Wednesday
2026-11-04Your source for daily security alerts from some of the best experts in the world.
Find the problems, secure your systems now!
Get these alerts in your inbox every morning. Subscribe
CONTENTS
MSRC Unclassified ( 29 )
TLDR InfoSec ( 2 )
Krebs On Security
Hacker News ( 29 )
Check Point Research ( 2 )
Bleeping Computer ( 15 )
CISA
Cisco Advisories ( 2 )
DataBreaches.net ( 10 )
Huntress Blog ( 3 )
Alexander Popov
CVEMon Intruder ( 10 )
Mozilla Attack & Defense
Hacking Lab
Schneier on Security ( 2 )
Securelist ( 2 )
Talos – Vulnerability Reports ( 2 )
Troy Hunt
WeLiveSecurity ( 2 )
Zero Day Initiative-Published ( 21 )
Microsoft-Azure Network Security
Veeam
MSRC Unclassified
11/03 TOC Mariner – Forge: X.509 basicConstraints bypass in verifyCertificateCha…
11/03 TOC Mariner – Forge: PKCS#12 MAC forgery and constant-key PBE via zero ite…
11/03 TOC Mariner – Forge: Certificate signature verified with the issuer’s RSA …
11/03 TOC Mariner – Forge: Prototype Pollution in forge.http cookie handling via…
11/03 TOC Mariner – Forge: TLS client crash when the server sends no certificate…
11/03 TOC Mariner – Dnsmasq: dnsmasq: tftp prefetch cache keyed on stale heap po…
11/03 TOC Mariner – Dnsmasq: dnsmasq: tcp/53 child-slot exhaustion starves dnsse…
11/03 TOC Mariner – Dnsmasq: dnsmasq: heap out-of-bounds write in dnssec validat…
11/03 TOC Mariner – Dnsmasq: dnsmasq: out-of-bailiwick cache injection through c…
11/03 TOC Mariner – Dnsmasq: dnsmasq: –leasequery without address argument appl…
11/03 TOC Mariner – Dnsmasq: dnsmasq: heap out-of-bounds read in dhcpv6 option 3…
11/03 TOC Mariner – Gcc: stack overflow in std::bitset on libstdc++ CVE-2026-115…
11/03 TOC Mariner – Gcc: confirmed out-of-bounds read/write in libstdc++ paralle…
11/03 TOC Mariner – Gcc: integer wrap in `std CVE-2026-114691
11/03 TOC Mariner – Glib-networking: unbounded tls 1.3 session ticket queue grow…
11/03 TOC Mariner – HTTP::Tiny versions before 0.093 for Perl do not validate CR…
11/03 TOC Mariner – HTTP::Tiny versions before 0.095 for Perl forward credential…
11/03 TOC Mariner – Python-Markdown 3.0 through 3.11.2 Denial of Service via Lin…
11/03 TOC Mariner – pyasn1: Quadratic CPU use in schemaless BER/CER/DER containe…
11/03 TOC Mariner – Forge: X.509 pathLenConstraint not enforced by verifyCertifi…
11/03 TOC Mariner – Forge: ASN.1 OID first arc truncation in asn1.oidToDer CVE-2…
11/03 TOC Mariner – Forge: Regular expression denial of service in PEM decoding …
11/03 TOC Mariner – Forge: Denial of service in TLS record processing via call s…
11/03 TOC Mariner – Forge: AES-GCM authentication bypass via unvalidated tagLeng…
11/03 TOC Mariner – Forge: Denial of service in TLS record processing via a reco…
11/03 TOC Mariner – Forge: Incomplete PKCS#7 padding validation in AES/DES CBC a…
11/03 TOC Mariner – Forge: ASN.1 resource exhaustion via BIT STRING decoding in …
11/03 TOC Mariner – Forge: Denial of Service via infinite loop in BigInteger.mod…
11/03 TOC Mariner – Forge: verifyCertificateChain() removes trusted CA certifica…
TLDR InfoSec
11/02 TOC EU freezer cyberattack , Langflow critical RCE , Steam Platform RCE
11/01 TOC Cursor Claude Malware , VOLTA AI infostealer , Finding Encrypted USB b…
Krebs On Security
11/02 TOC Tech Firms Dismantle Botnet That Turned 1.3M TV Boxes Into Proxies
Google said today it worked with industry partners to dismantle a botnet made up of more than 1.3 million Android TV set-top boxes that ship with malicious software which secretly rents the user’s Internet connection out to strangers and conducts advertising fraud. Experts involved in the takedown say the action is likely to sever the botnet’s access to more than 10 million additional compromised systems, including other Internet of Things (IoT) products such as Android-based healthcare devices and karaoke machines.Hacker News
11/04 TOC Russian Police Arrest 3 Suspected VasyGrek Hackers, Dismantle Criminal…
Russian authorities have arrested three suspected members of a threat group known as VasyGrek and dismantled its criminal infrastructure. Also known as Fluffy Wolf, the threat actor has a history of targeting Russian and international companies since 2016. The Ministry of Internal Affairs of the Russian Federation (MVD) said members of the group are “suspected of embezzling funds from the11/04 TOC Google Issues Patches for Critical Android Flaw That Could Allow RCE W…
A critical Android flaw could allow an attacker to run code on a phone without any user action remotely, Google said in its November security bulletin. The flaw, CVE-2026-58868, affects Android 14 through 17. Phones get the fix with security patch level 2026-11-01 or later, which phone makers and carriers send on their own schedules. As of November 4, Google’s bulletin did not report11/03 TOC CISA Confirms Hackers Exploiting WordPress Core Flaw During Software U…
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a security flaw in WordPress Core to the Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation. The high-severity vulnerability, tracked as CVE-2026-119977 (CVSS score: 8.1), is a case of Time-of-check Time-of-use (TOCTOU) race condition that could be exploited to achieve arbitrary code11/03 TOC mSecure Warns Users to Change Passwords, Reset 2FA and Passkeys After …
Customers of the mSecure password manager are being urged to act now to protect the confidential information they store in it, possibly by changing passwords, resetting two-factor authentication (2FA), and removing passkeys. The warning came in an email sent on November 3 in the name of developer mSeven Software. It says the company recently learned of suspicious activity linked to the app but11/03 TOC Chainstack Reports Production Systems Breach Exposing Customer Data an…
Blockchain infrastructure provider Chainstack on Tuesday disclosed that it was targeted in a cyber attack that allowed an unauthorized party to gain access to some parts of its infrastructure. The incident is assessed to be part of a large-scale, artificial intelligence (AI)-powered attack campaign that came to light last week. “An external attacker gained unauthorized access to part of11/03 TOC Binance Reveals How Fake Job Interviews and AI Tool Abuse Led to $6.43…
