Weekly recap: Week of 26 October to 1 November 2026

Most covered

• vulnerabilities5 sources
  Brotli CVE-2026-111497 and git-remote-httpsSource ↗

  CVE-2026-111497 affects git-remote-https when libcurl is built with brotli support, which is common across Linux distributions. Applications using libcurl with CURLOPT_ENCODING or its alias CURLOPT_ACCEPT_ENCODING may also be vulnerable to this issue.

  Grouped: similar headlines and the same Common Vulnerabilities and Exposures (CVE) record (CVE-2026-111497).

• vulnerabilities4 sources
  Attackers Exploit Second Cisco Firewall VPN Zero-Day Since AugustSource ↗

  Cisco released patches for CVE-2026-76418, a critical vulnerability in its Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense products affecting the remote access virtual private network (VPN) service. The flaw, rated 8.6 CVSS…

  Grouped: similar headlines and the same Common Vulnerabilities and Exposures (CVE) record (CVE-2026-76418).

• vulnerabilities3 sources
  CVE-2026-111497: Critical out-of-bounds write in the Node.js Brotli decoderSource ↗

  CVE-2026-111497 is an out-of-bounds write vulnerability in the Brotli decoder bundled with Node.js, affecting versions 22.x, 24.x, and 26.x, with a CVSS score of 9.2. An attacker supplying malformed Brotli data to an application could corrupt process memory…

  Grouped: the same Common Vulnerabilities and Exposures (CVE) record (CVE-2026-111497) and the same name (GOOGLE BROTLI).

• vulnerabilities3 sources
  Attacker Tried to Exploit Alpine Linux’s GitLab via CVSS 10.0 Flaw Its Ruby Left OpenSource ↗

  An attacker attempted to exploit CVE-2026-97229, a critical GitLab vulnerability with a CVSS 3.1 score of 10.0, against Alpine Linux's GitLab infrastructure approximately one week after a patch was released. The flaw allows remote code execution (RCE) through…

  Grouped: the same event, confirmed by the daily automated review.

• threat intel3 sources
  Inside KeyDrift: Analyzing historical UAT-11473 activity on Cisco SD-WANSource ↗

  Cisco Talos identified UAT-11473, an advanced persistent threat (APT) actor, exploiting CVE-2026-20127, a critical authentication bypass vulnerability in Cisco SD-WAN Catalyst Controller instances, to deploy KeyDrift, a sophisticated custom malware framework…

  Grouped: the same Common Vulnerabilities and Exposures (CVE) record (CVE-2026-20127) and the same name (CISCO SD-WAN).

• vulnerabilities2 sources
  CVE-2026-35273: SSRF to RCE in Oracle PeopleSoftSource ↗

  CVE-2026-35273 is a critical server-side request forgery (SSRF) vulnerability in Oracle PeopleSoft that allows remote code execution (RCE) through a chain of three distinct flaws in the Integration Gateway and Environment Management Hub components. Mandiant…

  Grouped: similar headlines and the same Common Vulnerabilities and Exposures (CVE) record (CVE-2026-35273).

• vulnerabilities2 sources
  CISA Adds Two Known Exploited Vulnerabilities to CatalogSource ↗

  CISA added CVE-2026-48356 (Adobe Commerce and Magento file upload vulnerability) and CVE-2026-111497 (Google Brotli return value vulnerability) to its Known Exploited Vulnerabilities Catalog based on active exploitation evidence. These additions reinforce…

  Grouped: the same Common Vulnerabilities and Exposures (CVE) record (CVE-2026-111497) and the same name (KNOWN EXPLOITED VULNERABILITIES).

