Global Cybersecurity Risk Briefing

01 / Daily Analysis

Back to the four-story overview ↑

Brotli 解壓漏洞可影響多種執行環境　AWS 列出 Lambda 等更新安排

Published in this issue:2026.10.29 09:05 HKT

Facts

AWS 於 2026 年 10 月 28 日公布 CVE-2026-111497：原生 Brotli 解壓程式的緩衝區溢位，在處理特製壓縮輸入時可能導致程式碼執行或讀取程序記憶體。AWS 表示 Lambda 託管服務本身不受影響，但部分 Node.js 及 .NET Lambda runtime 受影響；容器基礎映像需要使用者重新建置及部署，ZIP runtime 則按公告時程分階段更新。已棄用的 Node.js 18、20 runtime 不會取得安全更新。

Analysis

Anti-Ransomware analysis：解壓功能常隱藏於網站、API、文件處理及無伺服器應用的依賴內，不能只搜尋名為「Brotli」的獨立程式。若攻擊者可令服務解碼外部內容，程式碼執行或記憶體洩漏可能成為竊取憑證及進一步橫向移動的入口；但公告不代表所有使用 Brotli 的環境均可被利用。

Suggested Actions

• 盤點會解碼外部 Brotli 內容的應用、套件、Lambda layer、容器映像及 App Runner 服務。
• 使用已修正的 Node.js／Brotli 版本；容器及自帶函式庫要重新建置和部署，不能只等候託管平台更新。
• 把 Node.js 18、20 等已停止支援 runtime 遷移至受支援版本，部署後核對實際 runtime 及映像建立日期。

Scope: as described by the source

Source

• Amazon Web Services · CVE-2026-111497: Native Brotli Decoder Remote Code Execution and Memory Disclosure · 來源發布 2026.10.29 06:00 HKT · 核實時間 2026.10.29 09:05 HKT

02 / Daily Analysis

Back to the four-story overview ↑

Strands Agents Tools 修正秘密遮罩繞過　曾載入 environment 工具者要輪換憑證

Published in this issue:2026.10.29 09:05 HKT

Facts

AWS 於 2026 年 10 月 28 日公布 CVE-2026-115415。Strands Agents Tools 的 environment 工具把是否遮罩秘密的參數暴露於 LLM 工具結構中；特製提示內容可能令模型關閉遮罩，並以明文返回智能體主機的環境變數，包括雲端憑證及 API Key，而毋須營運者同意。受影響版本為 0.1.0 至 0.8.6 之前；0.8.6 已修正，並棄用該工具。

Analysis

Anti-Ransomware analysis：這項漏洞顯示提示注入可由文字內容跨越到工具層，風險不只在模型回答，而在智能體可讀取的主機秘密及可呼叫的外部系統。即使沒有證據顯示個別部署曾洩漏，曾載入該工具的環境仍應按可能暴露範圍處理。

Suggested Actions

• 升級 strands-agents-tools 至 0.8.6 或以上，並從智能體移除已棄用的 environment 工具。
• 輪換曾存在於智能體程序環境中的雲端憑證、API Key 及其他秘密，檢查近期工具調用與對外連線紀錄。
• 改用短期憑證、最小權限、工具白名單及受限網絡出口，避免模型直接控制秘密顯示或遮罩參數。

Scope: as described by the source

Source

• Amazon Web Services · CVE-2026-115415 - Secret masking bypass in the environment tool in Strands Agents Tools · 來源發布 2026.10.29 03:30 HKT · 核實時間 2026.10.29 09:05 HKT

03 / Daily Analysis

Back to the four-story overview ↑

AWS SDK for pandas 的 Athena 結果位置需核對擁有權

Published in this issue:2026.10.29 09:05 HKT

Facts

AWS 於 2026 年 10 月 28 日公布 CVE-2026-118029。AWS SDK for pandas（awswrangler）的 Athena 模組未驗證預設查詢結果位置的擁有權，遠端使用者可能透過預先建立的 S3 bucket 讀取 Athena 查詢結果，或篡改返回給呼叫者的結果。受影響版本為 3.16.1 之前；修正版 3.16.1 已於 2026 年 5 月 8 日發布。

Analysis

Anti-Ransomware analysis：這項風險同時影響資料機密性及完整性；若查詢結果再供報表、AI 或自動化流程使用，被篡改資料可能令後續系統作出錯誤操作。公告在 10 月發布，但修正版早已存在，因此重點是找出仍未更新或仍依賴預設 bucket 的環境。

Suggested Actions

• 盤點所有使用 awswrangler Athena 模組的程式、Notebook、容器及排程工作，升級至 3.16.1 或以上。
• 逐一核對每個 AWS 帳戶及區域的預設 Athena 結果 bucket 是否由自身帳戶擁有。
• 明確設定查詢結果位置或強制使用 workgroup 設定，並檢查 S3 bucket policy、存取紀錄及異常結果。

