AI translation. Check versions, conditions and actions against the Japanese original and primary sources.
SECURITY REVIEW · 2026-10-27 18:47 JST / 2026-10-27 09:47 UTC
We summarize primary sources and conditional mitigations covering GMO reports 8–11, PAN-OS shipment status, GROWI, Sleipnir, MPC, Kubernetes, AI, BMC, and malicious packages.
Target: 2026-10-27 18:47 JST / 2026-10-27 09:47 UTC. Change window: 07:47–18:47 JST.
Actual retrieval is of current revisions from 18:49 JST onward. Same-day follow-ups with only dates are reference items.
Information claimed to have been published is being examined. Distinguish this from unconfirmed ransomware, and consult official device-isolation guidance and individual communications.
GMO updates and actions →Check the 4 PAN-OS hotfixes, GROWI 8.0.7, branch-specific Kubernetes fixes, and BMC management planes. Distinguish plans, actual deployment, and compromise investigation.
Release availability and affected conditions →For Fireblocks, distinguish the share hierarchy of 1 party from the threshold. For Psono, Mendix, and Qt, also check the features used and fixed release series.
Secrets and authorization →Inspect Mistral Vibe worktrees, GGUF and sanitize mode, specific malicious packages, and payment notifications with empty secrets separately.
Installation and execution paths →Organized by database inclusion/revision and advisory update times. These are not attack start times or counts of newly occurring harm.
08:16 JST NVD inclusion · Caveats on CNA record and prerequisites
CVE-2026-116554–116556 concern XSS in dataset names, custom field iframes, and text field processing in 2.8.0 and earlier. Saved developer issues referenced by the CNA, but this retrieval does not establish the minimum fixed version.
What to checkRestrict annotation/dataset inputs and sharing destinations, and check developer issues against deployed versions. Do not unconditionally open untrusted datasets in a browser with administrative privileges.
Developer issue5875 / Developer issue5876 / Developer issue5877
08:17 JST NVD inclusion (developer first published 9/14) · Caveats on CNA records and prerequisites.
CVE-2026-2270 is a confused deputy that creates cross-namespace Pods through namespace-scoped write access to StatefulSet and ControllerRevision. Persistent Pods also require conditions such as the victim StatefulSet UID. 76654 concerns possible NetNTLMv2 exposure through Windows kubelet subPath UNC symlinks; relay and impersonation conditions vary with domain membership and other factors.
What to checkApply 1.34.12 / 1.35.9 / 1.36.5 / 1.37.1 or later for the respective branches using official procedures. Separate controller manager and Windows kubelet update targets; inspect namespace write permissions and outbound SMB from Windows. Do not treat this as first disclosed today.
09:10 / 13:03 JST (official timeline) · Disclosure and updates checked
The PHP advisory JSON removed ETAs for 10.2.13-h27 / 10.2.16-h12 at 09:10 and 12.1.7-h11 / 12.2.4-h1 at 13:03 because they shipped. Other branches, including 11.2.13-h4, retain ETAs. An RSS refresh alone is not new confirmation of exploitation.
What to checkMatch the PAN-OS series and affected features in use to official hotfixes. Check planned dates against actual availability, and perform both updates and compromise investigation. Do not apply a version number from another series as a universal fixed version.
09:17 JST NVD inclusion · Qualifications on CNA record and exploit conditions
CVE-2026-111422 affects apache-airflow-providers-ssh before 7.0.1. Where a DAG maps params or dag_run.conf into the environment of SSHRemoteJobOperator, a user with trigger permission may execute commands as the SSH connection user. The CNA record was checked; retrieval of the vendor text is incomplete.
What to checkVerify the fix in SSH provider 7.0.1 or later. Do not judge by the Airflow core version alone; inspect DAGs that pass trigger inputs to the environment and least privilege for SSH connections.
09:17 JST NVD inclusion (developer publication 10/12) · Caveats on CNA record and prerequisites
CVE-2026-116802 / 803 affect versions below 3.4.17; 804 affects 3.4.4–3.4.16. XHTML and SVG animation, node detachment through IN_PLACE hooks, and SAFE_FOR_TEMPLATES with DOM output and shadow roots have separate prerequisites. This does not describe unconditional XSS in every default configuration.