Binance on Tuesday said the record-setting theft of $6.43 billion in assets from the world’s largest cryptocurrency exchange was the culmination of a “sophisticated, multi-stage campaign” that involved the use of a tampered Homebrew installation and recruitment-themed social engineering attack targeting two of its engineers. “It was not a single isolated breach or a simple phishing incident,”11/03 TOC Barracuda Flaws Could Be Chained to Bypass Authorization and Gain Root…
Barracuda has disclosed details of two vulnerabilities affecting its products that, if chained together, could allow an attacker to bypass authorization controls and gain root access to a susceptible device. The vulnerabilities, a pre-authentication authorization bypass vulnerability and a command injection vulnerability, have been assigned the CVE identifiers CVE-2026-116606 (CVSS score: 9.3)11/03 TOC Google Warns LLMjacking Attacks Are Costing Some Enterprises Up to $1 …
Google on Monday warned that threat actors are hijacking enterprise access to Large Language Models (LLMs) to fraudulently leverage expensive computing resources and AI services. The tactic is called LLMjacking, a form of resource hijacking adapted for the LLM era, where an attacker obtains an API key through phishing, source code leaks, misconfigured environments, or exposed client-side code11/03 TOC cPGuard Update Channel Hijacked to Backdoor Linux Servers and Collect …
An attacker broke into the update system of the cPGuard security tool on November 2 and used it to send a malicious script to customers’ Linux servers. The script installed a backdoor and collected password hashes and other sensitive files from servers that ran it, cPGuard maker OPSSHIELD said in an advisory. The attacker has since taken some of that data. cPGuard 5.88.25 and later versions11/03 TOC Red Hat Patches 9.8-Rated Linux TCP RCE Flaw While Ubuntu Releases Fix…
Fixed kernels for a use-after-free vulnerability in the Linux kernel’s IPv4 TCP code are now available for Red Hat Enterprise Linux 8, 9, and 10, while Ubuntu’s fixes for its three newest long-term-support releases remain in its opt-in testing channel with no date for a regular update. The flaw, tracked as CVE-2026-98432, can be reached by a remote, unauthenticated attacker and can11/03 TOC The 4 Elements of Exposure Prioritization and How to Operationalize Th…
Your team is remediating more vulnerabilities than ever, yet your breach risk has barely changed. You’re spending too much time and effort on exposures attackers may never exploit, while higher-risk exposures sit, waiting in the queue. Gartner®’s report on exposure prioritization states that fewer than 10% of vulnerabilities are exploited, yet most are treated as urgent. The report also argues11/03 TOC Russia-Aligned Gorbag Hackers Exploit WinRAR Flaw to Deploy Data-Steal…
A Russia-aligned threat actor known as Gorbag has been observed using simple information stealer malware in attacks targeting Ukrainian organizations. “Active since at least February 2025, the group has focused exclusively on Ukrainian targets, with a clear preference for law enforcement and justice entities, local administrations near the front line, and the defense sector,” ESET researcher11/03 TOC Hackers Exploit BTCPay Server Flaw to Steal Bitcoin and Litecoin From …
BTCPay Server, a self-hosted, open-source cryptocurrency payment processor, has urged users to install the latest version of its software in response to reports of Bitcoin and Litecoin being stolen from hot wallets on instances running older versions. “Our investigation found that these attacks targeted servers running BTCPay Server 2.4.1 (released on 23 July 2026) or earlier,” BTCPay Server11/03 TOC Synology NAS Devices Targeted in Ransomware Attacks Exploiting Patched…
Synology is urging customers to update the DiskStation Manager (DSM) software powering its Network Attached Storage (NAS) devices following ransomware attacks. The Taiwanese vendor said it observed threat actors exploiting a vulnerability patched in December 2024 to target devices running outdated versions of DSM. “These attacks aim to encrypt data and extort ransom,” it said in a statement11/03 TOC New Wave of Refrigeration Cyberattacks Hits Supermarkets Across Europe…
Attackers remotely changed the settings on refrigeration controls at supermarkets in Belgium, Sweden, Estonia and other European countries overnight into Monday, November 2, warming fridges and freezers. No chain reported more than several dozen affected stores, and some had to throw away chilled and frozen food or take it off the shelf. Danfoss, a Danish maker of refrigeration controls, 11/02 TOC Attackers Exploit Critical Siemens IoT2050 Flaw to Plant Remote Comman…
A maximum-severity security flaw impacting Siemens SIMATIC IoT2050 Advanced devices has come under active exploitation, VulnCheck has revealed. The vulnerability, tracked as CVE-2026-58115 (CVSS score: 10.0), is a case of missing authentication for a critical function that could be exploited by an unauthenticated remote attacker to run arbitrary code. “SIMATIC IoT2050 Advanced devices running11/02 TOC Attackers Target Unpatched CryptoPayment Gateway Flaw That Can Expose …
Threat actors are attempting to exploit an unpatched maximum-severity security vulnerability in the CryptoPayment Gateway WordPress plugin, according to findings from Defused Cyber. The vulnerability in question is CVE-2026-81648, which carries a CVSS score of 10.0. Successful exploitation of the flaw could permit unauthenticated users to delete arbitrary files on the server and extract11/02 TOC Weekly Recap: Critical CVEs, Linux DDoS Botnet, Device-Code Phishing, …
