Cyber Threat Brief — October 23 2026
⚠️ This report is AI-generated. Always validate findings.
1. CVE-2026-114625 — on-prem VeloCloud Orchestrator SQL injection
TL;DR: Any logged-in user of an on-prem VeloCloud Orchestrator can become a superuser operator through CVE-2026-114625, and Arista says it is being exploited, though no second organization has confirmed that and it is not in KEV. Upgrade to the fixed build for your train and block the two attacker IPs Arista published.
What’s New:
- Arista Security Advisory 0199, revision 1.0 dated 22 October 2026, tracks this as CVE-2026-114625 and BUG2043622. CVSS 3.1 is 9.9 (
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H). CVSS 4.0 is 9.4. CWE-89. Any authenticated user, down to the built-in Enterprise Read Only role, can gain operator privileges and masquerade as a local superuser operator, including functions meant for internal use only. - VCO is exposed by default. The attack needs network access to the web UI and a valid session. Arista says no configuration prevents that exposure. Affected on-prem trains: 5.2.x before 5.2.3.18, 6.1.x before 6.1.3.10, and 6.4.x before 6.4.2.12. A release that is not on that list is not vulnerable. End-of-support trains were not assessed. Hosted VCO, including Dedicated, was affected and is already patched. VeloCloud Edge and VeloCloud Gateway are not affected.
- Arista says it detected the issue and that exploitation has occurred. That is one vendor origin. The CVE is not in CISA KEV. Block 74.82.197.86 and 38.54.50.151, then review logs for those addresses. Arista did not publish a SQL payload, so generic SQL-injection rules were not claimed.
Actionable Intel
| Artifact | Type | ATT&CK | Log Source | Action |
|---|---|---|---|---|
| CVE-2026-114625 | Authenticated SQL injection | T1190 | VCO version inventory | Upgrade every on-prem VeloCloud Orchestrator on an affected train. Hosted and Dedicated VCO are already patched. Edge and Gateway are not affected. |
| VCO 5.2.3.18 | Fixed build | T1190 | VCO version inventory | On the 5.2 train, install 5.2.3.18 or later. Earlier 5.2.x builds are vulnerable. |
| VCO 6.1.3.10 | Fixed build | T1190 | VCO version inventory | On the 6.1 train, install 6.1.3.10 or later. Earlier 6.1.x builds are vulnerable. |
| VCO 6.4.2.12 | Fixed build | T1190 | VCO version inventory | On the 6.4 train, install 6.4.2.12 or later. Earlier 6.4.x builds are vulnerable. |
| End-of-support VCO trains | Not assessed | T1190 | VCO version inventory | Arista did not assess end-of-support trains and lists no fix for them. Contact TAC before you treat an old train as safe. |
IP 74.82.197.86 | Reported attack source | T1190 | VCO web access logs / firewall | Block 74.82.197.86 and search VCO web access logs for it. Arista lists this address as observed conducting the attacks. |
IP 38.54.50.151 | Reported attack source | T1190 | VCO web access logs / firewall | Block 38.54.50.151 and search VCO web access logs for it. Arista lists this address as observed conducting the attacks. |
Detection
| Source | Rule | Gap |
|---|---|---|
| Splunk ESCU | None — verified | No rule names VeloCloud or CVE-2026-114625. SQL Injection with Long URLs needs a web destination plus classic SQL tokens, and Arista published no payload. Web or Application Server Spawning a Shell does not list the orchestrator process names. |
| Elastic | None — verified | No rule names VeloCloud or CVE-2026-114625. Web Server Potential SQL Injection Request looks for classic sqlmap-like URL patterns. Those strings are not in the advisory. |
| Sigma | None — verified | No rule names VeloCloud or CVE-2026-114625. SQL Injection Strings In URI matches GET requests with classic SQL keywords. Arista published no request line to match. |
Detection index: ESCU 7aafb1e (2026-10-22) · elastic detection-rules f8a874e (2026-10-23) · SigmaHQ 05d1031 (2026-10-21).
Hunt hint: Confirm the on-prem VCO build first. If it is below the fixed build for that train, restrict the web UI to trusted admin networks and upgrade. Block 74.82.197.86 and 38.54.50.151, then search web access logs, backend application logs, system logs, and database logs for those addresses and for unexpected operator-role changes. Arista also says to look in VCO web access logs for requests with unusual URL-like path components, encoded characters, references to local or internal services, or high request rates. On the VCO host, look for unexpected outbound connections, new daemons, and web shells. If you suspect a compromise, preserve those logs and the relevant filesystem timestamps before you patch. Do not send a test SQL statement to prove the bug.
