1. Node2Shell: one Brotli decoder bug, patches across every runtime

SecurityWeek · October 26, 2026

Node2Shell (CVE-2026-111497, also circulating as HTTP2Shell and Broccoli2Shell) is an out-of-bounds write in Google’s Brotli decompression library, affecting Brotli 1.0.3 through 1.2.0. Crafted compressed input can push data past a decoder buffer, which can crash the process, leak memory or, according to the Node.js project, let an unauthenticated attacker run code. Google scores it 9.2 under CVSS v4; Microsoft scores it 8.1 and rates exploitation “more likely”. Brotli 1.0.10, 1.1.1 and 1.2.1 carry the fix. Node.js and the two affected Python packages (Brotli 1.2.1 and brotlicffi 1.2.1.0) patched first, and Microsoft followed on October 25 with .NET 8.0.33, 9.0.22, 10.0.14 and .NET 11 RC3, plus Visual Studio 2019, 2022 and 2026 and PowerShell 7.4 to 7.6. Bun, Envoy and Istio have updated too.

Exploitability is disputed. Imperva achieved code execution on the official Node.js 24.22.0 image for Linux on arm64, but the public proof of concept reportedly works only against a deliberately weakened build, and some researchers argue the bug is a denial-of-service at most. CISA has since added it to its Known Exploited Vulnerabilities catalog. The operational problem is reach rather than severity. OpenAI’s Patch the Planet advisory warns that “any application that passes attacker-controlled data to an affected Google Brotli decoder may be exposed”, including compressed request bodies, responses fetched from untrusted servers and compressed files. A public tracker of software that bundles its own decoder still lists unpatched projects, among them DuckDB, Apache Arrow, 7-Zip-zstd, p7zip and EDK II.

For patch operations this is a container and restart exercise as much as a package update. Running processes keep the vulnerable decoder in memory, so services must be restarted and container images rebuilt on a patched base before the fix takes effect. Software composition data that only checks the operating system’s Brotli package will miss runtimes that ship their own copy, so check Node.js, .NET, Bun and Python environments separately.

Sources: SecurityWeek (Node2Shell: Brotli Flaw Triggers Patching Across Microsoft, Node.js, Python Packages)

2. PHP2Shell, week two: a three-day federal deadline and a long tail of forgotten PHP

Federal News Network · CSO Online · October 27–29, 2026

CISA added both PHP2Shell flaws, CVE-2026-109618 and CVE-2026-109619, to its Known Exploited Vulnerabilities catalog on October 26, confirming active exploitation rather than scanning or proof-of-concept activity, and gave federal civilian agencies until October 29 to fix them. Under a binding operational directive issued earlier this year, CISA reserves that three-day deadline for the highest-risk flaws and has said it wants agencies to move faster still where they can. For a SOC that tracks KEV as a service level, the message is that “critical and exploited” now means days.

The harder part is what the CSO analysis describes as a long tail. VulnCheck found that 42% of 2.6 million internet-facing PHP hosts run end-of-life branches, and PHP also sits inside NAS boxes, firewalls, VPN gateways, printers, building management panels and OT HMIs that cannot be patched directly. Cogent Security counted an average of 2,266 affected assets per Fortune 500 environment, 122 of them internet-exposed, and that only covered servers and virtual machines. Version-banner scanning can mislead in both directions, because distribution backports can carry version numbers lower than upstream’s fixed releases. “With PHP, much of the forgotten infrastructure will be found, but won’t have an upstream fix,” said Sai Molige of Forescout.

Where you cannot patch, compensate. Move vulnerable applications off insecure segments, add firewall rules, and turn off embedded HTTP management where SSH or another channel can do the job. Do not lean on a WAF alone, since attackers can pad payloads past inspection limits, and remember that IPS detection needs HTTPS decryption. Hunt for PHP_SESSION_UPLOAD_PROGRESS alongside a PHPSESSID cookie, multipart uploads to endpoints that never take uploads, web workers spawning shells, and new or modified .php files in web roots. The Log4Shell precedent is sobering: a year on, nearly three-quarters of organisations still had vulnerable assets.