Some attacks this week didn’t need much of a trick. A fake support call, a trusted extension, a shared link, or a device with no password. Small things that people barely think about. Yet each was enough to cause serious trouble. Then there were the bigger messes. Billions stolen, hidden networks of hacked devices, poisoned software, and attackers finding new ways to turn normal tools against11/02 TOC Google Disrupts 1.3 Million-Device Android Botnet, Says TV Box Maker S…
A botnet of more than 1.3 million Android devices, mostly TV set-top boxes, lost control of its servers in late October in a takedown led by Google. Google says it is highly confident that device maker Videostrong intentionally put a backdoor in the boxes and sold access to criminals. They used the boxes for ad fraud and to pass other people’s internet traffic through owners’ home11/02 TOC DarkBlinders Compromises Israeli Target and Iraqi Kurdish Government C…
Cybersecurity researchers have disclosed details of a cyber espionage campaign targeting Israel and the Kurdistan Region of Iraq by an Iran state-aligned threat actor between August and October 2026. According to a report published by Dream Research Labs, the campaign has led to the compromise of a high-profile individual in Israel, along with additional compromises affecting a government cloud11/02 TOC Critical Langflow Flaws Could Let Unauthenticated Attackers Run Code o…
Two critical flaws in Langflow could let a remote attacker with no account bypass authentication or run arbitrary code, IBM said last week. Langflow is an open-source tool for building AI agents and workflows, and its vulnerability reports go to IBM. Every release from 1.0.0 through 1.12.8 has the flaws, and the only fix is version 1.13.0. Neither flaw is in CISA’s Known11/02 TOC Is Your SOC Ready for AI Agents? A Maturity Check Before You Deploy
Forty percent of security teams now use AI every day, and another 56% are testing it. Only 4% have no plans to adopt it, according to Prophet Security’s State of AI in Security Operations 2026 survey of more than 250 CISOs, SOC leaders and practitioners. For the teams still testing, the next decision is whether their own SOC is ready. AI SOC readiness has two parts: whether a SOC has the11/02 TOC Attackers Pose as IT Support on Microsoft Teams, Abuse AD CS to Steal …
Attackers posing as IT support on Microsoft Teams talked employees into giving them remote control of their PCs. They then used insecure Active Directory Certificate Services (AD CS) settings to obtain login certificates for privileged accounts, including one for a domain controller. Microsoft said in a report that it investigated two such intrusions, one of which resulted in company11/02 TOC Government Linux Servers Targeted With SysGoRAT and Suspected AI-Gener…
Cybersecurity researchers have disclosed details of a cyber espionage campaign specifically targeting Linux infrastructure associated with government entities and state-affiliated infrastructure. The activity, observed by Palo Alto Networks Unit 42 between October 2025 and April 2026, has been tracked under the moniker CL-UNK-1211, where “CL” refers to cluster and “UNK” stands for unknown11/01 TOC New VOLTA Infostealer Uses Claude, Gemini, and Kimi AI to Rank Victims…
Cybersecurity researchers have discovered a new Windows infostealer malware called VOLTA-AUTODOXER (aka VOLTA) that makes use of a large language model (LLM) to rank a victim’s stolen data by their monetization value. Like other typical stealer families, VOLTA is equipped to harvest passwords and cookies from Chromium-based web browsers; data from Outlook profiles and Slack workspaces;11/01 TOC CVSS 10.0 LXD, MicroCloud Flaw Lets Attackers Impersonate Trusted Clie…
A critical flaw in Canonical’s LXD and MicroCloud let an attacker log in as a trusted client without holding that client’s private key. To do it, the attacker had to reach their HTTPS API over the network and have the trusted client’s public certificate. Once in, the attacker would act as that client, with access to the cluster and its virtual machines. If the impersonated account is11/01 TOC Hackers Steal About $2.7 Million From Polymarket Traders via Hijacked …
Malicious code on the website of prediction market Polymarket sold some signed-in traders’ positions and moved their funds to the hackers on October 29. The code had replaced a page-speed script that the site loaded from an outside company. Polymarket says it is refunding about $2.7 million to 726 affected wallets. Blockchain records show crypto worth about $2.64 million reached11/01 TOC FBI Links North Korea’s TraderTraitor to Record $6.43 Billion Binance …
The U.S. Federal Bureau of Investigation (FBI) has officially attributed the theft of more than $6 billion in virtual assets from Binance to TraderTraitor, a North Korea-aligned elite hacking group also tracked as Jade Sleet, Pressure Chollima, PUKCHONG, Slow Pisces, and UNC4899. The FBI, along with the U.S. Secret Service (USSS) and the Internal Revenue Service Criminal Investigation (IRS-CI),11/01 TOC NetamLoader Malware Targets Government Windows 10 Systems in Asia via …
Cybersecurity researchers have disclosed details of what has been described as a “highly sophisticated infection chain” targeting government organizations in Asia. The activity, detailed by Kaspersky this week, targeted a custom Windows 10 build used exclusively by government entities in Asia and involves the deployment of a previously undocumented .NET assembly-loading framework codenamedCheck Point Research
11/03 TOC Free the Model, Sell the Gateway: Prompt Adware hidden in Jailbreak Bu…
11/02 TOC 2nd November Threat Intelligence ReportKey Points Free the Model, Sell the Gateway: Prompt Adware hidden in Jailbreak Bundles Check Point Research found a misconfigured webserver of a threat actor operating the Cobalt Strike framework. Besides an open Cobalt Strike server, whose logs showed the actor compromising various private computers of Chinese speaking individuals, other tools from the toolkit of […]
The post Free the Model, Sell the Gateway: Prompt Adware hidden in Jailbreak Bundles appeared first on Check Point Research.
