This week, we briefed our clients on shifting their mindset. Act as if you're already compromised and focus on controls to limit a full domain compromise.
KEY TAKEAWAYS
The new defensive mindset – assume compromise. Review different “compromise” scenarios to evaluate how threat actors can use that access to achieve Domain Admin.
Critical and high-severity vulnerabilities PHP, NodeJS/Python, eMudhra, Oracle, HPE Aruba, Cisco, Veeam, GitLab, Claude Code, Linux, Tailscale, and Langlow, plus updates to CISA KEV, patch now!
That is the mindset defenders need to have today. With AI tools rapidly increasing the rate of vulnerability discovery and exploit development, as well as making it incredibly simple and easy for threat actors to create convincing social engineering lures, we have entered an era where it is virtually impossible to secure the "perimeter" of a network. This situation does not mean "Game Over" though. Instead, defenders need to shift their mindset and configure and harden their networks accordingly. If a threat actor gains a root shell on a VPN device at the edge, or Sally from HR gets vished and is convinced to download and install an RMM tool giving the attacker a foothold on her laptop, there should be barriers and controls in place that prevent the threat actor from turning this initial foothold into full domain compromise (hint: think zero-trust).
Scenario 1
A new 0-day is discovered for a leading SSL VPN edge device used by enterprise networks. You happen to have one of these devices open to the internet (it's how your employees connect to the network from home), and a ransomware group exploits the vulnerability and installs a webshell before you are able to apply the patch.
There are a number of factors that will determine if this scenario leads to a rapid domain compromise or the threat actor getting stuck in their tracks.
Require authorization beyond the VPN connection - Simply authenticating to the VPN should not be enough to gain unlimited access to applications and systems within the network. Additional authentication and authorization should be required for using internal applications. Bonus points if these require phishing-resistant MFA.
Domain Hardening - Locking down Active Directory is crucial. Review accounts for excessive permissions, shared administrative credentials, validate service account permissions, and review other potential configuration weaknesses. The September 21 Intel Report reviewed this in depth.
Test The Assumption - Use red team assessments to test the scenario and help identify any missed paths to domain admin.
Scenario 2
Sally from HR receives a phone call from someone claiming to be IT Support. The caller is very convincing and eventually talks Sally into downloading and installing AnyDesk on her work laptop. The threat actor immediately uses this remote access to download and install additional remote access tools, giving them a persistent foothold on the network.
The scenario above is all too common, with more and more threat actors using this method to gain initial access (why "hack" something when the user will simply give you access?). There are certainly overlaps with security controls from Scenario 1, however, there are other controls and mitigations to consider:
In both scenarios, if the network is well isolated, permissions are locked down, and internal systems are patched, while they may technically be ways a threat actor can elevate privileges and traverse the network, the complexity and effort required to do it goes up dramatically. With this added complexity, it takes the threat actor much longer to achieve their goals, and they tend to generate much more "noise" on the network, which can mean the difference between them going undetected or getting caught in the act. Administrators and security teams should constantly operate under the assumption that edge devices and end-user devices are compromised and plan accordingly. Something as simple as a phone call should not lead to a full network compromise.
Resources
Vulnerability Roundup
On October 21, PHP disclosed two critical vulnerabilities that allow for remote code execution affecting all PHP versions dating back to version 5.4 (released in 2012). PHP is a general-purpose scripting language that is extremely common in websites, with some estimates stating it is used on up to 70% of the websites in the world. PHP is the language that powers popular content management systems such as WordPress, Joomla, Drupal, and more. The vulnerabilities are tracked as CVE-2026-109618 and CVE-2026-109619. On the day of disclosure, prominent web security companies like Wiz and Google claimed they were able to use AI to craft exploits for these vulnerabilities, which added to a sense of urgency for patching.
However, since the disclosure, while in-the-wild exploitation has been observed, each case has been targeted toward a specific PHP version at a time. Exploitation appears to be dependent on PHP build, the underlying operating system, and other PHP configurations. Exploitation is also extremely difficult, which limits the pool of threat actors that can abuse these vulnerabilities. This set of circumstances has meant that so far, there is no "one size fits all" exploit that is able to mass-compromise all of the vulnerable PHP sites. However, these vulnerabilities are currently under active exploitation, so administrators are urged to apply the patch as soon as possible if they have not already done so. Administrators can also use tools such as SOCRadar's free php2shell checker to scan their website to see if it is vulnerable.
