Cyber Threat Brief — October 24 2026
⚠️ This report is AI-generated. Always validate findings.
1. CVE-2026-111497 — Brotli decoder out-of-bounds write (Node.js, Bun, Envoy)
TL;DR: CVE-2026-111497 lets malformed Brotli data write past a decoder buffer in Node.js, Bun, and Envoy. Upgrade each runtime to the fixed build in the table, and treat Imperva’s lab run as a proof rather than a customer incident.
What’s New:
- The Node.js advisory is 21 October, and Imperva’s lab note is 22 October. Both sit outside this window.
- Bun has not tested code execution, and it still says to treat the bug as remote code execution.
- Envoy’s advisory, published 23 October, applies only when a Brotli decompressor is configured.
- A bare Node.js HTTP server does not decode a request body on its own. Express and body-parser are routes into the decoder, not a separate bug.
Actionable Intel
| Artifact | Type | ATT&CK | Log Source | Action |
|---|---|---|---|---|
| CVE-2026-111497 | Brotli decoder out-of-bounds write | T1190 | Runtime version inventory | Patch every process that decompresses untrusted Brotli. The CVE is not in KEV. Imperva’s lab run is not a customer incident. |
| Node.js 22.23.4 | Fixed build | T1190 | Node version inventory / image SBOM | On the 22.x line, install 22.23.4 or later. Check the binary inside the image. A package inventory can miss a bundled runtime. |
| Node.js 24.22.1 | Fixed build | T1190 | Node version inventory / image SBOM | On the 24.x line, install 24.22.1 or later. Imperva’s lab input was rejected on this build. |
| Node.js 26.12.1 | Fixed build | T1190 | Node version inventory / image SBOM | On the 26.x line, install 26.12.1 or later. |
| Node.js 20.x and older | No fix on that line | T1190 | Node version inventory | Node.js says end-of-life lines stay affected. Move 20.x and older to 22.23.4, 24.22.1, or 26.12.1. |
| Brotli 1.2.1 | Fixed library | T1190 | Dependency inventory | Install Brotli 1.2.1 or later on the 1.2 line. Bun 1.4.4 bundles this release. |
| Brotli 1.1.1 | Fixed library | T1190 | Dependency inventory | On the 1.1 line, install 1.1.1. Bun says 1.1.1 is a fixed release inside the affected 1.0.3–1.2.0 range. |
| Brotli 1.0.10 | Fixed library | T1190 | Dependency inventory | On the 1.0 line, install 1.0.10. Bun says 1.0.10 is a fixed release inside that same range. |
| Bun 1.4.4 | Fixed build | T1190 | Bun version inventory | Upgrade Bun from 1.0.21 through 1.4.3 to 1.4.4 or later. |
bun build --compile | Embedded runtime | T1190 | Binary inventory | Rebuild every compiled Bun executable with Bun 1.4.4 or later. The old binary stays vulnerable after you upgrade the toolchain. |
fetch with Content-Encoding: br | Response decode path | T1190 | Application source / proxy | Bun fetch and Node fetch decode Brotli responses. A server the app calls can supply the bytes. |
node:zlib Brotli APIs | Decode API | T1190 | Application source | Review brotliDecompress, brotliDecompressSync, and createBrotliDecompress for untrusted input. |
DecompressionStream format brotli | Decode API | T1190 | Application source | Review Bun DecompressionStream calls that set the format to brotli. |
decompress: false | Per-request workaround | T1190 | Application source | On unpatched Bun, pass decompress: false to fetch for untrusted URLs. Bun says this applies only to that request. |
| Express 5.0.0–5.3.0 | Request-body route | T1190 | Package inventory | Imperva ran code through Express 5 raw() and json() on Node 24.22.0. Upgrade the Node binary. Express itself is not the patch. |
| body-parser 2.0.0–2.3.0 | Request-body route | T1190 | Package inventory | Imperva ran code through body-parser 2 raw() and json() on Node 24.22.0. Upgrade the Node binary. |
| Envoy v1.40.0 | Fixed build | T1190 | Envoy version inventory | On the current train, install v1.40.0 or later when the Brotli decompressor is configured. |
| Envoy v1.39.3 | Fixed build | T1190 | Envoy version inventory | On the 1.39 train, install v1.39.3 or later. v1.39.2 is vulnerable when Brotli decompression is configured. |
| Envoy v1.38.6 | Fixed build | T1190 | Envoy version inventory | On the 1.38 train, install v1.38.6 or later. v1.38.5 is vulnerable when Brotli decompression is configured. |
| Envoy v1.37.8 | Fixed build | T1190 | Envoy version inventory | On the 1.37 train, install v1.37.8 or later. v1.37.7 is vulnerable when Brotli decompression is configured. |
| Envoy v1.36.12 | Fixed build | T1190 | Envoy version inventory | On the 1.36 train, install v1.36.12 or later. v1.36.11 is vulnerable when Brotli decompression is configured. |
Detection
| Source | Rule | Gap |
|---|---|---|
| Splunk ESCU | None — verified | No rule names Brotli or CVE-2026-111497. |
| Elastic | Partial — Curl or Wget Spawned via Node.js | Later curl or wget download only; the Brotli body and in-process execution miss. |
| Sigma | None — verified | The decoder does not emit the node:child_process log string. |
Detection index: ESCU a3f6523 (2026-10-23) · elastic detection-rules 52ef7a0 (2026-10-24) · SigmaHQ 05d1031 (2026-10-21).
