Welcome to Threat Thursday, Galactic’s weekly threat intelligence roundup. Every Thursday, we cover the cybersecurity stories that matter most for protecting organizations from emerging threats, and we break each one down into what happened, what it could mean for your organization, and what to do about it.
This week, attackers walked in through firewall admin pages, VPN login screens, network boot code, and a Teams chat that looked like the help desk. Something left switched on was the way in across almost every story this week.
This Week’s Stories
01. PHP2Shell Fallout: Attackers Hit Exposed Palo Alto Firewall Admin Pages (CVE-2026-109618, CVE-2026-109619)
Last week we covered PHP2Shell (CVE-2026-109618 and CVE-2026-109619), two serious flaws in PHP, the programming language behind most websites. This week the fallout reached firewalls. Palo Alto Networks, whose firewall software uses PHP for its admin web page, confirmed attackers are exploiting the flaws against firewalls whose admin page can be reached from the internet. Separately, Israeli security firm Dream tracked a group it suspects is linked to China that paired PHP2Shell with a second flaw to take full control of 25 servers in the U.S., Japan, Taiwan, and South Korea. Three belonged to a U.S. government-affiliated network, where the attackers set up a hidden connection back to their own systems and went after employee passwords. Dream did not name the firewall maker, and it found AI tools throughout the attackers’ setup.
Potential impact: The notable detail is where the attack went next. A firewall sits at the edge of the network, and once the attackers controlled one, it became a route to the system that manages every employee login. Dream says 22 of the hijacked firewalls still carried the attackers’ backdoor when it published, and the group had already catalogued about 19,000 similar devices, much of that work automated. An admin page facing the internet turned a web software bug into a way into the whole organization.
What to do: Organizations running Palo Alto firewalls should make the management page reachable only from trusted internal addresses, then install the fixed update for their version as soon as it’s available (several arrive October 29 and 30). Customers with Palo Alto’s threat prevention service should turn on the protections listed in its advisory. Any firewall whose management page was exposed since October 21 deserves a review, along with recent sign-in attempts across employee accounts.
Source: The Hacker News
02. Node2Shell: Attackers Exploit a Critical Flaw in Brotli, a Tool Inside Node.js and .NET (CVE-2026-111497)
Brotli is a Google tool for shrinking and unpacking web data so pages load faster, and it’s built into Node.js and Microsoft .NET, two foundations that many websites and business apps run on. A flaw in how Brotli unpacks data, nicknamed Node2Shell (CVE-2026-111497), lets an attacker send a booby-trapped compressed file that can crash an app, leak information from its memory, or in some cases let the attacker run their own commands. Node.js released fixes on October 21, and Microsoft followed with emergency .NET updates. On October 27, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the flaw to its list of vulnerabilities known to be used in attacks and gave federal agencies until November 10 to patch. One security firm logged attack traffic a day earlier.
Potential impact: This one tests software inventory. Brotli rarely appears on anyone’s list of installed software because it arrives tucked inside other tools, and updating an app’s own code doesn’t help if the platform underneath stays old. Older Node.js versions past their end of support won’t get a fix at all. The apps most at risk are customer-facing sites and portals that accept compressed data from visitors, which tend to be the same ones holding customer information.
What to do: Development teams should update Node.js to 26.12.1, 24.22.1, or 22.23.4, update .NET and Python Brotli packages, then restart apps and rebuild container images so the fix actually loads. Apps on unsupported Node.js versions need an upgrade plan. Until updates are in, block compressed incoming requests at the firewall or web proxy, and ask any vendor that builds or hosts your apps to confirm they’ve patched.
Source: BleepingComputer
03. Cisco ASA and FTD Firewall Zero-Day Exploited to Crash VPNs (CVE-2026-76418)
Cisco’s ASA and Firepower Threat Defense (FTD) firewalls are common in businesses of every size, and many use them to let employees connect securely from home through a virtual private network (VPN). On October 28, Cisco disclosed a flaw (CVE-2026-76418) that attackers were already using this month, making it a zero-day, meaning it was exploited before a fix existed. A malformed request sent to the VPN login page can force the firewall to restart, and the attacker never has to log in. Only firewalls using an extra login check called secondary authentication are affected. Cisco hasn’t said who is behind the attacks or who was targeted, and internet scans show more than 51,000 of these VPN devices online.
Potential impact: A restart disconnects every remote worker at once, and repeated attacks can keep remote staff offline for as long as they continue. The pattern matters more than any single outage: this is the second zero-day since August that crashes these same Cisco VPNs, and the platform has drawn government-backed spying campaigns since 2023. Cisco offers no workaround, and its temporary mitigation means switching off the extra login check, which trades one risk for another.
What to do: Cisco firewall owners should install the fixed release for their version and confirm it with Cisco’s Software Checker. Administrators should check whether any VPN connection profile uses secondary authentication. If patching has to wait, Cisco’s mitigation turns off that extra check, which lowers protection, so treat it as short-term only. Keep an eye out for unexpected firewall restarts.
