentication, SAML, or passkeys.
What to check: For affected configurations, update to 1.5.9.1 or later. Note that 1.5.9.0 does not include the fix and that LDAP users are affected when LDAP+Local is used.
Primary sources and references: 開発元説明
13:00 JST (previous JVN report), 16:17 JST (NVD inclusion)
V-SFT: NVD inclusion of 7 previously reported issues
CVE-2026-107894–107900 are 7 issues previously listed using JVN information. Their inclusion in NVD this time does not mean 7 new incidents or 7 newly confirmed cases of exploitation. The requirement to open a crafted V7-format file on a design workstation still applies.
What to check: Check use of 6.2.11.0 and earlier and handling of external design files, and review improvement information and patches for 6.2.12.0.
Primary sources and references: JVN一次勧告 / CVE-2026-107894
Observed and first published 10/24; last addition 10/26 11:28:31 JST
PHP2Shell: primary research observing execution in a limited honeypot setup
The researcher correlated HTTP requests with 35 Apache-child shell executions across 3 targets using PHP8.4.26, single-worker Apache mod_php, and 128MiB. Execution was under UID33; this does not mean 35 victims or root access. This article has not independently reanalyzed all PCAPs or run the PoC. The withdrawal of the connection to the government agency intrusion reported by Unit42 remains separately in effect.
What to check: In addition to updating, investigate suspicious child processes, communications, and file creation originating from PHP workers, together with surrounding HTTP records. Do not use 500 errors or large cookies alone to determine successful exploitation or absence of harm.
Primary sources and references: 研究者一次報告 / 公開履歴 / 証拠索引と限界 / Unit42現行訂正
SSH forwarding PR merged 10/26 12:08:59 JST. Change predates the previous review
Tailworm: distinguish source fixes from distributed releases and stop unnecessary forwarding
Official PR21942 changes Unix forwarding to use authenticated local user credentials. Serve PR21931 has also been merged, but the latest stable versions are 1.104.2 and headscale0.29.6, and the earliest fixed version covering all of Tailworm remains undetermined in this review. Connection policy PR21944 is open. A merge into main does not establish that a fix has been distributed.
What to check: After confirming an alternative management path, review the temporary measure of setting TS_SSH_DISABLE_FORWARDING=1 in the tailscaled service environment and restarting it to stop unnecessary forwarding. Do not treat check mode or this flag alone as completing fixes for every research finding.
Primary sources and references: ベンダー責任者の案内 / 公式転送PR21942 / 1.104.2公式flag実装 / 最新公式release一覧
Primary research published 10/22 22:00 JST. Observed 7/14–9/22
Microsoft 365: check MFA and registered devices as well as sessions
Huntress reports 497 successful sign-ins across 79 organizations, at least 48 unauthorized Entra device registrations, MFA replacement, and inbox rules. Distinguish reuse of stolen sessions from subsequent persistence. The source does not establish 79 intrusions today or the same cause as ConnectWise.
What to check: Alongside session revocation and password changes, investigate registered devices, MFA methods, inbox rules, new enterprise applications, and consent grants, and remove unauthorized entries. Do not prioritize response solely by the number of failed attempts.
Primary sources and references: Huntress一次研究
Primary research published 10/26 02:55:33 JST. Observed since 9/15
Gheist: exfiltration of secrets through GitHub logs
Wiz reports more than 850 accounts and over 13,500 suspicious branches involving stolen tokens. Workflows print secrets to logs, which are retrieved through the GitHub API before the runs are deleted. The public runs examined were blocked by approval holds, while execution and subsequent activity were observed in private / Enterprise environments. Branch counts are not counts of affected organizations.
What to check: Check for ci-sync- branches, sync-check workflows, runs deleted shortly after creation, and cloud-side role assumption. In repositories where execution occurred, revoke and replace tokens and accessible secrets, and investigate self-hosted runners and permissions. Do not approve pending suspicious workflows.
Primary sources and references: Wiz一次研究 / GitHubの承認hold案内
Primary research published 10/21 23:57:50 JST
uCreator: research into surveillance capabilities through modified APKs and containers
The research analyzes modified APKs for Telegram, WeChat, and other apps, and hooks inside Onion Box containers. It demonstrates capabilities to obtain 2FA information, sessions, and similar data, but a reliable victim count remains undetermined. It does not prove that the entire chain worked on Android17 or that OS updates alone can prevent every case.
What to check: Check distribution sources, signatures, and app provenance. If suspicious modified versions are present, investigate sessions and authentication methods from a safe device. Do not confirm infection solely from residual LSPatch files or add the previous year's infection counts to this case.
Primary sources and references: 研究者Oviの一次分析 / 前年のDoctor Web原報告・件数は別
18:10:22 JST (Summary edit in the official advisory)
Neat: confirm deployment completion separately for devices and the cloud
This update removes the advisory's old statement that firmware was being prepared. NeatOS26.5.4 remains in staged rollout, Pulse deployment varies by organization, and non-Pulse OTA is targeted for 10/28. The cloud-side fix is separate and expected to take about 2 weeks; this wording update does not prove completion of all deployments.
What to check: Check the Pulse Roadmap and actual device versions, and distinguish any necessary webhook credential rotation from confirmation that the cloud fix is complete. Do not infer that all devices are fixed from dates or advisory edits alone.
Primary sources and references: 公式セキュリティ勧告 / 26.5.4配信案内