Vulnerability Watch

What LXD and MicroCloud are: LXD is Canonical's system for running and managing Linux virtual machines and containers — think of it as a tool for spinning up isolated computing environments on a server. MicroCloud ties multiple LXD machines together into a single cluster.

What it is: An authentication flaw that lets an attacker log in as a trusted client without ever holding that client's private key. It carries a perfect CVSS (Common Vulnerability Scoring System — a standardised 0–10 scale measuring severity) score of 10.0.

Who's at risk: Administrators running LXD with the network API enabled, or anyone using MicroCloud. Standalone LXD installations are not exposed by default, but MicroCloud clusters are inherently networked.

CVSS: 10.0 (Critical — patch today.)

Root cause: LXD uses mutual TLS (Transport Layer Security — a protocol that verifies identity by requiring both sides to present certificates) to authenticate remote clients. The server checked every certificate a client presented against its list of trusted identities, but a TLS connection only proves ownership of the first — the "leaf" — certificate in the chain. The attacker could attach a trusted client's public certificate, which is not a secret, further back in the chain. The server saw the trusted cert and waved them through. It is like a bouncer checking the back of your ID queue rather than the person holding it.

Attack vector: An attacker needs two things: network access to the HTTPS API, and the public certificate of any client the server already trusts. In a MicroCloud cluster, that certificate is briefly visible as members join. With both in hand, the attacker builds a TLS chain with the trusted cert at the back, connects to the API, and is accepted as that trusted client — with full access to the cluster, its virtual machines, and, if the impersonated account is privileged, root access to the physical host.

Detection strategies:

1. Check API access logs for connections from unexpected IP addresses presenting certificates belonging to known cluster members.
2. Look for administrative API calls — such as VM creation, deletion, or configuration changes — that do not correspond to scheduled operations.
3. Monitor for new container or VM instances you did not create.

Recommended actions:

1. Run sudo snap refresh lxd and sudo snap refresh microcloud immediately. Verify the installed version after refresh.
2. Until patched, restrict network access to the LXD HTTPS API using firewall rules — only allow known, trusted IP addresses.
3. Incus users (the community fork of LXD) should upgrade to version 7.6.0.

What Brotli is: Brotli is a widely used data compression library developed by Google that shrinks files and web content before sending them over the internet, and is embedded in a large number of applications and programming frameworks.

What it is: A critical out-of-bounds write flaw (where a program writes data beyond the reserved memory space it was given, like overfilling a container until it spills into a neighbour's) allows specially crafted input to corrupt memory in ways that can crash an application, leak its contents, or execute attacker-controlled code.

Who's at risk: Any application that passes attacker-controlled data through an affected Brotli decoder — including compressed HTTP request bodies, responses fetched from untrusted servers, and compressed files. Microsoft .NET, Visual Studio, PowerShell, Node.js, and two Python packages are all confirmed affected.

CVSS: 9.2 (Critical — patch today). Microsoft also rates this 8.1 under CVSS v3.1 and assesses exploitation as "More Likely."

Root cause: The Brotli decoder failed to validate that incoming data would stay within its allocated buffer before writing. The underlying bug was actually fixed in Brotli's source code in February 2026, but was not recognised as a security vulnerability at the time, so no security advisory was issued until now.

Attack vector: An attacker sends a maliciously crafted Brotli-compressed payload — either as a server response retrieved by a target application, or as a request body processed by a web framework. If the data reaches the vulnerable decoder, it can trigger memory corruption, leading to a crash or, in demonstrated cases on Node.js running on Linux, arbitrary code execution (RCE — running the attacker's own commands on the target machine). No authentication is required.

Recommended actions:

1. Update Brotli to version 1.0.10, 1.1.1, or 1.2.1. Apply Microsoft's October 25 patches for .NET (8.0.33, 9.0.22, 10.0.14), Visual Studio 2019/2022/2026, and PowerShell 7.4–7.6.
2. Update Python packages Brotli and brotlicffi to version 1.2.1 and 1.2.1.0 respectively.
3. Review any application that fetches or processes external compressed content and confirm it runs a patched Brotli version.

What Pillow is: Pillow is the most widely used Python library for processing images — it handles uploads, thumbnail generation, PDF pipelines, and image conversion across millions of web applications and machine-learning projects, downloaded roughly 436 million times per month.