Sources: Federal News Network (CISA gives agencies days to patch critical PHP bugs) · CSO Online (PHP2Shell will persist in enterprise environments for years)

3. Exploitation is becoming the front door, and it arrives within days

Help Net Security · CSO Online · SecurityWeek · October 27–29, 2026

Three data sets point the same way. Rapid7’s Q3 report (covered last week from a different angle) finds high-severity flaws exploited about three days after disclosure on average, with 71% of exploitation in the first week. Of 43 newly exploited high and critical flaws, 34 needed neither authentication nor user interaction, and 41 of 63 underground posts Rapid7 monitored were selling RDP or network access. LevelBlue’s incident data shows exploitation as the initial access route in 14% of Q3 cases, up from 4% in Q2, while phishing and social engineering fell from 65% to 42%. Verizon’s 2026 DBIR puts exploitation at the centre of 31% of breaches, ahead of credential abuse for the first time. Edge appliances from SonicWall, Fortinet, Palo Alto Networks, Ivanti and BeyondTrust dominate the most-exploited lists. “They’re exposed by design, and a working exploit puts the attacker directly on the network,” said Scott Doerr of ForeGuard Advisory Group.

Rapid7’s Christiaan Beek adds a caution: “Board decks often confuse the real explosion in AI-driven vulnerability discovery with actual exploitation.” The practical answer is a metric that measures exposure rather than volume. Qualys CISO Nathan Smolenski argues for tracking the average window of exposure, from the moment a confirmed exploit is present in your environment until the fix is verified, instead of mean time to remediate from disclosure. His team found that only 357 of 48,172 vulnerabilities disclosed in 2025, about 0.74%, were both remotely exploitable and weaponised. Layering KEV status, business context and safe exploitability testing cut one customer’s 62.5 million alerts to about 60,000. He recommends rolling out autonomous patching by asset tier, low-risk systems first, with rollback ready and human review for staged changes.

Tod Beardsley’s NetScaler column makes the optimistic case for the same trend. Citrix’s September zero-days were spotted and patched over a weekend, Citrix cut its average time from discovery to CVE from about 40 days to 17 after setting up a dedicated NetScaler CNA, and CISA made a rare Sunday KEV addition. His advice is to keep emergency patch pipelines primed: there is a gap in Citrix’s reserved CVE numbers, from CVE-2026-88779 to CVE-2026-88787, which suggests more advisories could follow.

Sources: Help Net Security (71% of vulnerability exploitation starts within a week of disclosure) · CSO Online (Vulnerability exploitation rising as the root cause of many breaches) · Help Net Security (Qualys CISO on what security teams can do as exploit campaigns grow) · SecurityWeek (This is Fine: What NetScaler Zero-Days Tell Us About the New Normal)

4. The rest of the patch queue: Tailworm, Oracle EBS, Veeam and Juniper

SecurityWeek · October 27–29, 2026

Cyberdione Labs published Tailworm, 11 findings in the Tailscale 1.104.2 client and the self-hosted headscale 0.29.5 control server, before any patch existed. Six are rated high, and four concern Tailscale SSH, which performed some forwarding operations with root privileges behind safeguards that could be bypassed. An attacker who already controls one device on a tailnet could get root on any server that device may reach over Tailscale SSH with forwarding allowed. In the lab, a chained attack moved from server to server in under a second per hop with no user interaction. Tailscale said exploitation needs prior access and depends on how SSH access is configured: “Based on our current assessment, we’re not recommending that everyone disable Tailscale SSH.” Its interim advice was to tighten SSH policies and set TS_SSH_DISABLE_FORWARDING=1 where forwarding is not needed. It has since shipped version 1.104.4 with four security bulletins. No in-the-wild exploitation has been reported.

Oracle’s October update fixed CVE-2026-101767 (CVSS 9.8), an unauthenticated SQL injection in the E-Business Suite Thin Client Framework servlet that chains to remote code execution in versions 12.2.3 to 12.2.15. Defused’s honeypots recorded exploratory exploit attempts from October 27, and Shadowserver tracks more than 670 internet-exposed EBS instances. Oracle EBS has been a mass-exploitation target before, so treat this as urgent even before it reaches KEV.

Adobe, Veeam and Juniper fixed more than three dozen flaws between them, none reported exploited. The ones that matter most for operations are Veeam’s: a critical Backup for Microsoft 365 bug allowing cross-tenant configuration read/write and code execution, and a critical unauthenticated authorisation bypass in Backup & Replication. Backup servers are a ransomware operator’s first stop. Juniper fixed 18 flaws in Session Smart Router and Conductor, two of them critical unauthenticated command execution bugs, and Adobe fixed eight critical bugs in Campaign Classic and one in Connect. Juniper also says PHP2Shell’s CVE-2026-109618 is present in Junos OS but not exploitable.

