Patch Now: Brotli Emergency Fixes; HPE AOS 8 & 10 Max-Severity Flaws; Apple OS Updates Plus Backported Fix

A critical vulnerability in the Brotli compression library has been addressed in patches from Google, Brotli's developer and maintainer, that are being incorporated into downstream emergency patches by developers whose products use Brotli. Aikido Security explains that "the root cause was fixed in the Brotli source code in February [2026], but it wasn't recognized as a security issue at the time and no release shipped with the fix until now. That means every project that bundles Brotli has to ship its own update." CVE-2026-111497, given a CVSS score of 9.2 by Google, allows a remote unauthenticated attacker to "corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code" by causing a buffer overflow in the Brotli decoder using a crafted Brotli-compressed stream. This vulnerability affects Google Brotli versions 1.0.3 through 1.2.0, and users should update any affected Brotli libraries or binaries to the latest available version, which may be 1.0.10, 1.1.1, or 1.2.1. Various names have been given to this vulnerability: "Node2Shell" was coined by Imperva Red Team, referring to Node.js, who first disclosed the flaw on October 21 after it was reported by Khai Tran and Sylvie Mayer at OpenAI Codex Security, affecting Node.js 26.x, 24.x, and 22.x through the bundled Brotli library. "HTTP2Shell" seems to have been coined by Aikido to refer to the broader impact of the flaw on languages and services that use HTTP. "Broccoli2Shell" has also been used, though Brötli is a Swiss German word for a bread roll. Other products that have received security updates addressing CVE-2026-111497 include Python, .NET, Java, PHP, curl/libcurl, Bun, Envoy, Istio, Debian, Alpine, and Amazon Linux. As of this writing, partial fixes are available in Fedora and Red Hat Enterprise Linux (RHEL), and no patches have been released for RHEL nodejs:24 and nodejs:26 modules, Ubuntu, or SUSE, but Aikido has released patched images for platforms with no vendor fix.

Hewlett Packard Enterprise (HPE) has published a security advisory addressing 72 vulnerabilities — eight of which carry a CVSS score of 10.0 — that affect HPE Networking Wireless Operating Systems for Mobility Conductors, Controllers, Gateways, and Access Points, specifically ArubaOS (AOS) 8 and 10. HPE notes that "any hardware, Mobility solutions (such as conductors, controllers, and gateways), access points, or virtual machines (VMs) compatible with the affected versions are vulnerable." Of the maximum-severity vulnerabilities, three are authentication bypasses: CVE-2026-79844 allows remote code execution (RCE) in AOS-10, CVE-2026-79850 allows RCE in AOS-8, and CVE-2026-79845 allows unauthorized access and modification of sensitive data through exploitation of the PAPI Protocol in AOS-10. Two of the eight are unauthenticated buffer overflows: CVE-2026-79847 and CVE-2026-79851 both allow RCE in AOS-10. Two more are unauthenticated SQL injection flaws, CVE-2026-79848 and CVE-2026-79849 allow RCE in AOS-8. Finally, CVE-2026-79846 is an unauthenticated command injection vulnerability that allows arbitrary commands to be run on the underlying operating system in AOS-8. 24 of the remaining flaws are critical, ranging from CVSS 9.8 to 9.3, and another 31 are high-severity, ranging from CVSS 8.8 to 7.0. Users should address the flaws by upgrading to the following AOS versions or above: 10.8.1.2, 10.7.2.7, 10.4.1.14, 8.13.3.1, and 8.10.0.24. HPE also notes that users can minimize likelihood of exploitation by restricting CLI and web-based management interfaces to a dedicated layer 2 segment/VLAN and/or controlling them with firewall policies at layer 3 and above, "along with accounting controls for tracking and logging user activities and resource usage."

On Monday, October 26, Apple published updates for all its operating systems and for the Safari browser, addressing a total of 304 security vulnerabilities. This release includes a backported fix for a high-severity flaw affecting older versions of iOS and iPadOS, which was already addressed in iOS and iPadOS 26.7.1, macOS Tahoe 26.7.1, and macOS Sequoia 15.8.1 on September 28, and was known to be exploited in targeted attacks at the time of disclosure. CVE-2026-86950, CVSS score 8.8, allows an attacker to achieve arbitrary code execution by exploiting an out-of-bounds write issue when CoreGraphics processes a maliciously crafted file. This flaw has now been fixed in iOS and iPadOS 18.7.11, available for iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generationAir 4th generation and later, iPad 9th generation and later, and iPad mini 6th generation and later. The SANS Internet Storm center also indicates two other notable vulnerabilities addressed in the release: CVE-2026-86990 (CVSS score not yet assigned) allows a malicious app to access the camera without user permission, and CVE-2026-28864 (first disclosed in March 2026, CVSS score 3.3) allows a local attacker to gain access to a user's Keychain items. The software released in this update includes version 27.2 of iOS and iPadOS, macOS Golden Gate, tvOS, watchOS, visionOS, and Safari; iOS and iPadOS 26.7.2 and 18.7.11; macOS Tahoe 26.7.2; and macOS Sequoia 15.8.2.

Quest Diagnostics has published a notice and an FAQ informing providers and patients of a cyber incident in which the company's Quanum Lab Services Manager (LSM) system was accessed without authorization. Quanum LSM is a platform used by healthcare providers to centralize tasks and information related to labs, supplies, specimens, test results, pricing, billing, and other functions. The company's Form 8-K filing with the US Securities and Exchange Commission (SEC) states that Quest Diagnostics became aware of the unauthorized access on October 21, 2026, activated its incident response procedures for containment, assessment, investigation, and remediation, and contacted law enforcement as well as external cybersecurity experts. Personal information and patient records including Protected Health Information (PHI) and Personally Identifiable Information (PII) were accessed by an unauthorized third party, but the full scope of the breach is still under investigation. Access to Quanum LSM was temporarily disabled, but business services were not materially or operationally affected, including direct-customer LIS interfaces and EMRs. Clients that normally use Quanum LSM to order testing can find their local PSC through the Quest Diagnostics website and make requisitions via fax, and providers looking for test results can call the customer services hotline or use eFax. Quest Diagnostics does not believe this incident is related to the critical vulnerabilities in PHP that were patched on October 21. The company will notify those affected as investigation continues, and mentions future offers of credit and identity monitoring. TechCrunch notes that the incident notification page contains a "noindex" tag that hides the page from search engines.

Operations at the University of New Mexico Health System in Albuquerque — which includes the UNM Health Sciences Center (HSC) and more than 30 UNM Health clinics — have been disrupted by a cyber incident that took place on Monday, October 26. Between 12:30pm and 2:30pm MDT, UNM Health was forced to cancel all appointments, divert ambulances, stop accepting new patients, and suspend outpatient surgeries, reportedly coordinating with two other local healthcare providers, Presbyterian Healthcare Services and Lovelace Health System, to redirect patients for care. After 2:30pm, UNM health started restoring systems in phases and gradually resuming operations. All Monday and Tuesday classes on the Health Sciences campus have been cancelled, and the academic and research units of UNM Health Sciences will remain closed on October 27; nonessential employees have been sent home. When the HSC IT security teams became aware of the unspecified cybersecurity event, they took steps to contain it and to protect the network, also notifying state and federal law enforcement and engaging external partners to aid investigation. UNM leadership also activated an Emergency Operations Center "to coordinate the response and provide guidance to HSC employees, students and UNM Health system frontline providers," and will provide updates by Tuesday morning (10/27) about outpatient surgeries and appointments.

INTERPOL has published an announcement describing the accomplishments of its recent cybercrime crackdown effort throughout Africa known as "Operation Serengeti III," which involved law enforcement from 21 countries and took place between June 29 and August 31, 2026. The operation targeted "cyber-enabled fraud, ransomware, business email compromise (BEC), online scams and digital extortion," and resulted in the disruption of 10,909 malicious networks, the arrest of 1,462 suspects, and the recovery of US$105 million in illicit funds. Investigators from Angola, Benin, Cameroon, Congo, Côte d'Ivoire, Democratic Republic of Congo, Eswatini, Gabon, Gambia, Ghana, Kenya, Mozambique, Nigeria, Rwanda, Senegal, South Africa, Tanzania, Uganda, Zambia, Zimbabwe, and the US began by accumulating intelligence on suspicious domains, IP addresses, and command-and-control infrastructure, and were supported with analysis, operational expertise, and additional intelligence provided by private sector partners. The press release highlights the dismantling of fraud operations in Uganda, illegal cryptocurrency mining centers in Angola, a large-scale phishing and BEC operation and an investment fraud scheme in Nigeria, a malicious loan application scheme in Tanzania, a vehicle import fraud network in Gabon, and an unspecified cybercrime operation in the Republic of Congo. The first Operation Serengeti took place in 2024, and the second in 2025, each also leading to over 1,000 arrests, tens of thousands of takedowns, and tens of millions of dollars in seized funds.

Japanese video game company Capcom has published a notice disclosing a recent breach of its CAPCOM ID membership service. On October 19, the company detected and blocked unauthorized access, implemented emergency measures, and launched an investigation into the cause, scope, and method of attack involved. On October 20, the company reported the incident to the Information Technology Security Oversight Committee and "established an internal incident response headquarters" while investigation continued, revealing that the intruder had accessed customer information registered with CAPCOM ID, including email addresses and "system-specific identifier information" contained in 11,774,247 records, and accessed the date of birth, gender, country/region, and nickname for 43 of that set. Additionally, 196 affected accounts had their CAPCOM ID passwords changed without authorization. These account holders' original passwords do not seem to have been exposed, and the attacker-changed passwords have since been reset, but Capcom published an update on October 23 noting that the intruder accessed the e-Capcom account pages of 19 of those 196 accounts, affecting additional data including “name, name in Japanese phonetic characters, telephone number, postal code, address, gender, date of birth, purchase history, e-Capcom customer inquiry history, [and] saved address book information.” It does not appear that any credit card information has been compromised. On October 21, Capcom filed reports with the Osaka Prefectural Police and Japan’s Personal Information Protection Commission. The company has "identified and addressed the attack method," but has not published further information. CAPCOM ID and the publisher's games are still accessible, but the company recommends users exercise caution and refrain from opening URLs or files in suspicious messages in case stolen information is used to send fraudulent communications. Emergency response measures are now complete, and Capcom has created support hotlines, forms, and email addresses for customers; those affected will be contacted directly.

