Threat Digest October 28, 2026: Node2Shell and Ransomware

Top Stories#

CISA confirms active exploitation of Node2Shell

CISA confirmed that attackers are exploiting the critical Google Brotli vulnerability CVE-2026-111497, also known as Node2Shell, Broccoli2Shell, or HTTP2Shell. The vulnerability was added to CISA’s Known Exploited Vulnerabilities catalog alongside CVE-2026-48356, affecting Adobe Commerce and Magento.

Organizations should treat affected Brotli-dependent applications and internet-facing services as emergency priorities. Identify where Brotli is used directly or through Node.js, web servers, proxies, frameworks, containers, and packaged applications. Apply available vendor fixes or documented mitigations, then validate remediation with authenticated scans and application testing.

• BleepingComputer: CISA warns of hackers exploiting the critical Node2Shell flaw
• CISA: Two vulnerabilities added to the Known Exploited Vulnerabilities Catalog

Ransomware disrupts healthcare and technology services

The University of New Mexico Health Sciences Center disclosed a cyberattack that caused outages affecting patient care, surgeries, and academic activity. Healthcare organizations should assume that disruption can spread beyond IT systems into clinical operations, scheduling, communications, and third-party services.

In Japan, GMO urged customers to disconnect systems and shut down computers after a threat actor breached its Onamae Desktop Cloud environment and threatened ransomware. The incident highlights the need for an isolation procedure that balances containment with business continuity.

• BleepingComputer: UNM Health ransomware attack disrupts patient care and surgeries
• BleepingComputer: Japan’s GMO urges customers to shut down PCs amid ransomware threat

Ransomware affiliate sentenced to 70 months

A Ukrainian national linked to Nefilim and Hive ransomware attacks against hospitals, government entities, and businesses was sentenced to 70 months in prison. The case shows how ransomware investigations combine victim-side telemetry, infrastructure evidence, cryptocurrency tracing, and international law enforcement cooperation.

Defenders should focus on reducing the attacker’s operating window. Enforce phishing-resistant MFA, restrict remote administration, monitor identity-provider activity, and ensure that backup systems cannot be reached with ordinary administrator credentials.

• BleepingComputer: Nefilim and Hive ransomware affiliate gets 70 months in prison

Hijacked analytics script used to steal payment-card data

Attackers reportedly compromised a shared Convertr analytics script to skim payment-card data from e-commerce transactions. A compromise of a third-party script can affect many merchants without requiring direct access to each merchant’s infrastructure.

Payment-page owners should maintain an inventory of JavaScript dependencies, review changes to externally hosted scripts, enforce a restrictive Content Security Policy, and monitor checkout requests for unexpected destinations or altered form behavior. Where practical, use Subresource Integrity for static third-party resources and minimize scripts running on payment pages.

• BleepingComputer: Hackers hijack Convertr analytics script to steal payment-card data

Microsoft distrusts compromised eMudhra certificates

Microsoft released out-of-band Windows updates to remove trust in certificates associated with compromised eMudhra certificate-authority keys. Administrators should deploy the updates across supported Windows systems and confirm that certificate trust changes are present on endpoints, servers, and managed images.

Certificate-related response should include a review of affected applications, signed binaries, TLS connections, and internal trust stores. Standard patch reporting does not confirm the removal of every locally installed or separately managed certificate. For background, see what a digital signature is.

• BleepingComputer: Microsoft releases Windows OOB updates to distrust eMudhra certificates

CISA and researchers report exploitation of PHP flaws

CISA and security researchers reported successful exploitation of critical PHP vulnerabilities. Organizations running PHP should identify internet-facing applications, confirm supported versions, review framework and plugin dependencies, and inspect logs for suspicious requests or post-exploitation activity.

PHP exposure is often distributed across web servers, content-management systems, custom applications, development environments, and legacy appliances. Prioritize systems with direct internet access and applications handling authentication, file uploads, administrative functions, or sensitive data.

• Google News report: CISA and researchers confirm successful exploitation of PHP flaws

Analyst’s Take: The KEV entries should drive the first response, but the exposure is broader than two patches. Brotli can be embedded in dependencies and packaged applications, while the ransomware and payment-skimming incidents show why containment and dependency visibility need to proceed alongside remediation.