Hunt hint: Read node -v, bun --version, and the Envoy build before you hunt crashes. A decoder error or an unexpected exit during decompression is a lead only when that runtime is still in the vulnerable range. On Bun 1.4.4, invalid Brotli fails with BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH. On Node, look for fetch of Content-Encoding: br and for Express 5 or body-parser 2 inflating request bodies. On Bun, rebuild every bun build --compile binary. On Envoy, confirm whether a Brotli decompressor is configured, then move to the patched build. Imperva’s WAF rules are vendor coverage. They are not in this ESCU, Elastic, or Sigma index.
Sources: Node.js October 2026 security releases · Bun GHSA-663w-cv8g-jj2p · Envoy GHSA-3wvj-j6qm-62mr · Imperva
2. Ruby-Onigmo-2026-10-23 — Regexp compiler fixes for the GitLab CVEs
TL;DR: Ruby shipped Onigmo fixes for the regex bugs behind GitLab’s four CVEs, but only when an app compiles attacker-controlled text. Upgrade the Ruby line in the table, and patch the Ruby that GitLab ships rather than only the host interpreter.
What’s New:
- Ruby’s post is 23 October at 03:11 UTC, a few hours before this window.
Regexp.timeoutand a length cap do not stop these bugs, including some short patterns.- Ruby has not requested its own CVE identifiers, so track the GitLab IDs.
- GitLab.com needs no action, and current dedicated internal builds already include the GitLab fix.
Actionable Intel
| Artifact | Type | ATT&CK | Log Source | Action |
|---|---|---|---|---|
| CVE-2026-89078 | Onigmo double free | T1190 | Ruby version inventory | Track this GitLab CVE until Ruby is on a release that contains change #13332. Ruby 4.0.0 and later on the 4.0 line include it. 3.4 and 3.3 need 3.4.12 and 3.3.13. |
| CVE-2026-93577 | Onigmo integer overflow | T1190 | Ruby version inventory | On Ruby 4.0, change #19020 arrives in 4.0.8. On 3.4 and 3.3, install 3.4.12 or 3.3.13. |
| CVE-2026-97229 | Onigmo integer overflow | T1190 | Ruby version inventory | Same Ruby change as CVE-2026-93577 (#19020). GitLab’s own fix for this CVE is still the GitLab build, not a system Ruby upgrade. |
| CVE-2026-110264 | Onigmo ID overflow | T1190 | Ruby version inventory | Change #16801 is in Ruby 4.0.9, 3.4.12, and 3.3.13. Ruby 4.0.8 does not contain it. |
| Ruby 4.0.9 | Fixed build | T1190 | Ruby version inventory | Install 4.0.9 or later. This is the first 4.0 release that contains all four fixes. |
| Ruby 4.0.8 | Incomplete build | T1190 | Ruby version inventory | 4.0.8 still needs the CVE-2026-110264 fix. Move to 4.0.9 or later. |
| Ruby 3.4.12 | Fixed build | T1190 | Ruby version inventory | On the 3.4 line, install 3.4.12 or later. |
| Ruby 3.3.13 | Fixed build | T1190 | Ruby version inventory | On the 3.3 line, install 3.3.13 or later. Ruby calls this an exception during security maintenance. |
| Ruby 3.2 and earlier | Not in the fix table | T1190 | Ruby version inventory | The advisory’s table lists 4.0, 3.4, and 3.3 only. Move older apps to 3.3.13, 3.4.12, or 4.0.9, or stop compiling untrusted patterns. |
Regexp.new | Untrusted compile | T1190 | Application source | Find Regexp.new whose argument can come from a user, a CI file, or an API body. Upgrade, or stop compiling that string. |
Regexp.compile | Untrusted compile | T1190 | Application source | Find Regexp.compile with the same untrusted input. Ruby treats it as a compile path for this bug. |
