Daily Security Intelligence Briefing — October 25, 2026
Tier 1 — Priority Targets (Must-Read)
1. NetScaler Dual Zero-Days Exploited in the Wild Prior to Disclosure
Source & Article Link: ThreatAft
Technical Severity / Domain: Network Security / CVE-2026-88771 & CVE-2026-88772 (Active Exploitation)
Why You Must Read This: Attackers actively exploited two zero-day vulnerabilities in Citrix NetScaler ADC and Gateway appliances for three weeks prior to public disclosure, compromising over 100 enterprise environments. CVE-2026-88771 allows unauthenticated root execution via log manipulation within 24 hours of triggering, while CVE-2026-88772 provides direct unauthenticated root access via a DTLS heap overflow on default VPN vservers. Both flaws affect the entire fleet without requiring specific configurations, making them high-priority perimeter risks.
Recommended Immediate Action: Immediately update NetScaler ADC and Gateway instances to version 14.1-73.46 or later, and audit device logs from the past 30 days for unexpected log entries or crashes in the ns_monuploadd_err.pl process.
2. Widespread PHP2Shell Mass Exploitation and Secondary RCE Disclosures
Source & Article Link: Help Net Security
Technical Severity / Domain: Web Infrastructure / CVE-2026-109618, CVE-2026-109619 & CVE-2026-115560 (Mass Exploitation)
Why You Must Read This: Mass scanning and exploitation attempts for PHP2Shell remote code execution vulnerabilities were observed days before official vendor patch release, impacting web hosting environments globally. Additionally, a secondary unpatched RCE vector (CVE-2026-115560) involving PHP session upload progress and serialization mismatches was disclosed shortly after. While specific configuration prerequisites bound full weaponization, millions of automated exploit packets are hitting exposed web infrastructure.
Recommended Immediate Action: Apply the latest PHP security updates immediately, audit web application servers for newly created web shells deployed prior to patching, and set session.upload_progress.enabled = Off in php.ini where applicable.
Tier 2 — Essential Intelligence (Summaries & Analysis)
1. CISA Adds Collabora CODE Server and Arista VeloCloud Flaws to KEV Catalog
Domain: Vulnerability Management
Subject / Topic Summary: CISA added CVE-2026-110447 (Collabora Online CODE Server OS command injection) and CVE-2026-114625 (Arista VeloCloud Orchestrator SQL injection) to its Known Exploited Vulnerabilities catalog. Threat actors are actively using the Collabora flaw to plant web shells on Nextcloud servers, while Arista VeloCloud SQLi attacks have been traced to Japanese IP addresses.
Key Technical & Strategic Takeaways: Collabora CODE server vulnerability allows unauthenticated command injection even when the server process is stopped.; Federal Civilian Executive Branch (FCEB) agencies face an immediate patching deadline for both flaws.
Essential Direct Quote: Attackers are actively exploiting CVE-2026-110447 to backdoor Nextcloud environments with web shells.
Source: The Hacker News
2. Node.js and Cloud Proxies Exposed to RCE via Brotli Decoder Flaw
Domain: Application & Library Security
Subject / Topic Summary: A critical memory corruption vulnerability (CVE-2026-111497) in Google's C-based Brotli decoder allows attackers to write past buffer bounds via crafted compressed payloads. The vulnerability cascades across downstream runtimes and reverse proxies that bundle Brotli, including Node.js, Bun, Envoy, and Istio.
Key Technical & Strategic Takeaways: Imperva demonstrated remote code execution against unpatched Node.js applications receiving malformed compressed HTTP data.; Fixes require updating individual bundled dependencies across Node.js (22.23.4 / 24.22.1), Bun (1.4.4), and Python brotli packages.
Essential Direct Quote: Crafted compressed data overwrites past the buffer end leading to crash, memory leak, or remote code execution.
Source: The Hacker News
3. BlackX UEFI Bootkit Exploits Legacy Baton Drop Flaw to Bypass Secure Boot
Domain: Endpoint & Firmware Security
Subject / Topic Summary: A newly identified UEFI bootkit dubbed BlackX was discovered bypassing Secure Boot during espionage operations by abusing the known Baton Drop vulnerability. Once established, BlackX drops a kernel driver engineered to disable EDR and antivirus tools, specifically targeting Kaspersky and Avast security software.
Key Technical & Strategic Takeaways: Demonstrates continued threat actor reliance on unpatched or legacy UEFI vulnerabilities to achieve persistent boot-level execution.; Disables security agent driver checks early in the OS boot sequence before defense mechanisms initialize.
Essential Direct Quote: BlackX loaded a malicious driver designed to interfere with security solutions from Kaspersky and Avast.
Source: BleepingComputer
4. Autonomous AI Attack Agent 'Skynet' Caught Hijacking External Models in Honeypot
Domain: AI & Emerging Tech Security
Subject / Topic Summary: Symantec security researchers captured an autonomous attack agent in an AI honeypot that actively hijacked exposed third-party AI models to execute up to 100,000 attack steps without human interaction. Separately, OpenAI announced plans to air-gap frontier model training due to risks involving VM escapes and unauthorized cross-sandbox communications.
Key Technical & Strategic Takeaways: Attacker instruction sets enable autonomous reconnaissance, lateral movement, and exploit execution across connected LLM tools.; Highlights the rising threat of autonomous agent-on-agent hijacking and untrusted model output execution.
Essential Direct Quote: The agent was configured to run up to 100,000 steps without human approval by taking control of exposed models.
Source: The Register