For the latest discoveries in cyber research for the week of 2nd November, please download our Threat Intelligence Bulletin. TOP ATTACKS AND BREACHES Binance, a global cryptocurrency exchange, has suffered a cyberattack resulting in the theft of approximately $6.3 billion in digital assets. Attackers reportedly compromised a DevOps engineer’s laptop and abused internal wallet infrastructure […]
The post 2nd November – Threat Intelligence Report appeared first on Check Point Research.
Bleeping Computer
11/04 TOC Hackers use n-day exploits in zero-click attacks on iOS, Android devic…
A large-scale watering hole attack associated with Russian hackers has been targeting iOS and Android users visiting compromised sites or fake ones impersonating legitimate portals. […]11/03 TOC Hackers hijack cPGuard autoupdate to deploy backdoor, steal data
Attackers have compromised the update infrastructure for the cPGuard web security suite to distribute a backdoor and a data-stealing script. […]11/03 TOC WorkOS says attacker used ARTEX AI to breach internal sales app
Developer platform WorkOS suffered a data breach after a threat actor accessed business contact records and summaries of customer communications. […]11/03 TOC Binance says fake job interview led to $6.3 billion crypto heist
Cryptocurrency exchange Binance says North Korean hackers used a fake job interview to trick an employee into installing malware that ultimately let them compromise the company’s wallet infrastructure and steal about $6.34 billion in digital assets. […]11/03 TOC Google: LLMjacking attacks rack up $1 million in cloud AI charges
Large language model hijacking attacks, also known as LLMjacking, are generating large fraudulent cloud charges, with some organizations losing more than $100,000 per day. […]11/03 TOC Barracuda warns of critical flaws allowing root access to devices
Cybersecurity company Barracuda Networks warned customers to patch two vulnerabilities that can let attackers run commands with root privileges. […]11/03 TOC Gartner Predicts SOCs Will Have 50% More Engineers Than Analysts by 20…
Gartner predicts that security operations centers will have 50% more engineers than analysts by 2028 as AI agents take over routine alert handling. Prophet Security examines how AI is reshaping SOC roles, from analyst responsibilities and detection engineering to threat hunting and exposure management. […]11/03 TOC UK school estate hit by 3AM ransomware in suspected AI-assisted attack…
A 3AM ransomware affiliate targeted a school estate in the UK and successfully encrypted around 37 of nearly 50 machines reached from an unmanaged host. […]11/03 TOC Police seizes over 100 servers in investment scam crackdown
European law enforcement authorities arrested seven suspects and seized more than 100 servers in a joint action targeting an unnamed company suspected of providing fraudulent trading websites to criminal gangs. […]11/03 TOC Google adds new $250,000 Cloud VRP reward for Root-in-Cloud bugs
Google has expanded its Cloud Vulnerability Reward Program (VRP) with a new top-tier reward for high-impact architectural security flaws. […]11/03 TOC Harvard University data breach exposed info of 851,000 accounts
Hackers who breached Harvard University’s Alumni Affairs and Development systems in November 2025 stole data linked to more than 850,000 unique email addresses, according to breach notification service Have I Been Pwned. […]11/02 TOC Chinese hackers use ARTEX AI in automated attacks against 200 orgs
Chinese hackers used ARTEX, an open-source, multi-agent AI penetration-testing framework, in attacks against more than 200 organizations across 14 countries. […]11/02 TOC Fintech platform Sageworks taken offline after suspected cyberattack
Financial technology company Abrigo has restored its Sageworks risk management application, except for borrower-facing capabilities, following an outage triggered by “irregular activity” in its environment. […]11/02 TOC Google disrupts million-device XCPE Android malware botnet, bans TV bo…
Google and industry partners have dismantled the XCPE malware botnet consisting of more than 1.3 million Android TV streaming TV boxes that Google says its manufacturer intentionally infected with malware to generate revenue through cybercrime activities. […]11/02 TOC BTCPay Server warns of hot wallet crypto thefts on outdated instances
The maintainer of BTCPay Server, an open-source cryptocurrency payment processor, has urged users to install the latest version as hackers have been draining “hot wallets” on instances running older versions. […]CISA
11/03 TOC Subnet Solutions PowerSYSTEM Center
Summary
Successful exploitation of these vulnerabilities could allow an attacker to execute unauthorized SQL commands and gain access to unauthorized resources.
The following versions of Subnet Solutions PowerSYSTEM Center are affected:
- PowerSYSTEM Center 2020 <=5.29.x (CVE-2026-63017)
- PowerSYSTEM Center 2024 >=6.0.x|<=6.2.x (CVE-2026-63017, CVE-2026-63774)
- PowerSYSTEM Center 2026 >=7.0.x|<=7.1.x (CVE-2026-63017, CVE-2026-63774)
CVSS Vendor Equipment v3 9 Subnet Solutions PowerSYSTEM Center
2 Vulnerabilities Incorrect Authorization, Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) Background
- Critical Infrastructure Sectors: Critical Manufacturing, Energy
- Countries/Areas Deployed: Worldwide
- Company Headquarters Location: Canada
Vulnerabilities
Acknowledgments
- Chinmay Patel of Digital Boundary Group reported these vulnerabilities to CISA.
- Subnet Solutions reported these vulnerabilities to CISA.
Recommended Practices
CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities.
- Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet.
- Locate control system networks and remote devices behind firewalls and isolating them from business networks.
- When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices.
CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.
Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B–Targeted Cyber Intrusion Detection and Mitigation Strategies.
Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.
CISA also recommends users take the following measures to protect themselves from social engineering attacks:
- Do not click web links or open attachments in unsolicited email messages.
- Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams.
- Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.
No known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time. These vulnerabilities are not exploitable remotely.
Revision History
- Initial Release Date: 2026-11-03
Date Revision Summary 2026-11-03 1 Initial Publication
Legal Notice and Terms of Use
Cisco Advisories
11/03 TOC Cisco Secure Email Gateway SQL Injection Vulnerability
11/02 TOC Vulnerabilities in Node.js Affecting Cisco Products: October 2026A vulnerability in the email parsing of Cisco AsyncOS Software for Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to execute arbitrary commands with root privileges on the underlying operating system.
This vulnerability is due to insufficient validation in the email parsing logic. An attacker could exploit this vulnerability by sending a crafted email message that contains malicious SQL statements through an affected device. A successful exploit could allow the attacker to execute arbitrary SQL statements, leading to command execution with root privileges on the underlying operating system.
Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.
This advisory is available at the following link:
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-inj-2bLVGmhX
Security Impact Rating: Critical
CVE: CVE-2026-76461
On October 21, 2026, Node.js announced the availability of fixes for multiple vulnerabilities across the following supported release lines: 22.x, 24.x, and 26.x.Â
These vulnerabilities impact critical operations such as the Brotli decoder, DNS resolution, and TLS certificate validation. The vulnerabilities pose risks for remote code execution and traffic interception. For more information, see Node.js Security Release.Â
The following vulnerabilities have a Security Impact Rating (SIR) of High and are addressed in this advisory:Â
- CVE-2026-111497 – Brotli decoder out-of-bounds write; potential remote code execution
- CVE-2026-105482 – DNS resolution truncation involving embedded NUL characters
- CVE-2026-105483 – TLS hostname validation bypass using fullwidth IP digits
- CVE-2026-106069 – TLS hostname validation bypass with noncanonical IP addresses
For information about Splunk products and offerings, see Vulnerabilities in Node.js (CVE-2026-111497, CVE-2026-105482, CVE-2026-105483, CVE-2026-106069) on Splunk Products – October 2026
Important: If a product is not listed within this advisory, Cisco’s review indicates that the product is not affected by this vulnerability.
This advisory will be updated as additional information becomes available.
This advisory is available at the following link:
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-oct2026-node-js-Jj3SQ19u
Security Impact Rating: HighDataBreaches.net
11/03 TOC French blood storage units targeted in cyberattack
OMM reports: Cold-storage facilities used by France’s national blood service were targeted in a cyberattack, with units containing blood samples reportedly programmed to reach 110 degrees Celsius (230 degrees Fahrenheit), French weekly Le Canard enchaîné reported on Tuesday. Anadolu Agency also reported the incident. The attack took place overnight from Sunday to Monday and targeted…11/03 TOC AU: Criminal investigation after NSW Health hit by cyber breach
Richard Wood reports: A major cyber breach has been declared at NSW Health, but officials say patient data has not been affected. A spokesperson for Cyber Security NSW says investigations are under way. “Cyber Security NSW is responding to a cyber breach impacting an isolated server within NSW Health. “The breach has been declared a…11/03 TOC Ukraine and Russia both report fake emergency alerts after cyberattack…
AP reports: Authorities in Ukraine and Russia said their emergency alert mobile apps had been targeted by cyberattacks, with users in Ukraine receiving false warnings of an imminent nuclear threat. It was not clear if the attacks late Sunday were related. Ukraine said its service, which residents rely on to seek safety amid daily Russian…11/03 TOC Nine health systems affected by AI company data breach
Giles Bruce reports: A data breach involving healthcare AI company Xsolis has ensnared at least nine health systems and 1.4 million patients. Xsolis, which provides utilization management and care coordination technology for health systems, reported the targeted phishing attack June 5, noting that on Jan. 20 an unauthorized person accessed portions of the company’s IT…11/03 TOC JPN: More companies seeking cyber insurance following high-profile dat…
Maddie Baker reports: “Cybersecurity insurance normally covers compensation for costs arising from data breaches such as hacking, internally caused cyber leaks and, in some cases, IT security assessments to prevent similar data compromises from happening in the future. It also covers costs for conducting digital forensic analysis to identify cyberattackers and where vulnerabilities lie in…11/03 TOC KR: Presidential office holds emergency meeting over leak of personal …
Park Boram reports: The presidential office held an emergency meeting Tuesday to address the leak of personal information of President Lee Jae Myung and members of an entourage that accompanied him on his overseas trip in June. The meeting, presided over by presidential chief of staff Lim Kwang-hyun, followed news reports that a computer file…11/03 TOC Syrian Man Sentenced for Wide-Ranging Hacking Conspiracy Conducted on …
Ahmad Umar Agha (also known as Th3Pr0) had spent more than a decade as a fugitive for targeting of Western media entities, businesses, NGOs, and U.S. and allied government entities October 29 – Today a federal district court in the Eastern District of Virginia sentenced Ahmad Umar Agha to 42 months in prison for his…11/03 TOC A Defense Contractor Gave Their Personal AI Agent Access to a Secure P…
Vittoria Elliott reports: Earlier this year, sources tell WIRED, a contractor caused a security incident at the Department of Defense by connecting a secure centralized system used by multiple intelligence agencies to their personal account for Claude Code, Anthropic’s AI coding agent. It appears that the agent used by the contractor, who is employed by…11/03 TOC Hackers hit UNM hospital, then apologize and offer patients $2,500. In…
In more than 20 years of blogging about breaches, DataBreaches has never seen ransomware threat actors offer monetary compensation to patients affected by their attack. We have seen threat actors regret hitting a hospital or a facility providing direct patient care and then offer them a free decryptor and drop the ransom demands, but this…11/03 TOC HHS Office for Civil Rights Settles Ransomware Investigation of Lehigh…
DataBreaches.net previously covered the 2023 Lehigh Valley Health Network breach by AlphV (aka “BlackCatâ€). The breach garnered a lot of public attention when the threat actors crossed a line by posting nude pictures of patients on their leak site. In 2024, patients settled civil litigation for $65 million. Now HHS has settled its own charges…Huntress Blog
11/03 TOC Huntress + Hudu Integration: Security Context in Your IT Docs
Hudu’s new Huntress integration brings your Huntress organizations, agents, memberships, and identities into Hudu. See what it does, how to set it up, and how Hudu built it on the Huntress API.11/03 TOC Gangsters, Money Trails, and Wuffy | Huntress
A $30 AI toy dog led Mastercard to 250+ scam sites. See how small charges and ransomware payouts follow the same money trail, and how to cut it off.11/02 TOC Threat Hunting: What It Is, How It Works, & Why It Matters
Huntress breaks down threat hunting, how the process works, which methodologies matter, and why human-led detection catches what automation misses.Alexander Popov
11/02 TOC Dangerous Device: Exploiting CVE-2026-31695 in the Linux Kernel via st…
Several months ago, I discovered and fixed an interesting Linux kernel vulnerability CVE-2026-31695, which was caused by a logical bug in network device management. This vulnerability had been present in the kernel code for nearly 5 years. In this article, I will describe the exploit for this vulnerability providing local privilege escalation (LPE) on Fedora 44 Server for the x86_64 architecture. I will demonstrate how to bypass the security hardening mechanisms and gain full control over the operating system by spoofing a struct device. Moreover, I will explain how to make the attack absolutely stable, despite the elusive race condition during the exploitation of CVE-2026-31695. Let’s go 🚀CVEMon Intruder
11/04 TOC CVE-2026-118306
Currently trending CVE – Hype Score: 84 – Use after free in FileSystem in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)11/04 TOC CVE-2026-118344
Currently trending CVE – Hype Score: 84 – Use after free in Layout in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical)11/04 TOC CVE-2026-118331
Currently trending CVE – Hype Score: 84 – Use after free in FileAPI in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)11/04 TOC CVE-2026-118348
Currently trending CVE – Hype Score: 84 – Integer overflow in Skia in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)11/04 TOC CVE-2026-109618
Currently trending CVE – Hype Score: 18 – PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request …11/04 TOC CVE-2026-109619
Currently trending CVE – Hype Score: 18 – PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may …11/04 TOC CVE-2026-97229
Currently trending CVE – Hype Score: 14 – GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server via a specially …11/04 TOC CVE-2026-111497
Currently trending CVE – Hype Score: 14 – A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, …11/04 TOC CVE-2026-106072
Currently trending CVE – Hype Score: 12 – A flaw in Node.js TLS hostname verification allows a certificate with only a DNS SAN to authenticate an IP endpoint when the client connects using a non-canonical IPv4 spelling, such as `0177.0.0.1`, `0x7f.0.0.1`, `2130706433` or `127.1`. `tls.checkServerIdentity()` did not …11/04 TOC CVE-2026-81963
Currently trending CVE – Hype Score: 1 – Improper link resolution before file access (‘link following’) in Windows Update Stack allows an authorized attacker to elevate privileges locally.Mozilla Attack & Defense
11/02 TOC Firefox Security & Privacy Newsletter 2026 Q3
Welcome to the Q3 2026 edition of the Firefox Security & Privacy Newsletter.Hacking Lab
11/30 TOC PatchIsland: Orchestration of LLM Agents for Continuous Vulnerability …
Schneier on Security
11/03 TOC AIs Hacking the Law
11/02 TOC AI Vulnerability FindingIn both a 2021 essay and my 2022 book, A Hacker’s Mind, I talk about AIs finding vulnerabilities and exploits—hacking—the legal system.
Here’s some demonstrations of this from Germany:
Legal systems encode the foundations of social order in natural language. Similar to computer systems, the written law can contain vulnerabilities that invite exploitation.1 Courts absorb most exploits through interpretation, and such vulnerabilities rarely surface in the first place. With highly capable AI systems enabling the discovery of vulnerabilities at unprecedented scale, we believe the latter could change…
A comment:
3% of ‘critical’ software security bugs, in all of recorded history, have been found in the last month. This is on pace to find another ~100,000 bugs this year alone, adding ~26% more vulnerabilities to the all time total Do you realize how fucking insane that is?
Yes. It is a new world out there.
Securelist
11/03 TOC MLEP in KICS for Networks 5.0: how machine learning helps track networ…
We explain how Kaspersky Industrial CyberSecurity for Networks uses Machine Learning Event Processor (MLEP) technology to help take inventory of assets and detect anomalies in industrial networks.11/02 TOC CyberStrikeAI in the wild: the use of AI in real-world attacks on orga…
We analyze a series of attacks on educational institutions that were fully automated during the post-exploitation phase using the CyberStrikeAI penetration testing framework.Talos – Vulnerability Reports
11/03 TOC Microsoft Windows Cloud Files Mini Filter Driver CldiStreamCompleteReq…
11/03 TOC Microsoft Windows Cloud Files Mini Filter Driver CldiStreamPrepareRequ…
Troy Hunt
11/01 TOC Weekly Update 528: Reading AI-generated Code & the Economics of Solar
By pure timing coincidence, the Proton CEO’s AI @ Proton, Engineering Manifesto made headlines around the same time as this week’s video. The guy’s management style and choice of language have really rubbed a lot of people up the wrong way, and deservedly so, IMHO.
