Three-day deadlines don't leave room
for a missed email.
CyberComply monitors the CISA KEV catalog 24/7 and alerts you within minutes of every new listing, so the clock never starts without you.
KEV Brief: Edge Devices, Developer Platforms, and Foundational Code
Date: November 2, 2026
Eight new KEV entries landed between October 27 and 30. Three of the deadlines have already passed and a fourth is today, so this is a triage brief as much as an awareness one. The common thread is that attackers are chaining flaws to turn a small foothold into root or admin control, and two of this week's entries are the missing links in attacks we have been tracking for weeks: the Ivanti Connect Secure zero-day chain and PHP2Shell.
Chained Exploitation: Ivanti and the Linux Kernel
Both entries in this section complete chains that started with flaws already in the catalog. If you patched those earlier flaws and moved on, you are not finished.
Ivanti Connect Secure has two new entries, both added October 30. They are the remaining pieces of the zero-day chain Volexity disclosed in October, which began with CVE-2026-104935 (added October 13, deadline October 16).
- CVE-2026-111357 is the privilege escalation that took attackers from the web server account to root, by abusing how the appliance's dsinvoked service trusts its DSCache configuration data. Its deadline is today, November 2.
- CVE-2026-118527 is a predictable-filename flaw that lets a remote authenticated attacker place files with attacker-controlled content at a known location on disk. Its deadline is November 13.
The critical point: the October fix for CVE-2026-104935 did not close these. Ivanti said at the time that the privilege escalation fix would follow in a later release, and reporting on the new advisory lists 22.8R2.5, the October build, among the affected versions. Organizations that patched in October need this update too. Reporting points to 25.1.1.3 and 22.8R2.6 as fixed builds, but published version lists conflict, so confirm against Ivanti's current advisory before marking an appliance done.
The two deadlines are 11 days apart, but treat them as one job. And because this chain was used to steal Active Directory credentials, LAPS passwords, and BitLocker recovery keys from fully patched appliances, assume compromise is possible until you have checked:
- Do not rely on Ivanti's Integrity Checker Tool. The attackers modified code only in memory and restored what they changed, so the tool is unlikely to detect this activity. Network and memory forensics are required.
- Hunt web logs for bursts of requests to
/dana-na/auth/url_default/welcome.cgicarrying anX-DSCGI-PATHheader, and check/tmp/on the appliance. - Rotate credentials and secrets that touched the appliance, including local accounts, LDAP and service-account bindings, and certificates, and rotate LAPS passwords and BitLocker keys domain-wide.
Linux Kernel CVE-2026-46300, nicknamed "Fragnesia," is a missing-initialization flaw in socket buffer coalescing that lets ESP (IPsec) input processing decrypt shared fragments in place and modify page-cache-backed data. CISA notes it chains with PHP2Shell (CVE-2026-109618 and CVE-2026-109619) to implant PHP webshells and run commands as root. Its deadline was October 31, so it is overdue.
This is the second stage of PHP2Shell. PHP2Shell gives an attacker code execution as the web server account; Fragnesia turns that into root. Any Linux web server that was exposed to PHP2Shell before it was patched should be checked for this follow-on, not just PHP servers that also run IPsec. Because the payload is written into the page cache rather than to disk, on-disk file integrity checks may not reveal tampering.
- Patch the kernel. Fragnesia is not fixed by the earlier "Dirty Frag" kernel patches, so confirm your distribution's update covers this CVE specifically.
- On internet-facing hosts that do not terminate IPsec, unload the
esp4andesp6modules to remove the attack path until you can patch. - If you suspect compromise, capture memory before rebooting. A reboot clears the poisoned page cache, but it also erases the evidence.
- Prioritize web servers that were exposed to PHP2Shell, then multi-tenant hosts and container nodes.
Internet-Facing Platforms: Unauthenticated Reach
Four entries involve components that are often exposed directly or process untrusted input.
-
Cisco Secure Firewall ASA/FTD, CVE-2026-76418 is an unchecked return value leading to a NULL pointer dereference. An unauthenticated remote attacker can force a reload, causing denial of service. The deadline was November 1 and has passed. It is "only" DoS, but repeated reloads on a perimeter firewall mean failed-open or failed-over traffic, lost VPN sessions, and a good window to hide other activity. For HA pairs, stage the upgrade and plan the failover. Check for unexpected reloads or crash files.
-
GitLab CE/EE, CVE-2026-97229 is an integer overflow that lets an unauthenticated user execute code on the server through a crafted regular expression in CI/CD configuration. Fixed versions are 19.2.8, 19.3.5, and 19.4.2. The deadline was November 1 and has passed. This is among the most severe items here: unauthenticated RCE on a platform holding source code, runner tokens, and deployment credentials. If your instance was reachable and unpatched, assume exposure. Rotate CI/CD variables, runner registration tokens, deploy keys, and personal access tokens, and audit recent pipeline and config changes. Restrict the instance behind VPN or an allowlist until patched.
