Daily digest,
Critical Path Traversal Vulnerability in FearlessCMS Disclosed (+7 more)
Vulnerabilities
Critical Path Traversal Vulnerability in FearlessCMS Disclosed
A critical vulnerability, CVE-2026-63190, has been identified in FearlessCMS, a flat-file content management system, allowing unauthenticated attackers to execute privileged PHP scripts in the `/admin/` directory. This flaw arises from improper authentication and path validation, enabling attackers to perform path traversal attacks, write arbitrary files, and execute stored JavaScript, leading to potential site defacement and data exposure. The vulnerability affects versions prior to 0.1.4 and has a CVSS score of 9.4, indicating a critical severity level. As of now, there is no evidence of or public proof-of-concept code. Users are advised to upgrade to version 0.1.4 or later and implement security measures to mitigate risks. The vulnerability was published on October 28, 2026, and is currently.
Vulnerability · 2 sources · score 78 · CVE-2026-117574, CVE-2026-118579, CVE-2026-63190, Path Traversal, XSS
CISA Flags Critical Brotli Node2Shell Flaw Amid Active Exploitation
On October 27, CISA added CVE-2026-111497, a critical vulnerability in Google's Brotli decoder, to its Known Exploited Vulnerabilities (KEV) catalog due to evidence of active exploitation. The flaw, known as Node2Shell, affects Brotli versions 1.0.3 to 1.2.0 and can lead to memory corruption, denial of service, or remote code execution. Federal agencies have until November 10 to patch their systems. The vulnerability impacts various platforms, including Node.js, .NET, Envoy, and PAN-OS, with patches already released by several vendors. Security firms have reported exploitation attempts in their honeypots, indicating the flaw is being actively targeted. Adobe Commerce's PolyShell flaw was also flagged in the same update, highlighting ongoing threats to online stores.
Vulnerability · 2 sources · score 73 · CVE-2026-111497, CVE-2026-48356, Broccoli2Shell, Brotli Decoder Vulnerability, HTTP2Shell
Critical Vulnerabilities in Node.js Affecting Multiple Platforms
On October 21, 2026, Node.js disclosed multiple vulnerabilities, including CVE-2026-111497, a critical out-of-bounds write flaw in the Brotli decoder with a CVSS score of 9.2. This vulnerability can lead to remote code execution (RCE) and affects various platforms using Node.js, including libraries and runtimes like Python and.NET. Other vulnerabilities disclosed include CVE-2026-105482, CVE-2026-105483, and CVE-2026-106069, all rated high with CVSS scores of 7.4. The vulnerabilities pose risks for traffic interception and process crashes. Cisco and Splunk are currently assessing their products for potential impacts. CISA added CVE-2026-111497 to its Known Exploited Vulnerabilities (KEV) catalog on October 27, 2026, indicating in the wild. Organizations are urged to patch affected systems immediately.
Vulnerability · 2 sources · score 73 · CVE-2026-105482, CVE-2026-105483, CVE-2026-106069, CVE-2026-111497, HTTP2Shell
Cisco SSL VPN Denial of Service Vulnerability Exploited in the Wild
A vulnerability identified as CVE-2026-76418 in Cisco Secure Firewall ASA and FTD Software allows unauthenticated remote attackers to trigger a denial of service (DoS) condition. This flaw arises from logic errors when secondary authentication is configured on a tunnel group. Attackers can exploit this by sending crafted requests to the SSL remote access VPN, causing affected devices to reload unexpectedly. Cisco has released patches to address this vulnerability, but there are no workarounds available. The risk level is rated as high due to confirmed exploitation in the wild. Organizations using vulnerable versions are urged to apply the updates promptly to mitigate risks.
Vulnerability · 2 sources · score 72 · CVE-2026-76418
UN Experts Accuse Nicaragua of Crimes Against Humanity
United Nations human rights experts reported on October 28, 2026, that Nicaragua's co-presidents, Daniel Ortega and Rosario Murillo, have established a dictatorship and may have committed crimes against humanity. The investigation, ongoing since April 2018, documented actions such as arbitrary detentions, forced disappearances, and political persecution aimed at eliminating opposition. The U.N. experts indicated that there are reasonable grounds to believe that these actions constitute crimes against humanity. The Nicaraguan government has denied these allegations, labeling the U.N. Human Rights Council as manipulated and obsolete. Since 2018, the government has imprisoned or exiled numerous adversaries, stripped hundreds of citizenship, and shuttered over 5,000 organizations. The U.S. does not recognize Ortega's presidency following the 2021 election, which was deemed illegitimate. Reed Brody, a member of the U.N. expert group, highlighted the total control of the ruling Sandinista Party over state institutions, leaving no space for dissent.
Vulnerability · 2 sources · score 62
Breaches
Massive Data Leak Exposes 41,000 DHS Employees' Information
A significant data breach has revealed the personal information of over 41,000 employees from the U.S. Department of Homeland Security (DHS), including agents from Immigration and Customs Enforcement (ICE) and Customs and Border Protection (CBP). The breach was executed by a group known as the Department of Peace, which accessed the data through the Okta single sign-on system used by DHS. The leaked information includes names, job titles, email addresses, and phone numbers, providing insights into the agency's internal operations and personnel involved in sensitive activities. The dataset, referred to as 'Icepick', was made public by the nonprofit organization Distributed Denial of Secrets (DDoSecrets). DHS has acknowledged the breach and is investigating the incident, while Okta claims its systems were not compromised. This incident marks the third major government data leak in recent weeks, following similar breaches at the FBI and the Defense Department.
Breach · 11 sources · score 67
Threat actors and malware
Browser Extensions Hijack Searches for 13 Million Users
An investigation revealed that 319 malicious browser extensions have hijacked search queries from approximately 13.4 million users. These extensions, often disguised as legitimate tools, manipulate search results and collect referral payments from Yahoo and Bing. The extensions were found to be installed through deceptive advertising and are capable of redirecting users to potentially harmful sites. Microsoft identified at least 250 related extensions, which also tracked user activity and could lead to phishing or malware sites. Despite efforts to remove these extensions from official stores, new variants continue to emerge, indicating a persistent threat. The campaign has been ongoing for over a decade, exploiting the vulnerabilities in browser extension marketplaces. Users are advised to be cautious of extensions that do not provide clear value and to regularly review installed extensions for any suspicious activity.
Malware · 2 sources · score 70 · SleeperWidget, SecuryBrowse
Also worth knowing
California Nuclear Lab Faces Security Violations Endangering National Secrets
The Special Technologies Laboratory in Santa Barbara, California, has been cited for severe security failures that allowed classified information to be processed on unauthorized computer systems. The National Nuclear Security Administration (NNSA) issued a preliminary violation notice on October 16, 2026, indicating that one violation received the highest severity rating from the Department of Energy, highlighting a significant potential threat to national security. The laboratory, operated by Mission Support and Test Services, LLC (MSTS), is now facing a proposed fine of $196,350. Federal officials have not disclosed the specific classified information involved or confirmed unauthorized access. The security lapses were first discovered in March 2024, with the incident marked as closed in August 2024. Investigations continued, leading to the recent findings. The laboratory plays a crucial role in safeguarding the U.S. nuclear arsenal and detecting foreign nuclear threats.
Critical Infrastructure · 2 sources · score 54
New on leak sites
24 victims listed on ransomware leak sites by 14 groups in the 24 hours before this issue. The most active:
Also moving
- CVEs: CVE-2026-109618, CVE-2026-109619, CVE-2026-111497, CVE-2026-101767, CVE-2026-48356
- Vulnerabilities: Node2Shell, HTTP2Shell, OS Command Injection, PolyShell, XSS
- APT groups: ShinyHunters, Volt Typhoon, Bronze Silhouette, CARR
- Campaigns: Silent Train, Belarusian Foreign Information Manipulation And Interference Operation, Be Ready, Black October, Breaking Chains
- Malware: StealC, AgentTesla, Amadey, BeatBanker, BoneSpy
- Ransomware groups: Blackbyte, BlackSuit, Coinbase Cartel
Get the next one by email
The digest is free and arrives every morning. One click to leave.
A free account turns the digest into a personal watchlist: choose what you want to follow.