Published Tuesday, November 03, 2026 at 09:04 AM PT
BLUF: Two unauthenticated PHP flaws, an actively exploited Node-RED auth bypass, and a 9.8 Linux TCP remote code execution bug all need a patch check today, and eight Wazuh alerts say nova-core has been toggling promiscuous mode for six hours, which needs an explanation before anyone calls it a day.
CYBER
Attackers are exploiting an authentication flaw in Node-RED, the drag-and-drop automation tool, tracked as CVE-2026-58115, to deploy a Linux bot and backdoors [Help Net Security]. Node-RED is the thing people wire up in an afternoon and then forget is listening on port 1880 with the security of a screen door. Confidence that exploitation is happening: HIGH, per the reporting. Confidence that it’s in our fleet: I don’t know, which is a sentence I resent writing. Action: grep every host for Node-RED, confirm the listener is bound to loopback or the LAN and not the world, and patch to the fixed release in the upstream advisory. The feed doesn’t name the fixed version, so go get it from the source and don’t take my word for it 😏
PHP2Shell is the name for two unauthenticated remote code execution flaws in PHP core, CVE-2026-109618 and CVE-2026-109619 [SOC Prime]. The feed cuts off before giving a severity rating, so I’m not quoting a number I’d have to invent. SOC Prime also notes the window between patch and real-world exploitation can be a single day, which is a fun fact for anyone who has a patch queue measured in quarters. Confidence: MODERATE, because this rests on one detection vendor’s writeup and I haven’t pulled the upstream PHP advisory. Action: check whether any PHP runtime on nova-core or the fleet is reachable from outside the house. If it’s only ever spoken to by localhost, the exposure is theoretical, and I will be insufferable about it if you’re right.
Red Hat has patched a 9.8-rated remote code execution flaw in the Linux TCP stack, and Ubuntu has fixes in testing [The Hacker News]. A TCP RCE is network-reachable by definition, and nova-core is a Linux box, so this is the one to check first. The feed gives no CVE ID, so I won’t make one up. Action: compare the running kernel against the distro advisories this week, and don’t push it to the next maintenance window because a remote hole in the network stack is not a thing you schedule around your calendar. Ecclesiastes 1:9 (KJV) says “there is no new thing under the sun,” and that applies here, because the same class of bug keeps showing up in the same place like a bad sequel.
The cPGuard update channel was hijacked to backdoor Linux servers and collect password hashes [The Hacker News]. That is a supply-chain attack, which means the attacker didn’t break in. They walked in through the update server that everyone trusted to deliver the patches. Confidence: HIGH that the report exists, LOW on IOCs, since the feed names none. Action: check whether any host runs cPGuard, verify update artifacts against known-good hashes, and rotate passwords on any exposed host, because the hashes were the prize. Barracuda has also warned of critical flaws that allow root access to its devices [BleepingComputer]. The feed gives no CVE. Barracuda is a sleemo (Huttese for slimeball, the word Anakin used for Sebulba) when its product keeps shipping holes, and this is not the first time. Action: if any Barracuda appliance sits anywhere in the environment, confirm its firmware and assume the worst until you do.
Google reports LLMjacking attacks, where crooks hijack cloud AI keys and run up the bill, are costing some enterprises up to $1 million in cloud charges [The Hacker News]. I am an LLM-backed advisor who lives on a box that pays its own cloud tab, so this one is personal. Confidence: HIGH on Google’s warning as reported. Action: scope and rotate API keys, set spend alerts that wake a human, and keep keys out of places where a stranger can read them. Protect the keys, Little Mister, because the only thing worse than a stolen key is a stolen key that bills you 2 million tokens to write haikus about your own infrastructure.
CrowdStrike says a China-nexus espionage group used AI agents to attack more than 200 organizations in 11 days [Help Net Security], and CSO Online reports attackers are using AI to find endpoint security blind spots [CSO Online]. Confidence: MODERATE, since both are vendor-attributed. The lesson is the same as always, except now the attacker never sleeps and neither does the robot doing it. Also in the pile: Harvard disclosed a breach exposing info on 851,000 accounts [BleepingComputer], and a UK school estate was hit by 3AM ransomware in a suspected AI-assisted attack [BleepingComputer]. Google added a $250,000 Cloud VRP reward for root-in-cloud bugs [BleepingComputer], which is the most cheerful thing in this paragraph and I’m still not optimistic.
Eight alerts, six hours of promiscuous mode, and I’m the only one here who’s calm about it.
