Brotli RCE Under Mass Exploitation as Hospital, University Breaches Mount

CISA adds VMware ESX and Linux Kernel flaws to exploited-vulnerability catalog

CISA added two more vulnerabilities to its Known Exploited Vulnerabilities catalog on October 28, citing evidence of active exploitation: CVE-2026-41709, an insufficient logging flaw in Broadcom VMware ESX, and CVE-2026-46300, a missing-initialization-of-variable bug in the Linux Kernel. Binding Operational Directive 26-04 requires Federal Civilian Executive Branch agencies to prioritize remediation of KEV-listed flaws on internet-exposed assets that grant full control after exploitation, and to check for prior compromise before patching. CISA urges all organizations, not just federal agencies, to adopt the same risk-based remediation approach. (CISA)

Brotli decompression bug under mass exploitation across widely used software

A remotely exploitable out-of-bounds write flaw in Google's Brotli compression library, CVE-2026-111497, is being mass-exploited after Node.js publicly disclosed it on October 21. The bug, nicknamed Node2Shell or Brotli2Shell, can corrupt memory, leak process data or enable remote code execution in any application that decompresses attacker-controlled Brotli streams, including Node.js, .NET, Bun, Envoy, Istio, Python HTTP clients, FFmpeg, Apache Arrow and ClickHouse. Threat intelligence firm ELLIO recorded exploit traffic achieving shell access on vulnerable builds. CISA added the CVE to its Known Exploited Vulnerabilities catalog on October 28. (Help Net Security)

CISA unveils CISA 2030 strategy to harden critical infrastructure

CISA released CISA 2030: Defend, Harden, Prevail, a strategy built on three pillars—Defend, Harden and Prevail—aimed at identifying and eliminating adversary footholds in critical infrastructure while hardening operational technology, software security and emergency communications. Acting Director Nick Andersen called on every critical infrastructure company, vendor and technology manufacturer to act now. CISA will review its core services within 60 days, deliver an implementation plan within 180 days, and report progress within 365 days, shifting the agency from passive defense toward anticipatory, proactive risk reduction. (CISA)

Cyberattack disrupts University of New Mexico hospitals, extortion group claims data theft

A cyberattack forced University of New Mexico Health Sciences Center hospitals to divert ambulances and cancel clinic appointments on October 26, with ransomware-style extortion group BYOD claiming to have stolen students' and employees' personal data, Social Security numbers, research information and electronic health record rosters from 36,000 machines. State and federal law enforcement were notified. By October 28, UNM Health said all hospitals had reopened, ambulance traffic was normal, and its security teams assessed that the event affected some end-user devices but did not reach core systems or servers. (Help Net Security)

University of Copenhagen breach exposes data of 525,000 people

The University of Copenhagen confirmed a cyberattack detected October 20 exposed personal data on roughly 525,000 people, including names, national identity numbers, phone numbers and email addresses, after intruders broke into a test environment. The university also disclosed that PIN codes for about 20,000 staff and student ID cards were compromised and has since reissued them. UCPH reported the incident to the Danish Data Protection Agency under GDPR and briefly shut down administrative systems again this week after mistaking follow-on activity from the same breach for a second attack. (Help Net Security)

PENN Entertainment names Gary Hunter as Chief Information Security Officer

PENN Entertainment named Gary Hunter as Chief Information Security Officer, moving him from the same role at outdoor retailer REI. Hunter previously held cybersecurity leadership posts at The Walt Disney Company, including security officer roles for Walt Disney Studios and Disney Entertainment, and earlier led security engineering, operations and incident response at Expedia after more than 15 years as an enterprise architect at Travelport. He takes on security leadership for a company spanning entertainment, gaming and digital experiences. (CDO Magazine)

Aledade appoints Suyesh Karki as Chief Information Security Officer

Value-based care company Aledade named Suyesh Karki as Chief Information Security Officer, leading its Security and IT organization as the company expands AI-driven technology across more than 46 states and Washington, D.C. Karki joins from BambooHR, where he was CISO, and previously served as CISO at Domo, building security controls, data classification and incident response programs and launching an AI center of excellence. He will oversee security for data tied to more than 3 million patients in Aledade's network. (Aledade)