AI translation. Check versions, conditions and actions against the Japanese original and primary sources.
SECURITY REVIEW · 2026-10-26 13:01 JST
Domestic leaks and operational disruptions, additional software advisories, and AI/MCP. Primary sources distinguish newly learned facts from ongoing responses.
Target: 2026-10-26 13:01 JST / 04:01 UTC. Change window: 10:27–13:01 JST.
Actual retrieval began at 13:04 JST. Same-day follow-ups with dates only are separated as reference material.
PHP, GitLab, PAN-OS, Arista, Nextcloud CODE, Plex, and others. Check affected configurations and running versions, and investigate existing intrusions in addition to patching.
Morning table: 21 groups and conditions →For LiteLLM, Railway, ConnectWise, and others, check key revocation, additional permissions, and logs. GMO Desktop Cloud FX users should change credentials from a separate safe device and disconnect all remaining sessions.
GMO primary guidance →Fuji Electric V-SFT, the Electronic Deliverables Inspection Support System, products bundling Brotli, Continue, OpenBB, and others. Check file-opening conditions, execution privileges, and API reachability rather than judging by product name alone.
Changes after 10:27 →The minimum fixed version for Tailworm remains unconfirmed in this investigation. Do not assume 1.104.2 or 0.29.6 is fixed; check SSH, connection permissions, Serve/Funnel, and other features individually.
Tailworm special report →Ordered by delivery and database inclusion times, not attack start times. NVD entries are checked starting from CNA records against official code and changelogs. Undetermined minimum fixed versions are not guessed.
11:05:33 / 11:11:58 JST (RSS delivery) · Publication/delivery verified.
oss-sec identifies downstream users of CVE-2026-111497 and an existing bundled update in Ghostscript. Duplicate URLs in the original email were corrected in a follow-up. Do not assume RCE under identical conditions in all products.
What to checkAlso compare distributor-bundled versions of PDF, image, and font processors beyond Node and Bun.
Primary mailing-list message / Correction / Ghostscript changes
11:17:06 JST (NVD inclusion) · Caveats on CNA records and prerequisites.
CVE-2026-116108. The CNA identifies access control issues through 4.7.2/5.0.0. Default CORS settings in official code were checked, but that alone is not independent proof of credential theft or RCE. The minimum fixed version is unconfirmed.
What to checkCheck bind addresses, authentication, allowed origins, and browser reachability.
11:17:06 JST (NVD inclusion) · Caveats on CNA records and prerequisites.
CVE-2026-116107 affects 1.3.24 and earlier. The official changelog adds permission checks to the AJAX handler in 1.3.25 on 10/5. Further fixes exist in 1.3.26; this is not a new fix this morning.
What to checkCheck fixes in 1.3.25 or later, and additional measures in 1.3.26 and Datafeedr API 1.4.3 or later.
11:17:06 JST (NVD inclusion) · Caveats on CNA records and prerequisites.
CVE-2026-116105 / 116106. CNA-listed version: 1.0.103. The 2 issues concern plaintext communication and FileProvider access control. Linked research material returns 404; reproduction and the minimum fixed version remain unverified.
What to checkCheck devices in use, sensitive information handled, and distributor notices.
12:00 JST (JVN feed) · Disclosure and delivery checked
CVE-2026-113345. A low-privilege local user can tamper with files in the installation directory of Ver.4.0.36 and earlier, potentially leading to code execution. The minimum fixed-version number is undetermined.
What to checkUpdate existing installations and use the latest installer for new installations.
12:17:10 JST (NVD inclusion) · Qualifications on CNA record and exploit conditions
CVE-2026-116109. The CNA describes OS command injection in Continue 2.0.0 MCP transport. Current official code confirms a path generating stdio connections from configuration, but all exploit conditions in the affected version, remote input paths, and the minimum fixed version remain undetermined.
What to checkDo not load untrusted MCP launch definitions; limit execution privileges and secrets.
12:17:11 JST (NVD inclusion) · Caveats on CNA records and prerequisites.
CVE-2026-116110. Affected Windows version: 2.6.8.0. The developer fix of 10/24 changes listening from all interfaces to loopback and checks paths and other inputs. The minimum release number and actual exploitation remain unconfirmed.
What to checkCheck distributions containing the fix commits and the reachability of management APIs.
12:17:11 JST (NVD inclusion) · Caveats on CNA records and prerequisites.
CVE-2026-116111. CNA-listed version: 1.0.3.144. Retrieval of the researcher text is restricted, and the vendor advisory, minimum fixed version, and actual exploitation remain unconfirmed. Do not describe normal startup alone as unconditional RCE.
What to checkCheck inputs such as untrusted MODs and device privileges.
12:17:11 JST (NVD inclusion) · Caveats on CNA records and prerequisites.