What it is: When Pillow opens an EPS image file, it passes the filename to Ghostscript (a separate program that renders the image). It does not check that filename first. An attacker who controls the filename can craft it as a command rather than a path, causing Ghostscript to execute arbitrary operating system instructions on the server.

Who's at risk: Any web application using Pillow to open EPS images on a host where Ghostscript is installed. Upload endpoints that preserve or derive filenames from user input are the realistic target. The flaw only triggers when Ghostscript is present — it is required to open EPS files at all.

CVSS: 9.2 (Critical — patch today.)

Root cause: Pillow passes the filename directly to Ghostscript without sanitising or validating it. The weakness is not in the image content but in the filename itself. Think of it like a librarian who fetches a book by reading the title aloud — if the title is itself an instruction, the system obeys it instead of looking up a book.

Attack vector: An attacker submits a file with a maliciously crafted filename to an upload endpoint. Pillow passes that filename to Ghostscript during processing. Ghostscript interprets the crafted name as a command and executes it, giving the attacker remote code execution (RCE — the ability to run arbitrary commands on the server) without needing to exploit anything inside the image file itself.

Detection strategies: Look for unexpected shell processes spawned from your Python web application process. Review server logs for unusual child processes originating from image processing jobs. Monitor for unexpected outbound network connections following image upload events.

Recommended actions:

1. Upgrade Pillow to version 13.0.0 immediately — this is the patched release.
2. If you cannot upgrade now, disable EPS file handling or block EPS uploads at the application layer.
3. Audit upload endpoints to ensure filenames from user input are never passed unsanitised to external programs.

What FortiSIEM is: FortiSIEM is Fortinet's security information and event management platform — software that organisations use to collect, monitor, and analyse security logs across their entire network from a single dashboard.

What it is: A critical path traversal flaw (where an attacker manipulates file path references to reach files outside the intended directory, like navigating from a guest room into a locked server room by exploiting the stairwell) that allows an unauthenticated attacker to execute arbitrary code remotely.

Who's at risk: Anyone running FortiSIEM 7.5.0. Version 7.6 is not affected. A public proof-of-concept exploit is now available, meaning the bar to exploitation is low.

CVSS: 9.4 (Critical — patch today)

Root cause: The flaw lives inside a function called SendQueryResult(), which accepts a user-supplied query-id parameter and passes it directly into a file path without validating it. Two weaknesses combine: directory traversal sequences (../) let an attacker escape the intended folder, and a null byte (\0) injected into the parameter causes the operating system to ignore everything that follows it, allowing the attacker to choose the exact filename to overwrite.

Attack vector: An unauthenticated attacker connects to the gRPC service (a framework for communication between services) on TCP port 27918. By crafting a query-id value containing traversal sequences and a null byte, they can overwrite a shell script (redishb.sh) that runs automatically every 60 seconds via a scheduled task. Replacing that script with malicious code gives the attacker remote code execution (the ability to run any command on the target server) with no login required.

Detection strategies:

1. Check logs on port 27918 for unexpected external connections or unusual gRPC traffic.
2. Monitor redishb.sh and surrounding files in /opt/charting/ for unexpected modifications or timestamp changes.
3. Look for anomalous cron job activity or unexpected outbound connections from the FortiSIEM host.

Recommended actions:

1. Upgrade FortiSIEM 7.5.0 to version 7.5.1 or above immediately.
2. Restrict access to TCP port 27918 at the network perimeter — this service should not be reachable from untrusted networks.
3. Review recent file modification logs on affected systems to check whether exploitation has already occurred.

What Plex Media Server is: A self-hosted media application that lets you organise and stream your personal collection of films, TV shows, and music from your own hardware to any device.

What it is: CVE-2026-96655 is one component of a four-vulnerability chain called Plex2Shell, according to Security Week. When the four flaws are combined, an attacker can run arbitrary code (any commands they choose) on an exposed Plex server without needing a valid login. The code runs with the same privileges as the Plex service itself.

Who's at risk: Anyone running a Plex Media Server that is accessible from the internet and has not yet applied the September 2026 patch. Exploitation began within 24 hours of a public proof-of-concept being released.

CVSS: Not yet individually scored — treat as Critical until confirmed.

Root cause: The vulnerability chain exploits insufficient input validation across multiple components of the Plex server. Each flaw alone is limited; chained together, they allow an unauthenticated attacker to escalate from a simple request to full code execution. Think of it like a series of unlocked doors: no single one gets you into the vault, but walking through all four does.