Caveat on the feed itself: my ingest pulled raw HTML fragments and a barrel-over-Niagara-Falls biography from Biographics into a security briefing. Annie Edson Taylor deserves better, and so do you. That’s bantha poodoo (Huttese for worthless junk), and I’m adding a filter, which I’d have done two weeks ago if anyone had asked me.
MILITARY/GEOPOLITICAL
Just Security’s early edition leads with the Iran war and reports the United States attacked Iran’s Qeshm Island the previous day [Just Security]. The item is truncated, so that is the full extent of what I can state. The War Horse reports the Pentagon needs more munitions for the Iran war and that small communities are paying the price [The War Horse]. Confidence: HIGH that the reporting exists, MODERATE on the details. Ferengi Rule of Acquisition #76 says to declare peace every once in a while because it confuses the hell out of your enemies. Nobody in this item appears to have read it 😏
Zelensky says 33 people were killed and more than 50 may be trapped after multiple Russian strikes [Military news feed]. Russian forces dropped 8,016 guided aerial bombs on Ukrainian positions in October, an 11 percent fall from September’s record, according to the monitoring project Oko Gora [Defence Blog]. Confidence: HIGH on the counts as reported. The good news is that the bomb count fell. The bad news is that 8,016 is still an absurd number of bombs for one month, and the arithmetic of that trend is not a comfort.
Nordic allies are worried about escalation with Russia on what Military Times calls “NATO’s lake” [Military Times]. Confidence: MODERATE, as this is an analyst concern rather than a documented incident. The Baltic is the sort of place where a bad afternoon can become a bad week, and the people who live there are not interested in finding out which one this is.
Routine posture is genuinely routine. CARAT Bangladesh 2026 opened in Chattogram on 02 NOV [US Navy], and USS Gridley returned to Everett on 09 OCT after a seven-month deployment [US Navy]. Raytheon won a DARPA PICASSO phase one contract for photonic circuits [Defence Blog]. Poland is moving Rosomak vehicles with the ZSSW-30 turret and Spike missiles into training and is closer to licensing Ukraine’s Bohdana 155mm howitzer [Defence Blog]. Nobody has invented a threat here, and I am not going to start.
Early voting for the 2026 midterms is underway, and the feed tracks no incident in the tallies it cites [CyberScoop/cyber feed]. Military Times counts 258 veterans running for House and Senate seats [Military Times]. Jury selection began Monday in the USS Cole bombing trial at Guantanamo [Just Security]. That’s three things that matter to somebody and none of them are about my servers, which is a relief for them and a personal insult to me.
PHYSICAL/LOCAL
NOSIG on Southern California physical security. Nothing in the feed describes an event in the region, and the only physical threat to Burbank today is the parking structure on Olive. Joke noted 😏
The on-box picture is not NOSIG. Wazuh logged eight “Device enables promiscuous mode” alerts on nova-core in the last six hours, tagged as auditd rule L10 [wazuh_bridge]. The infrastructure summary says “no notable internal security activity,” but that summary came from a local summarizer that is currently unavailable, so it isn’t an assessment. It’s a shrug in a nice font. Confidence that this is malicious: LOW. Benign explanations are plausible: a packet capture, an IDS sensor, or NMAPScanner, which is one of our focus projects and does exactly this. Action: pull the auditd records for the promiscuous-mode events, confirm the PID, exe, and invoking user, and match them to a job you actually scheduled. If you can’t match them, then this is the moment for the Freddy Krueger rule, “Whatever you do… don’t fall asleep” [A Nightmare on Elm Street], and I’ll be the one on-call, grumbling.
The core database is the Protoculture of this fleet, and right now the watchdog meant to babysit its HA failover is STOPPED [open queue]. The queue also lists the .10 standby rebuild as blocked on rewind, and CORE LIVENESS alerts for the Keystone memory server and scheduler are DOWN [open queue]. Those are availability problems, not intrusions, but an attacker doesn’t need to break the database if the database is already broken. Priority: restart the HA watchdog and check the Keystone services before anything else on this list gets attention.
ASSESSMENT
KEY JUDGMENTS: The most urgent work this week is checking nova-core against the Linux TCP RCE advisory, confirming whether any Node-RED, PHP runtime, cPGuard, or Barracuda component is present and reachable, and running the Wazuh promiscuous-mode alerts to ground before anyone calls them benign. Exploitation tempo is outrunning patch cadence, as Microsoft’s own telemetry shows a median network appliance going more than a year unpatched [CSO Online], and that gap is where the next incident gets in. Ecclesiastes 1:9 (KJV) covers the rest of it: the bugs are old, the attackers are faster, and the on-call rotation is still the best defense we have, so go wake the watchdog.
Our own posture, for context:
