> InfoSec News Nuggets – 10/27/2026

Brotli Decoder Flaw Behind Node.js RCE Also Affects Bun, Python and Other Widely Used Software A memory-corruption bug in Google’s Brotli decoder, tracked as CVE-2026-111497 and rated 9.2 on CVSS 4.0 by Google, reaches far beyond the Node.js remote code execution first reported on October 21. Because each program bundles its own copy of the C decoder, Bun, .NET, Envoy, Istio, the Python Brotli and brotlicffi packages, and even FFmpeg, ClickHouse, and Apache Arrow are affected whenever they decode attacker-controlled Brotli data. Imperva researchers achieved code execution on one unpatched Node.js build, though no in-the-wild exploitation has been reported. Microsoft shipped out-of-band .NET fixes on October 25 and Linux distributions are patching unevenly, so admins should update to fixed versions, restart services, rebuild container images, and, where patching isn’t yet possible, reject or disable Brotli decompression of untrusted input.   Reports of PHP bug exploitation attempts grow as experts downplay viability of exploits Exploitation attempts against the critical PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) have exploded since disclosure, with Amazon reporting activity as early as October 17, days before patches shipped, and botnets such as Mirai and Potassium trying to conscript vulnerable servers. However, experts say no successful attacks have been confirmed and that most public proof-of-concept exploits only work in lab conditions, tripping over address space layout randomization on production systems. VulnCheck says it has developed a technique to bypass ASLR, and researchers warn that internet-wide scanning is already building target lists, with Censys counting more than 41 million internet-facing PHP services still on affected versions. Defenders are urged to treat the current lull as borrowed time and patch immediately.   University of Copenhagen Hit by Second Cyberattack Days After 525,000-Person Data Breach The University of Copenhagen (KU) shut down several administrative systems on the evening of October 26 after a second cyberattack, coming only days after hackers accessed names, CPR identification numbers, phone numbers, and private email addresses belonging to roughly 525,000 people. The university said attackers gained access to one of its test environments and that PINs for 20,000 staff and students were exposed. Denmark’s Minister for Research, Education and Digitalization called the incidents an attack on the country’s knowledge institutions and summoned the leaders of all eight Danish universities to discuss cybersecurity, as the Technical University of Denmark and Aarhus University have also been targeted in recent weeks.   Over 2,000 More Victims Discovered… KB Kookmin Bank Says “Additional Hacking Damage Confirmed, Apologizes to Customers” South Korea’s KB Kookmin Bank announced on October 26 that an additional 2,091 people, including 1,631 customers and 460 executives and employees, had their information leaked in a hacking incident first disclosed on October 2, raising the total number of victims to 2,210. The bank said the increase was not the result of a new attack but of a thorough re-verification of data tied to the previously compromised mobile work support system for employees, through which names, phone numbers, addresses, and encrypted resident registration numbers were exposed. The bank apologized for failing to grasp the full scale of the incident at the outset and said it will individually notify affected customers and compensate for any secondary damage.   WordPress sites compromised after TeamUpdraft credential exposure Attackers are using UpdraftCentral connection keys stolen in a breach of TeamUpdraft, the developer of the UpdraftPlus backup plugin, to install malicious plugins and create administrator accounts on connected WordPress sites. Patchstack observed attacks beginning October 18 and identified at least 99 malicious plugin variants, some disguised as maintenance tools and designed to hide from WordPress’s admin screens. The potentially accessed customer database also held names, email and billing addresses, order histories, password hashes, and two-factor settings. TeamUpdraft released UpdraftPlus 1.26.13 and 2.26.13 to revoke old cloud connections, but revoking keys does not remove backdoors already planted, so admins should inspect every connected site, review admin accounts and plugins, rotate credentials, and restore from a clean pre-October 17 backup if compromise is found. The post InfoSec News Nuggets – 10/27/2026 appeared first on AboutDFIR - The Definitive Compendium Project.