CVE-2026-116112. Affects commits through cc258425b915d1af9e298777ccd26d160493e68d, in the spec argument of admin/add-new.php. Fixed version numbers and actual harm remain undetermined.
What to checkCheck versions of the affected software in use and exposure of management interfaces.
13:00 JST (JVN feed) · Publication/delivery confirmed
7 vulnerabilities in V-SFT 6.2.11.0 and earlier. Opening a crafted V7-format file may cause information leakage or code execution. This is not confirmation of actual exploitation.
What to checkCheck distributor improvement information and patches for Ver.6.2.12.0.
This does not mean incidents newly occurred on 10/26. Entries are ordered by disclosure date, with material lacking verified dates/times placed last.
Published 10/9, time unspecified · Supplement to existing incidents.
Leakage is confirmed for 1,325 people and possible for 8,687, with different affected fields. The explanation says passwords are excluded and sales AX services and similar services are unaffected. Do not inflate disclosures by the contractor and client into separate incidents.
What to checkCheck affected scope and information categories in individual User Forum notifications.
Initial report 10/16; guidance displays last update 10/20 12:30 · Supplement to existing incident
Unauthorized access on 9/30–10/1 was confirmed, discovered on 10/13, and addressed on 10/13–14. Actual acquisition is unconfirmed, but the response assumes acquisition occurred. This does not confirm identical harm at every user site.
What to checkCheck affected information and required actions through email and individual guidance after login.
Exchange disclosure dated 10/21 · Supplement to existing incident
Reported on 10/16. Preliminary analysis of approximately 375,000 dark-web records identified 3,897 records of customer PII. Authenticity, completeness, source, and scope remain under further investigation. This does not mean leakage affecting all 375,000 customers or a banking shutdown.
What to checkCheck official bank notifications to affected people; do not inflate estimated affected counts.
Initial report 10/22, 2nd report 10/23. Correction time unspecified · Supplement to existing incident
The initial report page withdrew its explanation blaming PHP and corrected it to a vulnerability in its own service. Report 2 describes malware installation on 10/20 and possible leakage.
What to checkDo not add these to actual PHP2Shell harm; check individual affected-service notices.
Published 10/23, time unspecified · Supplement to existing incidents.
Intrusion on 10/17, information acquisition on 10/18, detection on 10/19. The 3,147,469 leaked records concern members of 1 store, not every store. They include hashed passwords but not card information. A specific CVE is not established from public material.
What to checkCheck individual notifications and password instructions from affected stores.
Reports 4 and 5 on 10/24, times unspecified · Supplement to existing incidents.
Supplementary response to the existing Desktop Cloud compromise. Existing sessions may persist after password changes. Device scanning is precautionary, not confirmation that all users' devices are infected.
What to checkChange credentials from a device not used for trading, disconnect all sessions, and check transaction history and balances.
Publication timestamp unconfirmed · existing incident context
The operator describes internal-system access using stolen credentials during 9/9–10/7 US time and leakage of up to about 5 ten-thousand personal-information records in Japan. Unauthorized TiDB Cloud access and card-information leakage are unconfirmed. The current page was retrieved later; its publication time and content before the target time remain undetermined.
What to checkCheck individual notifications to affected people and prepare for suspicious emails and similar contacts.
10/26 date only; publication before 13:01 unconfirmed · Publication before 13:01 unconfirmed
The subsequently retrieved 3rd report confirms external transmission and reports 1,213 corporate information records and sales-related data for 875 companies. The number of personal information records is under investigation. Do not include this as confirmed information before 13:01. Gradual resumption from 10/26 and mandatory password changes across all services are plans/instructions, not confirmed completion.
What to checkSeparate certainty about publication times, and check individual resumption and password-change instructions.
The fixed window is 10/26 10:27–13:01 JST, covering all severities and pages. All 8 new NVD records are also included in the 20 updated records. The 13 GHSAs overlap this run's 8 NVD records and 5 from the previous run. Do not add them as new incident counts. KEV is the 2026.10.23 edition with 1,756 entries, byte-for-byte identical to the morning original.
Coverage spans official and researcher feeds from JVN/JPCERT, CISA, Microsoft, GitHub, Unit 42, Talos, oss-sec, SANS, Project Zero, and others, plus first-party reports in Japan and abroad. This is not a complete list of all incidents worldwide. Old IPA URLs returning 404, researcher material returning 404, and some text retrieval restrictions are recorded. Undated later additions cannot be fully reconstructed as of the cutoff time.
PSGI version boundaries remain inconsistent between CNA descriptions and the primary advisory's Solutions section. Database numbers alone do not remove earlier qualifications.
Primary research and all topics / Structured index / URLs, retrieval timestamps and original hashes / 10:27 record: 21 ongoing-response groups