For GMO users
Report 7 at 23:10 describes the attacker's 10/27 12:00 warning and the policy of not meeting demands. Continue the account checks in report 6. The date correction at 00:20 is after the cutoff.
Scope confirmed in reports 7 and 6 →AI translation. Check versions, conditions and actions against the Japanese original and primary sources.
SECURITY REVIEW · 2026-10-27 00:18 JST / 2026-10-26 15:18 UTC
Check resumption, announced plans, and decoder reachability separately.
We organize ConnectWise's daily updates, GMO's 7th report, resumption of SoftBank emergency alerts, and reachability conditions in Brotli downstream products using primary sources. The 98 new NVD entries are not an incident count.
Target: 2026-10-27 00:18 JST / 2026-10-26 15:18 UTC. Change window: 21:35–00:18 JST.
Actual retrieval from 00:48 JST onward. Same-day follow-ups with only dates are reference items.
Quick overview: check only what you use.
ConnectWise / SoftBank
ConnectWise's 23:00 update describes continued onboarding preparation, not the start of restoration. SoftBank resumed disaster and evacuation information at 23:17.
Separate recovery from reopening →Brotli / HTTP2Shell
The flaw is in the C decoder, not HTTP/2. .NET requires a fixed runtime and NativeAOT republishing; FFmpeg/ClickHouse/Arrow have different reachability conditions. The Bandit HTTP/2 series is a separate cluster.
Downstream reach and response →Public services and edge appliances
FortiSandbox, Harbor webhooks, the eMudhra CA in mongosh, MCP Toolbox, Camel Saxon, and Mautic 7 are newly included in NVD. Do not interpret Received as confirmed exploitation.
NVD-window conditions and primary guidance →Database and advisory updates in the window · 12 groups
Organized by database inclusion/revision and advisory update times. These are not attack start times or counts of newly occurring harm.
00:16 JST (NVD published 15:16:39 UTC) · Qualifications on CNA record and exploit conditions
mongosh: eMudhra intermediate CA in bundled Node.js
CVE-2026-115930 concerns mongosh before 2.14.0 including a recoverable eMudhra intermediate CA in its bundled Node.js TLS store. NVD says 2.14.0 bundles Node.js 24.22.1 or later. Installations via npm separately require updating the host Node. This does not prove a Tailworm fix.
What to checkCheck mongosh versions by distribution path separately from host Node versions. For eMudhra distrust, check the Node 24.22.1 series and mongosh 2.14.0 as instructed.
00:16 JST (NVD published 15:16:45 UTC) · Caveats on CNA records and prerequisites.
MCP Toolbox: unauthenticated file exfiltration and local overwrite
CVE-2026-93328 concerns path traversal and missing authorization in the cloud-storage source of googleapis/mcp-toolbox 1.2.0–1.4.0. NVD states that unauthenticated users can exfiltrate host files to external GCS and overwrite local files. Received.
What to checkCompare PR 3454 with distributor fixes only if exposing an affected version.
00:16 JST (NVD published 15:16:41 UTC) · Caveats on CNA record and prerequisites
Avocent ACS8000: command construction in wsserver
runZero reports that CVE-2026-65184 involves root-privileged wsserver passing commands from WebSocket fields to system()/popen(). The public-key session path does not perform appliance session checks. Received. This investigation has not established a fixed version.
What to checkOnly if managing the applicable appliance over the internet, cross-check runZero's advisory and vendor guidance.
00:16 JST (NVD published in the 15:16:45 UTC range) · Qualifications on CNA record and exploit conditions
Apache Camel: Saxon XXE and OAuth token caches.
CVE-2026-90885 is XXE in camel-saxon (4.0.0 to before 4.18.5, and 4.19.0 to before 4.22.2). CVE-2026-94386 is OAuth token cache confusion (4.19.0 to before 4.22.2). These conditions differ from the Docling path supplemented previously.
What to checkMatch the components and series in use against official guidance for 4.18.5 / 4.22.2 or later. Do not count this as universal RCE across Camel.
23:00 JST (14:00 UTC daily update) · Publication/update confirmed
ConnectWise: 14:00 UTC update reports continuing preparations, not the start of restoration
Trust Center published an update for Monday October 26 14:00 UTC. It says preparations for phased partner onboarding continue and guidance will follow when restoration from existing backups can begin. This is not a report that restoration began on 10/26. Keep affected connections disabled until individual instructions arrive. Archives are encrypted, isolated, and preserved, with no indication of impact on other products. The next update is 10/27 14:00 UTC.