Sources: Arista Security Advisory 0199
2. TimeSmuggler-NetScaler-2026-10 — CVE-2026-88771 and CVE-2026-88779
TL;DR: The KEV-listed NetScaler bug CVE-2026-88771 now has two separate post-exploitation toolsets: ThreatLabz’s FreeBSD implant TimeSmuggler and a Rapid7-documented kit that chains it with CVE-2026-88779 for root. Patch to the builds below, then hunt both sets of artifacts before you trust a patched appliance.
What’s New:
- @Threatlabz on 22 October says attackers used CVE-2026-88771 to deliver a FreeBSD Rust backdoor they track as TimeSmuggler, and that Sansec saw the same malware in StyleSmuggler. The 16 October ThreatLabz writeup is the technical source for that post and is outside this brief’s window. It does not use the name TimeSmuggler. The inline variant downloads
kw2-freebsd-x64-s11fromhttp://209.141.43.95/files/kw2-freebsd-x64-s11to/var/kw2s11, marks it executable, and runs it. ThreatLabz lists fixed builds 14.1-73.46, 13.1-64.29, 14.1-73.46 FIPS, and 13.1-FIPS/NDcPP 13.1.37.283. Elastic’s rule note still cites the earlier builds 14.1-73.37 and 13.1-64.23. - Sansec’s StyleSmuggler page lists 209.141.43.95 as a malware download host for CVE-2026-75650. It does not name TimeSmuggler,
kw2-freebsd-x64-s11, or NetScaler. The shared host is a lead. It is not confirmation that the FreeBSD file and the StyleSmuggler Linux samples are the same binary. - Rapid7, published 19 October and last updated 22 October, describes a different intrusion. It chains the CVE-2026-88771 log poison with CVE-2026-88779 so a SAML crash handler runs the payload as root without the usual wait. That kit uses
/nsconfig/.slap/, setschmod 6555 /bin/sh, and runs a Go agentnsvmdagainstv5v.in. Do not merge it with TimeSmuggler. CVE-2026-107406 is a different SAML issue and stays on the watch list.
Actionable Intel
| Artifact | Type | ATT&CK | Log Source | Action |
|---|---|---|---|---|
| CVE-2026-88771 | Log-poison command injection | T1190 | NetScaler version inventory / citrix_adc.log | Patch every NetScaler ADC and Gateway. CISA KEV added this CVE on 2026-09-27 with due date 2026-09-30. |
| CVE-2026-88779 | SAML crash handler | T1190 | NetScaler version inventory | Patch alongside CVE-2026-88771. Rapid7 says this bug lets the crash handler run the poisoned payload as root. |
| NetScaler 14.1-73.46 | Fixed build | T1190 | NetScaler version inventory | On the 14.1 train, install 14.1-73.46 or later. ThreatLabz lists this build. Elastic’s note still cites 14.1-73.37. |
| NetScaler 13.1-64.29 | Fixed build | T1190 | NetScaler version inventory | On the 13.1 train, install 13.1-64.29 or later. ThreatLabz lists this build. Elastic’s note still cites 13.1-64.23. |
| NetScaler 14.1-73.46 FIPS | Fixed FIPS build | T1190 | NetScaler version inventory | On 14.1-FIPS, install 14.1-73.46 FIPS or later. |
| NetScaler 13.1.37.283 | Fixed FIPS/NDcPP build | T1190 | NetScaler version inventory | On 13.1-FIPS and 13.1-NDcPP, install 13.1.37.283 or later. |
/var/kw2s11 | TimeSmuggler drop path | T1105 | NetScaler filesystem | Look for /var/kw2s11 and for a fetch of kw2-freebsd-x64-s11. ThreatLabz describes this as a Rust FreeBSD x64 binary. No hash was published. |
http://209.141.43.95/files/kw2-freebsd-x64-s11 | Implant download URL | T1105 | DNS / proxy / NetScaler shell history | Block the URL and search for fetches of kw2-freebsd-x64-s11 from 209.141.43.95. |
IP 209.141.43.95 | Implant download host | T1071.001 | Firewall / DNS | Block 209.141.43.95. ThreatLabz and Sansec both list this host. Sansec ties it to StyleSmuggler, not to a named NetScaler file. |
pitboss PPE missed too many heartbeats | Forged PPE failure | T1190 | NetScaler /var/log/ns.log / syslog | Alert when a pitboss record contains missed too many heartbeats followed by shell syntax. ThreatLabz variant 1 uses this string. |
