RedLegg

10/27/2026

Security Bulletin: http://Node.js Brotli Decoder Remote Code Ex*****on — CVE-2026-111497 is a critical out-of-bounds write vulnerability affecting http://Node.js 22.x, 24.x, and 26.x.
Malformed Brotli-compressed input can cause the decoder to write beyond an internal buffer, potentially resulting in process memory corruption, application crashes, memory disclosure, or remote code ex*****on.

Applications that decompress externally supplied Brotli data using node may be exposed.
No exploitation in the wild has been reported, and the vulnerability is not listed in CISA's Known Exploited Vulnerabilities (KEV) Catalog.

The http://Node.js project has released fixed versions:
• http://Node.js v22.23.4
• http://Node.js v24.22.1
• http://Node.js v26.12.1

Organizations should inventory affected http://Node.js installations, including container images and hosting environments, apply the appropriate security update, and restart applications to ensure the fixed runtime is in use.

Prioritize internet-facing applications that process untrusted Brotli-compressed data.

*****on
https://hubs.li/Q04Cw5Vf0

Node.js CVE-2026-111497 is a critical Brotli decoder vulnerability that may allow remote code ex*****on or memory disclosure. Update affected Node.js versions.

10/21/2026

Security Bulletin: Multiple vulnerabilities affecting PHP

Critical PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619 may allow remote code ex*****on. Exploitation reported for CVE-2026-109618. Update PHP.

10/19/2026

Security Advisory: BeyondTrust Remote Support Vulnerability (CVE-2026-102764)
BeyondTrust has released emergency security updates for a critical authentication bypass vulnerability affecting self-hosted Remote Support deployments. The vulnerability is confirmed to be actively exploited and has been used to gain unauthorized access to appliances.

Recommended actions:
• Apply the BT26-05-RS patch immediately
• Investigate all self-hosted appliances for indicators of compromise
• Restrict administrative and external access to only required services
• Forward appliance logs and session events to your SIEM
• Rotate credentials and terminate active support sessions if compromise is identified

Organizations using self-hosted BeyondTrust Remote Support should prioritize remediation and threat-hunting activities.

CVE-2026-102764: Actively exploited BeyondTrust Remote Support vulnerability that enables authentication bypass and appliance compromise. Patch immediately

10/14/2026

Security Bulletin: PAN-OS Management Interface Remote Code Ex*****on — CVE-2026-0322 is a high-severity vulnerability affecting Palo Alto Networks PA-Series and VM-Series firewalls and Panorama appliances. CVSS 8.6.

An authenticated attacker with high privileges and network access to the management interface can exploit the vulnerability to execute arbitrary code with root privileges.
Palo Alto Networks has confirmed limited exploitation in the wild, and CISA has added the vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog.

No special configuration is required for affected PAN-OS versions to be vulnerable.
Organizations should identify affected firewalls and Panorama deployments, upgrade to the appropriate fixed release, and restrict management interface access to trusted internal IP addresses.

Security teams should also review available logs for connections associated with reported exploitation attempts, including 66[.]42[.]72[.]14, 208[.]83[.]239[.]114, and 149[.]248[.]47[.]234.

PAN-OS CVE-2026-0322 is an actively exploited code injection vulnerability allowing authenticated root-level code ex*****on. Update affected firewalls and Panorama.

10/14/2026

Security Bulletin: Cisco Secure Email Gateway Arbitrary File Write — CVE-2026-76519 is a critical vulnerability affecting the Advanced Malware Protection feature in Cisco Secure Email Gateway. CVSS 9.8.

An unauthenticated remote attacker can send an email containing a crafted attachment through an affected appliance, potentially writing arbitrary files and executing commands with root privileges.

Active exploitation has been confirmed.

The vulnerability affects appliances with File Reputation enabled in a mail policy and Content Scanner Tools versions earlier than 25.3.0.5525.

Cisco has released a Content Scanner Tools update that addresses the vulnerability without requiring a software upgrade or restart. Cisco also recommends upgrading to AsyncOS 16.5.0-780.

Organizations should verify their Content Scanner Tools version, apply the update, and review affected appliances and cluster members for indicators of compromise.
Because exploitation can provide root access, local logs alone may not be sufficient to rule out compromise. Corroborate findings with external network and firewall logs and follow Cisco's recovery guidance for compromised systems.

Cisco Secure Email Gateway CVE-2026-76519 is an actively exploited critical vulnerability allowing root-level command ex*****on. Apply the Content Scanner Tools update.

10/14/2026

Validation schedules are often calendar-driven because calendars are easy to manage.

The environment rarely changes on that schedule.

A new federation model can alter identity traversal. A segmentation change can close one route and make another reachable. New cloud roles, workloads, or trust relationships can change previously validated paths.

M&A can introduce inherited identities, configurations, and trust boundaries. Major remediation can remove the original weakness while leaving the objective reachable through another route.

Each of those changes can materially alter attacker reachability without waiting for the next annual assessment.

That makes the environment itself a useful input into testing cadence.

Continuous validation becomes more valuable when meaningful architectural and operational changes influence when the next validation cycle starts.

10/05/2026

Security Bulletin: Citrix NetScaler SAML Denial of Service — CVE-2026-88779 is a high-severity memory overflow vulnerability affecting NetScaler ADC and NetScaler Gateway appliances configured as a SAML service provider or SAML identity provider. CVSS 8.7.
An unauthenticated remote attacker can trigger the vulnerability to cause a denial of service. Repeated exploitation may keep the affected service unavailable.

CVE-2026-88779 is actively exploited and has been added to CISA’s Known Exploited Vulnerabilities (KEV) Catalog.

Organizations should upgrade affected NetScaler deployments to the applicable fixed version as soon as possible. Teams should check appliances for samlAction and samlIdPProfile configuration entries and prioritize systems where either is present.
Secure Private Access Hybrid deployments using NetScaler instances should also be identified and upgraded.

Citrix NetScaler vulnerability CVE-2026-88779 allows unauthenticated attackers to cause denial of service in SAML configurations. Actively exploited upgrade affected appliances.

10/02/2026

Security Bulletin: Fortinet FortiMail Arbitrary File Write — CVE-2026-104286 is a critical path traversal vulnerability that may allow an unauthenticated attacker to write arbitrary files to the underlying system through crafted HTTP or HTTPS requests. CVSS 9.8.
Fortinet has confirmed active exploitation, and CISA has added CVE-2026-104286 to its Known Exploited Vulnerabilities (KEV) Catalog.

No patched version is currently available for most affected FortiMail branches. Organizations should immediately disable IBE feature support, which Fortinet identifies as the current workaround, and restrict management interface access to trusted private networks.

Teams should also review encryption logs for BufferException errors involving invalid Base64 encoding in the IBE decryption path and investigate affected appliances for signs of compromise.

Monitor Fortinet's advisory for patched releases and apply them as soon as they become available.

Fortinet FortiMail vulnerability CVE-2026-104286 allows unauthenticated arbitrary file writes via path traversal. Actively exploited—apply Fortinet's IBE workaround immediately.

10/02/2026

Security Advisory: NetScaler SAML Authentication Vulnerability
Citrix has issued advance guidance regarding a vulnerability affecting NetScaler ADC and NetScaler Gateway deployments configured for SAML authentication. Fixed builds have not yet been released, but organizations are encouraged to assess their exposure immediately.
The issue affects appliances configured as a SAML Service Provider or Identity Provider and may impact internet-facing Gateway and AAA deployments.

Recommended actions:
• Audit NetScaler appliances for SAML authentication configurations
• Identify internet-facing Gateway and AAA virtual servers using SAML
• Evaluate whether SAML can be temporarily disabled where not operationally required
• Restrict management access to trusted networks
• Forward authentication logs to your SIEM and monitor for suspicious activity
• Be prepared to apply Citrix security updates as soon as they are released

Early validation of affected systems can help accelerate remediation once vendor patches become available.

A NetScaler SAML authentication vulnerability affects SAML-enabled ADC and Gateway deployments. Audit configurations now and prepare to apply Citrix fixes upon release.

09/28/2026

Security Bulletin: Multiple vulnerabilities affect Citrix NetScaler ADC and NetScaler Gateway, including two critical zero-days actively exploited in the wild.

CVE-2026-88771 and CVE-2026-88772 are both rated CVSS 9.5 and can allow unauthenticated attackers to execute commands or code on vulnerable NetScaler appliances. CISA added both vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog.

Citrix Security Bulletin CTX697096 also addresses six additional vulnerabilities, ranging from High to Critical severity. Citrix states that every NetScaler deployment is affected by at least one vulnerability covered by the bulletin.

Organizations should upgrade to the applicable fixed builds immediately and investigate exposed appliances for indicators of compromise.
For CVE-2026-88778, upgrading alone is not sufficient. Administrators must also enable Enhanced ISN Generation as directed by Citrix.

Multiple Citrix NetScaler vulnerabilities include two actively exploited zero-days, CVE-2026-88771 and CVE-2026-88772. Upgrade affected ADC and Gateway appliances immediately.