Cybersecurity Threat Digest October 25, 2026

Top Stories#

BlackX UEFI Bootkit Bypasses Secure Boot

A UEFI bootkit named BlackX was used in an espionage campaign observed in early 2026. According to BleepingComputer, the malware exploited the Baton Drop vulnerability to bypass Secure Boot and load a malicious driver designed to interfere with Kaspersky and Avast security products.

The incident targets trust controls below the operating system. A successful UEFI compromise can establish persistence before endpoint agents initialize, weaken security tooling, and complicate forensic collection.

Organizations should verify firmware integrity, Secure Boot configuration, boot-chain measurements, and endpoint tamper protection. Operating-system controls alone do not cover this part of the boot process. For broader control-design context, see the compensating control glossary.

Analyst’s Take: The BlackX report makes firmware state an immediate investigation point, not a background configuration check. Teams should start with critical systems, compare their boot state against approved baselines, and look for endpoint tampering that occurred before normal agent initialization.

AI Investment Attention Shifts Toward Cybersecurity

Barron’s reporting says investor attention around artificial intelligence is shifting from semiconductor stocks toward cybersecurity companies.

For defenders, the market movement matters less than the operational signal: organizations continue to face pressure to improve resilience as AI expands the attack surface, accelerates abuse, and increases the value of security telemetry and automated response.

Critical Vulnerabilities#

CVE-2026-115933 — Postiz Token Confusion

• Product: Postiz
• Vendor: GitroomHQ
• Severity: CVSS 9.9
• Status: Not listed in the provided data as CISA Known Exploited Vulnerability
• Fixed version: Postiz 2.25.3 or later, according to the supplied release reference

Postiz uses one shared signing secret for session, invitation, password-reset, and enterprise-provisioning tokens without token-type markers. An attacker who obtains a validly signed token may be able to supply attacker-controlled claims, potentially enabling account or organization takeover.

Actions:

1. Upgrade to Postiz 2.25.3 or later.
2. Rotate relevant signing secrets after patching.
3. Invalidate active sessions, invitations, password-reset links, and provisioning tokens.
4. Review recent administrative changes, organization memberships, and newly created accounts.
5. Use the Gad Advisory for technical details.

CVE-2026-115932 — Postiz Arbitrary File Read

• Product: Postiz
• Vendor: GitroomHQ
• Severity: CVSS 9.6
• Status: Not listed in the provided data as CISA Known Exploited Vulnerability
• Fixed version: Postiz 2.25.3 or later, according to the supplied release reference

Postiz does not constrain media paths to the upload directory. A registered user, and potentially an unauthenticated attacker where self-registration is enabled, may cause arbitrary server files to be read and sent as an attachment to an attacker-controlled Discord server.

Actions:

1. Upgrade to Postiz 2.25.3 or later.
2. Disable or restrict self-registration.
3. Inspect Postiz and Discord logs for unexpected attachments and outbound transfers.
4. Review application secrets, configuration files, SSH keys, and cloud credentials that may have been exposed.
5. Restrict outbound access from the Postiz host where operationally feasible.
6. Consult the Gad Advisory.

CVE-2026-115995 — Unitree Go2 Command Injection

• Product: Unitree Go2
• Vendor: Unitree Robotics
• Severity: CVSS 9.6
• Affected area: chat_go component, set_volume function
• Fixed version: Firmware 1.1.11.5

The vulnerability permits remote operating-system command injection through the chat_go component’s set_volume function.

Actions:

1. Upgrade applicable Go2 systems to firmware 1.1.11.5.
2. Follow Unitree’s security information.
3. Place robotic platforms on isolated networks.
4. Restrict management interfaces to authorized administrators and approved control systems.
5. Review network and device logs for unexpected commands, outbound connections, or account activity.

CVE-2026-115557 — Python ssl Certificate Denylist Change

• Product: Python ssl module
• Vendor: Python Software Foundation
• Severity: CVSS 9.4

Python added a denylist for known compromised certificates so the ssl module rejects them even when certificate revocation checking is not configured. The supplied references describe the change as a security measure affecting certificate validation behavior.

Actions:

1. Update supported Python deployments.
2. Test TLS connections in staging and production-like environments.
3. Identify applications that rely on compromised or revoked certificates.
4. Confirm that certificate failures are logged and handled safely.
5. Review the oss-security discussion and the CVE record.

CVE-2026-114820 — Oracle Java and GraalVM JSSE Vulnerability

• Products: Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition
• Vendor: Oracle
• Severity: CVSS 9.1
• Exposure: Remotely exploitable without authentication, according to the supplied summary

The vulnerability affects the JSSE component and may compromise confidentiality and integrity. Oracle published a security alert and risk matrix on October 24, 2026.

Actions:

1. Apply the applicable updates from Oracle’s security alert.
2. Prioritize internet-facing Java services and applications using JSSE.
3. Identify unauthenticated endpoints and externally reachable Java management interfaces.
4. Review application, reverse-proxy, and network telemetry for suspicious requests.
5. Use Oracle’s related security blog post when assessing affected deployments.

Prioritization Note

None of the listed vulnerabilities is marked in the supplied data as included in CISA’s Known Exploited Vulnerabilities catalog. That does not make them low priority. Rank remediation using internet exposure, authentication requirements, exploitability, asset criticality, available fixes, and evidence of suspicious activity.

What Defenders Should Do Today#

1. Audit UEFI and Secure Boot

For high-value endpoints and servers:

• Confirm Secure Boot is enabled.
• Record firmware versions and bootloader versions.
• Validate Secure Boot keys and boot-policy changes.
• Review measured-boot and endpoint telemetry where available.
• Search for unexpected EFI binaries and unauthorized boot entries.
• Compare firmware state against approved baselines.

2. Investigate Endpoint Tampering

Review endpoint-security telemetry for attempts to:

• Disable or unload security drivers.
• Stop endpoint protection services.
• Modify security-product configuration.
• Add exclusions.
• Load unsigned or unexpected drivers.
• Alter boot configuration or Secure Boot state.

The BlackX reporting specifically identifies interference with Kaspersky and Avast products. The broader detection objective is to identify security-control tampering on any endpoint.

3. Patch and Contain Postiz

For every Postiz deployment:

• Upgrade to version 2.25.3 or later.
• Rotate token-signing secrets.
• Invalidate existing sessions and invitation links.
• Disable unrestricted self-registration.
• Review organization and administrator changes.
• Inspect Discord audit records and outbound file transfers.
• Search application logs for unusual media paths and token failures.

If compromise is suspected, isolate the host, preserve logs, rotate application and cloud credentials, and review files that may have been readable by the application account.

4. Isolate Robotics Networks

Unitree Go2 systems should not be directly reachable from untrusted networks. Apply:

• Network segmentation.
• Firewall rules restricting management access.
• Strong administrative authentication.
• Monitoring for unexpected device commands.
• Controlled firmware-update procedures.
• Egress filtering for robotic-device networks.

5. Patch Java and Validate TLS Dependencies

Prioritize Oracle Java and GraalVM systems that are:

• Internet-facing.
• Used for authentication or API gateways.
• Connected to sensitive databases.
• Running unauthenticated services.
• Handling confidential or integrity-sensitive transactions.
• Difficult to monitor at the application layer.

After patching, validate service startup, TLS negotiation, certificate chains, and application-specific JSSE behavior.

6. Update Python Runtime Deployments

Inventory Python versions and applications that use the ssl module. Test:

• Connections to internal certificate authorities.
• Mutual TLS workflows.
• Certificate pinning.
• Proxy and inspection infrastructure.
• Failure handling when a certificate is rejected.
• Logging and alerting for TLS validation errors.

Do not weaken certificate validation simply to restore a failing connection. Replace certificates that are compromised, revoked, or otherwise rejected by the updated trust behavior.

Detection and Hunting Priorities#

Search for the following activity across endpoint, identity, application, and network telemetry:

• Secure Boot being disabled or reconfigured.
• New or unexpected EFI boot entries.
• Firmware changes outside approved maintenance windows.
• Unsigned driver loads during early boot.
• Endpoint protection services stopping unexpectedly.
• Attempts to modify antivirus or EDR configuration.
• New Postiz administrators or organization members.
• Unexpected Postiz token errors or unusual token-use locations.
• Discord attachments originating from Postiz infrastructure.
• Postiz processes reading outside their expected upload directory.
• Unitree device connections from user or guest networks.
• Unexpected commands sent to robotic platforms.
• Java services receiving unusual unauthenticated traffic.
• Python applications generating new certificate-validation failures.

Technical Notes#

Verify Secure Boot on Windows

Run from an elevated PowerShell session:

Confirm-SecureBootUEFI
Get-ComputerInfo | Select-Object BiosFirmwareType,SecureBootState
bcdedit /enum firmware

Record results centrally and compare them with the organization’s approved device baseline.

Verify Secure Boot on Linux

Common checks include:

mokutil --sb-state
bootctl status
efibootmgr -v

Review unexpected boot entries and inspect EFI system partition contents through an approved forensic workflow. Command availability and output vary by distribution and firmware implementation.

Review Linux Boot and Driver Events

journalctl -b 0 | grep -Ei 'secure boot|shim|mok|efi|module|driver'
dmesg --level=err,warn | grep -Ei 'efi|secure boot|module|firmware'

These searches are starting points, not proof of compromise. Correlate timestamps with firmware changes, endpoint alerts, and administrative activity.

Hunt for Postiz File-Access and Outbound Transfer Indicators

Example searches depend on the application and logging stack:

grep -Ei 'media|attachment|discord|token|invite|password|organization' /var/log/postiz/*.log

Also review reverse-proxy logs for unusual paths, repeated token errors, large outbound responses, and requests associated with newly registered accounts.

Inspect Python TLS Failures

Application logging varies, but teams can search for patterns such as:

certificate verify failed
CERTIFICATE_VERIFY_FAILED
unable to get local issuer certificate
certificate revoked
certificate has expired

Treat changes in failure volume after a Python update as a validation signal requiring investigation, not as a reason to disable certificate verification.

Recommended Priority Order#

1. Immediately: Isolate exposed Postiz instances, patch to 2.25.3 or later, rotate secrets, and investigate account and file-access activity.
2. Today: Patch internet-facing Oracle Java and GraalVM services according to Oracle’s alert.
3. Today: Upgrade affected Unitree Go2 systems to firmware 1.1.11.5 and restrict network access.
4. Today: Audit Secure Boot, firmware state, boot entries, and endpoint tamper alerts on critical systems.
5. Next maintenance window: Update supported Python deployments and validate all TLS-dependent applications.
6. Continuously: Hunt for early-boot persistence, unsigned drivers, security-tool interference, suspicious outbound transfers, and unauthorized administrative changes.

Start with exposed Postiz deployments: patch them, rotate their secrets, and investigate account and file-access activity. Then address internet-facing Oracle Java and GraalVM services, affected Unitree Go2 systems, and critical endpoints with firmware or tamper indicators. Availability of a fix does not replace investigation where logs show suspicious access.

This article may contain affiliate links. We earn a commission on qualifying purchases at no extra cost to you.