What to checkUpgrade to 3.4.17 or later and check actual parser, hook, and template processing. Also check DOM operations after sanitization and downstream template evaluation. Disclose the developer's Low rating and 10/12 publication, distinguishing them from this database inclusion.
09:17 JST NVD inclusion (already disclosed by developer on 10/11) · Qualifications on CNA record and exploit conditions
The 14 CVEs cover tenant SQL, public WebSocket, Bull Board worker dashboards, webhook JavaScript sandboxes, and credential or log exposure. While the CNA uses below 3.0.0 as the boundary, some developer GHSAs retain commit ranges and empty patched_versions, and their publication text is outdated. Version alone cannot establish that remediation is complete.
What to checkRestrict access to worker/Bull Board and unnecessary WebSockets, and cross-check pinned image digests, fixing commits, and actual deployments. Separately revoke potentially exposed ingestion/integration secrets and DB connection details and investigate logs.
Developer WebSocket advisory / Developer worker advisory / Developer sandbox advisory
09:17 JST NVD inclusion (already published by developer on 10/12) · Caveats on CNA records and prerequisites.
CVE-2026-116820–116828 cover SQL information exposure, ACL wildcards, template traversal, XSS, signature replay, administrator SSRF, and other issues. In 4.6.2 and later, 116825 lacks Date freshness and replay prevention, allowing previously valid signed ActivityPub requests to be resent. It is not a signature forgery issue.
What to checkUpgrade to YesWiki 4.7.0 or later. Check freshness and deduplication as well as signatures and actor ownership, and avoid publishing signed request logs from reverse proxies or similar systems. Treat SSRF requiring administrator privileges separately from unauthenticated XSS.
Developer signature-replay advisory / Developer ACL advisory
As of 09:58 / added correction at 10:56 JST · Publication/update verified.
In addition to continued investigation and cooperation arrangements, report 8 asks customers to back up, disconnect from the network, shut down, and unplug cords connected to PCs. Report 9's heading was corrected to 11:59, but its history section still says 11:52, leaving a discrepancy in initial publication times.
What to checkCheck official guidance specific to your usage, proceed with backups and instructed device isolation. Protect accounts from another trusted device, and do not restore browser synchronization or connections before the investigation is complete.
10:15 JST JVN aggregate update / vendor gives only the 10/26 date · Publication/update verified.
SSA-887643 explains in V1.1 on 10/26 that the earlier fixed version for CVE-2026-80465 was incomplete. CVE-2026-89209 in SSA-137528 is an IdP-initiated SSO authentication bypass by replaying a valid SAML assertion. JVN's 20 new and 22 updated entries are cumulative for October (month 10), not 42 new incidents today.
What to checkCheck each series separately: SAML module 3.6.29 or later for Mendix 9, and 4.2.4 or later for 10/11. Distinguish the main product version from the module version. The interim mitigation for 89209 is disabling IdP-initiated SSO. The vendor's publication time itself is not confirmed to fall within the window.
10:19 JST NVD inclusion · Caveats on CNA records and prerequisites.
The CNA for CVE-2026-116843 specifies versions below 3.0.3. Starting --worktree in an untrusted repository can invoke Git filter drivers in .git/config before the trust check, potentially running commands with the executing user's privileges. A fixed release was confirmed.
What to checkUpdate to 3.0.3 or later and do not unconditionally execute Git settings or filters in unfamiliar repositories. Running an AI agent in another worktree alone is not a security boundary.
10:19 JST NVD inclusion (also includes 2024/2025 identifiers) · Caveats on CNA record and prerequisites
6 issues involve out-of-bounds reads in GGUF tensor offsets and special token IDs, heap writes in the PLAMO tokenizer, and GGUF shape/size integer overflows. The respective fix boundaries are b2731 / b3701 / b5649 / b10261 / b11301 / b11275. Some are newly assigned CVEs for old fixes; do not treat them as 6 new RCEs today.
What to checkMatch the build in use against each fix commit, and handle untrusted GGUF files in isolated, low-privilege environments. Restrict APIs accepting arbitrary token IDs. Do not assume models are safe because they contain only weights.
