Three-day deadlines don't leave room
for a missed email.
CyberComply monitors the CISA KEV catalog 24/7 and alerts you within minutes of every new listing, so the clock never starts without you.
KEV Brief: Edge Devices, Developer Platforms, and Foundational Code
Date: November 2, 2026
Eight new KEV entries landed between October 27 and 30. Three of the deadlines have already passed and a fourth is today, so this is a triage brief as much as an awareness one. The common thread is that attackers are chaining flaws to turn a small foothold into root or admin control, and two of this week's entries are the missing links in attacks we have been tracking for weeks: the Ivanti Connect Secure zero-day chain and PHP2Shell.
Chained Exploitation: Ivanti and the Linux Kernel
Both entries in this section complete chains that started with flaws already in the catalog. If you patched those earlier flaws and moved on, you are not finished.
Ivanti Connect Secure has two new entries, both added October 30. They are the remaining pieces of the zero-day chain Volexity disclosed in October, which began with CVE-2026-104935 (added October 13, deadline October 16).
- CVE-2026-111357 is the privilege escalation that took attackers from the web server account to root, by abusing how the appliance's dsinvoked service trusts its DSCache configuration data. Its deadline is today, November 2.
- CVE-2026-118527 is a predictable-filename flaw that lets a remote authenticated attacker place files with attacker-controlled content at a known location on disk. Its deadline is November 13.
The critical point: the October fix for CVE-2026-104935 did not close these. Ivanti said at the time that the privilege escalation fix would follow in a later release, and reporting on the new advisory lists 22.8R2.5, the October build, among the affected versions. Organizations that patched in October need this update too. Reporting points to 25.1.1.3 and 22.8R2.6 as fixed builds, but published version lists conflict, so confirm against Ivanti's current advisory before marking an appliance done.
The two deadlines are 11 days apart, but treat them as one job. And because this chain was used to steal Active Directory credentials, LAPS passwords, and BitLocker recovery keys from fully patched appliances, assume compromise is possible until you have checked:
- Do not rely on Ivanti's Integrity Checker Tool. The attackers modified code only in memory and restored what they changed, so the tool is unlikely to detect this activity. Network and memory forensics are required.
- Hunt web logs for bursts of requests to
/dana-na/auth/url_default/welcome.cgicarrying anX-DSCGI-PATHheader, and check/tmp/on the appliance. - Rotate credentials and secrets that touched the appliance, including local accounts, LDAP and service-account bindings, and certificates, and rotate LAPS passwords and BitLocker keys domain-wide.
Linux Kernel CVE-2026-46300, nicknamed "Fragnesia," is a missing-initialization flaw in socket buffer coalescing that lets ESP (IPsec) input processing decrypt shared fragments in place and modify page-cache-backed data. CISA notes it chains with PHP2Shell (CVE-2026-109618 and CVE-2026-109619) to implant PHP webshells and run commands as root. Its deadline was October 31, so it is overdue.
This is the second stage of PHP2Shell. PHP2Shell gives an attacker code execution as the web server account; Fragnesia turns that into root. Any Linux web server that was exposed to PHP2Shell before it was patched should be checked for this follow-on, not just PHP servers that also run IPsec. Because the payload is written into the page cache rather than to disk, on-disk file integrity checks may not reveal tampering.
- Patch the kernel. Fragnesia is not fixed by the earlier "Dirty Frag" kernel patches, so confirm your distribution's update covers this CVE specifically.
- On internet-facing hosts that do not terminate IPsec, unload the
esp4andesp6modules to remove the attack path until you can patch. - If you suspect compromise, capture memory before rebooting. A reboot clears the poisoned page cache, but it also erases the evidence.
- Prioritize web servers that were exposed to PHP2Shell, then multi-tenant hosts and container nodes.
Internet-Facing Platforms: Unauthenticated Reach
Four entries involve components that are often exposed directly or process untrusted input.
-
Cisco Secure Firewall ASA/FTD, CVE-2026-76418 is an unchecked return value leading to a NULL pointer dereference. An unauthenticated remote attacker can force a reload, causing denial of service. The deadline was November 1 and has passed. It is "only" DoS, but repeated reloads on a perimeter firewall mean failed-open or failed-over traffic, lost VPN sessions, and a good window to hide other activity. For HA pairs, stage the upgrade and plan the failover. Check for unexpected reloads or crash files.
-
GitLab CE/EE, CVE-2026-97229 is an integer overflow that lets an unauthenticated user execute code on the server through a crafted regular expression in CI/CD configuration. Fixed versions are 19.2.8, 19.3.5, and 19.4.2. The deadline was November 1 and has passed. This is among the most severe items here: unauthenticated RCE on a platform holding source code, runner tokens, and deployment credentials. If your instance was reachable and unpatched, assume exposure. Rotate CI/CD variables, runner registration tokens, deploy keys, and personal access tokens, and audit recent pipeline and config changes. Restrict the instance behind VPN or an allowlist until patched.
-
Adobe Commerce and Magento, CVE-2026-48356 is an unrestricted upload of a dangerous file type, leading to code execution in the context of the current user. The deadline is November 10. Storefront compromise typically means payment skimmers and customer data theft. Review upload directories and recently modified PHP/JS files, and check checkout pages for injected scripts.
-
Google Brotli, CVE-2026-111497, nicknamed "Node2Shell," is a flaw in the Brotli decoder that lets a remote unauthenticated attacker corrupt decoder memory, leak memory, cause DoS, or potentially achieve code execution through a crafted compressed stream. The deadline is November 10. It was first disclosed in Node.js's October 21 security release, and the exposure is broader than "Google Brotli" suggests. Affected software includes:
- Node.js, fixed in 22.23.4, 24.22.1, and 26.12.1. Node 20 and earlier get no fix. Node's built-in
fetchdecompresses Brotli responses automatically, and some frameworks decompress Brotli request bodies, so apps are exposed even if they never call the decoder directly. - .NET, for which Microsoft issued an emergency update.
- HTTP servers, proxies, and clients built on vulnerable Brotli copies.
Use SBOMs and software composition analysis to find statically linked copies, and expect vendor patches to arrive on different schedules. After patching, restart affected processes and rebuild and redeploy container images. Until then, blocking Brotli-compressed requests at the proxy is a reasonable stopgap for inbound traffic, though it does nothing for responses your applications fetch.
- Node.js, fixed in 22.23.4, 24.22.1, and 26.12.1. Node 20 and earlier get no fix. Node's built-in
Visibility Gap: VMware ESX Logging
Broadcom VMware ESX, CVE-2026-41709 is an insufficient logging flaw that lets an attacker with admin access perform some operations without leaving log entries. Its deadline is November 11. It does not provide initial access, but it helps an intruder hide after compromising a hypervisor. Patch it, and forward ESX logs off-host. Treat any gap in hypervisor logs as suspicious, and keep management interfaces on isolated networks with strong admin credential controls.
Priority Order
- Today and overdue: Ivanti CVE-2026-111357, Linux CVE-2026-46300, GitLab CVE-2026-97229, Cisco CVE-2026-76418. Document exceptions and compensating controls under BOD 26-04 if you cannot meet them.
- By November 10–13: Brotli/Node2Shell, Adobe Commerce/Magento, ESX, and Ivanti CVE-2026-118527. Pull Ivanti's remediation forward, since it is part of an active chain, and give Brotli the same urgency if you run Node.js or .NET services that face the internet.
- Ongoing: Where mitigations are unavailable, BOD 26-04 calls for discontinuing use. Evaluate each asset's exposure rather than relying on a single patch date.
Sources: CISA KEV Catalog · Ivanti Security Advisories · Volexity: Chained Exploitation of Ivanti Connect Secure Zero-Days · SecurityOnline: Ivanti Connect Secure Vulnerability Exploited · CSO Online: PHP2Shell plus Fragnesia · BleepingComputer: CISA Warns of Node2Shell Exploitation · Node.js October 2026 Security Releases · Cisco Security Advisories · GitLab Releases and Security Advisories · Broadcom VMware Security Advisories · Linux Kernel CVE Announcements · Adobe Security Bulletins
Free KEV Alerts
- Real-time notification the moment a KEV drops
- Vendor and product details
- BOD 26-04 remediation deadline included
Pro Alerts Coming Soon
- Real-time notification the moment a KEV drops
- Filtered to your specific vendor watchlist
- Urgency scoring (Critical / Urgent / Standard)
- Direct patch links included
Stay ahead of CISA.
Search the KEV Catalog by Vendor or Product
Search for CVEs by vendor or product to identify known exploited vulnerabilities in your environment
Upcoming Patch Due Dates
via Binding Operational Directive 26-04
BOD 26-04 is CISA's current vulnerability remediation directive for Federal Civilian Executive Branch (FCEB) agencies, updating the KEV-driven framework introduced under BOD 22-01 with a more risk-based approach to prioritization. While binding only on FCEB agencies, its framework increasingly influences contractor expectations through procurement requirements, FedRAMP programs, and agency security clauses.
Loading...
Cyber Security News
You may have missed...