The UK Government's Department for Digital, Culture, Media and Sport is calling for an overhaul of the legislation protecting critical undersea infrastructure (CUI), proposing modernizations for existing laws that "[have] not been updated to reflect technological advances, the growing importance of undersea infrastructure, or the evolving threat environment." The proposal's section on criminal penalties notes that "the Submarine Telegraph Act 1885 (‘STA’) remains the UK’s principal piece of legislation designed specifically to protect subsea cables from harm," and that this law's scope and penalties are no longer applicable. The proposal points to recent submarine activity allegedly targeting CUI, and mentions growing demand for and reliance on many forms of "high-capacity international connectivity" as motivators for ensuring the infrastructure's security and resilience beyond "commercial incentives and voluntary arrangements alone." A recent government review concluded that existing UK legislation fails to deter of harmful conduct affecting CUI, fails to strengthen security and resilience duties performed by subsea telecom cable owners and operators, fails to grant the government sufficient power to address threats to these cables, and fails to both manage national security risks and realize potential benefits of "new fibre-optic sensing technologies." New maximum sentences are proposed for different levels of harmful actions, including up to 14 years in prison for intentional conduct. Courts would be given flexibility to impose fines across all categories without limitations, allowing the scale to apply to corporate offenders as well as to individuals. Further chapters cover legally mandated duties for security and resilience, government powers to direct industry to take certain actions, and the implementation and security of sensing technologies such as Distributed Acoustic Sensing (DAS) and Distributed Temperature Sensing (DTS). Consultation on this proposal will be open until January 14, 2027.

The US Cybersecurity and Infrastructure Security Agency (CISA) has published an agency strategy document titled, "CISA 2030: Defend, Harden, Prevail." The guidance is structured around these three pillars, and is motivated by a need to "transform [CISA's] operational model to advance collective cyber defense, harden infrastructure most essential to [US] national and economic security, and mobilize [CISA] partnerships to strengthen collective resilience." The key objectives for "Defend" assert CISA's responsibility to lead national cyber defense by integrating cyber defense capabilities across all levels of government, industry, and other stakeholders; by improving visibility, anomaly detection, and supply chain integrity in an effort to modernize and secure operational technology (OT); by establishing data-driven guidance and best practices for developing secure software and maintaining a transparent supply chain; and by assessing and securing emerging technologies. The objectives for "Harden" are to invest in and mature the "intelligence-to-operations pipeline" by improving technology, decision making and alerts, and operational response; to support security prioritization by maintaining and analyzing infrastructure data and helping to develop the National Risk Register; to "advance infrastructure security through localized action" in a network of partnerships; and to reinforce domestic critical infrastructure. "Prevail" focuses on spreading capability through CISA advisors and through its ten regional offices; on strengthening interoperability and continuity of national security/emergency preparedness (NS/EP) communications; on continuously assessing readiness and joint planning efforts; and on "investing in scalable, encrypted, and resilient infrastructure," also prioritizing interoperability and continuity. CISA sets three milestones for this strategy: Within 60 days, the agency will begin a preparatory review of its services and capabilities; within 180 days, the agency will deliver a plan for implementation and for measuring outcomes; and within 365 days, the agency will provide an update on its progress.

The State Bank of India (SBI) has filed a legally mandatory disclosure with India's National Stock Exchange and BSE Limited, describing a recent "incident involving data loss." On October 16, SBI was notified by CERT-In and by the Defense Cyber Agency, SBI's threat intelligence service provider, that SBI customer information may have been exposed on the dark web. Analysis confirmed that "of approximately 375,000 records available on the dark web, 3,897 customer records containing Personally Identifiable Information (PII) were identified," which included mobile number, date of birth, name, gender, email address, residential address, branch and CIF identifiers, lead IDs, and metadata and files associated with loan/lead records. SBI activated protocols for incident response and containment, and engaged a cybersecurity agency empaneled by CERT-In to assist with assessment of the incident. SBI states that the bank's business, operations, and financials have not been materially impacted nor disrupted, and assessment is continuing alongside remedial and preventive measures. SBI's official notice addressing customers on social media emphasizes that "the incident has impacted a very very small number of customers," and states that "customer balances are completely safe."