Attack vector: An attacker sends crafted requests to an internet-exposed Plex server, working through the four-flaw chain without supplying credentials. Observed attacks have deployed a cryptocurrency miner (XMRig) and proxy software that routes attacker traffic through the victim's residential IP address — useful for bypassing corporate VPN and email security controls.

Detection strategies:

• Check running processes for XMRig or any process named myawesomeproxy
• Review outbound network connections for unexpected high-bandwidth traffic, particularly to mining pools
• Check Plex server logs for unauthenticated requests that result in unusual process spawning

Recommended actions:

1. Update Plex Media Server to the latest release immediately — Plex shipped fixes in September 2026
2. If you cannot patch right now, remove public internet access to your Plex instance until you can
3. Audit running processes and outbound connections on any machine hosting Plex

What BeyondTrust Remote Support is: A platform IT teams use to remotely access, diagnose, and fix computers and devices — widely used by managed service providers and enterprise help desks.

What it is: An improper validation flaw that lets attackers perform unauthorised file operations on Remote Support appliances. Think of it like a mail clerk who accepts packages without checking whether the return address is real.

Who's at risk: Any organisation running BeyondTrust Remote Support up to version 26.2.3, particularly self-hosted customers who have not yet applied the BT26-05-RS patch.

CVSS: 9.3 (Critical — patch today.)

Root cause: The software failed to properly verify the origin of incoming messages, allowing a malicious party to send instructions the system would treat as legitimate without ever confirming they came from a trusted source.

Attack vector: The China-linked group Armory Castle (also tracked as UNC5221) exploited this as a zero-day (a flaw attacked before a patch exists) from 29 August onward. Once inside, they deployed a webshell called Sawfly — a small program installed on a compromised server that lets attackers run commands remotely — gained root-level control, harvested credentials, deleted logs to cover their tracks, and used the platform's own file-transfer tools to extract sensitive internal documents.

Detection strategies: Look for unexpected administrator account permission changes, missing or truncated system and web server logs, and outbound connections to unfamiliar IP addresses from your BeyondTrust appliance.

Recommended actions:

1. Apply patch BT26-05-RS immediately. SaaS customers were patched automatically on 9 October; self-hosted customers must apply it manually.
2. If running versions older than 24.3.1, upgrade first, then apply the patch.
3. Audit administrator account permissions and review logs for anomalous activity going back to late August.

What Windows Shell is: The Windows Shell is the core interface layer of Microsoft Windows — it handles how files are opened, executed, and displayed on your computer.

What it is: This is a zero-day (a vulnerability that was being exploited before a fix existed) that lets attackers bypass Mark of the Web (MotW) protections. MotW is a tag Windows attaches to files downloaded from the internet, telling security tools like Defender SmartScreen to treat them with caution. Bypassing it means a malicious file can open without triggering any warning.

Who's at risk: Any Windows user who opens email attachments or downloads files. An attacker must convince the target to open a crafted file — social engineering (manipulating someone into taking an action) is required, but that is exactly how most phishing works.

CVSS: 8.8 (High — patch immediately)

Root cause: The Shell fails to correctly validate MotW metadata on specially crafted files, allowing the tag to be stripped or ignored. This breaks the chain of trust between downloaded files and the security tools designed to inspect them.

Attack vector: An attacker sends a malicious file via email or message. The target opens it. Because MotW is bypassed, Defender SmartScreen does not raise an alert, and the file executes with no visible warning.

Detection strategies: Look for SmartScreen bypass events in Windows Defender logs; unexpected execution of recently downloaded files; and files with mismatched or absent Zone.Identifier alternate data streams.

Recommended actions:

1. Apply Microsoft's October 2026 Patch Tuesday updates immediately
2. Block macro execution in Office for files from external sources
3. Monitor endpoint logs for SmartScreen suppression events

CVE ID not confirmed in source — check the original advisory before acting.

What Bricksforge is: A commercial add-on for the Bricks visual site builder that extends WordPress websites with features like custom forms, animations, an email designer, and custom admin pages. It is used by approximately 6,000 websites.

What it is: A critical file upload flaw that lets completely unauthenticated users — no account, no login required — push arbitrary files onto a WordPress server and trigger those files to execute as code. Think of it like a letterbox with no filter: anyone walking past can post whatever they want inside, and the house automatically opens and reads it.