• vulnerabilities
  CVE-2026-109618: PHP-CGI Pointer Underflow → Remote Code Execution (CVSS 9.2)Source ↗

  A pointer underflow vulnerability in PHP's CGI SAPI (CVE-2026-109618, CVSS 9.2) allows unauthenticated remote code execution on all PHP versions 5.x through 8.4.26 when cgi.fix_pathinfo is enabled by default. The flaw mirrors CVE-2019-11043, which affected…

• vulnerabilities
  NCSC-2026-0458 Vulnerabilities Fixed in Cisco Secure Firewall ASA, Threat Defense and Management CenterSource ↗

  Cisco patched eight classes of vulnerabilities across Secure Firewall ASA, Threat Defense, and Management Center products on October 28, 2026. Four of the eight CVE identifiers carry CVSS scores of 9.0 or higher, with CVE-2026-20329 and CVE-2026-20330 rated…

• threat intel
  26th October: Threat Intelligence ReportSource ↗

  A weekly threat intelligence bulletin reported significant breaches at Japanese cloud provider Onamae Desktop Cloud (26,000 affected servers), India's State Bank of India (3,897 customer records exposed), and WordPress backup service TeamUpdraft, along with a…

Most active ransomware groups (leak-site claims, unverified)

Leak-site claim data is unverified: RansomLook (CC BY 4.0), with ransomware.live as a failover, credited and linked as its terms require (Source: Ransomware.live).

Takedowns and arrests

• Defense contractor pleads guilty to aiding North Korean remote worker schemeGuilty Plea · CyberScoop

  A defense contractor with top secret clearance pleaded guilty to enabling North Korean operatives to apply for U.S. jobs using his identity and security credentials. Between June and October 2025, the scheme generated nine job offers across 88 applications, including a position developing artificial intelligence (AI) systems for military use; the longest employment lasted three weeks. Kurrle hosted laptops at his Virginia residence to facilitate remote access by co-conspirators outside the United States, though a video verification check and other safeguards prevented most attempts from succeeding.

• Bulletproof Host Virtualine Loses Its Domain to FBI SeizureSeizure · SecurityWeek

  The FBI seized the domain of Bulletproof Host Virtualine, a hosting provider that facilitated illegal activities including hack-for-hire services, ransomware operations, and infostealer distribution. The platform accepted cryptocurrency payments to obscure transactions.

• Israeli National Extradited to Face Charges for Stealing Nearly $3M in Virtual Currency HeistIndictment · Extradition · U.S. Department of Justice

  Alexander Gurevich, 49, an Israeli national, had his initial appearance today in the Northern District of California on a 2023 indictment that charged him for exploiting the Nomad Bridge’s self-executing computer program, also known as a smart contract, to steal $2.89 million in virtual currency.

• Syrian Hacker Behind Fake Tweet That Triggered $136 Billion Market Drop Gets 42 Months in PrisonSentencing · The Hacker News

  Ahmad Umar Agha, a Syrian hacker known as Th3Pr0, received a 42-month prison sentence for participating in a hacking conspiracy targeting Western news outlets. The conspiracy was organized by members of Bashar al-Assad's inner circle, including Syria's General Intelligence commander. Agha's activities included the dissemination of a fake tweet that caused a significant market disruption.

• ATM Jackpotter from Venezuela Pleads Guilty in St. LouisGuilty Plea · U.S. Department of Justice

  Aaron Nieves-Carrillo admitted being part of a group of Venezuelans involved in ATM jackpotting across the U.S.

• Two “Chairmen” Of Ghana Romance Scam Conspiracy Plead GuiltyGuilty Plea · U.S. Department of Justice

  United States Attorney for the Southern District of New York, Jamie McDonald, announced today that ISAAC ODURO BOATENG, a/k/a “Kofi Boat,” and INUSAH AHMED, a/k/a “Pascal,” pled guilty for their roles in an international criminal organization that stole more than $100 million from victims via romance scams and business email compromises.

• US sanctions Russians, North Koreans for laundering IT worker earningsSanction · The Record

  The U.S. Treasury Department imposed sanctions on Russian and North Korean nationals accused of laundering income earned by illicit IT workers operating for Pyongyang. The action targets a financial scheme that funnels unauthorized work earnings back to North Korea through intermediaries.