Critical Vulnerabilities#

CVE-2026-111497 — Google Brotli

• Severity: Critical; listed in CISA KEV
• Status: Active exploitation reported
• Aliases: Node2Shell, Broccoli2Shell, HTTP2Shell
• Action: Identify affected Brotli-dependent software and apply vendor fixes or mitigations immediately.

Because Brotli may be embedded in other software, direct package inventory is not sufficient. Review software bills of materials, container images, operating-system packages, Node.js dependencies, reverse proxies, and managed application platforms.

CVE-2026-48356 — Adobe Commerce and Magento

• Severity: Critical; listed in CISA KEV
• Action: Prioritize exposed storefronts, administration panels, integration services, and connected infrastructure.

Restrict administrative interfaces while patching, review authentication and administrative activity, and look for unexpected changes to catalog, checkout, payment, or scheduled-task functionality.

CVE-2026-65145 — NVIDIA NeMo Agent Toolkit

• CVSS: 10.0
• Issue: Missing authentication may enable code execution, privilege escalation, data tampering, denial of service, and information disclosure.
• References: NVIDIA security advisory, NVD record, CVE record

Treat exposed agent-toolkit services as high-risk administrative interfaces. Remove unnecessary internet access, verify authentication boundaries, inspect process execution and outbound connections, and update according to NVIDIA’s advisory.

CVE-2026-117564 — nest-admin

• CVSS: 9.8
• Issue: Versions before 1.0.1 contain a hardcoded JWT secret that enables unauthenticated attackers to forge administrator tokens.
• Action: Upgrade to version 1.0.1 or later and rotate potentially exposed secrets.
• References: Project repository, affected configuration, fix commit, NVD record

A software upgrade alone is insufficient if the secret was exposed or reused. Invalidate existing sessions, rotate JWT-signing material, review administrator creation and login events, and check for unauthorized configuration changes. Organizations reviewing credential exposure may also find the JWT glossary useful.

CVE-2026-112362 — @fastify/express

• CVSS: 9.1
• Issue: Versions 4.0.5 through 4.0.8 may allow unauthenticated bypass of path-scoped authentication, authorization, or rate-limiting middleware when a non-default option is enabled.
• Fixed version: 4.0.9
• References: OpenJSF security advisories, GitHub advisory, NVD record

Check whether the affected non-default option is enabled. Until upgraded, review route-level authorization, rate-limit behavior, and requests reaching protected paths without expected identity context.

CVE-2026-115216 — Eclipse ioFog Operator

• CVSS: 9.1
• Issue: Versions 3.8.0 before 3.9.2 disable TLS certificate verification, allowing an on-path attacker to capture credentials and access tokens.
• Fixed version: 3.9.2
• References: Release 3.9.2, Eclipse security work item, NVD record

Upgrade to 3.9.2 or later and assume credentials or tokens may require rotation if the operator communicated across an untrusted network while certificate validation was disabled.

CVE-2026-4337 — PuMuKIT

• CVSS: 8.8
• Issue: Unauthenticated users may upload arbitrary file types to writable paths and may delete files.
• References: INCIBE-CERT advisory, NVD record

Restrict upload functionality, review writable directories, inspect recently created files, and check for web shells or unexpected executable content. Remove internet exposure until a fixed release or effective mitigation is deployed.

What Defenders Should Do Today#

1. Prioritize the KEV-listed vulnerabilities. Patch or mitigate CVE-2026-111497 and CVE-2026-48356 immediately. Confirm fixes with rescans and application-level validation.
2. Build a dependency inventory. Search production, development, containers, virtual machines, appliances, and software images for Brotli, PHP, Magento, Adobe Commerce, Node.js, and related components.
3. Remove unnecessary internet exposure. Restrict management panels, agent services, upload endpoints, and administrative APIs using network controls and identity-aware access.
4. Upgrade newly disclosed critical components. Update NVIDIA NeMo Agent Toolkit, nest-admin, @fastify/express, Eclipse ioFog Operator, and PuMuKIT where deployed.
5. Rotate secrets and tokens. Rotate JWT-signing secrets, API keys, credentials, and access tokens associated with vulnerable or potentially compromised systems.
6. Hunt for exploitation. Review web, proxy, application, identity, endpoint, and cloud logs for suspicious uploads, forged-token activity, unexpected administrator actions, command execution, and abnormal outbound connections.
7. Deploy Microsoft’s certificate updates. Confirm eMudhra-related trust changes across Windows endpoints, servers, golden images, and managed deployment rings.
8. Audit third-party payment scripts. Compare current scripts with approved versions, enforce Content Security Policy, monitor payment-page integrity, and investigate unexpected card-data destinations.
9. Test ransomware recovery. Verify offline or immutable backups, perform restoration tests, restrict backup administration, and document isolation procedures for clinical and business-critical systems.
10. Reassess incident readiness. Ensure security, infrastructure, legal, communications, and business-continuity teams know who can authorize system isolation and customer notification.

