Daily DefSec Brief·Oct 28, 2026·6m

HTTP2Shell flaw exploited, stolen GitHub tokens, Magento PolyShell | Cyber Security News Oct 28

Show notes

1. Update: Brotli flaw now listed as exploited - CVE-2026-111497 - Do: Patch every service that decompresses Brotli - https://nodejs.org/en/blog/vulnerability/october-2026-security-releases

2. Stolen GitHub tokens dump private repo secrets - Do: Search GitHub for ci-sync branches - https://www.wiz.io/blog/gheist-attempted-scaled-abuse-of-stolen-github-tokens-stumbles

3. Magento PolyShell flaw now listed as exploited - CVE-2026-48356 - Do: Patch Magento and audit its admin accounts - https://helpx.adobe.com/security/products/magento/apsb26-73.html

4. Apple fixes 304 flaws, backports exploited fix - CVE-2026-86950, CVE-2026-86990 - Do: Require supported OS versions on mobile devices - https://support.apple.com/en-us/149225

5. Skimmer hid in a store platform's analytics script - CVE-2026-8467 - Do: List every script your checkout page loads - https://github.com/plausible/analytics/releases/tag/v3.2.1

6. Camera management software led to malware on PCs - Do: Find camera management software on your PCs - https://www.huntress.com/blog/camera-management-software-compromise-malware

7. Veeam fixes critical flaw in Backup & Replication - CVE-2026-108142, CVE-2026-106076, CVE-2026-106078 - Do: Upgrade Veeam B&R and Backup for Microsoft 365 - https://www.veeam.com/kb4948

8. Chrome update fixes 52 flaws, four critical - CVE-2026-118306, CVE-2026-118331, CVE-2026-118344 (+ 1 more) - Do: Push the Chrome update and force the restart - http://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_0562499947.html

9. Update: Tailscale fixes the Tailworm SSH flaws - Do: Upgrade Tailscale on servers that run Tailscale SSH - https://tailscale.com/security-bulletins

10. UEFI network boot flaw runs code before the OS - CVE-2026-97631 - Do: Turn off network boot where it's unused - https://github.com/tianocore/edk2/security/advisories/GHSA-99cj-7hg9-mp4m

11. Desktop host breach: customers told to unplug PCs - Do: Turn off drive sharing on hosted desktop sessions - https://www.bleepingcomputer.com/news/security/japans-gmo-urges-customers-to-shut-down-pcs-amid-ransomware-threat/

12. Attack agent built to run on victims' AI models - Do: Require authentication on every AI model endpoint - https://www.security.com/threat-intelligence/ai-llmjacking-skynet

← Previous

Guessed FortiGate passwords, coding agent hijack, Brotli beyond Node | Cyber Security News Oct 26

Attackers are exploiting the Brotli flaw behind HTTP2Shell and Magento's PolyShell, and stolen GitHub tokens are dumping private repo secrets. Every version number and every fix in this episode was checked against the vendor's own advisory before it aired. Today's question: How do you find the services that quietly bundle a library like Brotli? Reply in the comments or at [email protected] . 1. Update: Brotli flaw now listed as exploited - CVE-2026-111497 - Do: Patch every service that decompresses Brotli - https://nodejs.org/en/blog/vulnerability/october-2026-security-releases 2. Stolen GitHub tokens dump private repo secrets - Do: Search GitHub for ci-sync branches - https://www.wiz.io/blog/gheist-attempted-scaled-abuse-of-stolen-github-tokens-stumbles 3. Magento PolyShell flaw now listed as exploited - CVE-2026-48356 - Do: Patch Magento and audit its admin accounts - https://helpx.adobe.com/security/products/magento/apsb26-73.html 4. Apple fixes 304 flaws, backports exploited fix - CVE-2026-86950, CVE-2026-86990 - Do: Require supported OS versions on mobile devices - https://support.apple.com/en-us/149225 5. Skimmer hid in a store platform's analytics script - CVE-2026-8467 - Do: List every script your checkout page loads - https://github.com/plausible/analytics/releases/tag/v3.2.1 6. Camera management software led to malware on PCs - Do: Find camera management software on your PCs - https://www.huntress.com/blog/camera-management-software-compromise-malware 7. Veeam fixes critical flaw in Backup & Replication - CVE-2026-108142, CVE-2026-106076, CVE-2026-106078 - Do: Upgrade Veeam B&R and Backup for Microsoft 365 - https://www.veeam.com/kb4948 8. Chrome update fixes 52 flaws, four critical - CVE-2026-118306, CVE-2026-118331, CVE-2026-118344 (+ 1 more) - Do: Push the Chrome update and force the restart - http://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_0562499947.html 9. Update: Tailscale fixes the Tailworm SSH flaws - Do: Upgrade Tailscale on servers that run Tailscale SSH - https://tailscale.com/security-bulletins 10. UEFI network boot flaw runs code before the OS - CVE-2026-97631 - Do: Turn off network boot where it's unused - https://github.com/tianocore/edk2/security/advisories/GHSA-99cj-7hg9-mp4m 11. Desktop host breach: customers told to unplug PCs - Do: Turn off drive sharing on hosted desktop sessions - https://www.bleepingcomputer.com/news/security/japans-gmo-urges-customers-to-shut-down-pcs-amid-ransomware-threat/ 12. Attack agent built to run on victims' AI models - Do: Require authentication on every AI model endpoint - https://www.security.com/threat-intelligence/ai-llmjacking-skynet