Cyber Threat Brief — October 29 2026
⚠️ This report is AI-generated. Always validate findings.
1. Fragnesia — CVE-2026-46300
TL;DR: CISA added CVE-2026-46300 on 28 October, due 31 October 2026. Boot a fixed kernel, and read /etc/pam.d/su before that reboot.
What’s New:
- CISA added CVE-2026-46300 on 28 October, due 31 October 2026, and BOD 26-04 forensic triage applies.
- The KEV note says the bug can be chained with CVE-2026-109618 and CVE-2026-109619 to implant a PHP webshell and run commands as root.
- Dream’s 26 October writeup says the chain overwrites the page-cache copy of
/etc/pam.d/suso it loadspam_permit.so. - Dream assesses Chinese-nexus indicators and says it does not name a threat actor.
Actionable Intel
| Artifact | Type | ATT&CK | Log Source | Action |
|---|---|---|---|---|
| Linux 5.10.257 | Fixed kernel | T1068 | uname -r | On the 5.10 line, boot 5.10.257 or later. The kernel CVE announce lists that version as fixed. |
| Linux 5.15.208 | Fixed kernel | T1068 | uname -r | On the 5.15 line, boot 5.15.208 or later. The kernel CVE announce lists that version as fixed. |
| Linux 6.1.174 | Fixed kernel | T1068 | uname -r | On the 6.1 line, boot 6.1.174 or later. Debian 12’s first fixed package is linux 6.1.174-1. |
| Linux 6.6.141 | Fixed kernel | T1068 | uname -r | On the 6.6 line, boot 6.6.141 or later. The kernel CVE announce lists that version as fixed. |
| Linux 6.12.91 | Fixed kernel | T1068 | uname -r | On the 6.12 line, boot 6.12.91 or later. The kernel CVE announce lists that version as fixed. |
| Linux 6.18.33 | Fixed kernel | T1068 | uname -r | On the 6.18 line, boot 6.18.33 or later. The kernel CVE announce lists that version as fixed. |
| Linux 7.0.10 | Fixed kernel | T1068 | uname -r | On the 7.0 line, boot 7.0.10 or later. The kernel CVE announce lists that version as fixed. |
| Ubuntu 22.04 linux 5.15.0-181.191 | Fixed package | T1068 | uname -r | On Ubuntu 22.04, install linux 5.15.0-181.191 or later. uname -r will not match upstream 5.15.208. |
| Ubuntu 24.04 linux 6.8.0-124.124 | Fixed package | T1068 | uname -r | On Ubuntu 24.04, install linux 6.8.0-124.124 or later. uname -r will not match an upstream stable number. |
| Ubuntu 25.10 linux 6.17.0-35.35 | Fixed package | T1068 | uname -r | On Ubuntu 25.10, install linux 6.17.0-35.35 or later. Ubuntu’s CVE page lists that package as fixed. |
| Ubuntu 26.04 linux 7.0.0-22.22 | Fixed package | T1068 | uname -r | On Ubuntu 26.04, install linux 7.0.0-22.22 or later. Ubuntu’s CVE page lists that package as fixed. |
| Ubuntu 20.04 linux-hwe-5.15 5.15.0-181.191~20.04.1 | Fixed package | T1068 | uname -r | On Ubuntu 20.04 HWE, install linux-hwe-5.15 5.15.0-181.191~20.04.1 or later. Ubuntu lists that build under Ubuntu Pro. |
| Ubuntu 22.04 linux-hwe-6.8 6.8.0-124.124~22.04.1 | Fixed package | T1068 | uname -r | On Ubuntu 22.04 HWE, install linux-hwe-6.8 6.8.0-124.124~22.04.1 or later. Ubuntu’s CVE page lists that package as fixed. |
| Ubuntu 24.04 linux-hwe-6.17 6.17.0-35.35~24.04.1 | Fixed package | T1068 | uname -r | On Ubuntu 24.04 HWE, install linux-hwe-6.17 6.17.0-35.35~24.04.1 or later. Ubuntu’s CVE page lists that package as fixed. |
| /etc/pam.d/su | PAM config | T1556.003 | Host file read | Before you reboot, read /etc/pam.d/su. If it loads pam_permit.so, treat the host as rooted and save a copy. Dream says the on-disk file can stay untouched, so a reboot erases the evidence. |
