Global Cybersecurity Risk Briefing

Płatnik 修補更新下載、密碼編碼及登入驗證三項漏洞

Published in this issue:2026.10.30 20:10 HKT

Facts

CERT Polska 於 10 月 30 日公布 Płatnik 的三項漏洞。CVE-2026-110970 涉及以 HTTP 下載更新、程式庫及支援檔案，可能令中間人截取資料或替換檔案；CVE-2026-110971 涉及容易還原的密碼編碼；CVE-2026-110972 涉及用戶端登入驗證設計，讓可連接同一後端的應用程式實例繞過登入核對。公告指問題已在 10.02.002 版本的 metric 242 修正。

Analysis

Our analysis：Płatnik 用於處理僱員及社會保險資料，更新通道、憑證保護及登入驗證同時出現弱點，可能影響資料保密性、完整性與帳戶控制。官方公告描述的是漏洞條件，沒有表示所有安裝均已被利用。

Suggested Actions

• 盤點 Płatnik 安裝，確認已升級至 10.02.002 metric 242 或更新的官方支援版本。
• 只使用原廠授權渠道更新，並核對下載檔案與簽署／完整性資料。
• 如舊版曾保存或傳送相關憑證，評估更換密碼並覆核後端登入、更新及異常檔案活動。

Scope：波蘭及其他使用 Płatnik 的機構 · 企業軟件與資料保護

Event date：2026-10-30

Source

• CERT Polska · Vulnerabilities in Płatnik software · 來源發布 2026-10-30 · 核實時間 2026.10.30 20:10 HKT

ARKETEAM Protectel 修補檔案上載、權限、SQL 注入及儲存型 XSS 漏洞

Published in this issue:2026.10.30 23:31 HKT

Facts

CERT Polska 於 10 月 30 日公布 ARKETEAM Protectel 的五項漏洞，影響 PROTECTELMAJ 6.5.19 之前版本及 BDF 6.4.67 之前版本。CVE-2025-68391 涉及任意檔案上載及覆寫臨時目錄檔案；CVE-2025-68392 可讓低權限使用者調用部分管理員功能；CVE-2025-68393 與 CVE-2025-68394 是低權限使用者可觸發的 SQL 注入；CVE-2025-68395 是筆記編輯器的儲存型 XSS。官方表示 PROTECTELMAJ 6.5.19 及 BDF 6.4.67 已修正。

Analysis

Our analysis：這組漏洞同時涉及權限邊界、資料庫查詢及使用者瀏覽器內容。若低權限帳戶被濫用，影響可能由單一帳戶操作擴大至管理功能、資料完整性或其他已登入使用者。公告描述的是漏洞條件，沒有表示已觀察到實際利用。

Suggested Actions

• 盤點 Protectel 的 PROTECTELMAJ 與 BDF 模組，分別確認已升級至 6.5.19 及 6.4.67 或更新的受支援版本。
• 覆核低權限帳戶、管理功能使用、異常資料庫錯誤及筆記內容變更，並移除不再需要的帳戶。
• 升級前限制系統只供受控網絡及必要人員存取；完成後測試登入、管理功能及資料庫相關工作流程。

Scope：使用 ARKETEAM Protectel 的機構 · Vulnerability advisories

Event date：2026-10-30

Source

• CERT Polska · Vulnerabilities in ARKETEAM Protectel software · 來源發布 2026-10-30 · 核實時間 2026.10.30 23:30 HKT

AWS Private CA Connector for Kubernetes fixes issuer authorisation; check certificate types before upgrading

Published in this issue:2026.10.30 08:59 HKT

Facts

AWS disclosed CVE-2026-119115 on 29 October 2026. Under particular conditions, an authenticated user authorised only for a namespace-scoped issuer could obtain certificates from an unauthorised cluster-scoped issuer, including subordinate CA certificates. Affected releases are before aws-privateca-issuer 1.10.1 and EKS add-on 1.10.1-eksbuild.1. Those releases contain fixes.

Analysis

Our analysis: unauthorised cluster-level or subordinate CA certificates could weaken Kubernetes workload identities and trust boundaries, creating opportunities for impersonation or lateral movement. The update also tightens issuerRef.kind validation; certificates relying on the former permissive parsing may stop renewing. Plan security patching and service continuity together.