What to checkKeep affected connections disabled. Do not reconnect until service-specific re-enablement instructions are issued. Continue separate M365 checks of Entra sign-ins, app registrations, consents, forwarding rules, and registered devices. Do not interpret infrastructure recovery or daily updates as permission to reconnect.
23:07–00:16 JST (GHSA updated) · Disclosure and updates checked
GHSA: 0 newly published, 19 existing reviewed advisories revised
The publication window contains 0 entries. The 19 updated entries include aiohttp 3.14.4, Keycloak, kobako, Grav, Wagtail, Talos Linux, Dolibarr, ImageSharp, PostCSS, retouched old Open WebUI GHSAs, and the Log4j 1-to-2 bridge. Updated means revisions to text or affected ranges, not a set of newly disclosed zero-days tonight.
What to checkIf installed, check current version boundaries in each GHSA. Do not add these again to previous publication counts.
23:10 JST (cutoff in 7th report text) · Publication/update confirmed
GMO report 7: 12:00 is the attacker's announced time. Do not comply with demands
The statement says a presumed attacker gave notice at 10/27 12:00 of information disclosure and a ransomware attack. Demands will not be met. Devices collected through 10/26 at 22 with cooperation in the investigation are being analyzed. This does not confirm malware installation. Account protection from report 6 is reiterated. Passwords or authentication codes will never be requested.
What to checkIf devices or accounts connected to the affected service, continue the checks in the 6th report from a separate safe device. Do not respond to unofficial demands for money or contacts offering to recover lost funds. Do not treat 12:00 as the official disclosure time. Not submitting a device does not mean it was unaffected.
23:16 JST (NVD published 14:16:24 UTC) · Qualifications on CNA record and exploit conditions
FortiSandbox: authentication bypass via an alternative path (NVD Received)
CVE-2026-107656 describes authentication bypass through an alternate path and possible unauthorized code or command execution via crafted HTTP in FortiSandbox 5.0.0–5.0.6, 4.4.0–4.4.9, all 4.2 versions, and corresponding PaaS offerings. Status is Received. Do not infer fixed version numbers from NVD.
What to checkOnly if the management plane is exposed to the internet, read FortiGuard FG-IR-26-185 and check official fixes by branch. Do not interpret Received as confirmed urgent exploitation.
23:16 JST (NVD published 14:16:28 UTC) · Caveats on CNA records and prerequisites.
Harbor: ProjectAdmin webhook SSRF
CVE-2026-111590 involves insufficient webhook destination validation. A ProjectAdmin can specify private or link-local destinations, with response bodies retained in execution logs. This is not unauthenticated compromise of all Harbor installations.
What to checkCheck webhook creation privileges and destination restrictions, and verify the fix for GHSA-2phj-cp9f-qq6w.
Around 23:16 JST (NVD Deferred) · Caveats on CNA records and prerequisites.
Mautic 7: a series involving upload / SSTI / deserialization / SQLi and other issues
CVE-2026-115188–115196 have different conditions in Mautic 7: campaign import uploads, Twig SSTI, deserialization, SQLi in administrative AJAX and dashboard APIs, stored XSS, Asset API paths, Stats API permissions, and open redirects in public forms. Some require authenticated privileges or specific features. Do not add the 9 issues together as unauthenticated compromise of every server.
What to checkOnly if the affected feature is used, check each GHSA's fixed versions and permission settings.
GHSA-mxjf-pghx-h299 / GHSA-h7pm-79gc-8867 / GHSA-5r63-8h35-j3mw
Around 23:16 JST (NVD published) · Caveats on CNA records and prerequisites.
Bandit HTTP/2 and others: a separate cluster from HTTP2Shell (Brotli)
A series of resource exhaustion, complexity, compression amplification, and request smuggling issues in mtrudel bandit's HTTP/2 and HTTP/1.1 implementations entered NVD. These are separate from the Brotli decoder flaw in CVE-2026-111497. Do not include systems in Brotli remediation solely because they use HTTP/2. Separate hackney CVEs are in the same batch.
What to checkOnly where Elixir/Bandit or hackney is used on public interfaces, check each CVE's prerequisites and distributor fixes.
23:17 JST (official text) · Disclosure and updates checked
SoftBank: disaster/evacuation information resumed at 23:17
Distribution of national and local government disaster/evacuation information resumed at 10/26 23:17, in addition to earthquake early warnings and tsunami warnings. SoftBank / Y!mobile / LINEMO say all emergency alert email information can be received. Maintenance lasted from 10/23 6:47 to 10/26 23:17. This is restoration of the carrier delivery path, not completion of fixes across the PHP ecosystem.