https://cloud.google.com/blog/products/identity-security/responding-to-core-php-vulnerabilities-cve-2026-109618-cve-2026-109619
https://thehackernews.com/2026/10/php2shell-attack-roots-25-servers.html
Just a short 2 days after releasing the emergency fixes for PHP2Shell, PHP warned of another remote code execution vulnerability. Tracked as CVE-2026-115560, this issue affects a much smaller subset of PHP deployments as it requires a certain set of conditions. In order to be vulnerable, the web application must: set the session.serialize_handler option to "php_binary" or "php_serialize" in its configuration, then change that option to "php" while running by calling ini_set(), and make that change before it calls session_start(). Additionally, session upload progress must also still be turned on. Instead of issuing a patch for this vulnerability, PHP recommends the following mitigation: setting session.upload_progress.enabled=0. Incidentally, this setting is also a mitigation for CVE-2026-109619, part of the PHP2Shell set of vulnerabilities.
On October 21, as part of their October 2026 Security Release, NodeJS disclosed CVE-2026-111497, a high-severity remote code execution flaw in the Brotli decoder bundled with Node.js versions 26.x, 24.x, and 22.x. Brotli is a library written in C by Google and is used in HTTP clients to decode compressed data. Proof-of-concept exploit code was released in the wild, and active exploitation of this vulnerability has been confirmed. Additionally, other languages used for web applications were found to use the vulnerable library, including certain Python packages, web request libraries urllib3, requests, httpx, and aiohttp. PHP for Windows versions 8.2 through 8.5 were found to use the vulnerable library, and recommended administrators download the new PHP builds here. Administrators are urged to review their web applications for use of this library and patch accordingly.
https://nodejs.org/en/blog/vulnerability/october-2026-security-releases
https://www.imperva.com/blog/node2shell-from-brotli-data-to-remote-code-execution/?x=1
https://discourse.thephp.foundation/t/announce-updated-php-windows-builds-for-brotli-security-fix/6324
https://socradar.io/blog/node2shell-brotli-flaw-hits-python-packages/
On October 20, it was disclosed that eight intermediate CA certificates from the India-based certificate authority eMudhra Limited were compromised. All eight private keys for these certificates were so weak, it was possible for anybody to create "fake" valid certificates. All major web browsers quickly blocked the certificates. The "cleanup" issue resides in things like IoT devices, developer tools such as git, curl, and python3. The unofficial disclosure site has a list of OS distributions, libraries, language runtimes, applications, and tools that are vulnerable and have received patches. There is also a list of workarounds for cases where patches cannot be applied. Administrators are urged to review these lists and ensure that these certificates are no longer trusted in their environment.
https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/0R3XLJL6FuE/m/0XofdebrAAAJ
https://arstechnica.com/security/2026/10/the-internet-goes-on-high-alert-after-discovery-of-8-compromised-tls-certs/
https://ifin.network/t/emudhra-intermediate-certificates-compromised/909
Oracle released a Critical Patch Update for their E-Business Suite software which contains fixes for 194 new vulnerabilities. Among these vulnerabilities is CVE-2026-101767, a critical flaw in the Core component of the Oracle Application Object Library. Per the advisory, the vulnerability is easily exploitable over HTTP and requires no user interaction, where "a single network request to an exposed E-Business Suite endpoint is sufficient to compromise the component." The attacker also does not need valid credentials to successfully exploit the vulnerability. The following product versions are affected:
Administrators are urged to apply the update as soon as possible.
https://www.sentinelone.com/vulnerability-database/cve-2026-101767/
https://www.oracle.com/security-alerts/cpuoct2026.html#AppendixEBS
Hewlett Packard Enterprise released fixes for 72 vulnerabilities in the Aruba Operating System (ArubaOS). Out of these 72 vulnerabilities, 8 of them are maximum-severity authentication bypass and code execution flaws. Each of these flaws are low-complexity and do not require user interaction. All of the vulnerabilities listed in the advisory affect the following devices and versions:
Administrators are urged to apply the patches as soon as possible.
On October 28, Cisco disclosed CVE-2026-76418, a high-severity vulnerability affecting the Remote Access SSL VPN service of Cisco Secure Firewall Adaptive Security Appliance (ASA) and Cisco Secure Threat Defense (FTD). Successful exploitation allows for an unauthenticated remote attacker to cause the device to reload unexpectedly, resulting in a denial-of-service (DoS) condition. Per the advisory, the vulnerability affects devices running a vulnerable version of ASA or FTD software, the SSL remote access VPN login service is reachable, and secondary authentication is configured in the tunnel group scope. The tables below show the vulnerable versions and their corresponding fixed versions. Administrators are urged to apply the fixes as soon as possible.