Suggested Actions

• Inventory CertificateRequest, Certificate and Ingress resources. Explicitly set issuerRef.kind to AWSPCAIssuer or AWSPCAClusterIssuer and confirm it matches the actual issuer.
• Upgrade aws-privateca-issuer to 1.10.1 or later, or the EKS add-on to 1.10.1-eksbuild.1 or later.
• If an immediate upgrade is not possible, restrict approval policies and Kubernetes RBAC by both issuer name and kind, and check unusual certificate issuance.

Scope：Organisations using AWS Private CA Connector for Kubernetes worldwide · Cloud identity and Kubernetes

Event date：2026-10-29

Source

• Amazon Web Services · CVE-2026-119115 - Incorrect authorization in issuer resolution in AWS Private CA Connector for Kubernetes · 來源發布 2026.10.30 00:30 HKT · 核實時間 2026.10.30 08:58 HKT

Delinea patches privileged remote-code-execution flaw in Privilege Manager Windows Agent

Published in this issue:2026.10.30 11:10 HKT

Facts

Delinea published its CVE-2026-92744 advisory on 29 October 2026. Under particular conditions, the Windows Agent for on-premises and cloud Privilege Manager may allow an unauthenticated remote attacker to execute code as LocalSystem. Affected versions include 10.1.0 through 12.0.5796 and 13.0.0 through 13.0.1058. Delinea recommends upgrading to 12.0.5804 or 13.0.2064 and later, respectively.

Analysis

Our analysis: endpoint privilege-management agents normally operate with high privileges. Network exposure can therefore make this more consequential than an ordinary application flaw. The official CVSS v4.0 score is 8.7, but actual risk depends on the agent version, reachability and deployment. The advisory does not report exploitation, so we do not infer it.

Suggested Actions

• Inventory Privilege Manager Agent versions on Windows endpoints and identify versions 12.0.5796 or earlier and 13.0.1058 or earlier.
• Follow vendor guidance to upgrade to 12.0.5804, 13.0.2064 or later, then verify the installed version.
• If upgrading must wait, follow Delinea's release notes to restrict inbound TCP 5593 through group policy or device management, assessing existing on-premises management communication.

Scope: as described by the source

Source

• Delinea · Delinea Privilege Manager agent unauthenticated remote code execution vulnerability - CVE-2026-92744 · 來源發布 2026-10-29 · 核實時間 2026.10.30 11:10 HKT
• Delinea · Privilege Manager 13.0.1 Release Notes · 來源發布 2026-10-02 · 核實時間 2026.10.30 11:10 HKT

Chrome 156 stable fixes 21 security issues, including a critical MediaStream memory flaw

Published in this issue:2026.10.30 14:14 HKT

Facts

On 29 October 2026, the Chrome team released desktop Stable/Extended Stable versions 156.0.8078.79/.80 for Windows and macOS and 156.0.8078.79 for Linux, with a staged rollout. The update contains 21 security fixes, including critical CVE-2026-76024, a MediaStream memory-corruption issue, and high-severity issues in components including FileSystem, Autofill, CacheStorage, Network, V8, DOM, Blink and Skia. The vendor announcement does not report exploitation of this batch.

Analysis

Our analysis: browsers continually process untrusted internet content, so memory-corruption and use-after-free flaws can pose significant endpoint risks. With a staged rollout, enabling automatic updates does not prove that every device is patched. The installed version and restart state provide verifiable evidence.

Suggested Actions

• Use browser management or endpoint inventory to confirm Windows/macOS versions 156.0.8078.79/.80 and Linux version 156.0.8078.79 or later.
• Accelerate managed-device updates after compatibility checks and remind users to restart their browsers to apply them.
• Track exceptions for devices that are offline long-term, have automatic updates disabled or run older versions, rather than checking only whether a policy is configured.