Regexp.union | Untrusted compile | T1190 | Application source | Find Regexp.union when any argument is attacker-controlled. |
/#{input}/ | Regexp interpolation | T1190 | Application source | Find regexp literals that interpolate a variable. A developer-written literal with no interpolation is outside this bug. |
| GitLab bundled Ruby | Separate fix | T1190 | GitLab package inventory | Upgrade self-managed GitLab to the fixed build for its branch. A host Ruby upgrade does not patch the Ruby GitLab ships. |
Detection
| Source | Rule | Gap |
|---|---|---|
| Splunk ESCU | None — verified | A regexp compile does not match ruby -e with exec and sudo. |
| Elastic | Partial — Suspicious Command Execution via Web Server | Only a ruby web-server parent spawning a shell; in-process Onigmo corruption misses. |
| Sigma | None — verified | A regexp compile does not match a Ruby reverse-shell command line. |
Detection index: ESCU a3f6523 (2026-10-23) · elastic detection-rules 52ef7a0 (2026-10-24) · SigmaHQ 05d1031 (2026-10-21).
Hunt hint: Inventory Ruby with ruby -v on app hosts, CI runners, and container images. Anything below 4.0.9, 3.4.12, or 3.3.13 that passes request or CI text to Regexp.new, Regexp.compile, Regexp.union, or /#{input}/ is the exposure. A worker crash during regexp compile is the host symptom. GitLab’s own rules (org_mode_render_error_burst, onigmo_native_worker_crash) read GitLab’s puma_stderr.log and do not cover a generic Ruby app. Dedicated tenants on 19.3.5-internal0 or 19.4.2-internal0 or later are covered. Self-managed GitLab still needs 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, or 18.11.13. Do not send a crafted pattern at a production process to prove the bug.
Sources: Ruby regexp fixes · GitLab 19.5.1 release · Original GitLab brief
Status Updates
- CVE-2026-114625 (VeloCloud Orchestrator): CISA added this CVE to KEV on 2026-10-23. The due date is 2026-10-26. CISA and the KEV catalog are the second origin for exploitation. Yesterday’s brief treated Arista as the only organization reporting it. Fixed builds are unchanged: 5.2.3.18, 6.1.3.10, and 6.4.2.12. Block 74.82.197.86 and 38.54.50.151. Original brief.
- CVE-2026-110447 (Collabora Online built-in CODE server): CISA added this CVE to KEV on 2026-10-23. The due date is 2026-10-26. CISA. Update
richdocumentscodeto 26.4.303 or remove it withocc app:remove richdocumentscode. Disabling the app leavesproxy.phpreachable. Nextcloud 29 and older must upgrade Nextcloud or remove the app. Standalone Collabora Online is not affected. No new file hash or IP beyond the 15 October brief. Original brief. - eMudhra-CVE-2026-111943 (Okta and Auth0): Okta, dated 23 October, is removing trust in emSign ECC Root CA – G3 and the eight intermediates across Okta and Auth0. Okta reports no evidence of exploitation. Sign-in to Okta and Auth0 is unaffected. Check outbound hooks you control (Okta Inline Hook, Event Hook, Auth0 Action, Custom Database, Federated Connection) with
openssl s_client -showcerts -connect <your-host>:443and look foremSign. Replace that certificate. Yesterday. - eMudhra-CVE-2026-111943 (Chrome root): Chrome is removing emSign ECC Root CA – G3 from the Chrome Root Store. The removal is expected Tuesday morning 27 October 2026 PDT, and sooner on Canary and Beta. Okta says Mozilla has already removed that root. Site owners with a certificate that chains to this root need a certificate from another hierarchy. This is the root, separate from yesterday’s eight intermediate SPKI hashes.