-
Adobe Commerce and Magento, CVE-2026-48356 is an unrestricted upload of a dangerous file type, leading to code execution in the context of the current user. The deadline is November 10. Storefront compromise typically means payment skimmers and customer data theft. Review upload directories and recently modified PHP/JS files, and check checkout pages for injected scripts.
-
Google Brotli, CVE-2026-111497, nicknamed "Node2Shell," is a flaw in the Brotli decoder that lets a remote unauthenticated attacker corrupt decoder memory, leak memory, cause DoS, or potentially achieve code execution through a crafted compressed stream. The deadline is November 10. It was first disclosed in Node.js's October 21 security release, and the exposure is broader than "Google Brotli" suggests. Affected software includes:
- Node.js, fixed in 22.23.4, 24.22.1, and 26.12.1. Node 20 and earlier get no fix. Node's built-in
fetchdecompresses Brotli responses automatically, and some frameworks decompress Brotli request bodies, so apps are exposed even if they never call the decoder directly. - .NET, for which Microsoft issued an emergency update.
- HTTP servers, proxies, and clients built on vulnerable Brotli copies.
Use SBOMs and software composition analysis to find statically linked copies, and expect vendor patches to arrive on different schedules. After patching, restart affected processes and rebuild and redeploy container images. Until then, blocking Brotli-compressed requests at the proxy is a reasonable stopgap for inbound traffic, though it does nothing for responses your applications fetch.
- Node.js, fixed in 22.23.4, 24.22.1, and 26.12.1. Node 20 and earlier get no fix. Node's built-in
Visibility Gap: VMware ESX Logging
Broadcom VMware ESX, CVE-2026-41709 is an insufficient logging flaw that lets an attacker with admin access perform some operations without leaving log entries. Its deadline is November 11. It does not provide initial access, but it helps an intruder hide after compromising a hypervisor. Patch it, and forward ESX logs off-host. Treat any gap in hypervisor logs as suspicious, and keep management interfaces on isolated networks with strong admin credential controls.
Priority Order
- Today and overdue: Ivanti CVE-2026-111357, Linux CVE-2026-46300, GitLab CVE-2026-97229, Cisco CVE-2026-76418. Document exceptions and compensating controls under BOD 26-04 if you cannot meet them.
- By November 10–13: Brotli/Node2Shell, Adobe Commerce/Magento, ESX, and Ivanti CVE-2026-118527. Pull Ivanti's remediation forward, since it is part of an active chain, and give Brotli the same urgency if you run Node.js or .NET services that face the internet.
- Ongoing: Where mitigations are unavailable, BOD 26-04 calls for discontinuing use. Evaluate each asset's exposure rather than relying on a single patch date.
Sources: CISA KEV Catalog · Ivanti Security Advisories · Volexity: Chained Exploitation of Ivanti Connect Secure Zero-Days · SecurityOnline: Ivanti Connect Secure Vulnerability Exploited · CSO Online: PHP2Shell plus Fragnesia · BleepingComputer: CISA Warns of Node2Shell Exploitation · Node.js October 2026 Security Releases · Cisco Security Advisories · GitLab Releases and Security Advisories · Broadcom VMware Security Advisories · Linux Kernel CVE Announcements · Adobe Security Bulletins
Free KEV Alerts
- Real-time notification the moment a KEV drops
- Vendor and product details
- BOD 26-04 remediation deadline included
Pro Alerts Coming Soon
- Real-time notification the moment a KEV drops
- Filtered to your specific vendor watchlist
- Urgency scoring (Critical / Urgent / Standard)
- Direct patch links included
Stay ahead of CISA.
Search the KEV Catalog by Vendor or Product
Search for CVEs by vendor or product to identify known exploited vulnerabilities in your environment
Upcoming Patch Due Dates
via Binding Operational Directive 26-04
BOD 26-04 is CISA's current vulnerability remediation directive for Federal Civilian Executive Branch (FCEB) agencies, updating the KEV-driven framework introduced under BOD 22-01 with a more risk-based approach to prioritization. While binding only on FCEB agencies, its framework increasingly influences contractor expectations through procurement requirements, FedRAMP programs, and agency security clauses.
Loading...
Cyber Security News
You may have missed...