Scope：Individuals and organisations using desktop Google Chrome worldwide · Operating systems and enterprise software

Event date：2026-10-29

Source

• Google Chrome · Stable Channel Update for Desktop · 來源發布 2026-10-29 · 核實時間 2026.10.30 14:14 HKT
• HKCERT · Google Chrome Multiple Vulnerabilities · 來源發布 2026-10-30 · 核實時間 2026.10.30 14:14 HKT

Aur0ra ransomware operators use AI agents to assist lateral movement and privilege escalation

Published in this issue:2026.10.30 05:08 HKT

Facts

In research published on 29 October, Sophos Counter Threat Unit reported observing Aur0ra ransomware operators using AI agents for tool testing and intrusion workflows. Sophos assessed that human operators still supplied targets, credentials and connectivity, while agents helped with network and Active Directory discovery, credential attack-path analysis and some lateral movement. These were not fully autonomous attacks.

Analysis

Our analysis: the key development is faster internal discovery, privilege analysis and repetitive operations, rather than AI replacing the attacker. Perimeter blocking alone may not prevent an intruder with a valid account from quickly finding network shares, backups and privileged accounts.

Suggested Actions

• Use phishing-resistant MFA and review unusual use of VPN, administrator and service accounts.
• Separate critical servers and backup environments, and limit ordinary accounts' access to network shares and management interfaces.
• Include EDR alerts, Active Directory enumeration, suspicious remote administration and bulk access to shared data in rapid-response procedures.

Scope：Enterprise networks worldwide · Ransomware and AI-assisted attacks

Event date：2026-10-29

Source

• Sophos Counter Threat Unit · AI used in Aur0ra ransomware testing and execution · 來源發布 2026-10-29 · 核實時間 2026.10.30 05:08 HKT

Microsoft: North Korean threat actors are adding generative and agentic AI to established attack workflows

Published in this issue:2026.10.30 05:08 HKT

Facts

In research published on 29 October, Microsoft Threat Intelligence reported that several North Korean threat actors it tracks were using AI to accelerate reconnaissance, social engineering, fabricated identities, tool development and repetitive analysis. Microsoft stressed that the observed operations remained human-led and had not become fully autonomous attacks.

Analysis

Our analysis: financial services, cryptoassets, software supply chains and IT service providers are among the targets discussed in the research. AI can speed up fabricated applications, targeted lures and technical research. Identity verification, recruitment procedures and access to development environments should form a connected defence.

Suggested Actions

• Add identity and work-location verification to remote recruitment, outsourced development and privileged technical roles.
• Limit initial permissions for new and contractor accounts, and monitor unusual access to repositories, cloud resources and credentials.
• Train staff to recognise highly personalised social engineering; fluent writing or a convincing video call should not be the only proof of identity.

Scope：Financial, cryptoasset, IT, software supply-chain and government organisations worldwide · AI threat intelligence

Event date：2026-10-29

Source

• Microsoft Threat Intelligence · Tracking AI adoption in North Korean threat actor tradecraft · 來源發布 2026-10-29 · 核實時間 2026.10.30 05:08 HKT

Zimbra 10.1.21 fixes two stored XSS vulnerabilities in email interfaces

Published in this issue:2026.10.30 05:08 HKT

Facts

On 29 October, CERT Polska disclosed CVE-2026-66911 and CVE-2026-66912, two stored cross-site scripting vulnerabilities affecting Zimbra Collaboration versions before 10.1.21. They involve the Content-Location header of attachments and the From header when replying in Classic UI. CERT Polska states that both issues were fixed in 10.1.21.

Analysis

Our analysis: email is a trusted entry point. If a crafted message executes code in a user's browser context, sessions or account actions may be at risk. The trigger depends on the interface and user actions; the advisory does not establish that every Zimbra deployment has been compromised.

Suggested Actions

• Inventory Zimbra Collaboration versions and plan an upgrade to 10.1.21 or a newer supported release.
• Until the upgrade is complete, remind users to avoid unknown attachments or replies to suspicious messages and strengthen email filtering.
• Review unusual administrative actions, sessions and mail-rule changes; handle suspicious activity through the incident-response process.

Scope：Organisations using Zimbra Collaboration worldwide · Enterprise email security

Event date：2026-10-29

Source

• CERT Polska · Vulnerabilities in Zimbra Collaboration software · 來源發布 2026-10-29 · 核實時間 2026.10.30 05:08 HKT

Szafir signing software fixes XXE, path-traversal and certificate-validation flaws

Published in this issue:2026.10.30 08:11 HKT

Facts

On 29 October, CERT Polska disclosed CVE-2026-93570, CVE-2026-93571 and CVE-2026-106036. Szafir versions before 2.0.0 build 708 have issues involving XML external entities, update-filename path traversal and TLS certificate/hostname validation. Build 708 fixes these issues. The unsupported Szafir Weryfikująca product is also affected by XXE and has no fixed release.

Analysis

Our analysis: signing tools process documents obtained by users and access local data. Crafted XML, update paths or unverified TLS connections can put files and update integrity at risk. The advisory describes vulnerability conditions; it does not prove that every user has been attacked.

Suggested Actions

• Inventory Szafir and Szafir Weryfikująca versions and uses, and upgrade Szafir to 2.0.0 build 708 or later.
• Stop using the unsupported, unpatched Szafir Weryfikująca product and move to a supported alternative workflow.
• Before updates are complete, process signing files only from trusted sources and monitor unusual updates, external connections and local file access.

Scope：Organisations using Szafir software worldwide · Enterprise software and electronic signatures

Event date：2026-10-29

Source

• CERT Polska · Vulnerabilities in Szafir software · 來源發布 2026-10-29 · 核實時間 2026.10.30 08:11 HKT

Cisco ASA and FTD VPN flaw is being exploited; check the fixed release for your branch

Published in this issue:2026.10.30 02:51 HKT

Facts

On 28 October at 19:15 GMT, Cisco disclosed CVE-2026-76418. Certain ASA and FTD SSL VPN configurations can let an unauthenticated attacker trigger a device reload and disrupt service. Cisco has observed exploitation and provides fixed releases for the affected branches.

Analysis

A VPN outage can directly disrupt teams that depend on remote access. Exposure depends on the software version and VPN configuration; this does not mean that every Cisco device is vulnerable.

Suggested Actions

• Inventory ASA and FTD versions and enabled SSL VPN configurations.
• Plan a compatible upgrade using Cisco's fixed-release table and retain a rollback plan.
• Review unexpected reloads and connection logs; do not weaken authentication as an unreviewed temporary measure.

Scope：Organisations worldwide using the affected Cisco ASA or FTD configurations · Vulnerability advisories

Event date：2026-10-28

Source

• Cisco PSIRT · Cisco ASA and FTD SSL VPN denial-of-service advisory · 來源發布 2026.10.29 03:15 HKT · 核實時間 2026.10.30 02:51 HKT

Drupal Commerce Core access bypass is being exploited; online stores should update and review orders

Published in this issue:2026.10.30 08:59 HKT

Facts

On 28 October 2026, the Drupal Security Team published SA-CONTRIB-2026-254. It confirms that insufficient protection of some Commerce Core routes and entity fields can allow an access bypass with financial consequences for merchants. The team rates CVE-2026-118539 highly critical and reports exploitation. Affected releases are before 2.41, and from 3.0.0 up to but excluding 3.3.13.

Analysis

Our analysis: bypassing order and pricing permissions can cause direct transaction losses and disrupt inventory, fulfilment and financial records. This is the vendor's confirmation of a vulnerability and exploitation, not evidence that a named merchant has been affected.

Suggested Actions

• Upgrade Commerce Core 3.x to 3.3.13 or later; upgrade the older branch to 8.x-2.41 or a newer supported release.
• Review recent orders, discounts, payment states and unexpected field changes, preserving application and payment records for investigation.
• Restrict management and deployment permissions, keep verified backups before updating, and test checkout and recovery afterwards.

Scope：Websites using Drupal Commerce Core worldwide · Website and ecommerce platform security

Event date：2026-10-28

Source

• Drupal Security Team · Commerce Core - Highly critical - Access bypass - SA-CONTRIB-2026-254 · 來源發布 2026-10-28 · 核實時間 2026.10.30 08:58 HKT

WordPress 7.1.4 fixes an upgrade-process RCE risk and multiple stored XSS issues

Published in this issue:2026.10.30 05:08 HKT

Facts

WordPress.org released the 7.1.4 security update on 28 October. It fixes multiple issues, including a weakness that could allow remote code execution during an upgrade, several stored XSS vulnerabilities and a stored denial-of-service issue in the Interactivity API. It also updates revoked root certificates. The official announcement recommends immediate updating; backports for eligible older branches are still being rolled out.