Who's at risk: Any WordPress site running Bricksforge version 3.1.8.9 or earlier. Active exploitation has been confirmed since 7 October.

CVSS: 9.8 (Critical — patch today, without waiting for a maintenance window.)

Root cause: The plugin failed to validate or restrict uploaded file types before accepting them. No authentication check was in place to confirm who was making the request, meaning the vulnerability could be triggered by anyone on the internet.

Attack vector: An attacker sends a crafted HTTP request to the vulnerable plugin endpoint with a malicious PHP file attached. Because no authentication or file-type validation is enforced, the server accepts the file and stores it. The attacker then requests that file's URL, the server executes it, and the attacker gains full control of the site. Patchstack observed two automated attack clusters — one using 44 different IP addresses firing identical payloads, another testing 25 variations of PHP file extensions — suggesting organised, scripted exploitation.

Detection strategies:

1. Check server logs for POST requests to Bricksforge form endpoints containing unusual file extensions (.php, .phtml, .php5).
2. Look for unfamiliar PHP files in WordPress upload directories (typically /wp-content/uploads/).
3. Review your WordPress admin user list for any accounts you did not create.

Recommended actions:

1. Update Bricksforge to version 3.1.8.10 immediately.
2. Audit uploaded files in your WordPress installation for anything suspicious added after 7 October.
3. Restrict direct PHP execution in your uploads directory via your server configuration or hosting control panel.

What NetScaler is: Citrix NetScaler ADC and Gateway are enterprise networking appliances used by organisations to manage, secure, and control application traffic and remote access.

What it is: A memory overflow flaw (where a programme writes more data than a buffer can hold, corrupting adjacent memory) that can allow an attacker to remotely execute code or crash the appliance entirely. Citrix rates this as critical and is urging immediate action, according to SecurityWeek.

Who's at risk: Organisations running NetScaler ADC or Gateway configured as a SAML SP or SAML IdP (identity and authentication components used in single sign-on systems), or Secure Private Access Hybrid deployments that use NetScaler.

CVSS: 9.5 — Critical. Patch today.

Root cause: The flaw lives in how the appliance processes SAML authentication requests. Input is not properly validated before being written to memory, so a specially crafted request can overflow the buffer and hand an attacker control over what executes next. Think of it like a form that accepts any length of text and crashes the filing system when you type too much.

Attack vector: A remote attacker sends a malformed SAML request to an exposed NetScaler endpoint. If the appliance is not patched, that request overflows the memory buffer and can either crash the service or deliver arbitrary code with the privileges of the running process. No authentication is required to trigger it.

Recommended actions:

1. Upgrade to NetScaler ADC and Gateway version 14.1-73.46, 13.1-64.29, or the relevant FIPS build immediately.
2. If patching cannot happen today, restrict external access to SAML endpoints at the network perimeter.
3. Review access logs for unexpected SAML authentication attempts or service restarts.

What Atlassian's products are: Atlassian makes widely used business collaboration and development tools — Jira for project tracking, Confluence for team wikis, Bitbucket for code storage, and several others used by software teams worldwide.

What it is: An arbitrary file access flaw — meaning an attacker can request and read specific files on the server without logging in, as long as they know the file's exact path.

Who's at risk: Anyone running a self-hosted instance of any of the eight affected products. Cloud-hosted Atlassian customers are not affected.

CVSS: 9.3 (Critical — patch today.)

Root cause: The server fails to verify whether a requesting user has permission to access a file before returning it. If the attacker already knows the file path — and for common configurations, paths are predictable — there is nothing stopping retrieval. Organisations using Crowd for single sign-on are at heightened risk because authentication credentials are stored in plaintext at a known location.

Attack vector: An unauthenticated attacker sends a crafted HTTP request pointing at a known file path. The server returns the file. No login required. With SSO credentials in hand, the attacker can then create admin accounts and move freely through the environment.

Detection strategies: Look for unusual GET requests to configuration or credential file paths in your web server logs. Monitor for new admin account creation outside normal provisioning windows. Flag external access to Crowd endpoints.

Recommended actions:

1. Patch all affected products immediately using the fixed versions listed in the Atlassian advisory.
2. If patching is not immediately possible, block external internet access to your Atlassian instances entirely.
3. Deploy WAF (web application firewall) rules per Atlassian's guidance as a temporary mitigation.