Hacking Editorial Brief — November 2, 2026
North Korean Attribution and Operational Details Emerge in Binance Investigation
Multiple blockchain intelligence firms and law enforcement agencies have now linked North Korea's TraderTraitor hacking unit to the $6.3 billion Binance theft, with U.S.-based firm TRM providing additional technical analysis supporting the FBI's attribution, according to Asahi Shimbun and Ynet News reporting. TraderTraitor, tracked as part of North Korea's broader cryptocurrency theft apparatus, has been observed using fake job offers and malicious software in previous operations targeting cryptocurrency platforms, researchers report. The group's operational tradecraft appears consistent with patterns documented in earlier compromises attributed to North Korean state actors, though specific technical indicators linking this intrusion to previous campaigns have not been independently verified. Separately, Japanese media reported that a North Korea-linked hacking group was likely behind a cyberattack against GMO Internet Group, according to The Japan Times, though attribution confidence and technical evidence supporting the link have not been disclosed. Binance users withdrew $3.6 billion following the compromise, BBC reports, as the company continues phased restoration of withdrawal services.
Ukraine and Russia Report Coordinated Compromises of Emergency Alert Systems
Ukraine and Russia have accused each other of compromising their respective emergency alert applications, with the Ukrainian system sending false warnings of nuclear attacks to users in multiple regions, according to France 24, The Telegraph, and ABC News reporting. Several Ukrainian regional governors confirmed the alerts were false and attributed the incident to Russian hacking operations, though technical details of the compromise methodology have not been disclosed. Russia simultaneously accused Ukraine of compromising its emergency alert infrastructure in what appears to be coordinated information operations during a localized ceasefire in the Kherson region. Separately, hackers claimed to have stolen 23 terabytes of data from Russia's state statistics agency Rosstat, including information on Russian casualties in Ukraine, The Moscow Times reports, though the claim has not been independently verified and the operational impact remains unclear.
Supply Chain Compromises Target Cryptocurrency and Enterprise Platforms
Hackers compromised the DebugBear script delivery infrastructure to inject malicious code into the Polymarket prediction market platform, stealing approximately $2.7 million by selling signed-in traders' positions and redirecting funds, according to The Hacker News. The compromise represents a supply chain attack targeting third-party JavaScript delivery, though the initial access vector and duration of the malicious code injection have not been confirmed. Separately, Microsoft security researchers reported that Chinese-linked threat actors compromised ConnectWise infrastructure to target hundreds of organizations globally, NewsNow reports, though victim identification, compromise methodology, and operational objectives remain under investigation. Security researchers also published technical analysis of Flock automated license plate reader camera systems, demonstrating vulnerabilities in the devices following hardware teardown, Jalopnik reports.
Sources: Asahi Shimbun · Ynet News · The Japan Times · BBC · France 24 · The Telegraph · ABC News · The Moscow Times · The Hacker News · [NewsNow](https://www.newsnow.com/us/
*
Inside a cyberattack: How hackers steal data
The truth about cybersecurity is that it's almost impossible to keep hackers outside of an organization, particularly as the cybercrime industry ...
Cisco SD-WAN Zero-Day Exploitation Tied to Volt Typhoon's 'Silent Train' Network
A threat actor whose infrastructure overlaps with Volt Typhoon exploited a critical Cisco SD-WAN vulnerability CVE-2026-20127 to deploy malware design...
Blockchain intelligence firms link North Korea to $6.3B hack on Binance
U.S.-based blockchain intelligence firm TRM said a North Korea hacking unit was likely behind the theft of more than $6 billion on the world's ...
Chainalysis Discloses Data Breach Following AI-Driven Cyberattack
Blockchain analytics company Chainalysis announced falling victim to an AI-driven cyberattack using offensive agentic techniques that resulted in unau...
New VOLTA Infostealer Uses Claude, Gemini, and Kimi AI to Rank Victims by Financial Value
Cybersecurity researchers have discovered a new Windows infostealer malware called VOLTA-AUTODOXER (aka VOLTA) that makes use of a large language ...
Binance says 90% of losses from $6.3bn hack covered as FBI says North Korea behind attack
Cryptocurrency exchange Binance says it has replaced 90% of the amount stolen after a record $6.3bn hack of its platform by a group the FBI ...
FBI Blames North Korea for Stolen Billions From Binance in Biggest Hack in History
... of minutes, the biggest crypto heist in history, was orchestrated by North Korean hackers, the FBI said Saturday.
FBI says North Korea behind $6 billion Binance crypto theft - NewsNation
Earlier Saturday, Binance said it had replenished 90% of the stolen assets following the $6.3 billion hack of its platform. On Thursday, funds ...
North Korea responsible for $6 billion Binance cryptocurrency hack, FBI says - Fox Business
North Korean hackers stole over $6 billion in crypto from Binance, according to the FBI. The stolen assets were converted primarily into Ethereum ...
Updated daily