Source: BleepingComputer
04. 16-Year-Old UEFI Firmware Flaw Threatens Servers That Boot Over the Network (CVE-2026-97631)
UEFI firmware is the software that starts a computer before Windows or Linux loads. Much of it is built on EDK II, a free, shared codebase used by major firmware makers including AMI, Insyde, and Phoenix. Researchers found a flaw (CVE-2026-97631, rated 9.5 out of 10) that has sat in EDK II’s network boot code for 16 years. Servers that start up by downloading their operating system over the network, a feature called PXE boot, can be frozen or taken over at that moment by someone already on the local network. Disclosure was planned for January, but a fix AMI published in September revealed the details early. Which server and storage models are affected is still unclear, and no attacks have been reported.
Potential impact: What sets this one apart is when the code runs. An attacker who succeeds controls the machine before the operating system, antivirus, or Secure Boot can do anything about it, which makes the activity very hard to see. It needs a foothold inside the network first, so it’s a tool for someone already in rather than a way in. The slower problem is the repair path, since fixes travel from EDK II to firmware makers to server manufacturers, a chain that often takes months.
What to do: IT teams should find servers and storage that start up over the network and turn that feature off wherever it isn’t needed. Ask each hardware vendor whether its products are affected and when firmware updates will ship, then schedule them. Keep Secure Boot on, keep network boot traffic on its own isolated network, and watch for servers that hang during startup.
Source: Security Affairs
05. Microsoft Teams External Chat Used to Breach Organizations in Under 15 Minutes
Microsoft Teams lets employees chat with people at other companies, and that setting is on by default. Security firm Arctic Wolf reported on October 26 that it has seen more than 400 attacks that started this way. The attackers first flood an employee’s inbox with hundreds of junk sign-up emails, then send a Teams message posing as IT support and offering to fix it. If the employee agrees, the attacker uses Quick Assist, a remote help tool built into Windows, to take control of the computer, then installs other remote-access software to keep a way back in. In many cases, malicious code was running less than 15 minutes after the employee first replied. Between 30% and 40% of the fake accounts used free Microsoft addresses that require no verification.
Potential impact: This attack works because every step looks normal. The inbox flood creates a real problem, the help arrives in a trusted company tool, and the remote session runs on software Windows already includes. Email filters never see the Teams message, and the employee believes they’re cooperating with their own IT team. From there, attackers have hands-on access to a company computer, which past campaigns using this same approach have turned into ransomware.
What to do: Administrators should limit Teams external chat to the specific partner companies the organization works with and block chats from personal Teams accounts and brand-new trial accounts. Restrict Quick Assist to IT staff and block remote-control apps the organization doesn’t use. Tell employees exactly how the real help desk will contact them, and show them how to spot the External label and report suspicious chats in Teams.
Source: Infosecurity Magazine
06. Oracle E-Business Suite Flaw Probed Days After Its Patch (CVE-2026-101767)
Oracle E-Business Suite (EBS) is software larger organizations use to run finance, payroll, HR, and purchasing. On October 20, Oracle fixed a flaw (CVE-2026-101767) with a critical 9.8 severity score that lets an outsider take over the system without a password. Researchers at Horizon3.ai, who reported it in July, say a carefully built web request can trick the system’s database into running the attacker’s instructions, and from there run commands on the server itself. About a week after the fix, security firm Defused Cyber saw attackers testing the flaw against decoy EBS systems it runs to catch attacks. No confirmed break-ins or responsible group have been reported. The same update fixed a second flaw, scored a perfect 10, in another part of EBS.
Potential impact: EBS has been here before. In 2025, the Cl0p extortion group exploited a different EBS flaw at scale to steal data from many organizations, and another EBS flaw has been exploited this year. Testing that starts a week after a patch suggests attackers are studying the fix to build their own exploit. Because EBS holds payroll, supplier payments, and financial records, a takeover can mean stolen employee data, altered payments, and breach notifications.
What to do: Any organization running EBS 12.2.3 through 12.2.15 should apply Oracle’s October update to every copy of the system, including backup and test environments, plus the related database and middleware patches. If patching must wait, keep EBS off the open internet and remove the affected web component from the system’s allowed list, as Horizon3.ai recommends. Review logs for unusual activity, and confirm any provider running EBS for you has patched.
Source: The Hacker News
The Big Picture
Most of this exposure traces back to a choice someone made once and never revisited. Features get enabled during setup, defaults ship turned on, and convenience settings outlive the project that needed them, and each one stays available to anyone who goes looking.
That makes a regular review of what’s turned on one of the cheapest defenses available. Ask which systems truly need to be reachable from the internet, which features staff actually use, and who outside the company should be able to contact employees directly. Turning off what nobody needs shrinks the target before the next flaw is announced, and it covers problems that haven’t been discovered yet, which no patch can do.
Make sure to check back here each week for another Threat Thursday update. See you then!