What to checkFor affected lines, checking emergency alert settings is often sufficient. Carrier resumption does not mean your organization's PHP is patched or exploitation has ended.
Mitigations and condition supplements for existing incidents · 6 groups
Supplementing conditions, fix/deployment methods, and operational impacts in previously published material. These are not recounted as new compromises during this period.
10/25 primary sources from JFrog and Microsoft. NVD lastMod 23:16 JST · Supplement to existing issues and response scope
Brotli: reachability in .NET / FFmpeg / ClickHouse / Arrow is not an HTTP/2 flaw.
CVE-2026-111497 is an out-of-bounds write in the C decoder. The aliases HTTP2Shell/Node2Shell/Brotli2Shell refer to the same CVE. .NET produces SIGSEGV; RCE is unproven. Fixed in 8.0.33/9.0.22/10.0.14; republish NativeAOT. FFmpeg→libjxl brob boxes corrupt pointers; a fixed release is unconfirmed. ClickHouse crashes with about 23MB of br data; the PR is merged but treated as unreleased. Arrow enters an infinite loop with 534 bytes; the issue remains open. Cloudflare's emergency WAF defaults to Log. cybersecuritynews returned 403.
What to checkInventory bundled copies and actual deployment paths. Do not consider removing br from Accept-Encoding sufficient. Republish NativeAOT. Treat ClickHouse/Arrow/libjxl as unpatched until distributed fixes are confirmed. A Log rule does not establish that blocking is complete.
JFrog Brotli2Shell / dotnet/announcements#494 / Cloudflare emergency WAF 2026-10-25 / Google CNA CVE-2026-111497
21:00 JST (6th report). Reproduced in the 7th report · Supplement to existing issues and response scope
GMO report 6: the account-protection request has not been withdrawn.
The 4 points in report 6 (full scanning, offline backups, disconnecting all sessions and changing passwords/MFA/disabling sync from another device, and optional device collection) are repeated in report 7. They cover securities, email, Google, and other services as well as FX. Infection of all connected devices has not been confirmed.
What to checkContinue checks from another trusted device. Do not enable browser synchronization until checks are complete.
Updated 17:00 JST (within the previous window). Next update around 10/27 12:00 · Supplement to existing issues and response scope
Blastmail: 345 contracts; resumption undetermined remains as in the 17:00 notice
Leakage beyond subscriber information is confirmed for 345 contracts, with 345 individually notified. The resumption time is undetermined. No content changes in this window. This does not mean 345 people, all recipients, or 345 new intrusions.
What to checkCheck affected items through individual notifications and maintain alternative communication/delivery paths. Notification of everyone does not mean the investigation is over or resumption is authorized.
JSON timeline last entry 14:45 JST (05:45 UTC) · Supplement to existing issues and response scope
PAN-OS PHP: no new ETA removals in this window
11.1.4-h38 / 11.1.6-h40 / 11.1.10-h36 / 11.1.13-h16 are released. Remaining ETAs (for example, 11.2.13-h4 and 10.2.13-h27 on 10/27) remain as in the table from before 05:45Z. The vendor is unaware of exploitation against its products. Retain the existing distinction that GlobalProtect portals and similar components are not impacted.
What to checkClose management interfaces to the internet and compare your release series against the released and ETA sections of the table. Do not use content signatures as a substitute for OS hotfixes. Do not reinterpret PAN's not aware statement as no exploitation of PHP in general.
Latest stable 1.104.2 (10/21). No new tags in this window · Supplement to existing issues and response scope
Tailscale: still 1.104.2. Minimum fixed Tailworm version undetermined
The latest stable version in official bulletins and GitHub releases is 1.104.2 (eMudhra). There are no new tags or bulletins in this window. Source merges, check mode, and TS_SSH_DISABLE_FORWARDING=1 are not evidence of a distributed fix.
What to checkFor eMudhra distrust, use 1.104.2 or later. For SSH forwarding, Serve/Funnel, and headscale, until official fixes are issued for each item, verify alternative management paths and disable unnecessary forwarding.
JPCERT 16:25 / JVN 18:00 JST (within the previous window) · Supplement to existing issues and response scope
Domestic PHP / Brotli alerts: continuing guidance from 16:25 / 18:00.
AT-2026-0033 adds that although PoCs and attempted traffic exist, successful execution depends on version, environment, and memory layout. For CVE-2026-115560, set session.upload_progress.enabled=0 and restart all workers. Brotli AT-2026-0034 specifies fix boundaries by release series. No new Japanese alert was issued in this window.
What to checkCheck the fix for the applicable branch and the copies actually deployed. Mitigation settings do not equal full PHP remediation.
Reference: publication time unconfirmed despite same date · 2 groups
This is current content retrieved after the target time. The following information is excluded from confirmed changes before the cutoff.
00:20 JST correction (after cutoff 00:18) · Publication before cutoff unconfirmed
Reference: GMO report 7 date correction is 2 minutes after the cutoff
The retrieved HTML says 10/27 0:20 correction: incorrect 10/23, correct 10/25 (the date of the device investigation request). Do not backdate the correction itself as a confirmed fact at 23:10. At retrieval, the customer request date had been corrected to 10/25.
What to checkCheck request dates on the current official page. Correction times are not intrusion or analysis completion times.
RSS pubDate 15:38 UTC (after the 15:18 cutoff) · Publication before the cutoff is unconfirmed.
Reference: BleepingComputer's .NET article RSS is after the cutoff.
The RSS item Microsoft releases emergency .NET patches is dated 15:38 UTC. The primary sources are dotnet/announcements#494/#493 dated 10/25. Do not treat an article after the cutoff as a newly shipped release within the window.
What to checkCheck primary guidance #494/#493 for .NET remediation. Retain NativeAOT republishing and the exclusion of Framework.
Collection scope, overlap and limitations
98NVD new records
1,048NVD revisions
0GHSA publication window
161Verified saved and referenced responses
All 98 new NVD entries overlap the 1048 revisions. GHSA has 0 newly published advisories (unreviewed0, malware0) and 19 revisions. Distinguish reviewed, unreviewed, and malware, and check publication/revision overlap in the ledger. KEV is the 2026.10.23 edition with 1,756 entries, identical to the previous original. Inclusion and differences between originals are separate from attack start times. Absence from the list is not proof of no exploitation. Of 161 responses, 55 reference previous originals to avoid duplicate storage.
- This is the current revision retrieved after the target time. Distinguish publication, database inclusion, intrusion, and availability of fixes.
- The delta includes first database inclusion and official alerts within the window; it does not uniformly mean new discoveries or new harm.
- All 98 new NVD entries overlap the 1,048 updates. GHSA has 0 publications; the 19 modified entries revise existing reviewed advisories.
- Do not add 98 + 1,048 + 19 as incident counts or affected organization counts.
- NVD Received / Deferred means CNA receipt or pending analysis, not finalized CVSS or confirmed exploitation.
- HTTP2Shell / Node2Shell / Brotli2Shell are the same CVE-2026-111497. This is not an HTTP/2 protocol flaw.
- The Bandit HTTP/2 resource-exhaustion cluster is separate from Brotli decoder flaws.
- Absence from KEV, no updates, or no feed delivery does not prove the absence of exploitation or harm.
- We do not infer fixed-version numbers for FortiSandbox or other products from NVD Received text.
- ConnectWise's 10/26 onboarding target remains in preparation in the 14:00 UTC update. Recovery work does not authorize reconnection.
- GMO's 10/27 12:00 refers to the attacker's warning. It is neither the official disclosure time nor analysis completion time.
- GMO report 7's date correction at 00:20 JST is after the cutoff. Do not write it back into the 23:10 text.
- SoftBank's 23:17 resumption restores delivery of the affected email type. It does not close the issue across the PHP ecosystem.
- Tailscale 1.104.2 addresses eMudhra. The minimum fixed version for Tailworm remains unconfirmed this time.
- Do not equate a ClickHouse PR merge or libjxl main bump with shipment of a fixed release for users.
- Arrow issue remains open. With NativeAOT, updating the shared runtime alone does not replace the decoder.
- Cloudflare's emergency WAF defaults to Log. Do not treat Log as completed blocking.
- cybersecuritynews.com and Reddit JSON returned 403. Do not treat secondary reporting as authoritative.
- Actual retrieval from 00:48 JST onward. HTTP originals are current revisions after the cutoff; undocumented additions cannot be fully reconstructed.
- Not comprehensive coverage of all worldwide incidents. Use reporting and social media only to find primary sources; do not add attacker claims to confirmed harm.
data/2026-10-27-0018/incident-register.json / data/2026-10-27-0018/collection-summary.json / data/2026-10-27-0018-vendors/collection-summary.json / docs/research-collection-2026-10-27-0018.md / docs/research-2026-10-27-0018.md / data/latest.json