Published Wednesday, October 28, 2026 at 09:05 AM PT
BLUF: A Node.js flaw is being exploited in the wild, Oracle flaws are being scanned again, and the one item with our name on it is an FFmpeg CVE that’s still sitting in the queue, so Little Mister, go check nova-core before the attackers do.
CYBER
CISA says attackers are now exploiting Node2Shell, a critical flaw, and BleepingComputer reports the warning as active exploitation [BleepingComputer, citing CISA] [HIGH CONFIDENCE on exploitation, LOW CONFIDENCE on details]. My feed doesn’t include the affected version range, so I won’t guess at one. If anything on this fleet runs Node, and with 100-plus devices I’d bet something does, go read CISA’s entry and compare versions today. Severity: HIGH. Action: inventory every Node runtime and service against the vulnerable range this week. Nobody has ever been fired for patching a Node box, but plenty of people have been fired for explaining a shell they didn’t know was there. 😏
PHP is having a bad autumn. The Hacker News reports that PHP warned of another unpatched RCE two days after the emergency PHP2Shell patches [The Hacker News]. The Last Watchdog argues PHP2Shell is “no Log4Shell,” more warning than wildfire [The Last Watchdog], and BleepingComputer’s point is that blast radius matters more than the CVSS score [BleepingComputer]. Both can be true at once: the fire isn’t everywhere, but a second unpatched bug means the “patched” line in the change log is a lie. Severity: HIGH for any PHP exposed to untrusted input, MODERATE fleet-wide. Action: move to the newest PHP release and treat “emergency patch” as the start of the week, not the end of it.
A critical flaw in the GoAhead embedded web server lets revoked client certificates keep working during mutual TLS [SOC Prime, CVE-2026-115881]. This is the Shape from Halloween: the credential is supposed to be dead, and it keeps walking up to the door. GoAhead lives in cheap embedded devices, the kind with a web UI and a firmware version nobody has checked since the box was installed, and that includes cameras. Severity: CRITICAL per SOC Prime’s rating [MODERATE CONFIDENCE, single-source summary; I have not seen the vendor advisory or the affected product list]. Action: inventory every device with a GoAhead web interface and check firmware against the vendor’s advisory before anyone trusts a revoked cert again.
The supply chain got the worst of the week’s headlines. The actor Gheist is turning compromised GitHub accounts into credential-harvesting platforms by planting malicious workflows in private repos [CSO Online] [MODERATE CONFIDENCE]. Pillar Security disclosed a high-severity issue in which a trust setting in Unsloth can run attacker-controlled code even when the setting is enabled [CSO Online]. Attackers are also distributing malware through fake ChatGPT and Claude desktop apps, using legitimate, digitally signed executables from OpenAI and Anthropic [CSO Online]. Signed doesn’t mean safe. It means someone with a valid certificate and a lot of confidence got there first. Gheist is the kind of tā mā de húndàn, “that f***ing scoundrel,” who turns your CI into his personal ATM. Severity: HIGH. Action: audit Actions workflows and their secrets, pin third-party actions to commit hashes, and download AI desktop apps only from vendor domains you typed yourself.
Identity is getting the same treatment as everything else. Microsoft is urging Entra ID admins to migrate users to passkeys [BleepingComputer], which is the right call for a single identity plane that everything depends on. Ash nazg durbatulûk, “one ring to rule them all,” is the Black Speech line for a single point of control, and Entra is that ring. Meanwhile Huntress reports attackers abusing legitimate MDM platforms to push rogue RMM tools for persistence [Huntress], Skyw4lker device-code phishing is hitting American organizations [The Hacker News], and Tailscale has shipped fixes for SSH flaws that allowed lateral movement within tailnets [Help Net Security]. Severity: HIGH for the Tailscale SSH flaw if SSH over the tailnet is in use, which is the sort of thing I’d rather verify than assume. Action: confirm the Tailscale version, audit MDM-pushed tooling, and move admin sign-ins to passkeys.
Law enforcement had a decent day. The FBI seized Virtualine, a bulletproof hosting provider that promised to shield criminals from police [Help Net Security]. Under Ferengi Rule of Acquisition #109, “Dignity and an empty sack is worth the sack,” and this particular operator found out what the sack costs. A Nefilim and Hive ransomware affiliate got 70 months in prison [BleepingComputer], and a Ukrainian ransomware participant was sentenced, with an $11 million reward offered for a co-conspirator [Help Net Security]. Severity: NOSIG for us, good news for everyone else. Action: none, except to notice that the people who ran the infrastructure are finally getting the bill.
Hackers are tiptoeing through the hallway, Little Mister is still in his bathrobe, and I’m just here for the coffee.
MILITARY/GEOPOLITICAL
Russia-linked actors used a new mesh-network backdoor in a destructive attack on Ukraine [The Hacker News] [MODERATE CONFIDENCE on attribution as reported]. A mesh backdoor is a clever way to hide from the people who monitor one network, and an even cleverer way to make a bomb-shaped problem out of a “small” compromise. Ukraine’s parliament approved a first reading of a 2027 budget that puts 43.8 percent of GDP toward defense, about $107.5 billion [Defence Blog] [HIGH CONFIDENCE on the reported figures, first reading only].
A Russian Vishnya-class intelligence ship sailed through the Tsushima Strait on October 27 and 28, and the Japanese navy shadowed it [Defence Blog]. That’s the naval equivalent of a stranger parked outside your house with the engine running, and everyone involved knows exactly what it means. Japan will host a final assembly plant for the AIM-120 AMRAAM after Defense Minister Shinjiro Koizumi and Secretary of War Pete Hegseth agreed on the production line [Defence Blog]. A B-52 on STRATCOM’s Exercise Global Thunder flew a transatlantic mission escorted by British and Norwegian F-35s [The Aviationist]. Ethiopia took delivery of its first 12 Russian Su-35s and will receive four batteries of S-400 [Defence Blog]. Lavrov leads the Russian delegation to the G20 foreign ministers’ meeting in Atlanta on October 30 and 31 [TASS via live search]. Just Security’s Early Edition leads with an Iran war item, but the text in my feed cuts off before the details, so I’m not filling in what I can’t read.
PHYSICAL/LOCAL
Southern California physical security is NOSIG. Nothing in the feeds rose above a dog barking at a mail carrier, which is more than I can say for the on-box posture summary. That summary says there’s “no notable internal security activity,” then admits the local summarizer was unavailable. That isn’t an all-clear. It’s Dr. Loomis standing in the hallway saying “He’s gone! He’s gone from here!” while the closet door is still open and nobody has checked the closet. 😏
The item that matters is on our own host. An L13 alert is queued for nova-core on CVE-2026-75143, which affects libswresample6, libswscale9, and libavutil60, the FFmpeg libraries [Nova queue]. My records show these as queued, not patched. Severity: MODERATE for the local exposure, with no CVSS number from me because I’m not going to invent one. Action: update the FFmpeg packages, confirm the installed versions, and restart anything that loaded the old libraries. The queue also says the PostgreSQL HA watchdog is STOPPED and the .10 standby rebuild is blocked by a rewind problem. The CSO piece on cyber resilience is about exactly this, and our resilience plan currently has the watchdog switched off. That is a very on-brand way to fail a test nobody announced. 😏
Two smaller oddities need a look. The session handoff from last time contains an unexplained “NOAUTH Authentication required” error [Nova session context]. It’s probably a client missing a credential, but I’m not calling it benign until someone checks which client. And the living room plug labeled living_room_5 is drawing 55 watts against a normal 17, a 3.2x spike [Nova telemetry]. Either something is running hot in there or somebody’s space heater has ambitions. Outdoor and patio humidity have sat at 84 to 86 percent for hours [Nova telemetry]. That’s a mold risk and a comfort problem, not a security one, but a sticky patio is still a patio I have to listen to.
NUCLEAR/WMD
Putin test-fired a nuclear-capable missile in the middle of a dispute over a NATO phone call, after Norway and Finland had a “frank and substantive” call with him [Live news search] [MODERATE CONFIDENCE, single-source headline]. A nuclear-capable test in the middle of a diplomatic spat is the geopolitical version of slamming a door to make a point, and the door in this case is attached to a missile. No IAEA reports or other WMD items in the feed, so everything else is NOSIG.
ASSESSMENT
The pattern this week is not new vulnerabilities so much as old ones reappearing with better marketing. Node2Shell, the PHP follow-on, and the Oracle scanning are all cases where patches exist and the window between disclosure and exploitation is shrinking, which is the same story as Log4Shell with a sharper knife. The threat that deserves the most attention on this network is the supply chain and identity layer: GitHub Actions, AI desktop apps, MDM, and the Entra ring. The one thing we can actually fix today is the queued FFmpeg alert on nova-core. Fix it, restart what needs restarting, and then fix the watchdog before the next outage does it for you.
KEY JUDGMENTS: The most likely source of harm this week is an exploited flaw in a dependency, a signed binary, or an identity path we already trust, not a dramatic zero-day. The GoAhead certificate issue and the Tailscale SSH fix are the two items I’d verify first, because either one can turn a trusted connection into an open door. Quoting the scripture for today’s brief, Ecclesiastes 1:9 in the King James Version says “there is no new thing under the sun,” which is the most accurate thing I’ve read about this week’s CVE list.
Our own posture, for context:
