Waper
Use on the web

Cybersecurity

Major breaches and actively exploited vulnerabilities, threat research worth reading, and the policy and business moves in security.

  • Official
  • Public
  • 0 followers
Sign up to followCustomize it
You're reading the brief from Thu, Oct 29.
Back to the latest brief

Active exploitation of Cisco firewall, PHP and Brotli vulnerabilities makes patch prioritization urgent.

Cybersecurity6 items

Major data exposures affected DHS personnel and Sony ISP customers, while a cyberattack forced Moldova to take more than 80 public services offline.

Vulnerabilities

Cisco patches firewall zero-day exploited to crash SSL VPN devices

Cisco released updates for an actively exploited denial-of-service vulnerability in ASA and FTD software. Unauthenticated attackers can exploit the Remote Access SSL VPN service to force vulnerable firewalls to reload.

Why it matters: Internet-facing VPN infrastructure faces an immediate availability threat, making these updates a priority for affected organizations.

Vulnerabilities

CISA warns attackers are chaining Linux Fragnesia flaw with PHP2Shell

CISA warned federal agencies to patch a high-severity Linux kernel privilege-escalation vulnerability being chained with PHP2Shell flaws in active attacks. Unit 42 also detailed two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619.

Why it matters: The attack chain makes both web application exposure and underlying Linux privilege escalation relevant to remediation priorities.

Vulnerabilities

CISA confirms active exploitation of critical Brotli Node2Shell vulnerability

Risky.biz reported a newly disclosed remote code execution vulnerability in Google's Brotli compression library affecting servers that decompress Brotli data, including Node.js, Python apps, Bun, Envoy, and Istio. The transcript summary does not confirm active exploitation or CISA involvement.

Why it matters: The flaw spans several server technologies, making it relevant to anyone tracking exposure across applications and infrastructure that process Brotli-compressed data.

Breaches & attacks

Moldova takes more than 80 public services offline after cyberattack

Moldova temporarily shut down 82 online public services after attackers stole personal and financial data on 750,000 citizens, roughly one third of its population. Attackers tried to regain access after being evicted, while the digital agency began restoring services.

Why it matters: The breach shows how a large-scale data theft can disrupt public services while defenders face continued attempts to regain access.

Ask Kiki about this brief

Sign in to ask questions about this brief.

Recent briefs

  1. Tue, Nov 38 itemsA hijacked security-tool update channel delivered backdoors to Linux servers, while active exploitation hit Siemens industrial devices, Node-RED and Synology NAS systems. Other major developments include a breach affecting over 1.3 million people and a cyberattack on Brazil’s largest cryptocurrency exchange.
  2. Mon, Nov 26 itemsGoogle and partners disrupted a 1.3 million-device Android botnet, while active attacks continued against Ivanti gateways, GitLab servers and outdated BTCPay Server installations. New developments included Binance theft tracing and Polymarket’s reimbursement pledge.
  3. Sun, Nov 15 itemsThe FBI attributed the Binance crypto theft to North Korea-linked TraderTraitor, while a hijacked third-party script cost Polymarket traders about $2.7 million. Alpine Linux rebuilt its GitLab server after an attempted exploit, and newly detailed vulnerabilities affect Canonical infrastructure and Android phones.
  4. Sat, Oct 318 itemsActive exploitation of Ivanti Connect Secure flaws and a remote-root Linux kernel vulnerability lead this edition. Northflank and Chainalysis disclosed breaches, while OpenAI fixed a flaw that could expose private ChatGPT conversations.
  5. Fri, Oct 308 itemsBinance reported a $6.3 billion theft, while Florida disclosed a financial-aid breach exposing 4.9 million people’s Social Security numbers. A compromised coding extension and active exploitation of GitLab, Drupal and PHP flaws add immediate priorities for security teams.
  6. Thu, Oct 296 itemsActive exploitation of Cisco firewall, PHP and Brotli vulnerabilities makes patch prioritization urgent. Major data exposures affected DHS personnel and Sony ISP customers, while a cyberattack forced Moldova to take more than 80 public services offline.
  7. Wed, Oct 288 itemsCISA confirmed active exploitation affecting Brotli and Adobe Commerce, while a Sony subsidiary disclosed a breach involving approximately 2.5 million customer records. Other major developments include widespread public-service disruption in Moldova and new details of PHP2Shell attacks.

Who and what it tracks

  • CISAOrganization8
  • GoogleCompany5
  • MicrosoftCompany4
  • CrowdStrikeCompany2
  • Palo Alto NetworksCompany1