Sources: SecurityWeek (Tailscale Rushes Patches After Uncoordinated Disclosure of Tailworm Flaws) · SecurityWeek (Hackers Start Probing Fresh Oracle EBS Vulnerability) · SecurityWeek (Adobe, Veeam, Juniper Networks Patch Critical Vulnerabilities)

5. Fake help desks over Teams, and where to talk when the attacker can listen

Infosecurity Magazine · Help Net Security · CSO Online · October 27–30, 2026

Arctic Wolf documented more than 400 incidents in which attackers abused Microsoft Teams external chat. The pattern starts with email bombing, flooding the victim’s inbox with newsletter and subscription confirmations. A fake service desk account such as “IT Service Desk – Liam” then offers to fix the problem. In 30-40% of cases the attackers used default onmicrosoft.com tenant domains, which need no verification and take minutes to set up. Victims were walked into Windows Quick Assist, the attackers moved to AnyDesk or ScreenConnect for persistence, and a payload ran less than 15 minutes after first contact. Ransomware groups including Black Basta have used the technique.

Cisco Talos Incident Response saw the same playbook in Q3 by phone, email and Teams, and notes how little the attackers needed: “The attackers appeared to know employee names and email addresses,” said Talos researcher Aliza Johnson, with no sign of deeper profiling. Anyone susceptible was a target, not only senior or technical staff. In one VYPR ransomware case a vishing call led to a Quick Assist session, an RMM tool and a PowerShell-delivered installer. The operators reused Conti-derived code, used vulnerable drivers to disable EDR and exfiltrated over several days. Across Talos engagements, insufficient logging was the most common weakness, found in over 40%. Talos recommends phishing-resistant MFA, help desk identity verification before any MFA enrolment, and at least 90 days of centralised log retention.

When one of these lands, the response team may be coordinating in the same Teams and email tenant the attacker is in. Andy Lunsford, CEO of incident-response software firm BreachRx, writes in CSO that “most incident response plans assume a safe place to coordinate”. Plans cover losing collaboration tools far more often than tools that still work but can no longer be trusted. He recommends mapping whether primary and backup channels share an identity provider, device management or admin credentials. Participants should be verified through a process that does not rely on the accounts under investigation, and tabletop exercises should rehearse the decision to move channels, not just the move.

Sources: Infosecurity Magazine (Attackers Exploit Teams External Chat to Breach Organizations in Under 15 Minutes) · Help Net Security (Fake IT help desk callers got by on little more than names and email addresses) · CSO Online (Everyday channels are available in an incident, but you may not want them)

6. SOC tooling: governed agents, self-hosted SOCs and the context layer

Help Net Security · SiliconANGLE · TechCrunch · October 27–28, 2026

The common thread in this week’s launches is control over what agents can do. Swimlane’s Turbine update lets teams run their own detection logic over large data sets, with one big-data action evaluating tens of thousands of records. Results feed its AI SOC, which routes each case to deterministic automation, AI-assisted investigation or a fully agentic investigation depending on the reasoning needed. New detections target local model use, unsanctioned AI accounts, prompt injection and bypassed guardrails. Turbine now works as both an MCP host and an MCP server under existing role-based access, and AI-generated app changes stay unsaved until a person accepts them. “MCP is most useful when it becomes part of the operating model, not just another integration,” said COO Srikant Vissamsetti. FireMon’s agentic AI for firewall policy has three agents that answer policy questions, design rules and turn access requests into staged changes. They pause for a practitioner when judgment is needed, nothing is saved until a person accepts it, and nothing is pushed to firewalls automatically. The AI is off by default, supports self-hosted models and logs everything; it ships in November at no extra charge for the first release.

Sekoia went the other way on deployment. Sekoia Self-Hosted runs its SOC platform inside the customer’s own infrastructure for government, defence, critical infrastructure and regulated buyers, including isolated, limited-connectivity and OT networks. Customers decide where data lives, how AI is deployed and where human approval is required. “Cloud is a deployment choice, not a definition of modern security,” said CEO Freddy Milesi. No availability date or pricing was given.

Two funding stories show where investors see the gaps. Northstar launched with a $7 million seed led by Wing Venture Capital for a security context graph that pulls from more than 70 tools, including Okta, GitHub and Workday. It looks for “toxic combinations” and exposes the graph to outside agents over MCP; CEO Amer Deeba says security teams are “drowning in data but starving for context.” Upwind raised $400 million at a $3.8 billion valuation, led by Bessemer, after Datadog tried to buy it without offering a premium. The runtime security vendor says it is adding $20 million to $30 million in annual recurring revenue a quarter, all company-reported figures.