| systemd unit containing ssh -R | Persistence | T1543.002 | systemd unit files | Review new units under /etc/systemd/system/ for an ssh process using -R. Dream says an 8-port reverse tunnel was wrapped in a systemd service, and the unit name was not published. |
| /etc/rc.local | Boot hook | T1037.004 | /etc/rc.local | Review /etc/rc.local for an ssh process using -R. Dream says the same tunnel was also hooked there so it survives reboot. |
Detection
| Source | Rule | Gap |
|---|---|---|
| Splunk ESCU | None — verified | No rule names /etc/pam.d/su. |
| Elastic | Partial — Systemd Service Created | Page-cache PAM write is not a file event. |
| Sigma | Partial — Systemd Service Creation | Auditd create misses the page-cache write. |
Detection index: ESCU 70e15c6 (2026-10-28) · elastic detection-rules abc8111 (2026-10-27) · SigmaHQ 05d1031 (2026-10-21).
Hunt hint: Run uname -r and boot the fixed kernel for that line. Before the reboot, read /etc/pam.d/su. If it loads pam_permit.so, treat the host as rooted and save a copy. Review new systemd units and /etc/rc.local for an ssh process using -R. Keep that copy until the host has booted the fixed kernel.
Sources: CISA alert, 28 October · KEV catalog · Dream · Kernel CVE announce · Ubuntu CVE-2026-46300 · Debian tracker · CISA on X
2. ESX logging gap — CVE-2026-41709
TL;DR: CISA added CVE-2026-41709 on 28 October, due 11 November 2026. Install the fixed ESX image for that line, and forward syslog off the host.
What’s New:
- CISA added CVE-2026-41709 on 28 October, due 11 November 2026.
- Broadcom VMSA-2026-0006 says a malicious administrator can perform certain operations without them being logged.
- CrowdStrike’s 28 October report says Warp Panda used this as a zero-day into early 2026 in vCenter cases.
- Broadcom does not name which operations go unlogged.
Actionable Intel
| Artifact | Type | ATT&CK | Log Source | Action |
|---|---|---|---|---|
| ESXi-9.1.0.0-25370933 | Fixed image | T1562 | esxcli system version get | On ESX 9.1, install ESXi-9.1.0.0-25370933. VMSA-2026-0006 lists that image for CVE-2026-41709, and it lists no workaround. |
| ESXi-9.0.2.0100-25595025 | Fixed image | T1562 | esxcli system version get | On ESX 9.0, install ESXi-9.0.2.0100-25595025. VMSA-2026-0006 lists that image for CVE-2026-41709. |
| ESXi80U3j-25429389 | Fixed image | T1562 | esxcli system version get | On ESXi 8.0, install ESXi80U3j-25429389. VMSA-2026-0006 lists that image for CVE-2026-41709. |
| VMware Cloud Foundation 5.2.4 | Fixed release | T1562 | VCF version inventory | On VCF 5.x, move to 5.2.4. VMSA-2026-0006 points at KB88287 for that line. |
| VMware Telco Cloud Platform KB449886 | Fixed guidance | T1562 | Telco Cloud version inventory | On Telco Cloud Platform 5.0.x or 5.1.x, apply the build in KB449886. VMSA-2026-0006 lists that KB for CVE-2026-41709. |
| ESXi 7.0 | Not in response matrix | T1562 | esxcli system version get | ESXi 7.0 is not in the CVE-2026-41709 response matrix. Do not treat a 7.0 build as fixed for this CVE from this advisory. |
Detection
| Source | Rule | Gap |
|---|---|---|
| Splunk ESCU | None — verified | Needs a log line this CVE can skip. |
| Elastic | None — verified | Needs a log line this CVE can skip. |
| Sigma | None — verified | Needs a log line this CVE can skip. |
Detection index: ESCU 70e15c6 (2026-10-28) · elastic detection-rules abc8111 (2026-10-27) · SigmaHQ 05d1031 (2026-10-21).