Analysis

Our analysis: enabling automatic updates does not prove that installation succeeded. Plugin compatibility, caching, read-only filesystems or permissions can prevent the deployed version from changing. An RCE risk in the upgrade process makes actual version and deployment records particularly important.

Suggested Actions

• Check the actual WordPress core version in production and when its update completed.
• Keep verified backups and a rollback point before updating, then test login, forms and essential plugins.
• For an older branch, confirm that its security backport has been released and actually installed.

Scope：WordPress websites worldwide · Websites and content management systems

Event date：2026-10-28

Source

• WordPress.org · WordPress 7.1.4 · 來源發布 2026-10-28 · 核實時間 2026.10.30 05:08 HKT

Node2Shell/Brotli now carries an exploitation warning; customers still need to check their own patches

Published in this issue:2026.10.30 05:08 HKT

Facts

On 28 October, Sophos Counter Threat Unit reported exploitation of CVE-2026-111497 and noted that CISA added it to the Known Exploited Vulnerabilities catalogue on 27 October. This supplements our earlier coverage of AWS runtime and container patching. Exposure still depends on the Brotli implementation and version included in each product.

Analysis

Our analysis: the new development is a warning about observed exploitation, beyond a theoretical vulnerability. Organisations should inventory embedded Brotli in applications, containers, proxies, document processing and other vendors' products as well as Node.js. A shared name does not establish that every environment is remotely exploitable.

Suggested Actions

• Include CVE-2026-111497 in an urgent asset review, prioritising services that decode external input.
• Check vendor fixes and actual deployed versions; rebuild and redeploy containers and bundled libraries where necessary.
• Monitor unusual crashes, memory errors and suspicious child processes during compressed-content handling, and preserve evidence.

Scope：Organisations using affected Brotli implementations or related products worldwide · Exploited vulnerabilities

Event date：2026-10-28

實質更新：Sophos 於 2026-10-28 報告實際利用,並確認 CISA 已於 2026-10-27 把 CVE-2026-111497 加入 KEV;這是相對本站 10 月 29 日 AWS 修補安排的實質風險更新。

前次日報

Source

• Sophos Counter Threat Unit · ‘Node2Shell’ vulnerability (CVE-2026-111497) in active exploitation · 來源發布 2026-10-28 · 核實時間 2026.10.30 05:08 HKT

Jenkins core fixes serious flaws involving RCE, file access and administrator-account risks

Published in this issue:2026.10.30 08:11 HKT

Facts

The Jenkins Security Team published a core security advisory on 28 October covering multiple high-risk vulnerabilities. Affected releases include Jenkins 2.587 and earlier, and LTS 2.580.1 and earlier. Issues involve an XStream deserialisation-filter bypass, agent-launch command approval bypass, symbolic-link and path handling, a setup-wizard race condition and stored XSS. Jenkins 2.588 and LTS 2.580.2 contain fixes.

Analysis

Our analysis: Jenkins often has access to source code, build credentials, package repositories and deployment environments, so file access or code execution on a controller can affect more than one server. Most issues still require authentication or particular read/configuration permissions; this is not evidence that every Jenkins instance can be attacked anonymously.

Suggested Actions

• Check the controller's actual version and prioritise Jenkins 2.588, LTS 2.580.2 or a newer supported release.
• Review Overall/Read, Item/Configure and Agent/Configure permissions and retain only necessary people and service accounts.
• After upgrading, check unusual configuration changes, agent creation, file access and build-credential use, and retain verified backups and rollback plans.

Scope：Organisations using Jenkins controllers worldwide · Enterprise software and software supply chains

Event date：2026-10-28

Source

• Jenkins Security Team · Jenkins Security Advisory 2026-10-28 · 來源發布 2026-10-28 · 核實時間 2026.10.30 08:11 HKT

Veeam Backup for Microsoft 365 fixes cross-tenant data risks and remote code execution

Published in this issue:2026.10.30 08:59 HKT

Facts

Veeam published KB4957 on 27 October 2026, listing four vulnerabilities in Veeam Backup for Microsoft 365 version 8. CVE-2026-106076 can allow an authenticated organisation-transfer peer to inject SQL into the source server's configuration database, read or change cross-tenant configuration data, and execute code as the PostgreSQL service account. Other issues involve arbitrary file reading, REST API authentication bypass and local privilege escalation during installation. Veeam identifies 8.6 Patch 1, build 8.6.0.5011, as the complete fixed release.