pitboss PPE unexpectedly died | Forged PPE failure | T1190 | NetScaler /var/log/ns.log / syslog | Alert when a pitboss record contains unexpectedly died followed by shell syntax. ThreatLabz variant 2 and the inline downloader use this string. |
User-Agent prefix INDEX: | Staged access-log payload | T1190 | NetScaler HTTP access logs | Search User-Agent values that start with INDEX: on /logon/LogonPoint/tmindex.html, /logon/LogonPoint/index.html, /vpn/index.html, and /logon/tmindex.html. The value after the prefix is Base64 that the poisoned log later decodes. |
/nf/auth/doAuthentication.do | Log-poison POST | T1190 | NetScaler HTTP logs | Review POSTs to /nf/auth/doAuthentication.do whose login field contains pitboss and shell metacharacters. |
/netscaler/ns_monuploadd_err.pl | Privileged log parser | T1059 | Process / auditd | Alert when /netscaler/ns_monuploadd_err.pl runs grep, b64decode, or a shell against /var/log. That script is what turns the poisoned PPE line into a command. |
Nx_7508.html | Web shell marker file | T1505.003 | NetScaler filesystem | Search for Nx_7508.html under the VPN and LogonPoint trees. ThreatLabz uses that name as a marker. The file body contains shell substitutions, so do not execute it. |
Nx_7508.php | PHP web shell name | T1505.003 | NetScaler filesystem / httpd.conf | Search for Nx_7508.php. ThreatLabz also describes php_engine being turned on in /etc/httpd.conf. |
/nsconfig/.slap/ | Rapid7 framework directory | T1505.003 | NetScaler filesystem | Search for /nsconfig/.slap/ and the files vc, vcscan-agent.sh, agent.pl, bridge.pl, boot.sh, and reverse-agent.sh. This is the Rapid7 kit, not TimeSmuggler. |
/flash/.nsvm/nsvmd | Rapid7 Go agent | T1105 | NetScaler filesystem / process list | Look for /flash/.nsvm/nsvmd and a process started as nsvmd -server v5v.in:443 -sni c.v5v.in. |
/var/netscaler/logon/LogonPoint/custom/.slap.receiver | Cookie web shell | T1505.003 | NetScaler filesystem | Look for .slap.receiver in the LogonPoint custom directory. Rapid7 says commands arrive in a second cookie and the response is an HTTP 404 body. |
/var/netscaler/logon/LogonPoint/custom/.ctxs.receiver | Cookie web shell copy | T1505.003 | NetScaler filesystem | Look for .ctxs.receiver next to .slap.receiver. Rapid7 lists it as a second copy of the shell. |
/var/netscaler/logon/LogonPoint/custom/receiver.deb | PHP-executed shell copy | T1505.003 | NetScaler filesystem / Apache config | Look for receiver.deb in that directory. Rapid7 says Apache was changed so .deb files run as PHP. |
/logon/LogonPoint/custom/receiver.v2.min.css | CSS alias to the shell | T1505.003 | NetScaler HTTP logs | Alert on requests to /logon/LogonPoint/custom/receiver.v2.min.css and the same name with a hex suffix before .css. Rapid7 says those URLs alias to .slap.receiver. |
chmod 6555 /bin/sh | setuid shell | T1548.001 | NetScaler audit / filesystem | Check whether /bin/sh is mode 6555. Rapid7 says the actor set that mode so the PHP shell can reach root. |
sync HA files all | HA implant sync | T1570 | NetScaler audit / CLI logs | Search CLI history for sync HA files all. Rapid7 says the kit copies implant files to the HA peer. |
force HA failover | HA failover | T1570 | NetScaler HA events | Search for force HA failover near the .slap files. Rapid7 says the kit fails over so the implanted node becomes active. |
/tmp/.uxdport | Loopback tunnel port file | T1090 | NetScaler filesystem | Look for /tmp/.uxdport and /tmp/.uxdlock. Rapid7 says agent.pl records an ephemeral loopback port in .uxdport. |
/var/tmp/.ux/slapshot.py | Python tunnel component | T1090 | NetScaler filesystem | Look for /var/tmp/.ux/slapshot.py and /var/tmp/.ux/whipd.py. |