Hunt hint: Run esxcli system version get and install the fixed image for that line. Run esxcli system syslog config get and confirm a remote host is set. Compare vCenter tasks for that host with hostd logs for the same session. Compare those tasks with the host shell log. If a task has no host log line, keep the off-host syslog.
Sources: CISA alert, 28 October · KEV catalog · Broadcom VMSA-2026-0006 · CrowdStrike legal threat landscape
3. KeyDrift — CVE-2026-20127
TL;DR: Talos says UAT-11473 used CVE-2026-20127, in KEV since 25 February 2026, to put KeyDrift on Catalyst SD-WAN controllers. Upgrade the train in the table, then look for /etc/sv/aaamgr/.
What’s New:
- Talos on 28 October says UAT-11473 injected PolyFlame into
vdaemonafter using CVE-2026-20127. - LittleFilch hooks
SSL_readinvdaemonand writes encrypted keying material to/var/tmp/vdaemon.bin. - Cisco’s advisory, updated 28 October, says there is no workaround.
- Talos says UAT-11473 infrastructure overlaps Volt Typhoon’s Silent Train, and Lumen separately says Volt Typhoon used this CVE.
Actionable Intel
| Artifact | Type | ATT&CK | Log Source | Action |
|---|---|---|---|---|
| Cisco Catalyst SD-WAN earlier than 20.9 | Vulnerable train | T1190 | Controller version inventory | On a release earlier than 20.9, migrate to a fixed release in this table. Cisco says there is no workaround that fixes this. |
| Cisco Catalyst SD-WAN 20.9.8.2 | Fixed release | T1190 | Controller version inventory | On the 20.9 train, install 20.9.8.2. Cisco’s 28 October advisory lists that release as the first fix. |
| Cisco Catalyst SD-WAN 20.11 | End of software maintenance | T1190 | Controller version inventory | 20.11 is end of software maintenance. Migrate to 20.12.6.1. |
| Cisco Catalyst SD-WAN 20.12.5.3 | Fixed release | T1190 | Controller version inventory | On the 20.12 train, 20.12.5.3 is a first fixed release. Confirm the build on the controller before you install it. |
| Cisco Catalyst SD-WAN 20.12.6.1 | Fixed release | T1190 | Controller version inventory | On the 20.12 train, 20.12.6.1 is also a first fixed release. Cisco lists it next to 20.12.5.3. |
| Cisco Catalyst SD-WAN 20.13 | End of software maintenance | T1190 | Controller version inventory | 20.13 is end of software maintenance. Migrate to 20.15.4.2. |
| Cisco Catalyst SD-WAN 20.14 | End of software maintenance | T1190 | Controller version inventory | 20.14 is end of software maintenance. Migrate to 20.15.4.2. |
| Cisco Catalyst SD-WAN 20.15.4.2 | Fixed release | T1190 | Controller version inventory | On the 20.15 train, install 20.15.4.2. Cisco’s 28 October advisory lists that release as the first fix. |
| Cisco Catalyst SD-WAN 20.16 | End of software maintenance | T1190 | Controller version inventory | 20.16 is end of software maintenance. Migrate to 20.18.2.1. |
| Cisco Catalyst SD-WAN 20.18.2.1 | Fixed release | T1190 | Controller version inventory | On the 20.18 train, install 20.18.2.1. Cisco’s 28 October advisory lists that release as the first fix. |
| /etc/sv/aaamgr/ | Runit service path | T1543 | Controller filesystem | List /etc/sv/aaamgr/. Talos says a PolyFlame variant runs there as aaamgrd with a modified run launcher. |
| conf_sshd | Launcher script | T1059 | sshd runit script | Look for conf_sshd in the sshd run script. Talos says that script remounts /rootfs.rw executable and starts conf_sshd before sshd. |