• Third Serengeti Sweep Tops 1,400 Arrests as Investigations MatureArrest · Dark Reading

  Interpol's third Operation Serengeti resulted in 1,462 arrests across 20 African countries and the United States, with recovery of $105 million in stolen funds. The annual coordinated enforcement action represents an expansion of the organization's cross-border investigative capacity.

• Nefilim, Hive ransomware operator given five-year-plus sentence after guilty pleaSentencing · The Record

  Artem Stryzhak, a 36-year-old Ukrainian national, received a sentence exceeding five years after pleading guilty to charges of participating in at least two prominent ransomware groups, Nefilim and Hive. His guilty plea came in the prior year.

• Omegatech Is Disrupted , and the Pressure on Bulletproof Hosting Keeps BuildingSeizure · Disruption · Silent Push

  The FBI seized virtualine.net on October 27, 2026, as part of Operation Omegaline targeting Omegatech (AS202412), a bulletproof hosting provider that took over infrastructure from the disrupted Railnet LLC in February 2026. Over the past 12 months, law enforcement and sanctions have forced 50 bulletproof hosting providers tracked by Silent Push to lose their autonomous system numbers, though operators often relaunch under new ASNs and front companies within days. The speed of ASN acquisition and coordination gaps between US and EU sanctions lists allow bulletproof hosters to rebuild infrastructure quickly under new identities.

• Ukrainian National Sentenced for Role in Hacking Hospitals, Businesses, and Governments as Part of Ransomware Conspiracies Causing Over $100 Million in LossesSentencing · U.S. Department of Justice

  Artem Stryzhak, 36, a Ukrainian national, was sentenced today to 70 months in prison for conspiracy to commit computer fraud in connection with a series of ransomware attacks that targeted hospitals, government entities, law firms, and other businesses around the world.

• “Bulletproof” website domain seized in international law enforcement operationSeizure · Takedown · U.S. Department of Justice

  The website virtualine.net was seized after being used for prolific criminal activity, including advertising sexually explicit images of minors, disclosure of nonconsensual intimate visual depictions, and international money laundering.

6 more qualifying actions on the full feed.

All takedowns and arrests

CISA KEV additions

Vulnerabilities on the move, 2026-10-26 to 2026-11-02 (the 7 days before this recap was generated)

Ransomware leak-site claims (20 of 327 shown, unverified)

• claimFirst DentalUnverified claim. Claimed by The Gentlemen.
• claimAngeles ContractorUnverified claim. Claimed by The Gentlemen.
• claimSK Capital PartnersUnverified claim. Claimed by The Gentlemen.
• claimCherry BekaertUnverified claim. Claimed by The Gentlemen.
• claimGIO DentalUnverified claim. Claimed by The Gentlemen.
• claimCommTankUnverified claim. Claimed by The Gentlemen.
• claimInedUnverified claim. Claimed by The Gentlemen.
• claimNOVADATAUnverified claim. Claimed by The Gentlemen.
• claimfzmb GmbH, Forschungszentrum für Medizintechnik und BiotechnologieUnverified claim. Claimed by Qilin.
• claimGlobal HoldingUnverified claim. Claimed by Qilin.
• claimShibata Co., Ltd.Unverified claim. Claimed by Qilin.
• claimMeshbesher & SpenceUnverified claim. Claimed by Qilin.
• claimBKV Vasúti Jármjavító KftUnverified claim. Claimed by Qilin.
• claimForumUnverified claim. Claimed by Qilin.
• claimSelect Community ManagementUnverified claim. Claimed by Qilin.
• claimCMD NaturkosmetikUnverified claim. Claimed by Qilin.
• claimquevedo-ponce.comUnverified claim. Claimed by Safepay.
• claimmars-semi.com.twUnverified claim. Claimed by Safepay.
• claimRood TruckingUnverified claim. Claimed by Safepay.
• claimgrifosespinoza.comUnverified claim. Claimed by Safepay.

Ransomware claim data is unverified: RansomLook (CC BY 4.0), with ransomware.live as a failover, credited and linked as its terms require (Source: Ransomware.live).

All leak-site claims and confirmed breaches