Today's outlook

CISA flags two actively exploited flaws — Adobe Commerce/Magento and Google Brotli — as the Brotli bug spreads well beyond Node.js

By The IT Security Desk

Good morning. CISA says it added two vulnerabilities to its Known Exploited Vulnerabilities Catalog on 27 October based on evidence of active exploitation: an unrestricted upload of a file with a dangerous type in Adobe Commerce and Magento, and an unchecked return value flaw in Google Brotli. CISA says Binding Operational Directive 26-04 requires Federal Civilian Executive Branch agencies to prioritise rapid remediation of catalogued vulnerabilities. If you run either product, treat these as in-the-wild and remediate per the vendor advisory; match the affected products CISA lists against your estate rather than assuming reach.

The Brotli flaw matters well beyond its headline product. Help Net Security reports that the bug in Brotli — Google's widely used open-source compression library, tracked under the nicknames "Node2Shell", "Broccoli2Shell" and "Brotli2Shell" — is a remotely exploitable out-of-bounds write that puts a broad range of software at risk. Because the library is bundled widely, inventory where Brotli is embedded, not only where Node.js is installed.

SecurityWeek reports that Tailscale is preparing a patch for Tailscale SSH flaws, dubbed "Tailworm", whose details went public over the weekend before any fix had been released. If you run Tailscale SSH, watch for the vendor's patch and apply it when issued.

BleepingComputer reports that Microsoft released out-of-band Windows updates to remove trust in certificates tied to compromised eMudhra certificate authority keys, protecting systems that do not receive automatic certificate trust updates. Apply the OOB update on machines without automatic root certificate updates.

On ransomware and health: BleepingComputer reports that Japan's GMO Group urged customers to disconnect from the internet and shut down computers after a threat actor who breached its Onamae Desktop Cloud threatened a ransomware attack that day. BleepingComputer reports that the University of New Mexico Health Sciences Center disclosed a cyberattack causing system outages that disrupted patient care and surgeries; The Register reports a second day of cancelled classes, with hospitals resuming patient intake after initial ambulance diversion.

On breaches and supply chains: BleepingComputer reports that Warp disclosed a breach exposing AI agent decision logs and user telemetry via a third-party vendor, and that a card-skimming group compromised a shared analytics script used by e-commerce platform Convertr to steal payment data at checkout. The Record reports that His Majesty's Inspectorate of Constabulary and Fire & Rescue Services found UK police data breached several times this decade through third-party IT suppliers — review your supplier access accordingly.

In enforcement, The Record reports that Ukrainian national Artem Stryzhak, 36, was sentenced to 70 months after pleading guilty to charges tied to the Nefilim and Hive ransomware groups, and that the US indicted a Malaysian national following a Madagascar scam-centre raid.