WeLiveSecurity
11/03 TOC Gorbag: Orcs at the border harvesting intelligence from Ukraine
ESET researchers uncover Gorbag, a Russia-aligned group using simple infostealers to harvest data from Ukrainian organizations near the front line11/02 TOC When confusion reigns, trusted vendors must guide their SMB customers
SMBs need guided onboarding and supervised protection to optimize their investmentsZero Day Initiative-Published
11/03 TOC ZDI-26-868: Microsoft Windows Aero Theme Improper Handling Of Error Co…
This vulnerability allows local attackers to create a denial-of-service condition on affected installations of Microsoft Windows. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 4.7.11/03 TOC ZDI-26-867: Cisco Snort sf_unfold_header Out-Of-Bounds Write Remote Co…
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Cisco Snort. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 9.8. The following CVEs are assigned: CVE-2026-20043.11/03 TOC ZDI-26-866: Quest Foglight for Databases renderTemplateString Server-S…
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest Foglight for Databases. Authentication is required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.2. The following CVEs are assigned: CVE-2026-92196.11/03 TOC ZDI-26-865: Quest Foglight for Databases Incorrect Permission Assignme…
This vulnerability allows local attackers to escalate privileges on affected installations of Quest Foglight for Databases. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2026-92200.11/03 TOC ZDI-26-864: Quest Foglight for Databases getSource XML External Entity…
This vulnerability allows remote attackers to initiate arbitrary server-side requests on affected installations of Quest Foglight for Databases. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 8.2. The following CVEs are assigned: CVE-2026-92198.11/03 TOC ZDI-26-863: Quest Foglight for Databases EncryptionUtil Hardcoded Ency…
This vulnerability allows local attackers to escalate privileges on affected installations of Quest Foglight for Databases. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2026-92199.11/03 TOC ZDI-26-862: Quest Foglight for Databases AbstractParser XML External E…
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Quest Foglight for Databases. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.2. The following CVEs are assigned: CVE-2026-92185.11/03 TOC ZDI-26-861: Quest Foglight for Databases writeTopologySectionToFile Ex…
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest Foglight for Databases. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 9.8. The following CVEs are assigned: CVE-2026-92189.11/03 TOC ZDI-26-860: Quest Foglight for Databases unzipFile Directory Traversal…
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest Foglight for Databases. Authentication is required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 8.8. The following CVEs are assigned: CVE-2026-92197.11/03 TOC ZDI-26-859: Quest Foglight for Databases runScript Incorrect Authoriza…
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest Foglight for Databases. Authentication is required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 8.8. The following CVEs are assigned: CVE-2026-92191.11/03 TOC ZDI-26-858: Quest Foglight for Databases paFnUploadFileAndCreateInfo D…
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest Foglight for Databases. Authentication is required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 8.8. The following CVEs are assigned: CVE-2026-92186.11/03 TOC ZDI-26-857: Quest Foglight for Databases loadManageServerLicense Direc…
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest Foglight for Databases. Authentication is required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 8.8. The following CVEs are assigned: CVE-2026-92194.11/03 TOC ZDI-26-856: Quest Foglight for Databases loadEvolveLicense Directory T…
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest Foglight for Databases. Authentication is required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 8.8. The following CVEs are assigned: CVE-2026-92195.11/03 TOC ZDI-26-855: Quest Foglight for Databases installLicense Directory Trav…
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest Foglight for Databases. Authentication is required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 8.8. The following CVEs are assigned: CVE-2026-92192.11/03 TOC ZDI-26-854: Quest Foglight for Databases ForgeMBeanServerSupport Missi…
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest Foglight for Databases. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 9.8. The following CVEs are assigned: CVE-2026-92188.11/03 TOC ZDI-26-853: Quest Foglight for Databases FileServlet External Control …
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Quest Foglight for Databases. Authentication is required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 6.5. The following CVEs are assigned: CVE-2026-92193.11/03 TOC ZDI-26-852: Quest Foglight for Databases extractAndCreateUploadInfoLis…
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest Foglight for Databases. Authentication is required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 8.8. The following CVEs are assigned: CVE-2026-92187.11/03 TOC ZDI-26-851: Quest Foglight for Databases baseRmiServiceExporter Deseri…
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest Foglight for Databases. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 9.8. The following CVEs are assigned: CVE-2026-92190.11/02 TOC ZDI-26-850: Microsoft Qlib MLflowRecorder Deserialization of Untrusted…
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Microsoft Qlib. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8.11/02 TOC ZDI-26-849: Microsoft Qlib RestrictedUnpickler Deserialization of Untr…
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Microsoft Qlib. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8.11/02 TOC ZDI-26-848: Microsoft Qlib StaticDataLoader Deserialization of Untrust…
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Microsoft Qlib. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8.Microsoft-Azure Network Security
11/02 TOC Protect against Brotli CVE-2026-111497 with Azure Web Application Fire…
Google Brotli versions 1.0.3 through 1.2.0 contain a buffer overflow vulnerability in the Brotli decoder, according to the recently published CVE-2026-111497. A remote, unauthenticated attacker can send a crafted Brotli-compressed stream to corrupt decoder memory, expose sensitive memory contents, cause a denial of service, or potentially run arbitrary code. Any application that decompresses untrusted Brotli data may be affected. This includes Node.js and Python applications that bundle the vulnerable decoder, and services that accept request bodies with the Content-Encoding: br header.Â
We strongly recommend upgrading Brotli to a patched version: 1.0.10, 1.1.1 or 1.2.1 (Brotli releases). If you use Node.js, upgrade to 22.23.4, 24.22.1 or 26.12.1 (Node.js security release).Â
If you can’t patch your applications right away, Azure WAF on Application Gateway, Application Gateway for Containers and Azure Front Door can help mitigate the inbound attack vector, which is Brotli-compressed request bodies sent to your application.Â
Note: Azure WAF inspects only inbound requests to your application. It can’t protect applications that fetch and decompress Brotli-encoded responses from external servers. Those applications must be patched.Â
Built-in protection enabled by default
If you use Azure WAF with DRS 2.2 on Application Gateway or Azure Front Door Premium, you’re protected by default against crafted Brotli-compressed request bodies. Rule 920450 (Paranoia Level 1, enabled by default) checks requests against a list of restricted headers, and DRS 2.2 adds Content-Encoding to that list. The rule has a critical anomaly score, so a single match blocks the request when the WAF policy is in Prevention mode. Earlier rule set versions don’t restrict the Content-Encoding header. If you’re still on DRS 2.1, CRS 3.2 or earlier, we recommend upgrading to DRS 2.2 to get the latest protection. To learn how, see Upgrade CRS or DRS ruleset version.Â
If your application uses Next.js image optimization, apply the BlockNextImageCVE2026111497 custom rule below, even if you’re on DRS 2.2.