10:19 JST NVD inclusion · Caveats on CNA records and prerequisites.
CVE-2026-116620 reports an out-of-bounds read in the regex parser in RapidJSON 1.1.0 and earlier. Developer issue2401 was checked, but the minimum fixed release remains undetermined. This does not mean every application using JSON is unconditionally attackable.
What to checkCheck paths that actually pass external input into regex/schema processing, and consider size and execution-resource limits, isolation, and fixing commits. Inventory copies bundled with products too.
10:30 JST JVN (CERT revision at 07:45 JST) · Publication/update confirmed
CVE-2026-90975 involves fallback to zero when a parent secret is absent during BIP32 hardened derivation. An attacker obtaining a descendant signer share and chain code may be able to reach an ancestor/root share of the same MPC party. The threshold layer remains, and this is not described as independently yielding a spendable private key. The CERT text says no fix is available.
What to checkProtect chain codes as secrets and do not distribute them through watch-only extended public keys or similar means. Do not treat hardened derivation as a guarantee of isolation between shares; if a leaf share is compromised, investigate that party's entire hierarchy. Do not use unconfirmed fixed-version numbers to make deployment decisions.
10:30 JST JVN (fixed on 7/6) · Publication/update verified.
CVE-2026-91141 is a DoS in reliable TCP endpoints in 3.7.3 and earlier that allocate a buffer of the declared size before confirming receipt. By default, up to approximately 4 GB can be specified per connection. Configurations with explicit size limits are excluded; clients connecting to malicious servers may also be affected.
What to checkUpdate to 3.7.4 or later. If updating is difficult, set suitable limits such as max-payload-size-reliable and restrict access to trusted peers. Do not count the 7/6 shipment of 3.7.4 as a new fix or observed attack today.
10:46 JST document update (01:46:22 UTC) · Publication/update verified.
Microsoft's October (month 10) CVRF contains 35 newly published revisions and 7 revisions to existing entries in this window. These are record updates involving GitLab, Wasmtime, Chromium, SSL, and others, not 35 attacks or newly shipped patches for Microsoft products. Individual revision indexes are saved with the originals.
What to checkCheck each product against FixedBuild and update history individually. Do not reinterpret old FixedBuild values for Edge and others as current recommended versions; consult current distribution channels and release notices.
12:00 JST JVN (fix shipped 10/15) · Publication/update confirmed
CVE-2026-109434 is UI spoofing in Sleipnir Mobile for Android below 3.9.0. Viewing a crafted page can lead to phishing through a fake address bar or similar interface. The developer announced 3.9.0 on 10/15; this is not a new patch today.
What to checkUpdate Android to 3.9.0 or later and check the domain and how to exit fullscreen. Do not generalize the scope to Windows/iOS versions.
12:22 JST (03:22 UTC status) · Publication/update verified.
The official status is unchanged from the previous check and explicitly says this is not an additional security incident. It says new registrations remain suspended to prioritize reliability for existing customers and no resumption date can be given. The blog text matches the previous original.
What to checkAffected users should continue revoking/reissuing stored secrets and auditing GitHub and registries. Do not interpret service restoration as a guarantee that old keys are safe. The next scheduled update at 10/28 00:00 JST is after the cutoff time.
Verified at 12:30 / disclosure contents at 13:55 / follow-up at 14:55 JST · Publication/update verified.
The 10th report says publication of material purportedly concerning the company and customers was confirmed at 12:30. Its content is under review and may be inaccurate. A ransomware attack was unconfirmed as of 13:55. The 9th report's statement that malware was not found on devices whose analysis was complete also does not confirm the safety of all devices.
What to checkFollowing report 11, refrain from accessing or reposting disclosed information or spreading links directing others to it. If already accessed, consult official full-scan guidance, and do not respond to requests for passwords, authentication codes, or money.
14:18 JST developer publication / 15:00 JST JVN · Publication/update verified.