Scope: as described by the source

Source

• Amazon Web Services · CVE-2026-118029 - Unverified ownership of the default Athena query result location in AWS SDK for pandas · 來源發布 2026.10.28 23:30 HKT · 核實時間 2026.10.29 09:05 HKT

04 / Daily Analysis

Back to the four-story overview ↑

Salt 推出 Agentic Security 自動處置　高影響動作仍應保留批准制

Published in this issue:2026.10.29 09:05 HKT

Facts

Salt Security 於 2026 年 10 月 28 日公布 Autonomous Defense，透過擴充 Salt Workflows，把智能體、MCP、API 及執行時風險的偵測連接至自動化處置。按原廠說明，系統可依客戶政策撤銷高風險智能體或 MCP 工具權限、向既有 WAF／API Gateway 推送阻擋規則、調整護欄或觸發設定修復；Salt Workflows 已向客戶提供，並支援人工批准及審計記錄。

Analysis

Anti-Ransomware analysis：由告警直接連接封鎖或修復可縮短暴露時間，但自動化本身亦可能因錯誤判斷、過度權限或連接器被濫用而擴大影響。以上能力屬原廠聲稱，並非本站實測、認證或推薦。

Suggested Actions

• 先把高影響操作設為人工批准，例如撤銷生產權限、修改 WAF 規則或變更 API Gateway 設定。
• 為每個連接器使用獨立最小權限帳戶，限制可作用的資源、動作及環境。
• 在非生產環境測試誤報、回復、撤銷及連接器失效流程，並把完整審計記錄送入 SIEM。

Scope: as described by the source

Source

• Salt Security · An Alert Doesn’t Stop an Attack: Introducing Autonomous Defense · 來源發布 2026-10-28 · 核實時間 2026.10.29 09:05 HKT
• Salt Security via PR Newswire · Salt Security Extends Agentic Security Platform with Autonomous Defense · 來源發布 2026.10.28 20:03 HKT · 核實時間 2026.10.29 09:05 HKT

05 / 每日分析

Back to the four-story overview ↑

Veeam fixes backup-platform authorisation bypass: check the 13.x branch and Linux Agent

Published in this issue:2026.10.29 04:40 HKT

Facts

On 27 October, Veeam published KB4948 covering four vulnerabilities. CVE-2026-108142 affects specified versions of Backup & Replication 13.0 and 13.1 and involves an authorisation bypass in the CDP Coordinator Service. The listed fixes are 13.0.3.63 and 13.1.2.57. A separate local privilege-escalation issue affects only Linux Agent 13.1 managed by Backup & Replication; it is fixed in 13.1.2.11. Check the version scope for each vulnerability separately.

Analysis

Our analysis: Backup systems also need version and access management. First identify the deployed branch and components, then schedule patching and recovery checks. This advisory does not mean an organisation has been compromised.

Suggested Actions

• Inventory backup servers, CDP and managed Linux Agents, recording versions and responsible owners.
• Use KB4948 to check the scope and upgrade path for each vulnerability, then schedule a controlled update.
• After updating, check backup jobs and sample restores, and retain verification records.

Scope: as described by the source

Source

• Veeam · Vulnerabilities Resolved in Veeam Backup & Replication 13.1.2 · 來源發布 2026-10-27 · 核實時間 2026.10.29 04:39 HKT

06 / 每日分析

Back to the four-story overview ↑

Chrome 156 desktop update includes 52 security fixes: confirm browser restarts and versions

Published in this issue:2026.10.29 04:40 HKT

Facts

On 27 October, Google announced a desktop stable-channel update to Chrome 156.0.8078.73/.74 for Windows and Mac and 156.0.8078.73 for Linux, with a phased rollout. The announcement lists 52 security fixes, including issues rated Critical in FileSystem, FileAPI, Skia and Layout. HKCERT also published an advisory on 28 October.

Analysis

Our analysis: Downloading an update does not mean every workstation is running the new version. Include restarting the browser and checking its actual version in the update process, and review devices with policy-delayed updates. Vulnerability severity should not be read as confirmation of exploitation.

Suggested Actions

• Check Chrome versions and managed update policies on Windows, Mac and Linux workstations.
• Complete the update through official channels, restart the browser, then confirm its version.
• Sample-test compatibility with business systems and follow up on devices that have not finished updating.

Scope: as described by the source

Source

• Google Chrome · Stable Channel Update for Desktop · 來源發布 2026-10-27 · 核實時間 2026.10.29 04:39 HKT
• HKCERT · Google Chrome Multiple Vulnerabilities · 來源發布 2026-10-28 · 核實時間 2026.10.29 04:39 HKT

This article was prepared with assistance from SI agents. Factual summaries, vendor claims and Anti-Ransomware analysis are presented separately. It provides general information and education, not professional advice for a particular environment. Completeness, timeliness, accuracy and product security are not guaranteed, nor are prevention, decryption or recovery. Check the original sources and consult qualified professionals about your environment. Inclusion does not imply certification, endorsement or partnership. Trademarks and rights to original text belong to their respective owners.