THE CYBERSECURITY BRIEFING
Daily reporting. Deeper analysis. Follow the evidence behind the headlines.
HIGHLIGHT OF THE DAY
Cybersecurity · In depth· 5 min read
CISA added the PolyShell vulnerability to its known-exploited catalog on October 27, with a November 10 remediation date. Recent storefront research strengthens the case for investigating existing attacker access alongside patching, but does not establish that 953 stores were breached through this flaw.
Cybersecurity
AT A GLANCE
CVE-2026-111497 affects software using vulnerable Brotli decoders when they process attacker-controlled data, and fixes are available for several Brotli and Node.js versions. Help Net Security reports that ELLIO observed exploit traffic in the wild, while CISA added the vulnerability to its Known Exploited Vulnerabilities catalog on October 28. Organizations are advised to check affected downstream products and verify patched components are running.
What changed The fix was publicly committed in February without a release or advisory; patched Brotli releases became available only last week, according to the report.
Why it matters For application owners, the key triage question is whether untrusted compressed data reaches the decoder. A vulnerable dependency alone does not establish exposure, so remediation needs product-specific assessment.
HelpNet Security ↗Arctic Wolf documented more than 400 incidents in which attackers flooded employees’ inboxes with subscription messages, then contacted them through external Microsoft Teams chats posing as help desk staff. The scammers often asked victims to install remote-access software; researchers said malicious code could be running in under 15 minutes after a victim engaged. Arctic Wolf recommends restricting external chats to approved partner domains and limiting remote-access tools to authorized IT staff.
Why it matters Organizations cannot address this entry route through Teams patching alone: attackers exploit permitted cross-tenant contact, making external-access policy a relevant security control.
HelpNet Security ↗Cyble says a September 2026 version of INJ3CTOR3’s FreePBX implant uploads 17 configuration files containing SIP trunk, AMI, database and mail-relay credentials to two staging hosts. Stolen trunk credentials could let the operator place calls as a victim from elsewhere, so Cyble advises cleaning the host before rotating secrets. The researchers say the staging hosts stopped responding in late September and that they did not capture the uploads in transit or obtain a victim list.
The May analysis described fraud dependent on a live implant in the victim's PBX; September artifacts show credentials being sent elsewhere, extending exposure beyond host cleanup.
LESS NOISE. MORE CONTEXT.
Why it matters PBX owners could continue incurring fraudulent call charges after successful cleanup. Stolen trunk secrets permit calls from other machines unless carrier-side IP restrictions prevent them.
What to watch next Victim identification remains unresolved. Cyble calls for law enforcement and CERTs to pursue data preservation and sinkholing with providers; the report does not establish that this work has begun.
A CISA advisory says EPICS Base versions 7.0.10 and earlier contain vulnerabilities that could cause denial of service, memory corruption, sensitive-information disclosure or potentially arbitrary code execution. The advisory gives one issue a CVSS 3.1 score of 9.8 and says the EPICS community has released updates; affected users should move to version 7.0.11. The listed vulnerabilities affect software used in critical manufacturing, according to CISA.
Why it matters For operators running affected EPICS Base releases, network-request processing is a potential route to service disruption or code execution, rather than merely a local software fault.
US Certs Alerts ↗NIST’s new roadmap, IR 8547, describes the transition from quantum-vulnerable cryptography to post-quantum standards and urges organizations to inventory cryptographic use and begin planning. It sets December 31, 2030, for quantum-resistant key-establishment methods in prioritized sensitive federal systems, and December 31, 2031, for digital signatures. NIST says it will deprecate quantum-vulnerable public-key cryptography after 2030 and disallow it under its standards and guidelines after 2035.
What changed Against the existing 2035 federal migration target, the roadmap describes earlier requirements for high-value, high-impact and other prioritized sensitive systems.
Why it matters Organizations planning migration may be constrained by vendor delivery and interoperability, so replacing cryptography requires coordinated product upgrades rather than a single configuration change.
What to watch next The confirmed milestones for those sensitive federal systems are December 31, 2030, for quantum-resistant key establishment and December 31, 2031, for digital signatures.
HelpNet Security ↗