AI translation. Check versions, conditions and actions against the Japanese original and primary sources.
SECURITY BRIEFING / 2026-10-25
Updates and compromise investigations to prioritize now.
Cutoff: 10/25, 2026 16:34 JST (07:34 UTC).
Additions and corrections for 16 groups verified through primary sources. Materials were retrieved after the cutoff time. Some supplement earlier disclosures; this does not indicate 16 new breaches. Continue consulting the previous day's investigation.
Response order
- Actively exploited public assets:Prioritize Arista VCO, Built-in CODE, SiteGuard, Plex, and similar products. Update and investigate compromise in parallel.
- Emergency updates:For Fortinet, check supported models and series without waiting for CVE details. Restrict external exposure of management systems.
- Trust and credentials:Check Java/Python certificate stores, LiteLLM keys, and added ConnectWise/M365 permissions.
- Verify bundled products:DNS, Brotli, proxies, and OT clients. Verify running versions after updates, restarts, and rebuilding.
Post supplement: HTTP2Shell / Brotli
Specified post (10/24 21:06 JST)were checked against primary sources.The same CVE-2026-111497 as Node2Shell.and is not a new flaw limited to HTTP/2. Google CNA rates it CVSS v4.0 9.2. Check paths that decompress untrusted Brotli input using vulnerable implementations.
- Envoy：1.40.0 / 1.39.3 / 1.38.6 / 1.37.8. Deployments configured with a Brotli decompressor are affected. A fix also exists in 1.36.12, but that series is unsupported.
- Istio：1.31.2 / 1.30.6 / 1.29.9. Check gateways/sidecars with Brotli decompression enabled. 1.29 is EOL.
- curl / requests / httpx：Check the Brotli actually loaded and automatic response decompression. HTTP use alone does not imply uniform impact across all products.
- Temporary mitigation:Reject input before decompression. Merely removing br from Accept-Encoding does not prevent br responses from peers. An inbound WAF alone does not fix decompression of external responses.
Patch the Planet's Brotli-specific advisory · Envoy official advisory · Istio official advisory · Full product scope, conditions and checks · Dedicated scene #40
Affected conditions and response
Items without explicit exploitation statements in the reviewed material are not treated as “exploited in the wild” based only on severity or PoCs.
| Affected products | Affected conditions | Response | Evidence and caveats |
|---|---|---|---|
| Fortinet security hardening | Check externally reachable FortiOS/Manager/Analyzer/Mail/Authenticator by product and release series | FortiOS 8.0.2 / 7.6.8 / 7.4.13 / 7.2.14 and related versions. Refer to the product-specific matrix. Restrict management exposure and plan updates without waiting for CVE details on 11/10. | Primary source 1Individual CVEs/CVSS undisclosed. Do not infer actual exploitation from this announcement alone |
| Oracle Java / GraalVM | JSSE trusting eMudhra-related roots and app-bundled JREs. | Emergency updates or official keystore/revocation checking procedures. Restart each running runtime. Do not mislabel affected versions in public tables as fixed versions | Primary source 1 / Primary source 2Check the support distribution table for exact fixed builds |
| Python ssl | Python communication processing certificate chains containing compromised eMudhra keys | Check denylist remediation with the distributor for your branch. A main merge alone does not complete remediation in the running environment. | Primary source 1 / Primary source 2Minimum distributed version undetermined. Check the OS, certifi, and actual TLS implementation. |
| ConnectWise Cloud Backup / M365 | Tenants that currently or previously consented to the affected app. Unauthorized post-authentication Graph operations and other activity observed in primary sources | Keep connections disabled until formal recovery instructions. Preserve evidence before deleting applications, and investigate authentication, added keys, owners, permissions, consent, and mail operations. | Primary source 1 / Primary source 210/26 is a phased-resumption target. Trial tenant count ≠ compromise count. Updates earlier unconfirmed information. |
| LiteLLM 1.107.0 final findings | Affected wheels or Docker/GHCR images matching the distribution period and digest | Do not run pip first in the affected environment. Isolate, preserve evidence, rebuild from a clean environment, and revoke reachable keys. | Primary source 1 / Primary source 210/23 confirmed cause: unrevoked master key → GitHub OAuth token → CI secrets |
| PHP / follow-on | Public-facing PHP and apps changing specific session settings at runtime | 8.2.35 / 8.3.36 / 8.4.27 / 8.5.12. Keep upload progress disabled and investigate back through 10/17. | Primary source 1 / Primary source 2Do not confuse observed attempts with successful compromise or all 3 issues being fixed |
| ISC BIND | CVE-specific conditions include obtaining GSS-TSIG-signed UDP traffic and replaying it while valid, RPZ or redirect configurations, and others | 9.20.30 / 9.21.27, Preview 9.20.30-S1. Migrate EOL branches to supported branches. | Primary source 1 / Primary source 2 / Primary source 3 / Primary source 4Do not describe unconditional RCE in all BIND deployments |
| Unbound | CVE-specific conditions including DoQ migration, nondefault thresholds, and trust islands. | Update to 1.26.2 or apply the patch covering all cases | Primary source 1The official UAF impact is DoS. Do not infer demonstrated RCE. |
| PowerDNS Recursor | Through 5.3.11 / 5.4.7. Includes configuration-dependent cases such as Web TLS and incoming EDNS subnet. | Update to 5.3.12 / 5.4.8 | Primary source 1Publication and discovery dates for 85559 are inconsistent; exact chronology unconfirmed |
| PowerDNS Authoritative | Through 4.9.17 / 5.0.7 / 5.1.4, DoS in compression pointer processing | Upgrade to 4.9.18 / 5.0.8 / 5.1.5. | Primary source 1Distinguish Recursor from other products and update targets |
| Knot DNS | Check features such as compression pointers, QUIC, and DoT by product. | Update to Knot DNS 3.6.2 | Primary source 1Distinct from Knot Resolver. The reviewed release notes do not establish a CVE. |
| Brotli / Bun / Python bindings | Decoding untrusted Brotli. Bun >=1.0.21,<1.4.4 and other versions, including bundled copies | Bun 1.4.4, Python brotli 1.2.1 / brotlicffi 1.2.1.0. Rebuild Bun compile executables too. Check OS backports separately. | Primary source 1 / Primary source 2 / Primary source 3Do not generalize the PoC in official Node builds into a Bun-specific demonstration or confirmed real attack. |
| Postiz | Tokens: 2.15.0 or later; files: 2.23.0 or later; both before 2.25.3. Conditions include registered users and Skool/Discord | Update to 2.25.3. Disabling self-registration does not prevent attacks by existing users | Primary source 1 / Primary source 2 / Primary source 3Distinguish laboratory demonstrations from exploitation in production |
| Apache Traffic Server | Configurations for each of 15 issues. 111817 includes cases with nondefault drop_chunked_trailers enabled in 9.x. | Branch-specific 9.2.16 / 10.1.5 / 10.2.1. However, 111817 is not fixed in 9.2.16; check settings and additional guidance. | Primary source 1See package investigation notes for conditions of all 15 items |
| open62541 | Clients in 1.5.0 to before 1.5.7 importing type definitions from a malicious OPC UA server | Update to 1.5.7 or later. Also check embedded and statically linked uses | Primary source 1 / Primary source 2Distinguish fixed release on 8/20 from CVE publication on 10/24 |
| Perl Web::Simple | Below 0.035, reach body-parameter match and send a huge Content-Length. | 0.035 or later + MAX_BODY_SIZE. Temporarily cap Content-Length at the reverse proxy. | Primary source 1DoS through excessive memory allocation, rather than OS command execution |
Counts and collection scope
The fixed NVD window is 10/24 01:34–10/25 07:34 UTC. Retrieved every page for 99 newly published and 5,432 updated entries. They overlap and cannot be added together. API content reflects the version at the later retrieval time. KEV is the 10/23 edition, totaling 1,756, with the latest 17 rows matching the previous day. No new listings is not proof of no harm.
Also checked the latest 100 GitHub entries, 14 official/research feeds, 2 news feeds, the latest 20 JVN entries, and 4 PHP release series. The detailed record preserves counting methods, retrieval times, unconfirmed fixed versions, and restrictions on retrieving F5 text.