Analysis

Our analysis: backup systems often hold valuable data, service credentials and recovery permissions. Abuse of a configuration database or management API could undermine backup isolation and increase recovery risks during ransomware incidents. Preconditions and privileges differ between the flaws; the advisory does not establish anonymous exploitation or compromise of every deployment.

Suggested Actions

• Inventory Veeam Backup for Microsoft 365 versions and follow vendor procedures to upgrade to 8.6 Patch 1, build 8.6.0.5011, or a newer supported release.
• Review organisation transfers, federation authentication, administrator roles and backup-server network access, retaining only necessary connections.
• After updating, review unusual configuration changes, REST API access and backup jobs, and verify independent recovery from offline or immutable copies.

Scope：Organisations using Veeam Backup for Microsoft 365 worldwide · Backup and recovery security

Event date：2026-10-27

Source

• Veeam · KB4957: Vulnerabilities Resolved in Veeam Backup for Microsoft 365 8.6 · 來源發布 2026-10-27 · 核實時間 2026.10.30 08:58 HKT

EDK II PXE driver flaw creates a pre-boot RCE risk; isolate network-boot environments

Published in this issue:2026.10.30 08:59 HKT

Facts

TianoCore published GHSA-99cj-7hg9-mp4m on 22 October 2026. It describes an out-of-bounds write in the EDK II PXE Base Code driver when handling oversized IPv4 or IPv6 ICMP error messages. During PXE network boot, CVE-2026-97631 may let an unauthenticated attacker able to send packets to the client interrupt booting or execute code before the operating system loads. The advisory did not list a released fixed version at publication.

Analysis

Our analysis: a pre-OS flaw affects the trust chain used for deployment, recovery and bare-metal rebuilding, before endpoint protection starts. Exposure depends on affected firmware code, whether PXE is enabled and access to the boot network. It does not follow that all UEFI devices are affected.

Suggested Actions

• Inventory PXE-booted servers, workstations and network devices and ask firmware vendors whether affected EDK II code is included.
• Disable PXE where it is unnecessary; otherwise separate deployment networks from user networks and restrict traffic reaching boot clients.
• Track vendor firmware fixes and schedule updates. Until then, monitor unusual boot failures and keep offline recovery media.

Scope：Devices using affected EDK II PXE drivers worldwide · Firmware and recovery infrastructure

Event date：2026-10-22

Source

• TianoCore / EDK II · Pre-boot RCE in EDK II PXE driver · 來源發布 2026-10-22 · 核實時間 2026.10.30 08:58 HKT

PAN-OS PHP advisory adds fixed releases on 29 October; prioritise exposed management interfaces

Published in this issue:2026.10.30 02:51 HKT

Facts

Palo Alto Networks updated its PHP advisory on 29 October to confirm further fixed PAN-OS releases. The advisory reports exploitation against management interfaces exposed to the internet. The original advisory was first published on 21 October.

Analysis

This is a remediation update to an existing vulnerability, not another newly discovered flaw. Prioritise management interfaces exposed to the internet and check the actual release branch; a PHP version number is not a PAN-OS fixed-release number.

Suggested Actions

• Check the device's release branch against the latest official fixed-version table.
• Restrict management access to a controlled administration network or jump host.
• Plan a compatible fixed PAN-OS release and review unusual administrative logins and configuration changes.

Scope：Organisations worldwide using affected PAN-OS versions · Security updates

Event date：2026-10-29

實質更新：2026-10-29 原廠確認 10.2.7-h39、10.2.10-h42、11.2.4-h23、12.1.4-h13 及 12.1.10-h3 已發布,移除預計推出日期。

Source

• Palo Alto Networks · PHP vulnerabilities: original advisory 21 October; fixed-release update 29 October · 來源發布 2026-10-21 · 核實時間 2026.10.30 02:51 HKT