Custom rules to mitigate CVE-2026-111497Â
The custom rules block two attack vectors:
1. CVE2026111497 blocks any request whose Content-Encoding header includes the br (Brotli) coding, which this attack uses. DRS 2.2 already covers this vector through rule 920450. We recommend this rule for:
- WAF policies still on DRS 2.1 or earlier, while you plan the upgrade.
- WAF policies where rule 920450 is disabled or overridden.
- Azure Front Door Standard, which supports custom rules only. Managed rule sets require Azure Front Door Premium.
- WAF policies attached to Azure Application Gateway for Containers.
2. BlockNextImageCVE2026111497 blocks any request to the Next.js image optimization endpoint, including under a base path. It URL-decodes and lowercases the request URI first, so encoded or mixed-case variants are also blocked. No managed rule set covers this vector. We recommend this rule for all WAF policies that protect Next.js applications, whatever rule set version they use.
These rules may also block legitimate traffic. The first may block clients sending Brotli-compressed request bodies. The second blocks every image served through Next.js image optimization (for example, by the image component), so those images won’t load. If you aren’t sure whether your application relies on either, set the action to ‘Log traffic only’ first, and review your WAF logs before switching to ‘Deny traffic’. You can remove the Content-Encoding rule once your applications are patched or your policy uses DRS 2.2. Keep the Next.js image optimization rule until your applications are patched.
Azure WAF on Application Gateway and Application Gateway for Containers
If you are using CRS 3.0 or CRS 3.1, upgrade your ruleset version to a later version first, then apply the custom rule.Â
{ “name”: “CVE2026111497”, “priority”: 100, “ruleType”: “MatchRule”, “action”: “Block”, “matchConditions”: [ { “matchVariables”: [ { “variableName”: “RequestHeaders”, “selector”: “Content-Encoding” } ], “operator”: “Regex”, “matchValues”: [ “(?:^|,)[ \\t]*br[ \\t]*(?:,|$)” ], “transforms”: [ “Lowercase” ] } ] } { “name”: “BlockNextImageCVE2026111497”, “priority”: 90, “ruleType”: “MatchRule”, “action”: “Block”, “state”: “Enabled”, “matchConditions”: [ { “matchVariables”: [{“variableName”: “RequestUri”}], “operator”: “Regex”, “negationConditon”: false, “matchValues”: [“^(?:https?://[^/?#]+)?/(?:[^?#]*/)?_next/image/?(?:\\?|$)”], “transforms”: [“UrlDecode”, “Lowercase”] } ] } Azure WAF on Azure Front DoorÂ
{ “name”: “CVE2026111497”, “priority”: 120, “enabledState”: “Enabled”, “ruleType”: “MatchRule”, “action”: “Block”, “matchConditions”: [ { “matchVariable”: “RequestHeader”, “selector”: “Content-Encoding”, “operator”: “RegEx”, “negateCondition”: false, “transforms”: [ “Lowercase” ], “matchValue”: [ “(?:^|,)[ \\t]*br[ \\t]*(?:,|$)” ] } ] } { “name”: “BlockNextImageCVE2026111497”, “priority”: 90, “ruleType”: “MatchRule”, “action”: “Block”, “enabledState”: “Enabled”, “matchConditions”: [ { “matchVariable”: “RequestUri”, “operator”: “RegEx”, “negateCondition”: false, “matchValue”: [“^(?:https?://[^/?#]+)?/(?:[^?#]*/)?_next/image/?(?:\\?|$)”], “transforms”: [“UrlDecode”, “Lowercase”] } ] } Restrict request sizeÂ
The proof-of-concept payloads analyzed so far are about 23 MB each. Attackers may be able to craft smaller payloads, so treat size limits as an extra layer of protection, not a mitigation on their own. Whatever rule set version you use, we recommend the following:Â
Azure WAF on Application Gateway and Application Gateway for ContainersÂ
The proof-of-concept payloads are well above the default maximum request body size of 128 KB on Application Gateway and Application Gateway for Containers. We recommend setting the maximum request body size in your WAF policy to the smallest value your application needs. Learn more. Â
Azure WAF on Azure Front DoorÂ
To limit request body size, create a custom rule with a size constraint. For request body checks, the size is measured on the decoded body. Set the limit to the smallest value your application needs and make sure request body inspection is enabled in your WAF policy settings.Â
The following example blocks request bodies larger than 40 KB. This rule supports limits of up to 128 KB.Â
Â
{ “name”: “BlockLargeRequestBody”, “priority”: 130, “enabledState”: “Enabled”, “ruleType”: “MatchRule”, “action”: “Block”, “matchConditions”: [ { “matchVariable”: “RequestBody”, “operator”: “GreaterThan”, “negateCondition”: false, “matchValue”: [ “40960” ] } ] } You can find more information about custom rules on Azure WAF for Application Gateway or for Azure Front Door.Â
Â
Changelog
- 11/2 9:00 AM PST – Updated with additional custom rules
Veeam
11/02 TOC How to Change the Veeam Reverse Proxy Service Port (443) After Deploym…
Starting in Veeam Backup & Replication 13.1, client service traffic is consolidated behind the Veeam Reverse Proxy Service, which listens on the Primary service port, port 443 by default. This article documents how to adjust that port on a Windows-based backup server after deployment, how to update remote consoles so that they connect on the new port, and the known issues that apply after the change.
Content on this page is collected from remote sources by IPWorX but is not created by IPWorX. The contents belong to the creators and should be considered theirs for all legal purposes, we have no editorial control or responsibility over them. IPWorX does not represent or endorse the accuracy or reliability of any opinion, statement, or other information provided by any third party.
This page contains links to third-party websites. These links are provided solely for your convenience. IPWorX does not control, maintain, or endorse the content, accuracy, or reliability of any third-party resources, and you access them at your own risk.
Scripts and tools to help manage your network found, managed and
happily shared with documentation on usage at the IP WORk eXchange.
https://www.IPWorX.com