Daily Brief for Wednesday, October 21, 2026

Added to KEV

6 additions

EG Secure Solutions SiteGuard Server Edition

OS command injection letting attackers run commands as root or SYSTEM

CISA due dateOct 23

Plex Media Server

Server-side request forgery letting attackers make the server send requests anywhere

CISA due dateNov 3

Plex Media Server

URL injection letting attackers call other plugins’ functions with chosen parameters

CISA due dateOct 23

Plex Media Server

Server-side request forgery letting signed-in users reach internal and outside addresses

CISA due dateNov 3

Plex Media Server

File write letting an admin plant code the server runs at startup

CISA due dateOct 23

Siemens Software Center

DLL search path flaw letting local users run code as the app

CISA due dateNov 3

Source: CISA’s Known Exploited Vulnerabilities catalog, version 2026.10.20

Vulnerabilities and patches

3 items

eMudhra

Mozilla Firefox and NSS

Google Go

Cloudflare One Client and cloudflared

Item 1

Mozilla drops an eMudhra root because keys for 8 of its CAs are recoverable

Anyone can recover the keys from the certificates, so software that doesn’t get revocation updates needs new trust stores to stop trusting them.

Mozilla Security Blog, source for item 1 Mozilla dev-security-policy forum, source for item 1 Mozilla Bugzilla incident report, source for item 1 eMudhra intermediate CA compromise site, source for item 1 Cloudflare, source for item 1 Go announcement, source for item 1

Fastify @fastify/middie

Item 2

Flaw in Fastify’s middie engine lets requests skip authentication middleware

Versions 9.0.0 through 9.3.5 can silently skip path-scoped middleware such as authentication, most often when a scope prefix ends in a slash, and 9.3.6 fixes it.

OpenJS Foundation CVE record, source for item 2 OpenJS Foundation security advisories, source for item 2

Oracle JD Edwards EnterpriseOne, Access Manager, E-Business Suite, SOA Suite and WebLogic Server

Item 3

Oracle ships 1,295 security patches in its quarterly October update

Oracle rates unauthenticated flaws in Access Manager, SOA Suite, E-Business Suite’s Workflow and JD Edwards EnterpriseOne at 10.0, and two in WebLogic Server at 9.8.

Oracle Critical Patch Update Advisory, source for item 3

Breaches and campaigns

3 items

Cisco Adaptive Security Appliance and Firepower Threat Defense

Veeam Backup & Replication

SonicWall SonicOS

Exploited
In KEV

Item 4

FBI and CISA detail SafePay ransomware, which has hit at least 600 victims

The joint advisory lists five known flaws the group exploits in Cisco, Veeam and SonicWall products, plus its tools, file names, hashes and IP addresses.

CISA joint advisory AA26-293A, source for item 4 CISA KEV catalog, source for item 4 ARIN registration for GitHub’s network, source for item 4 RIPE registration for GitHub’s network, source for item 4 Cloudflare IP ranges, source for item 4 Google IP ranges, source for item 4

Google Cloud and Workspace

Attacks confirmed

Item 5

Phishing ads lead to hijacked Google Cloud billing for Gemini use, Wiz says

Attackers linked their own projects to victims’ billing accounts and ran up tens to hundreds of thousands of dollars in Gemini API charges within two days.

Wiz Customer Incident Response Team, source for item 5

Microsoft

Attacks confirmed

Item 6

APT28 hit a NATO shipbuilder and engine maker with Hookedge, Symantec says

Symantec says the Russian group stole credentials, tunneled into the shipbuilder’s network over SSH and used a new loader, and it published hashes and network indicators.

Symantec Threat Hunter Team, source for item 6