Hacking Editorial Brief — November 3, 2026
Coordinated Supermarket Refrigeration Attacks Expand Across European Union
A second wave of cyberattacks targeting supermarket refrigeration systems spread across at least seven European Union countries on Monday, with hackers remotely altering temperature controls to spoil perishable inventory, according to multiple security researchers and media outlets. Stores in Sweden, Estonia, Belgium, and other EU nations reported refrigerators and freezers heated to 50–55°C, forcing mass food withdrawals and equipment shutdowns, The Register and United24Media report. The campaign follows similar attacks on French grocery stores in October and incidents at U.S. military commissaries in August, Fortune reports, though technical attribution and access methodology remain under investigation. The Pentagon has launched an investigation into potential links between the U.S. military incidents and the European compromises, according to Fortune, though no confirmed connection has been established. Security analysts told Euronews that the attacks appear to exploit remote management capabilities in commercial refrigeration systems, though specific vulnerabilities and initial access vectors have not been disclosed. Some researchers observed propaganda videos released following the Israeli grocery store compromise in October, NPR reports, though operational objectives across the broader campaign remain unclear.
North Korea Denies Binance Attribution as Laundering Analysis Projects Extended Timeline
North Korean officials denied U.S. government attribution of the $6.3 billion Binance compromise, with Kim Yo Jong calling the allegations "absurd rhetoric" and "a grave political provocation," The Japan Times reports. The denial follows FBI attribution to North Korean state actors and blockchain intelligence analysis by multiple firms linking the theft to known North Korean cryptocurrency theft operations. Financial Times reporting indicates the stolen tokens remain visible on public blockchains as the attackers begin a complex laundering process expected to take months, according to law enforcement and blockchain intelligence sources. Separate analysis by Bitquery estimates the attackers lost approximately $119 million through inefficient execution during initial token liquidation attempts, Bloomberg reports. Meanwhile, blockchain researchers documented ongoing attacks leveraging fake Cloudflare verification pages to trick users into granting remote access, Mashable reports, though no confirmed link to the Binance compromise has been established.
Additional Breach Disclosures and Vulnerability Analysis
Cloud application platform Northflank disclosed a security breach leading to unauthorized usage of customers' AI API keys, first detected by Wiz security researchers, CISOseries reports, urging customers to rotate credentials though compromise methodology and attacker objectives have not been disclosed. Check Point Research published technical analysis of HTTP2Shell (CVE-2026-111497), an actively exploited remote code execution vulnerability affecting Brotli decompression implementations, according to the firm's threat intelligence report, though exploitation scope and attacker attribution remain under investigation. Separately, hackers claimed responsibility for stealing 23 terabytes of data from Russia's Rosstat statistics agency, including alleged Ukraine war casualty figures, Tom's Hardware reports, though the claim has not been independently verified and Rosstat's website remained inaccessible at time of reporting.
Sources: The Register · United24Media · Fortune · NPR · Euronews · The Japan Times · [Financial Times](https://www.ft.com/content/a6212e33-2175-4957-91d1-8f8f
*
Inside a cyberattack: How hackers steal data
The truth about cybersecurity is that it's almost impossible to keep hackers outside of an organization, particularly as the cybercrime industry ...
North Korea calls U.S. claims it was behind Binance hack 'a grave political provocation'
Kim Yo Jong, the powerful sister of the North Korean leader, called the allegations “absurd rhetoric and nothing new.”
North Korean hackers expected to take months to launder stolen Binance billions
The stolen tokens are visible to law enforcement on public blockchains, but the hackers are embarking on a long and complex process to shift them in ....
Revolve Data Breach Impacts at Least 180,000 People
Fashion retailer Revolve disclosed a data breach affecting at least 180,000 customers whose personal and payment card information was stolen.
Freezers at supermarkets in several European countries hit by apparent cyberattacks
Supermarkets in Sweden, Belgium, Luxembourg, Ireland and Estonia experienced disruptions to their refrigeration systems apparently caused by cyberatta...
Why the freezer section is the new battleground in cyber security - NPR
Another wave of suspected cyberattacks targeted European supermarkets and fridges. NPR has been investigating what appears to be a pattern of ...
Cisco SD-WAN Zero-Day Exploitation Tied to Volt Typhoon's 'Silent Train' Network
A threat actor whose infrastructure overlaps with Volt Typhoon exploited a critical Cisco SD-WAN vulnerability CVE-2026-20127 to deploy malware design...
Blockchain intelligence firms link North Korea to $6.3B hack on Binance
U.S.-based blockchain intelligence firm TRM said a North Korea hacking unit was likely behind the theft of more than $6 billion on the world's ...
Chainalysis Discloses Data Breach Following AI-Driven Cyberattack
Blockchain analytics company Chainalysis announced falling victim to an AI-driven cyberattack using offensive agentic techniques that resulted in unau...
Updated daily