Technical Notes#

Identify vulnerable packages and dependencies

Use package-manager and image inventories rather than relying only on host-level scans:

# Node.js dependency inventory
npm ls --all

# Search lockfiles for relevant components
grep -RniE 'brotli|fastify-express|nest-admin' \\
  package.json package-lock.json npm-shrinkwrap.json yarn.lock pnpm-lock.yaml 2>/dev/null

# Debian-based package inventory
dpkg-query -W | grep -iE 'brotli|php|magento'

# RPM-based package inventory
rpm -qa | grep -iE 'brotli|php'

Validate each result against the relevant vendor or project advisory. A package name appearing in a lockfile does not prove that the vulnerable code is reachable, while a transitive dependency may still be deployed inside a production image.

Search logs for suspicious web activity

Initial triage can focus on upload attempts, unexpected administrative access, and unusual request paths:

# Common web-server indicators
grep -RniE 'POST|PUT|upload|multipart|admin|login|token|cmd=|shell|\\.php' \\
  /var/log/nginx /var/log/apache2 2>/dev/null | tail -n 200

# Recently created executable files in common web roots
find /var/www /srv/www -type f \\
  \( -name '*.php' -o -name '*.phtml' -o -name '*.jsp' -o -name '*.aspx' \) \\
  -mtime -14 -printf '%TY-%Tm-%Td %TH:%TM %p\\n' 2>/dev/null

Treat these commands as triage aids, not proof of exploitation. Correlate timestamps with identity-provider events, process execution, file integrity data, EDR telemetry, and outbound network activity.

Review JWT and administrative activity

For applications using JWT authentication, inspect:

• Tokens issued before and after patching
• Unexpected administrator creation or role changes
• Login events from new geographies, networks, or user agents
• Sessions that remain valid after secret rotation
• Configuration changes involving signing algorithms or key material

After rotating a signing secret, verify that previously issued tokens are rejected and that all application instances use the new secret.

Verify TLS certificate validation

For ioFog or similar operator components, confirm that certificate verification is enabled after upgrading. Test both successful validation against the expected certificate chain and rejection of an invalid or mismatched certificate.

# Inspect a remote certificate chain
openssl s_client -connect example.internal:443 \\
  -servername example.internal -showcerts </dev/null

# Review certificate dates and subject information
openssl s_client -connect example.internal:443 \\
  -servername example.internal </dev/null 2>/dev/null |
  openssl x509 -noout -subject -issuer -dates -fingerprint -sha256

Do not treat a successful TCP or TLS connection as evidence that identity validation is working. The client must reject untrusted, expired, or hostname-mismatched certificates.

Detect unauthorized payment-page changes

Compare deployed third-party scripts against approved hashes or repository versions, and alert on:

• New external script domains
• Changes to checkout form handlers
• JavaScript reading payment fields
• Requests sending card-related data to unfamiliar destinations
• Obfuscated scripts introduced outside the change process

Content Security Policy should be deployed in stages, beginning with reporting, followed by enforcement after legitimate dependencies are documented.

Bottom Line#

Start with the two CISA KEV-listed vulnerabilities: identify their presence, restrict exposed interfaces, apply fixes or mitigations, and validate the result. In parallel, rotate secrets and tokens where vulnerable systems may have been exposed, then use the listed telemetry and recovery checks to determine whether exploitation or ransomware activity has already crossed into the environment.

This article may contain affiliate links. We earn a commission on qualifying purchases at no extra cost to you.