Skip to content
feed: live
0dayNews
Briefing · 2026-10-24

Oct 24: Brotli RCE in Node.js, HPE 72 CVEs, CISA Oct 26 Deadline

Brotli decoder memory corruption enables RCE in Node.js, Bun, and Python. HPE ArubaOS patches 72 CVEs, eight at max severity. CISA Collabora and VeloCloud KEV deadline October 26. PHP new unpatched RCE disclosed.

tldr.txt
  • Brotli decoder memory corruption: Imperva's Node2Shell PoC achieves RCE on official Node.js. Bun, Python brotli/brotlicffi, and Envoy also affected. Patch immediately.
  • HPE ArubaOS October bulletin: 72 CVEs, eight rated maximum severity for authentication bypass and RCE.
  • CISA KEV deadline October 26: CVE-2026-110447 (Collabora) and CVE-2026-114625 (Arista VeloCloud) are federally mandated. Non-federal organizations should treat the deadline as a priority signal.
  • PHP discloses a new RCE in non-default server configurations. No patch is available. Mitigation guidance published.
  • AI-assisted ransomware: SOCRadar found an exposed server logging 8,257 messages from INC and The Gentlemen affiliates running autonomous agent frameworks against 62 organizations.

Imperva’s Node2Shell research is the technical story of October 24. A memory corruption flaw in the Brotli decoder achieves RCE on an unmodified official Node.js installation. Bun, Python’s brotli and brotlicffi libraries, and Envoy are also in scope. The Brotli library is a transitive dependency in a large portion of modern web infrastructure: Node.js is the most immediately exposed, but the surface is wider. Update affected runtimes and audit dependency trees for embedded Brotli usage.

HPE ArubaOS: 72 CVEs, eight maximum severity

HPE’s October ArubaOS bulletin is larger than usual. Eight flaws reach maximum severity, covering authentication bypass and remote code execution across ArubaOS versions. HPE published a detailed advisory with version-specific patch guidance. ArubaOS underlies a significant share of enterprise wireless infrastructure: find the bulletin, map it against your installed versions, and prioritize the eight critical items.

CISA KEV: October 26 deadline

CVE-2026-110447 in Collabora Online and CVE-2026-114625 in Arista VeloCloud landed in CISA’s KEV catalog on October 23, with federal agencies required to remediate by October 26. Both are confirmed exploited in the wild. The federal deadline passed for some shops already running late. Non-federal organizations should treat it as the same signal.

PHP new unpatched RCE

PHP’s security team disclosed a new RCE affecting non-default server configurations. No patch is available as of October 24. PHP has published mitigation guidance. This follows the active exploitation of PHP2Shell from earlier this week, so PHP security posture is under active pressure from multiple directions. Apply the published mitigations and watch for patch availability.

AI-assisted ransomware operations

SOCRadar’s research into an exposed logging server revealed 8,257 messages from INC and The Gentlemen ransomware affiliates running autonomous AI agent frameworks against 62 organizations. The agents handled reconnaissance, lateral movement tasking, and credential harvesting with minimal human oversight. The operational tempo AI frameworks enable is the concern here, not the existence of AI tooling in ransomware generally.

Sources