CVE-2026-105272 / 109848 bypass authorization for content and comments using known revision IDs of other pages, among other inputs. In 115624, collaborative editing checks only viewing permission, allowing unauthenticated guests to modify drafts on publicly viewable pages. This does not mean guests directly save revisions; changes can be incorporated when a legitimate editor subsequently saves.
What to checkUpdate to GROWI 8.0.7 or later. Setting guest access to Deny is a temporary measure for unauthenticated guests only, not complete protection against logged-in read-only users. Inspect drafts of public pages before saving.
15:17 JST NVD / 10/27 advisory (fixed release7/30) · Caveats on CNA record and prerequisites
CVE-2026-117468–117472 affect CE/EE from their respective introduction versions through 7.2.3. They cover device-code privilege escalation in restricted API sessions, file credential direction checks, WebAuthn challenge reuse, Duo host input, and read/write checks with URL_PREFIX. The WebAuthn issue requires a password and acquisition of a valid assertion; the URL_PREFIX issue involves special API key privileges and encrypted data.
What to checkCheck Psono Server 7.2.4 or later and inventory API key privileges, device codes, URL_PREFIX, and external file repositories. Distinguish the new disclosure from the existing fixed release of 7/30; do not treat this as plaintext vault leakage for everyone.
Psono developer advisory468 / Psono developer advisory470 / Psono developer advisory472
15:17 / 16:16 JST NVD inclusion · Caveats on CNA record and prerequisites
Notification validation issues involving unset or empty secrets are reported in Wompi 4.0.1 and earlier, Payex1.2.10 and earlier, TiendaCrypto1.2.1 and earlier, and PayDunya1.1.6 and earlier. Conditions differ: TiendaCrypto always uses an empty key, while others involve initial unset configurations. This investigation cannot uniformly confirm fixed versions.
What to checkCheck usage, configuration, and vendor fixes for applicable gateways, and consider disabling notification paths that cannot be secured. Before shipping, reconcile transactions with the payment provider rather than relying only on an order's paid status. Do not assume setting a secret fixes every issue.
15:31 JST GHSA publication · Publication/update verified.
GHSA-5crq-52j9-fc74 reports an import-time reverse shell in h13t0ry-hello-demo 0.1.0. No fixed version is listed. This does not confirm harm across PyPI or in other packages.
What to checkCheck installation and import histories for the affected versions, and consider isolating execution environments, preserving logs, and revoking secrets. Do not reuse the same image or cache before safety is established. Do not download or execute malicious packages for verification.
16:16 / 17:16 JST NVD inclusion · Qualifications on CNA record and exploit conditions
CVE-2026-105946 exposes heap information and causes crashes in Qt Network NTLM. Versions 6.8.0–6.8.9 / 6.9.0–6.11.1 are fixed in 6.8.10 / 6.11.2 / 6.12.0. 107472 affects QTextCodec TSCII conversion in 4.0.0–6.8.8 / 6.9.0–6.11.2, fixed in 6.8.9 / 6.11.3 / 6.12.0. The reviewed material lists NTLM impact below 6.8 as unknown.
What to checkCheck the Qt bundled and used by applications and the affected APIs, then apply the fix for the relevant branch. Inspect reachability conditions for NTLM server/proxy and TSCII inputs separately; a fixed version for one does not establish that both are fixed.
16:16 JST NVD inclusion · Caveats on CNA record and prerequisites
The Fortinet CNA record for CVE-2026-106174 lists 8.0.0 / 7.6.4–7.6.6 and describes HTTPS management interface DoS by an unauthenticated attacker with network access. The official PSIRT text returned 403 and could not be retrieved; the minimum fixed version has not been independently verified.
What to checkLimit exposure of the HTTPS management interface, and have administrators check FG-IR-26-181 for the series in use. Verify minimum fixed versions through official support. Distinguish this from existing hardening releases for multiple products.
NVD/CNA record CVE-2026-106174 / Fortinet PSIRT: retrieval403
16:54 JST GHSA publication · Publication/update confirmed
GHSA-2w7v-jwxh-w7wc reports @camera.ui/camera-ui-nvr-windows-amd64 1.6.1 as malware. The fixed-version field is empty. Do not generalize this into compromise of all unrelated camera.ui components.
What to checkCheck the name and 1.6.1 against lockfiles, CI artifacts, and installation history. Isolate hosts where installed or executed according to the advisory, and revoke/reissue accessible secrets from a separate safe device. Package removal alone does not complete compromise recovery.
17:16 / 18:16 JST NVD inclusion (developer dated 10/26) · Caveats on CNA records and prerequisites.
CVE-2026-18450 concerns inadequate integrity/encryption requirements for active RMCP+ sessions. According to the developer, 18449 concerns a hardcoded SMCRAKP key and password hash attacks; read NVD's duplicate 18450 description with this correction. 65219/65220 concern sessions and privileges; 65210/65211/65213 require an IPMI administrator. The syslog command injection in 16521 requires high-privilege authentication and restarting the related service.
What to checkRestrict BMC/IPMI to trusted management networks and check model-specific firmware tables. X13DEG-QT01.08.16 and similar versions are model-specific examples, not universal versions; X12DGU is TBD. Do not aggregate every vulnerability as an unauthenticated attack.
17:16 JST NVD inclusion · Qualifications on CNA record and exploit conditions
The CNA describes CVE-2026-111459 as certificate validation in MRC Client, 111460 as device impersonation using a shared key in OnCell G3150A-LTE, and 111461 as SMS management command injection in the same series. Do not assign all 3 to the same product based solely on product names in reference URLs. The official text could not be retrieved, and firmware versions remain unverified.
What to checkCheck MRC Client / OnCell as separate assets, including whether SMS management is enabled, required privileges, and communication paths. Restrict management interfaces and reconfirm affected products and fixed versions with official Moxa support.
NVD/CNA record CVE-2026-111459 / NVD/CNA record CVE-2026-111460 / Moxa official reference: body retrieval incomplete
Supplementing conditions, fix/deployment methods, and operational impacts in previously published material. These are not recounted as new compromises during this period.
10:13 JST Git commit / catalog dateReleased is 07:24 JST · Publication/update verified
CISA KEV is the 2026.10.26 edition with 1,758 entries. The 2 PHP CVEs were added since the previously saved original; forensicTriage is Yes and knownRansomwareCampaignUse is Unknown. The catalog dateReleased precedes this window, while the official Git commit falls within it, so these cannot simply be equated with the original publication time.
What to checkPrioritize official fixes for PHP and bundled products, and check intrusion traces and existing credentials. KEV inclusion informs prioritization of known exploitation, but does not prove new victim counts or confirmed ransomware in this window.
Retrieved again from 18:49 JST onward (not new changes) · Supplement to existing issues and response scope
Selected text for ConnectWise, SoftBank, Tailscale, eMudhra, and Fortinet matches the previously saved versions. The minimum fixed Tailworm version remains undetermined. Do not identify the CA remediation in Tailscale v1.104.2 as a Tailworm fix. The official .NET Brotli issue is also not newly revised within this window.
What to checkKeep affected ConnectWise connections disabled until individual instructions arrive. Distinguish .NET shared runtime updates and restarts, self-contained rebuilds/redeployments, and NativeAOT republishes/redeployments. Matching sources do not prove worldwide updates or absence of exploitation.
ConnectWise official statement / Tailscale security / Microsoft Brotli official source
This is current content retrieved after the target time. The following information is excluded from confirmed changes before the cutoff.
All 89 new NVD entries overlap with the 192 revised entries. GHSA has 127 newly published advisories (unreviewed125, malware2) and 181 revised advisories. Distinguish reviewed, unreviewed, and malware, and check publication/revision overlap in the ledger. KEV is the 2026.10.26 edition with 1,758 entries; changes from the previously saved original are CVE-2026-109618 / CVE-2026-109619. Inclusion and changes in original records are separate from attack start times. Absence from the list is not proof of no exploitation. Of 146 responses, 27 reference earlier originals to avoid duplicate storage.
data/2026-10-27-1847/incident-register.json / data/2026-10-27-1847/collection-summary.json / data/2026-10-27-1847-vendors/collection-summary.json / docs/research-collection-2026-10-27-1847.md / docs/research-2026-10-27-1847.md / data/latest.json