Sources: Help Net Security (Swimlane connects custom detections to AI-led investigation and response) · SiliconANGLE (Exclusive: FireMon unveils AI agents to handle the legwork behind firewall policy changes) · Help Net Security (Sekoia introduces self-hosted deployment for organizations with strict data controls) · SiliconANGLE (Northstar launches with $7M to give AI agents the context to act on security risks) · TechCrunch (Upwind raises $400M after walking away from Datadog acquisition offer)

7. Microsoft: local agent discovery reaches GA, and Sentinel’s October changes

Microsoft Tech Community · October 28–30, 2026

Microsoft Defender’s discovery of local AI agents and their configured MCP servers on Windows and macOS is now generally available, with coverage expanded to more than 50 supported agents and MCP servers, up from over 20 at Build. Discovery begins automatically on onboarded devices once Defender observes an agent running. Agents appear under Assets > AI agents and can be queried in advanced hunting through the AgentsInfo table. The baseline licence is Defender for Endpoint Plan 2, but risk levels, risk indicators and recommendations need Microsoft 365 E7 or Agent 365. Runtime protection for local agents on Windows remains in preview. “As local agents have moved from experimentation into everyday work, traditional security visibility is no longer enough,” the post says. For SOCs this is a shadow-AI inventory you can hunt on, whatever you decide about the paid risk layer.

Sentinel’s October release matters most to MSSPs and multi-tenant teams. Cross-tenant delegated access is now GA: analysts sign in with a home-tenant account rather than keeping B2B guest or local admin accounts in each tenant, and each governed tenant approves exactly which roles and scopes to grant. The ASIM EmailEvent schema is GA too, so email detections can be written once across sources. In preview, an SAP BTP analytics rule alerts only when a custom app with open high or critical vulnerabilities is actually used. Unified Data Management, also in preview, brings connectors, tables, ingestion health and estimated cost into one Defender portal view. Both posts are Microsoft product blogs.

Sources: Microsoft Tech Community (Now generally available: Discover local AI agents with Microsoft Defender) · Microsoft Tech Community (What's new in Microsoft Sentinel: October 2026)

8. Supervising agents, and preparing the SOC for adversaries that reason

Dark Reading · CSO Online · Security Boulevard · October 26–30, 2026

As agents take on investigations, the analyst’s job shifts to directing, reviewing and correcting their work, and a Dark Reading piece argues that supervision should be a qualification, not an assumption. Supervisors should prove they can spot a convincing but flawed investigation through blind reviews seeded with incomplete evidence, misleading conclusions, scope violations and inappropriate actions. Authorisation records should say which agents, systems, actions and risk levels each analyst may oversee, with a higher bar for disabling accounts or isolating hosts than for read-only work. Each accepted, modified or rejected conclusion should be recorded with the reason. A second Dark Reading piece adds containment patterns: task-scoped access, identity checks at every tool call, keeping the agent and its human creator as separate identities, and decoy credentials that stop the run, revoke access and rotate secrets the moment an agent touches them. It also warns against asking engineers to approve the same routine action fifty times a day.

Keith Lawson, CISO of London Health Sciences Centre, writes in CSO that the old 1-10-60 response benchmark is too slow for autonomous attackers. He treats every agent as a privileged identity with short-lived, scoped credentials, requires human approval before agents create identities, compute or network paths, and puts agents behind egress allowlists. His approach is tiered autonomy: automate narrow, reversible containment, and keep humans on irreversible or clinically risky actions. “We cannot rely on strokes of luck.” Anton Chuvakin reaches a similar design from the defence-in-depth side. Guard models often share the failure modes of the models they watch, irreversible actions such as moving money, deleting data or changing permissions need synchronous deterministic gates, and a defensive AI is both a new layer and a new common point of failure. “AI makes your layers more correlated and your edge slower than the attacker, so design for correlated failure and for speed.”

The talent question sits underneath all of this. If agents absorb the entry-level triage work that used to train analysts, Dark Reading argues, capture-the-flag competitions may be one of the few remaining ways to build the judgment supervisors need.

Sources: Dark Reading (Your AI Agent Has a Supervisor. Are They Qualified?) · Dark Reading (Redefining Security for the Agentic Enterprise) · CSO Online (Beyond deterministic worms: Preparing the SOC for reasoning adversaries) · Security Boulevard (How to Solve the Mystery of AI Defense in Depth?) · Dark Reading (Why CTF Competitions May Be More Important Than Ever)