/var/tmp/.s2loot/ | Loot staging directory | T1074.001 | NetScaler filesystem | Look for /var/tmp/.s2loot/. Rapid7 lists it as the loot staging directory. |
v5v.in | nsvmd C2 domain | T1071.001 | DNS / firewall | Block v5v.in and c.v5v.in. Rapid7 says nsvmd connects to v5v.in:443 with SNI c.v5v.in. |
IP 209.74.64.192 | nsvmd C2 | T1071.001 | Firewall / proxy | Block 209.74.64.192. Rapid7 lists it as C2 used by nsvmd. |
IP 192.159.99.139 | .slap C2 and relay | T1071.001 | Firewall / proxy | Block 192.159.99.139. Rapid7 lists it for .slap C2, relay, reverse-agent, and loot upload. |
IP 213.209.159.55 | Stage server | T1105 | Firewall / proxy | Block 213.209.159.55. Rapid7 says it delivered /v, 1.sh, and 17447d.sh, and collected staged data. |
SHA-256 6774bfed99da38cec82e721de4bd64a67db7840efadcc71e7df02eb6f0a03c44 | Dropper 1.sh | T1105 | File hash / EDR | Block and search for 6774bfed99da38cec82e721de4bd64a67db7840efadcc71e7df02eb6f0a03c44. Rapid7 names the file 1.sh. |
SHA-256 a0ba4e1ad622d9c3d950b4156d4430812d05bee216ab22c3804a9f7a80535556 | Dropper 17447d.sh | T1105 | File hash / EDR | Block and search for a0ba4e1ad622d9c3d950b4156d4430812d05bee216ab22c3804a9f7a80535556. Rapid7 names the earlier dropper 17447d.sh. |
SHA-256 56a892d80096a9db4ca473a9c3109729c60a5ba901d6ba65948bdb1f4a6fb186 | Installer 2.sh / r.sh | T1105 | File hash / EDR | Block and search for 56a892d80096a9db4ca473a9c3109729c60a5ba901d6ba65948bdb1f4a6fb186. Rapid7 names it 2.sh and r.sh, the nsvmd installer. |
SHA-256 8e8b9532ce40eacfe1b4cf2b11241878b70b910aabd90b453b1460df19b51a4d | Scanner scanner-freebsd-amd64 | T1046 | File hash / EDR | Block and search for 8e8b9532ce40eacfe1b4cf2b11241878b70b910aabd90b453b1460df19b51a4d. Rapid7 says vcscan-agent.sh installs this as /nsconfig/.slap/vc. |
SHA-256 eaf0086237879bbaac00a5874c0e2ff84deede1ba10e6b706e2288fd3a31cdde | Installed scanner vc | T1046 | File hash / EDR | Block and search for eaf0086237879bbaac00a5874c0e2ff84deede1ba10e6b706e2288fd3a31cdde. Rapid7 lists this hash for vc. |
SHA-256 ffe052fc50271e7739d458b155df790438776032bfd125b974735e1dd9c0b138 | Agent nsvmd | T1071.001 | File hash / EDR | Block and search for ffe052fc50271e7739d458b155df790438776032bfd125b974735e1dd9c0b138. Rapid7 lists this hash for nsvmd. |
Detection
| Source | Rule | Gap |
|---|---|---|
| Splunk ESCU | None — verified | NetScaler content in this index covers CitrixBleed and CVE-2023-3519 / CVE-2023-4966. No rule matches pitboss, /var/kw2s11, or /nsconfig/.slap/. Web or Application Server Spawning a Shell does not list nsppe as a parent. |
| Elastic | Partial — Potential NetScaler Log Poisoning Command Injection Attempt | Requires citrix_adc.log. It matches pitboss plus a packet-engine token and shell metacharacters, or PITBOSS-class messages with shell syntax. File drops, /var/kw2s11, Rapid7 paths, and nsvmd miss. The note still lists fixed builds 14.1-73.37 and 13.1-64.23. Use ThreatLabz’s later builds. |
| Sigma | None — verified | The NetScaler rules in this index are CVE-2023-4966. None name CVE-2026-88771, pitboss, or the Rapid7 paths. |
Hunt hint: Read the build first and move to 14.1-73.46, 13.1-64.29, or the FIPS builds above. Before you reboot, copy /var/log/ns.log, rotated logs, and HTTP access logs. Search those logs for pitboss PPE next to unexpectedly died or missed too many heartbeats, and for User-Agent values that start with INDEX:. On disk, look for /var/kw2s11, /nsconfig/.slap/, /flash/.nsvm/nsvmd, the LogonPoint .slap.receiver files, and mode 6555 on /bin/sh. Block 209.141.43.95, v5v.in, 209.74.64.192, 192.159.99.139, and 213.209.159.55. Rapid7’s indicator table has more delivery addresses than the four hosts in this section. A clean disk after a reboot does not clear an appliance that already synced the implant to its HA peer.
Sources: ThreatLabz · ThreatLabz on X · Rapid7 · Sansec StyleSmuggler · CISA KEV · Original NetScaler brief
3. eMudhra-CVE-2026-111943 — compromised intermediates and Java CVE-2026-91403
TL;DR: Eight eMudhra intermediate private keys are recoverable, and while CT-enforcing browsers are protected, Java, Go, Node.js and OS trust stores still need an update or denylist. There is no confirmed misuse and neither CVE is in KEV, so run the trust checks below and update runtimes first.
What’s New:
- The disclosure site, dated 20 October, says eight intermediate private keys were generated incorrectly and have been recoverable since April 2025. They chain to roots trusted by Mozilla, Microsoft, Apple, and Chrome. Reporter Wayne signed a proof with each key on 17 October. Firefox and Chrome have blocked the certificates since 17 October, Microsoft since 20 October, and Apple since 22 October. The CA revoked the certificates. There are no Certificate Transparency log entries for the intermediates, so Firefox, Chrome, Edge, and Safari could not have been attacked through those certificates. Clients that do not enforce CT, including curl, still can. The site says it does not know whether that happened.
- impacted-intermediates.json lists 16 certificates and 8 keys. Each key has two certificates. The rows below use the SPKI hash, which is the compromised key. CVE-2026-111943 is the id distros are using for the ca-certificates update. On 22 October the site added two no-CT check hosts. A successful connection to those hosts means the client trusts a compromised intermediate and does not enforce CT.
- Oracle’s 21 October alert addresses CVE-2026-91403 in JSSE, CVSS 3.1 9.1, remotely exploitable without authentication. Oracle lists Java SE 8u511, 8u511-perf, 11.0.33, 17.0.21, 21.0.13, 25.0.5, and 27.0.1, GraalVM for JDK 17.0.21 and 21.0.13, and GraalVM Enterprise Edition 21.3.20. The alert says to update to the latest Java version. OpenJDK’s 21 October advisory lists a different numbering for the old branches: 8u504, 11.0.32.1, and earlier, plus the same 17.0.21, 21.0.13, 25.0.5, and 27.0.1. Do not collapse those two lists. Unit 42 on 22 October describes the weak key generation and the impersonation risk. It does not name either CVE. @AndraxPentester says a GraalVM Native Image bakes the trust store in at build time, so a JDK upgrade does not rewrite a binary you already shipped. That is a researcher claim, not a sentence on the Oracle alert. The Oracle alert, the OpenJDK advisory, and the Go and Node releases are outside this brief’s freshness window. Unit 42 and the 22 October Apple block are what make the item current.