| /tmp/system-vdaemon | PID list | T1055 | Controller filesystem | Look for /tmp/system-vdaemon. Talos says the loader records vdaemon PIDs there before injection. |
| libdssl.so | Injected library | T1055 | Process memory or file inventory | Look for libdssl.so injected into vdaemon. Talos says the injector rsshd loads that library into each vdaemon process. |
| /var/tmp/vdaemon.bin | Staged keying material | T1005 | Controller filesystem | Look for /var/tmp/vdaemon.bin. Talos says LittleFilch RSA-encrypts keying material into that file. |
| /var/tmp/vdaemon.conf | LittleFilch config | T1005 | Controller filesystem | Look for /var/tmp/vdaemon.conf. Talos says LittleFilch deletes it after reading two host and port lines, and Talos did not recover the file. |
| Accepted publickey for vmanage-admin | Auth log line | T1078 | /var/log/auth.log | In /var/log/auth.log, review Accepted publickey for vmanage-admin from an unknown source. Cisco’s advisory asks for that check. |
| Snort SID 65938 | Vendor signature | N/A | Cisco Snort | Enable Snort SID 65938. Talos lists it for CVE-2026-20127. |
| Snort SID 65958 | Vendor signature | N/A | Cisco Snort | Enable Snort SID 65958. Talos lists it for CVE-2026-20127. |
| Snort v2 SID 67387 through 67416 | Vendor signature | N/A | Cisco Snort | Enable Snort v2 SIDs 67387 through 67416. Talos lists that block for the KeyDrift artifacts. |
| Snort v3 SID 7:44 through 7:73 | Vendor signature | N/A | Cisco Snort | Enable Snort v3 SIDs 7:44 through 7:73. Talos lists that block for the KeyDrift artifacts. |
Detection
| Source | Rule | Gap |
|---|---|---|
| Splunk ESCU | Partial — Cisco SD-WAN Multiple Source IP vManage Admin SSH Authentication | Misses /etc/sv/aaamgr/ and vdaemon.bin. |
| Elastic | None — verified | No rule names vdaemon or aaamgr. |
| Sigma | None — verified | No rule names vdaemon or aaamgr. |
Detection index: ESCU 70e15c6 (2026-10-28) · elastic detection-rules abc8111 (2026-10-27) · SigmaHQ 05d1031 (2026-10-21).
Hunt hint: Match the controller release to the fixed train in the table. List /etc/sv/aaamgr/. Look for conf_sshd in the sshd run script. Look for /tmp/system-vdaemon and /var/tmp/vdaemon.bin. If either file is present, isolate the controller and open a Cisco TAC case.
Sources: Talos UAT-11473 KeyDrift · Cisco SD-WAN advisory · Lumen Silent Train · KEV catalog
Status Updates
- PHP2Shell (CVE-2026-109618): KEV is due today, 29 October 2026, and goes overdue tomorrow. Palo Alto’s 29 October advisory update adds more released hotfixes, and 11.1.7-h12 is still ETA 30 October. GreyNoise saw its first successful sensor hit on 28 October at 05:14 UTC. Any rooted host should get the section 1
/etc/pam.d/sucheck before reboot. 28 October brief. Palo Alto CVE-2026-109618. KEV catalog. GreyNoise. - CVE-2026-97229 (Alpine GitLab): Alpine’s 28 October post says an attacker tried this CVE on 20 and 21 October against its GitLab 19.3.4 server, with no evidence that code ran. GitLab 19.3.6 alone did not apply the Onigmo fix on stock Ruby, so repull
alpinelinux/gitlab:19.3.6from 27 October, which ships Ruby 3.3.13. 24 October brief. Alpine post. - Ruby-Onigmo-2026-10-23: The same Alpine post says a GitLab install that uses its own Ruby needs 3.3.13, 3.4.12, or 4.0.9. Alpine 3.22, 3.23, 3.24, and edge ship Ruby 3.4.12. Alpine 3.21 ships Ruby 3.3.13. 4.0.8 is still an incomplete fix. 24 October brief.
