The Red Thread Weekly Wrapup: Issue #29
Friday, October 30, 2026
Categories: IT Risk Management | Information Security | Penetration Testing
From October 23 to October 29, 2026
When I review a risk report, I treat the score as a starting point, not a decision. This week made that distinction hard to ignore: a 2.7 flaw helped an intruder hide, a maximum-score exploit failed to show evidence of success, and stores were skimmed even after patching.
Last week, in Issue #28, I wrote about borrowed authority and evidence that expires. This week’s stories extend that concern: the number on the scoreboard cannot tell us what an attacker values, what damage is possible, or what we’ll be able to prove afterward.
The Flaw That Erased the Audit Trail
VMware ESX CVE-2026-41709 carries a CVSS score of just 2.7. It does not let someone break in; an administrator already inside can use it to perform certain operations without leaving audit records. That distinction looks small on a scorecard and enormous during an investigation.
Broadcom’s advisory says there is no workaround. Fixes are available in ESXi 8.0U3j-25429389, ESXi-9.1.0.0-25370933, ESXi-9.0.2.0100-25595025, and VMware Cloud Foundation 5.2.4. CISA added the flaw to its Known Exploited Vulnerabilities catalog on October 28, with a November 11 federal remediation deadline.
SecurityWeek reports that the China-nexus actor Warp Panda used it as a zero-day in espionage activity, including against legal organizations, to reduce visibility during forensic analysis. I see the business risk plainly: a low score that removes the record of what happened may be more valuable to an intruder than a high-score flaw that triggers alarms. Scores measure aspects of exploitation, not an attacker’s return.
PHP2Shell Gets a Ladder
Last week I covered PHP2Shell, two unauthenticated code-execution flaws in PHP itself, below the application. This week, CISA added both vulnerabilities to KEV on October 26, one week after disclosure.
Then the story grew. Dream Research reports that an actor chained PHP2Shell with Fragnesia, a Linux kernel flaw that can modify data in the page cache, to move from code execution as the low-privilege “nobody” user to root by altering /etc/pam.d/su. CISA added Fragnesia to KEV on October 28. Dream says the chain was used against 25 servers, including firewall and management systems, after about 240 were targeted.
The researchers also describe a pivot from compromised systems into a US government-affiliated environment and Active Directory, using reverse SSH tunnels and decrypted LDAP credentials. Dream’s technical account and SecurityWeek’s report show why I don’t treat a vulnerability as an isolated entry on a list. One flaw can be a step, not a destination.
Polyglot Files and 953 Stores
Adobe Commerce and Magento Open Source CVE-2026-48356 has a 9.3 score. The flaw allows unauthenticated file uploads through guest-cart REST endpoints. Attackers used polyglot files, files that can appear to be images while also containing executable PHP, to place webshells on stores.
Sansec’s research and SecurityWeek’s coverage describe a loader campaign dating to at least mid-2025, affecting 953 stores. Attackers used backdoors including accesson.php and JavaScript injected into store content to skim visitors. CISA added the flaw to KEV on October 27 with a November 10 federal deadline; Adobe’s isolated fix, APSB26-73, has been available since July.
Here is the uncomfortable part: Sansec found a fully patched store that still received the loader after a clean scan. A backdoor can remain after patching, and malicious code in database content may not show up in a scan of the application files. That is why I distinguish vulnerability scanning from penetration testing: identifying known weaknesses is useful, but it does not confirm what a system is actually serving.
A Perfect Score, a Failed Exploit, a Full Rebuild
GitLab CVE-2026-97229 received the maximum CVSS score of 10.0. GitLab patched it on October 12 in versions 19.4.2, 19.3.5, and 19.2.8. The flaw could allow unauthenticated code execution through a specially crafted CI/CD configuration. Organizations using custom Ruby builds also need a fixed Ruby version: 3.3.13, 3.4.12, or 4.0.9 and later. CISA added the vulnerability to KEV on October 29.
That same day, Alpine Linux disclosed an attempted attack against its GitLab instance. Crafted configurations crashed workers eight times; four attempts reached partway through the exploit. Alpine found no evidence of successful code execution and verified that packages, releases, and signing keys were not tampered with. They rebuilt the instance from scratch and reset all passwords anyway, because a partial exploit against infrastructure like that is not a risk worth carrying.
I take two lessons from that response. A maximum score does not guarantee an exploit will succeed, but uncertainty about what happened can still justify a full rebuild. And honest, detailed incident reporting is more valuable than pretending uptime proves safety. The work that follows an assessment matters; I’ve written about continuity and practical follow-through for exactly that reason.
The Numbers Behind the Breaches
Navigate360, which operates the P3 tip platform used by Crime Stoppers programs, acknowledged unauthorized access to its systems between November 21, 2025, and March 5, 2026. The acknowledgment came months after the intrusion period. CBC reported that more than 1.5 million Canadian tips may have been exposed, and Crime Stoppers programs have suspended operations. The attacker’s larger claims of eight million tips and 93 GB were not vendor-confirmed. Canada’s Privacy Commissioner has opened an investigation. I see how quickly a breach becomes a question of public trust, not just data volume. (Commissioner’s announcement; CBC reporting.)
Quest Diagnostics disclosed in an SEC filing that unauthorized actors accessed its Quanum Lab Services Manager platform, which clients use to order tests and retrieve results. Patient records were accessed; Quest has not yet said how many people are affected. (SEC filing; TechCrunch report.)
GMO Internet refused a ransom demand of about $50 million tied to unauthorized access to its Onamae.com Desktop Cloud service. The company said attackers published information they claimed was linked to the company and its customers, but it was still verifying the contents. GMO’s account makes clear why I treat a ransom demand, a claim of stolen data, and confirmed exposure as different things.
Seven months of fallout, an affected-person count not yet known, a ransom refused: none appears in a severity score, and all can land on an executive’s desk.
The Rest of the Patch List
Cisco disclosed CVE-2026-76418, an 8.6 flaw in Secure Firewall ASA and FTD that can force a device to reload. CISA added it to KEV on October 29. Cisco’s advisory describes a temporary mitigation: disable secondary authentication on tunnel groups that do not use it. Cisco firewall VPNs have now had a second zero-day exploited since August.
Node2Shell, CVE-2026-111497, affects the Brotli decoder and was added to KEV on October 27. Node.js fixed supported releases in 22.23.4, 24.22.1, and 26.12.1. Because Node bundles its own Brotli copy, updating a system library alone will not fix it; the runtime itself needs an upgrade. Versions 20, 23, and 25 are end-of-life. Tenable’s FAQ explains the affected versions and patching implications. CISA also added Arista VeloCloud Orchestrator and Collabora Online vulnerabilities to KEV on October 23.
The Takeaway
The scoreboard helps me organize work, but it cannot tell me which flaw an intruder will treasure. I would ask what the weakness makes possible, what it is worth to someone seeking access, and what evidence might be missing afterward. The 2.7 that erases logs, the backdoor left in a patched store, and the 10.0 exploit that failed all demand context beyond the number. If you’re weighing how to apply that context in your organization, I’m open to comparing notes.
Comments