AI translation. Check versions, conditions and actions against the Japanese original and primary sources.
DAILY RECORD · 2026-10-22
Do not label demonstrations in official builds the same as reports of actual exploitation or harm.
Review as of 10/26 10:27 JST. Exact JST dates remain unconfirmed for items whose original sources provide only dates.
Research and demonstration · 21:22 JST (UTC 12:22).
Imperva demonstrated the Brotli flaw in an official Node.js 24.22.0 build. A laboratory PoC alone does not confirm attacks in real environments.
What to check Check not only Node.js itself but also Brotli bundled with Bun, Envoy, Istio, Python, and Perl.
Existing sources and verification records / Existing sources and verification records
Disclosure of actual exploitation · Original source 10/22, time unspecified
SQL injection in VeloCloud Orchestrator may permit privilege escalation from a reachable valid account. Even the minimum read-only role meets the conditions.
What to check Update affected on-premises branches and investigate changes in administrative actions, accounts, and configuration.
Damage disclosure and operational response · CAPCOM original dated 10/22; distinguish GMO's announcement date from its suspension date.
The CAPCOM ID leak disclosure and suspension of Onamae.com Desktop Cloud are incidents that cannot be tracked using CVE lists alone. Do not infer a shared cause or relationship with PHP from this timeline.
What to check Check each company's scope and user guidance. Do not confuse disclosed record counts or maximum affected device counts with the number of affected companies.
CAPCOM official statement / Onamae.com official statement / Existing sources and verification records