CISA KEV - Malwlab

A decompression chip on a circuit board with a stream of compressed data overflowing into the adjacent memory, shown as a glowing red crack

vulnerability

.NET ships an out-of-band patch: a Brotli overflow, a tarball ownership flaw, and two fixes that had to be redone

Microsoft's 2026-10-25 out-of-band .NET release fixes a Brotli decompression buffer overflow now on CISA's KEV list, a Linux tarball ownership flaw that lets a local attacker escalate, and two network-code-execution CVEs whose October 13 patch turned out to be incomplete.

A metal computer chip engraved with the letters su on a dark workbench, with a shadow-like copy of the chip hovering above it, split open and glowing red from the crack

Linux

fragnesia: the /usr/bin/su that is clean on disk and corrupt in memory

CISA KEV-listed a Linux kernel bug called fragnesia on October 28, with a due date of October 31. Its entry names a chain with PHP2Shell that ends in an unauthenticated root shell. The catch: the exploit corrupts the in-memory copy of a system binary, so the file on disk

A Ghibli-style illustration of two cartoon robots in a misty green forest clearing, with no visible held shield.

citrix

Citrix NetScaler Zero-Days: Preserve the Evidence, Then Patch

Two of the eight vulnerabilities Citrix disclosed for NetScaler ADC and NetScaler Gateway on September 27, 2026 are already in the wild. CISA added CVE-2026-88771 and CVE-2026-88772 to its Known Exploited Vulnerabilities catalog that same day, after receiving reports and partner threat intelligence that confirmed active

Podcast

Cyber Briefing (2026-08-05): INC Ransomware SonicWall SMA zero-day at scale, Langflow RCE on KEV, cPanel SQL-root escalation

INC Ransomware claims 885 victims on SonicWall SMA 1000 zero-days CVE-2026-15409/15410 with TOTP seed theft. CISA adds Langflow CVE-2026-9198 RCE to KEV. cPanel CVE-2026-58048 (CVSS 9.4) SQL-root escalation.

Podcast

Cyber Briefing Weekly (2026-08-10): INC SonicWall TOTP theft, ChainDrop npm worm, RufRoot AI-agent hijack, NatJack

INC Ransomware hits 900+ victims via SonicWall SMA 1000 zero-days. npm worm ChainDrop poisoned 444+ packages with Ethereum C2 rotation. CVE-2026-59726 leaves Ruflo's MCP bridge unauthed (CVSS 10.0). Plus: TeamCity under BOD in latest KEV batch; NatJack NAT trust exploits.

litellm

The Gateway in the Middle: Why Your AI Proxy Is a Perimeter Device and What a Pre-Auth SQLi Taught Us

An unauthenticated pre-auth SQL injection in the LiteLLM AI gateway, fixed in 1.83.7 and exploited in the wild 36 hours after the global advisory. The AI gateway is the perimeter device of the self-hosted AI stack — here is the triage, the forensics, and the standing posture.

homelab

When Your Self-Hosted App Lands in CISA KEV: The Operator 72-Hour Response Checklist

CISA added four self-hosted apps to KEV in three weeks: Metabase, MLflow, Zimbra, Gitea. The 72-hour operator checklist: exposure check, patch or compensate, compromise check, scoped credential rotation, documentation for the next incident.