- eMudhra-CVE-2026-111943 (Cisco): cisco-sa-emudhra-info-ScS22A1r, version 1.0 Interim, first published 2026 October 23 16:00 GMT. PSIRT is not aware of malicious use. Duo Cloud needs no customer action. Upgrade Duo Access Gateway to 3.2.0, Duo Agentic Authorization Connector to 1.0.1, and Duo Network Gateway to 3.4.1. Application-hosting Agent 5.2.2 was targeted for 23 October. Ultra Cloud Core SMI 2026.04.1 is targeted for November 2026. FMC has the TechZone article “Configure FMC TLS Policy to Block Known eMudhra Certificate Issuers.” A long product list is still under investigation.
- PHP2Shell-CVE-2026-109618 / CVE-2026-109619: Mirai mass scans are attempts, not a confirmed compromise. SecurityWeek, The Hacker News, and CyberWire restate Sophos, Arctic Wolf, and Hunt.io on unsuccessful Potassium attempts. Unit 42 is a separate single-origin signal for one European government case (password hashes, MFA secrets, an NTLM-relay tunnel, a Domain Admin attempt, and
==SHELLUSER==/==PASSWD==batches) and is not in KEV. Google Cloud says Google Cloud itself is not vulnerable. That post is customer guidance, not a compromise report. The 21 October builds still miss CVE-2026-115560 when an app setssession.serialize_handlertophpwithini_set()beforesession_start(). Original brief. Yesterday. - LiteLLM-1.107.0-2026-10: LiteLLM’s attack-chain post, published 23 October, is the timeline for the leaked master key and the
Berri-AIrelease fork. Microsoft has thecook.py,sitecustomize.py, andcook.pthdigests that were not in the 22 October brief. Wheel digests and/tmp/.pc_once_72129118c59f5636c0bbstay in that brief. Microsoft on X. Original brief. - CVE-2026-110264 and CVE-2026-97229 (GitLab): Upstream Ruby now ships the Onigmo fixes in section 2. GitLab’s fixed builds are unchanged. Exploitation of either CVE is still unconfirmed, and neither is in KEV. Original CVE-2026-110264 brief. Original CVE-2026-97229 brief.
- Plex2Shell-CVE-2026-96652: CVE-2026-96654 and CVE-2026-96656 were KEV due 2026-10-23 and are now overdue. CVE-2026-96652 and CVE-2026-96655 are due 2026-11-03. Fixed build remains 1.43.3.10861. Original brief.
- SiteGuard-CVE-2026-106931: KEV added 2026-10-20, not yet briefed. KEV due 2026-10-23 is now overdue. Fixed in Ver8.00 Update5 (Apache, Nginx, IIS) and Ver7.00 Update6 (FreeBSD). KEV catalog · EG Secure.
- KEV deadlines already passed, no new fix or IOC: CVE-2026-102764 (BeyondTrust, due 2026-10-19, brief); CVE-2025-61624 (FortiOS, due 2026-10-19, brief); CVE-2026-21589 (Atlassian, due 2026-10-18, brief); CVE-2026-0257 (PAN-OS GlobalProtect, due 2026-06-01, brief).
- Retired from watch: CVE-2026-105134 (last update 2026-10-16), CVE-2026-76519 (last update 2026-10-15), CVE-2026-0322 (last update 2026-10-16). Each KEV due date of 2026-10-17 is now seven days past, and there is no new fix, IOC set, or exploitation report. Ahsay · Cisco Secure Email Gateway · PAN-OS.
- Watching (no change): TimeSmuggler-NetScaler-2026-10 (10-23); ConnectWise-CloudBackup-SkyKick-2026-10 (10-22, original 10-17); CVE-2026-105192 (10-22); Siemens-Software-Center-CVE-2026-110936 (10-21, KEV due 2026-11-03, fixed 4.0.9.8); CVE-2026-102255 (10-15); CVE-2026-85097 (10-09); CVE-2026-107406 (10-09); GhostAction-2026-10 (10-10); CVE-2026-82077 (10-11); CyberXero-2026-10 (10-12); Danfoss-AKSM-FROMAGEGATE-2026-10 (10-13); UNC7017-AOMEI-2026-10 (10-17); Candiru-AdFection-DiscoverTech-2026-10 (10-18); InfinityCore-2026-10 (10-18); UpdraftCentral-2026-10 (10-19); OVHcloud-CLI-2026-10 (10-20); RankMath-SEO-Pro-3.0.123 (10-20).