Actionable Intel
| Artifact | Type | ATT&CK | Log Source | Action |
|---|---|---|---|---|
SPKI EBED6475C2C2D80FCB199F3FE8DD6E6B3CE60B77EB15D4E42C3DEC0C6F5B5105 | Compromised key, EM DV TLS CA - G3B | T1557 | TLS inspection / trust store | Distrust this key. The JSON has two certificates, serials A4AEE678F23362B4C0E460B772F214 and A024FDF4BA665C785CE4A020483858B7. Issuer operators are eMudhra and Sectigo. |
SPKI 43BFFA19D6EF651451F6841E019931E96F6F2EAEFF28AB4B6F1CE4576DE2717B | Compromised key, EM OV TLS CA - G3B | T1557 | TLS inspection / trust store | Distrust this key. The JSON has two certificates, serials 6CADA367FB1C100088120EA202D568 and E94223BDE92F914E5AB9ACABFDAC3710. |
SPKI E0254C7FCDC265E2F0F8A428DABB75AB4AE039B4872D62F5EE57F0877D5A8A41 | Compromised key, EM EV TLS CA - G3B | T1557 | TLS inspection / trust store | Distrust this key. The JSON has two certificates, serials C7C41EFE92D825F05EAE841A4A82C1 and D8F8685E4F2BD9D82402A85A1C1EB731. |
SPKI 49DD353DC2B919A3770645117D0E60C16115E7D1BC259EEFE734B00EA434FE5F | Compromised key, EM DV TLS CA - G3C | T1557 | TLS inspection / trust store | Distrust this key. The JSON has two certificates, serials 588B2E3C2BB8CDA13E1A1209254321 and 91F347F1A5B7D39962B95E0EE4E299D1. This intermediate is operated under eMudhra Inc in the US. |
SPKI 63ECEFEE431D49523BC1136C4E72D0206A477086CAF606CD5CF025686C109CF8 | Compromised key, EM OV TLS CA - G3C | T1557 | TLS inspection / trust store | Distrust this key. The JSON has two certificates, serials 296926C227A3A1526392B19482A504 and 8D5A4811939EF447D77111CDD9849AE9. |
SPKI 5C0660A2B164910D8FF589C18E14552E9E0EC237DCEFE2CB736D41A4811F81A0 | Compromised key, EM EV TLS CA - G3C | T1557 | TLS inspection / trust store | Distrust this key. The JSON has two certificates, serials 8009928A64107601AF05FA2F19F109 and 05F078752DECE7A1BB8595D303167171. |
SPKI EC4FFA1AD0AC88081314B7AAFFEF6A91F97CD57291BB5BA686C5415F5EB4F6B6 | Compromised code-signing key, EM OV CS CA - G3B | T1553.002 | Code-signing / jarsigner | Distrust this code-signing key. The JSON has two certificates, serials 7818933F8F85B4619A2B35FBA83D0A and 41E32B73AC185D6CE0D7480BACF84E69. |
SPKI 92C063D67E8F14DB71D288E11266FFDAF69CBF115F7BAB14F3BC2F68D25E0E30 | Compromised code-signing key, EM OV CS CA - G3C | T1553.002 | Code-signing / jarsigner | Distrust this code-signing key. The JSON has two certificates, serials 544B7F922C31AE220A4A922916F6E6 and D6A5EF613B390F32EF9CDF349F772841. |
https://dv-g3b-emudhra.we-have-a-problem.com/ | Trust check | T1557 | curl / custom TLS client | A certificate error means this client does not trust the EM DV TLS CA - G3B chain. A successful handshake means it still does. |
https://dv-g3b-aaa-emudhra.we-have-a-problem.com/ | Trust check | T1557 | curl / custom TLS client | A certificate error means this client does not trust the chain that anchors at AAA Certificate Services. A successful handshake means it still does. |
https://dv-g3b-noct-emudhra.we-have-a-problem.com/ | No-CT trust check | T1557 | curl / custom TLS client | Added 22 October. A successful connection means the client trusts the compromised intermediate and does not enforce Certificate Transparency. |
https://dv-g3b-aaa-noct-emudhra.we-have-a-problem.com/ | No-CT trust check | T1557 | curl / custom TLS client | Added 22 October. A successful connection means the client trusts the AAA-chained intermediate and does not enforce Certificate Transparency. |
| Java SE 8u511 | Affected Java build | T1557 | Java version inventory | Oracle lists 8u511 as affected by CVE-2026-91403. Update to the latest Java 8 build from the alert. OpenJDK’s advisory numbers the old 8 branch as 8u504 and earlier. |
| Java SE 8u511-perf | Affected Java build | T1557 | Java version inventory | Oracle lists 8u511-perf as affected. Update to the latest build from the alert. |
| Java SE 11.0.33 | Affected Java build | T1557 | Java version inventory | Oracle lists 11.0.33 as affected. OpenJDK lists 11.0.32.1 and earlier. Update the build your vendor ships. Do not treat those two version strings as the same package. |
| Java SE 17.0.21 | Affected Java build | T1557 | Java version inventory | Oracle and OpenJDK both list 17.0.21. Update to the latest Java 17 build. |
| Java SE 21.0.13 | Affected Java build | T1557 | Java version inventory | Oracle and OpenJDK both list 21.0.13. Update to the latest Java 21 build. |
| Java SE 25.0.5 | Affected Java build | T1557 | Java version inventory | Oracle and OpenJDK both list 25.0.5. Update to the latest Java 25 build. |
| Java SE 27.0.1 | Affected Java build | T1557 | Java version inventory | Oracle and OpenJDK both list 27.0.1. Update to the latest Java 27 build. |
| GraalVM for JDK 17.0.21 | Affected GraalVM build | T1557 | Java version inventory | Oracle lists GraalVM for JDK 17.0.21. Update it with the Java SE alert. |
| GraalVM for JDK 21.0.13 | Affected GraalVM build | T1557 | Java version inventory | Oracle lists GraalVM for JDK 21.0.13. Update it with the Java SE alert. |
| GraalVM Enterprise Edition 21.3.20 | Affected GraalVM EE build | T1557 | Java version inventory | Oracle lists GraalVM Enterprise Edition 21.3.20. Update it with the Java SE alert. |
$JDK_HOME/lib/security/blocked.certs | JSSE denylist | T1557 | File integrity on JDK hosts | If you cannot upgrade, replace blocked.certs with the file from https://ops.java/windows/blocked.certs or https://ops.java/unix/blocked.certs. Keep any local entries you added. On JDK 8, rename the file to blacklisted.certs in the same directory. |
com.sun.net.ssl.checkRevocation | Revocation workaround | T1557 | Java command line | If you cannot upgrade, start TLS apps with -Dcom.sun.net.ssl.checkRevocation=true and -Dcom.sun.security.enableCRLDP=true. On JDK 17 and later, check signed JARs with jarsigner -verify -revcheck -strict. |
| Go 1.27.3 | crypto/x509 fix | T1557 | Go version inventory | Install Go 1.27.3 or later. go.dev says this release, dated 19 October, has security fixes in crypto/x509. Issue 82349 is the 1.27 backport titled for CVE-2026-111943. |
| Go 1.26.10 | crypto/x509 fix | T1557 | Go version inventory | Install Go 1.26.10 or later on the 1.26 line. Issue 82348 is the 1.26 backport titled for CVE-2026-111943. |
| Node.js 22.23.4 | ca-cert denylist | T1557 | Node version inventory | On the 22.x line, install 22.23.4 or later. The 21 October security release lists the eMudhra intermediate compromise as a ca-cert update. |
| Node.js 24.22.1 | ca-cert denylist | T1557 | Node version inventory | On the 24.x line, install 24.22.1 or later. Same ca-cert update. |
| Node.js 26.12.1 | ca-cert denylist | T1557 | Node version inventory | On the 26.x line, install 26.12.1 or later. Same ca-cert update. The Brotli issue CVE-2026-111497 is in this release and is tracked separately. |
OS ca-certificates | Distro trust store | T1557 | Package inventory | On Arch, Debian, Devuan, Fedora, Gentoo, Oracle Linux, RHEL, and Ubuntu, OpenJDK uses the OS trust store. Update ca-certificates. FreeBSD and Homebrew OpenJDK must be updated directly. |
| GraalVM Native Image binary | Baked-in trust store | T1557 | Application inventory | @AndraxPentester says Native Image bakes the trust store and cert blocklist in at build time. Rebuild those binaries on a fixed GraalVM and redeploy. Oracle’s alert does not state this. |
Detection
| Source | Rule | Gap |
|---|---|---|
| Splunk ESCU | None — verified | No rule names eMudhra, CVE-2026-111943, CVE-2026-91403, blocked.certs, or these SPKI hashes. |
| Elastic | None — verified | No rule names eMudhra, CVE-2026-111943, CVE-2026-91403, blocked.certs, or these SPKI hashes. |
| Sigma | None — verified | No rule names eMudhra, CVE-2026-111943, CVE-2026-91403, blocked.certs, or these SPKI hashes. |
Hunt hint: From a representative host, run the four curl checks above. A certificate error on the first pair is what you want. A successful connection to either no-CT host means that client still trusts a compromised intermediate and will accept a certificate that was never logged. Then inventory Java, GraalVM, Go, and Node.js against the builds in the table, and update ca-certificates where the JDK uses the OS store. Rebuild GraalVM native binaries after the JDK is fixed. The disclosure site does not claim the keys were used. A failed curl check does not prove a past impersonation.