- eMudhra (macOS CLI): Apple’s support article, published 23 October, says
curl,git,python3,ruby,perl, andopensslstill check/etc/ssl/cert.pemand can accept certificates that chain to roots in that file until a later OS update. Safari and Mail do not use that file. 23 October brief. Apple 149555. - eMudhra (AWS): AWS bulletin 2026-150, last updated 28 October 2026, says CloudFront root removal targeted 2026-10-28, so an origin that chains to AAA Certificate Services, emSign Root TLS CA – G3, or emSign ECC Root CA – G3 may now fail TLS. OIDC/JWT load balancers update 2026-10-29 through 2026-10-31, and Lambda ZIP runtimes by 2026-10-31. 27 October brief.
- Tailscale SSH: The client fix remains v1.104.4. headscale v0.29.6, published 24 October, pins the Tailscale dependency to v1.102.0 and does not fix TS-2026-014 through TS-2026-017. The Tailscale bulletins still do not list a headscale build. 28 October brief. headscale v0.29.6. Tailscale security bulletins.
- CVE-2026-114625 (VeloCloud Orchestrator): KEV due 2026-10-26 remains overdue. Fixed builds remain 5.2.3.18, 6.1.3.10, and 6.4.2.12. Block 74.82.197.86 and 38.54.50.151. BOD 26-04 forensic triage is required. No new IOC set. Original brief. KEV catalog.
- CVE-2026-110447 (Collabora Online built-in CODE server): KEV due 2026-10-26 remains overdue. Update
richdocumentscodeto 26.4.303 or remove it withocc app:remove richdocumentscode. Disabling the app leavesproxy.phpreachable. Nextcloud 29 and older must upgrade Nextcloud or remove the app. Standalone Collabora Online is not affected. This CVE has not had its own section. BOD 26-04 forensic triage is required. Original brief. KEV catalog. - Plex2Shell-CVE-2026-96652: CVE-2026-96654 and CVE-2026-96656 were KEV due 2026-10-23 and remain overdue. CVE-2026-96652 and CVE-2026-96655 are due 2026-11-03. Fixed build remains 1.43.3.10861. BOD 26-04 forensic triage is required on the overdue entries. Original brief.
- SiteGuard-CVE-2026-106931: KEV added 2026-10-20, not yet briefed. KEV due 2026-10-23 remains overdue. Fixed in Ver8.00 Update5 (Apache, Nginx, IIS) and Ver7.00 Update6 (FreeBSD). BOD 26-04 forensic triage is required. KEV catalog · EG Secure.
- Retired from watch: CVE-2026-102255, Danfoss-AKSM-FROMAGEGATE-2026-10 (last update 2026-10-15). No new fixed build or IOC set. SonicWall brief. Danfoss brief.
- Watching (no change): LiteLLM-1.107.0-2026-10 (10-22); CVE-2026-110264 (10-22); CVE-2026-105192 (10-22); Siemens-Software-Center-CVE-2026-110936 (10-21, KEV due 2026-11-03, fixed 4.0.9.8); GhostAction-2026-10 (10-10); UNC7017-AOMEI-2026-10 (10-17); Candiru-AdFection-DiscoverTech-2026-10 (10-18); InfinityCore-2026-10 (10-18); UpdraftCentral-2026-10 (10-19); OVHcloud-CLI-2026-10 (10-20); RankMath-SEO-Pro-3.0.123 (10-20); ConnectWise-CloudBackup-SkyKick-2026-10 (10-22, original 10-17); TimeSmuggler-NetScaler-2026-10 (10-23); CVE-2026-111497 (10-28, KEV due 2026-11-10, Node 22.23.4 / 24.22.1 / 26.12.1); CVE-2026-48356 (10-28, KEV due 2026-11-10).