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-tunnel-dos-s6mgkb75
Veeam recently disclosed a series of vulnerabilities for their Backup & Replication product. Among these is CVE-2026-108142, a critical vulnerability in Windows-based Veeam Backup & Replication and Veeam Software Appliance that allows an unauthenticated attacker to bypass authorization on the CDP Coordinator Service. The flaw affects 13.1.1.18 and all earlier 13.1 builds, as well as 13.0.2.29 and all earlier version 13.0 builds. Fixes are available in builds 13.1.2.57 and 13.0.3.63. Administrators are urged to apply the fix as soon as possible.
On October 21, GitLab released a fix for a maximum-severity flaw affecting all versions going back to 7.0, which was released in 2014. Tracked as CVE-2026-110264, successful exploitation allows an unauthenticated remote attacker to run arbitrary code on vulnerable self-managed servers. The table below shows applicable update versions:
https://thehackernews.com/2026/10/critical-gitlab-flaw-cvss-100-could.html
https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/
On October 30, security researchers identified a version of Anthropic's official Claude Code extension, which was distributed via the Cursor IDE Extension Marketplace, contained code that attempts to install a persistent SSH backdoor on any system it is installed on. The issue affects specifically version 2.1.313. The backdoored version was only distributed through the Cursor marketplace, and not through Open VSX or Microsoft's VS Code Marketplace. Cursor has provided steps to validate if a host has been impacted here. The notice also shows that compromised hosts would connect to 134.209.82[.]225 via SSH/22 and HTTP/8099.
\*.ip:(134.209.82.225)
https://cursor.com/blog/claude-code-extension-security-notice
https://thehackernews.com/2026/10/official-claude-code-vs-code-extension.html
Last week, Anthropic disclosed a series of vulnerabilities discovered with Claude AI, including what they rated as a critical-severity race condition flaw in the Linux kernel's TCP code. Tracked as CVE-2026-98432, successful exploitation allows a remote attacker with no credentials to run commands as root on Linux servers that have a multipath TCP listener. While Anthropic gave the vulnerability a 9.8 CVSS score, Linux distributors including Red Hat, Amazon, Oracle, and SUSE rated the flaw between 5.9 and 8.1, based on claims that the race condition is difficult to win, so successful exploitation is difficult. Administrators are urged to patch as soon as possible. A table of Linux distributions and their associated patch can be found here.
https://www.anthropic.com/research/discovering-vulnerabilities-with-claude
https://thehackernews.com/2026/10/linux-kernel-tcp-flaw-with-98-cvss.html
Last week, details of a flaw in Tailscale dubbed "Tailworm" were disclosed by Erica Windisch from Cyberdione Labs. In short, if an attacker gains access to a device on a Tailscale network, they can abuse a port forwarding flaw to gain root access to other servers on the network. The attack will only work if Tailscale SSH is set up to allow port forwarding. Tailscale quickly released version 1.104.4 to fix the issue. Administrators are urged to apply the update as soon as possible.
https://github.com/tailscale/tailscale/releases/tag/v1.104.4
https://thehackernews.com/2026/10/unpatched-tailscale-ssh-flaws-could-let.html
https://thehackernews.com/2026/10/tailscale-patches-ssh-flaws-that-could.html
TeamViewer recently disclosed a series of vulnerabilities, including a high-severity integer overflow flaw in the remote-control screen processing component. Tracked as CVE-2026-111585, successful exploitation allows a malicious remote host to cause a denial-of-service (DoS) or potentially execute arbitrary code with the privileges of the viewer process. Exploitation requires a user to establish a remote-control session to an attacker-controlled or compromised host, which would typically occur in a social engineering attack. The vulnerability affects TeamViewer versions prior to 15.83. Administrators are urged to apply the updates as soon as possible.
https://www.teamviewer.com/en-us/resources/trust-center/security-bulletins/tv-2026-1011/
https://thehackernews.com/2026/10/teamviewer-flaw-lets-remote-computers.html
IBM recently disclosed multiple vulnerabilities in Langflow OSS, their Python-based "drag-and-drop" AI workflow software. Among these vulnerabilities is CVE-2026-93680, a critical improper authentication flaw that allows a remote attacker to bypass security restrictions. The flaw affects versions 1.0.0 -> 1.12.8. Administrators and developers are urged to patch as soon as possible.
The following vulnerabilities were added to CISA's Known Exploited Vulnerabilities Catalog in the last 2 weeks:
This report is provided FREE to the cybersecurity community.
Visit our Cyber Threat Intelligence Blog for additional reports.
Visit our Cyber Threat Profile Blog for detailed intelligence profiles.
Visit our Beyond the Threat Feed Blog for more articles.
Subscribe to be notified of future Reports:
NOTE
We have enhanced our report with data from SOCRadar. You may need to register to view their threat intelligence content.