Sources: Disclosure site · impacted-intermediates.json · Oracle alert CVE-2026-91403 · OpenJDK advisory · Unit 42 · Go 1.27.3 · Go issue 82349 · Node.js October security releases · AndraxPentester
Status Updates
- CVE-2026-115560 (PHP, new): PHP’s 23 October note adds a code-execution path that the 21 October builds 8.5.12, 8.4.27, 8.3.36 and 8.2.35 do not fix. It applies only when an app switches
session.serialize_handlerfromphp_binaryorphp_serializetophpwithini_set()beforesession_start(), so keepsession.upload_progress.enabled=0until the next PHP release. No exploitation is reported. Original PHP2Shell brief. - PHP2Shell-CVE-2026-109618 / CVE-2026-109619 (PHP): Exploitation attempts continue, but no one has confirmed a successful compromise, and it is not in KEV. watchTowr says attempts are underway. Sophos saw only scanning and failed attempts, with C2
134.199.154.64and117.55.202.115. Arctic Wolf saw92.118.112.100try to fetchhxxp://92.118.112.100/nfs-setup. Vendor rules: ElasticPotential PHP2Shell Exploitation Attemptand ESCUPHP Session Upload Progress with PHP Code in Upload Filename. Original brief. Yesterday. - ConnectWise-CloudBackup-SkyKick-2026-10: Wiz says Storm-0940 is moving on to IT and software vendors, and adds source IPs
104.194.150.21and167.88.172.97plus the user agentsReconProbe/1.0andnorma/0.4. Hunt for the unsigned JWTeyJhbGciOiJub25lIn0.eyJlbWFpbCI6InRlc3RAdGVzdC5jb20ifQ.,GET /sign_in/oauth/microsoft/callback?code=AAAA&state=notvalidb64!!, and bursts of CognitoInitiateAuth,ForgotPasswordandSignUpcalls. Keep the ConnectWise apps disabled. Yesterday. Original brief. - Plex2Shell-CVE-2026-96652: CVE-2026-96654 and CVE-2026-96656 are KEV due today (2026-10-23). CVE-2026-96652 and CVE-2026-96655 are due 2026-11-03. Fixed build remains 1.43.3.10861. Original brief.
- SiteGuard-CVE-2026-106931: KEV added 2026-10-20, not yet briefed. KEV due today (2026-10-23). Fixed in Ver8.00 Update5 (Apache, Nginx, IIS) and Ver7.00 Update6 (FreeBSD). KEV catalog · EG Secure.
- KEV deadlines already passed, no new fix or IOC: CVE-2026-102764 (BeyondTrust, due 2026-10-19, brief); CVE-2025-61624 (FortiOS, due 2026-10-19, brief); CVE-2026-21589 (Atlassian, due 2026-10-18, brief); CVE-2026-0322 (PAN-OS) and CVE-2026-76519 (Cisco Secure Email Gateway), both due 2026-10-17 (brief); CVE-2026-105134 (AhsayCBS, due 2026-10-17, brief); CVE-2026-0257 (PAN-OS GlobalProtect, due 2026-06-01, brief).
- Retired from watch: CVE-2026-104935, CVE-2026-96951 (last update 2026-10-15). KEV due date 2026-10-16 has passed by seven days and there is no new fix, IOC set, or exploitation report. Last mentioned.
- Watching (no change): LiteLLM-1.107.0-2026-10 (10-22); CVE-2026-110264 (10-22); CVE-2026-97229 (10-22, original 10-13); CVE-2026-105192 (10-22); Siemens-Software-Center-CVE-2026-110936 (10-21, KEV due 2026-11-03, fixed 4.0.9.8); CVE-2026-102255 (10-15); CVE-2026-85097 (10-09); CVE-2026-107406 (10-09); GhostAction-2026-10 (10-10); CVE-2026-82077 (10-11); CyberXero-2026-10 (10-12); Danfoss-AKSM-FROMAGEGATE-2026-10 (10-13); CVE-2026-110447 (10-15); UNC7017-AOMEI-2026-10 (10-17); Candiru-AdFection-DiscoverTech-2026-10 (10-18); InfinityCore-2026-10 (10-18); UpdraftCentral-2026-10 (10-19); OVHcloud-CLI-2026-10 (10-20); RankMath-SEO-Pro-3.0.123 (10-20).