Defender DailyThe daily security brief for enterprise defenders
Daily Brief
Memory flaws letting an unauthenticated attacker run code on web servers
Fix8.5.12, 8.4.27, 8.3.36 or 8.2.35, or a distribution’s patched packageFurther readingAmazon research, further reading on PHP Group PHP PHP advisory, further reading on PHP Group PHP
Source: CISA’s Known Exploited Vulnerabilities catalog, version 2026.10.26
Google Brotli
Palo Alto says firewalls are exposed only with Brotli inspection and decryption turned on, and some hotfixes are out, with the rest due by Oct 30.
Further readingNode.js advisory, further reading on Brotli flaw that can let attackers run code reaches PAN-OS firewalls Palo Alto Networks advisory, further reading on Brotli flaw that can let attackers run code reaches PAN-OS firewalls Microsoft advisory, further reading on Brotli flaw that can let attackers run code reaches PAN-OS firewalls PHP notice, further reading on Brotli flaw that can let attackers run code reaches PAN-OS firewalls
Microsoft Teams
Arctic Wolf studied more than 400 incidents that began with a chat from an outside tenant, and describes a possibly new infection chain that ends in a Python implant.
Elastic
In Windows Insider builds, Elastic found the new wesp.sys driver tells a user-mode client when a process starts, but imports nothing that would let the client block it.
Wiz
GitHub’s new checkout protections and event policies close the easy routes, Wiz says, but explicit opt-ins and outdated checkout versions stay exposed, and it gives an audit checklist.
Read: Wiz on the GitHub Actions pull request attacks that still work in 2026