This is the security briefing for Saturday the 24th of October 2026, drawn from the BlueTeamSec community on infosec.pub. A busy one today, with thirteen stories to get through.
CISA have flagged a critical command injection vulnerability in Collabora Online, the built-in CODE server for Nextcloud. Unauthenticated attackers can achieve full remote code execution, and this one's been actively exploited in the wild since September with web shells turning up on internet-facing instances. If you're running the richdocumentscode app, patch to version 26.4.303 immediately and run a thorough compromise assessment.
Also from CISA, a SQL injection flaw in Arista VeloCloud Orchestrator that lets any authenticated user escalate straight to superuser. This is another zero-day with active exploitation detected from the 17th of October onwards, targeting internet-facing deployments. Patch urgently to the fixed versions, lock down web interface access to trusted IPs, and check your logs for unexpected privilege changes.
GitLab have released critical patches addressing three severe vulnerabilities, the worst being an unauthenticated remote code execution flaw via integer overflow in regex compilation. There's also an account takeover vector through SAML and LDAP misconfiguration, and an OAuth cache poisoning issue. Multiple versions affected, so check the release notes for your deployment.
Infrawatch are tracking patch uptake for the PHP2Shell vulnerability, and it's grim reading. Only thirteen percent of identifiable PHP hosts have applied the fix so far, leaving the vast majority exposed to arbitrary code execution. Fixed versions are available across the 8.2, 8.3, 8.4, and 8.5 branches — worth flagging internally if you've got PHP services exposed.
Google have made Chrome's HTTP warning system a default feature for all users, requiring explicit permission before establishing unencrypted connections. Previously limited to enhanced protection mode, this now protects everyone from eavesdropping and injection risks on HTTP sites. Local IPs and single-label hostnames are exempted to avoid breaking internal network access.
Kaspersky have written up a new UEFI bootkit called BlackX, used in targeted espionage against diplomatic entities in Central Asia. It exploits Baton Drop, the Secure Boot bypass from 2022, on systems where manual patch activation wasn't completed. Once in, it deploys kernel-level malware and remote access tools using cloud services for command and control.
ESET discovered a collaboration between two Russia-aligned threat actors targeting a Ukrainian grain logistics company. UAC-0099 gained initial access via spearphishing and deployed their MATCHWOK backdoor, then handed off to Sandworm, who executed a data-wiping attack via Group Policy two months later. The handoff included a new Go-based backdoor called MythicRatatoskr that uses the Yggdrasil decentralised mesh network for communications, which is notable tradecraft.
Kaspersky also published an analysis of Operation FlashHole, a Lazarus campaign active since January targeting South Korean organisations. The malware framework abuses legitimate INISAFE security software for deployment and features post-quantum cryptography, direct syscalls for evasion, and GitHub-based command and control using personal access tokens. Particularly relevant if you're tracking DPRK-nexus activity or post-quantum adoption in offensive tooling.
BlackFog identified a remote access trojan called DarkCore featuring a custom browser tool designed for session hijacking using stolen cookies. It employs hidden virtual network computing capabilities and proxies traffic through victims' machines to bypass multi-factor authentication and appear as legitimate traffic from the victim's IP. One for anyone tracking credential theft and session abuse techniques.
FULCRUMSEC documented a significant breach at PingCAP's TiDB Cloud service, resulting in 10.6 terabytes of data exfiltration affecting over 180,000 tenant organisations. The attackers exploited exposed cloud service account keys, poor credential hygiene including plaintext API keys in Jira tickets, and weak cryptography to conduct 88 automated exports over 22 days without detection. This follows the similar cloud database incidents we covered earlier this week.
GMO Internet disclosed unauthorised access to their Onamae.com Desktop Cloud service affecting nearly 27,000 servers. Malicious programs were discovered on the 20th of October, and while server data may have been accessed, no confirmed exfiltration or misuse has been detected yet. Affected servers have been shut down as of the 21st, and investigation is ongoing.
Two certificate authority incidents to note. eMudhra announced they're voluntarily exiting the global SSL/TLS certificate business following a recent security incident and public scrutiny, affecting about one percent of their revenue. Separately, GoDaddy revoked over 400,000 Starfield certificates that violated their own documented policies. All non-compliant certificates have now been revoked or expired.
That's everything for today from BlueTeamSec. The articles are the work of their original authors — the analysis here was automated.