November 2, 2026 Emerging Threats Weekly
This week’s briefing covers:
00:00 – Intro
00:47 [CAMPAIGN] PHP2Shell Chain Gives Suspected China-Nexus Operators Root Access to 25 Servers
Two critical PHP vulnerabilities moved from urgent patching concern to reported compromise last week. CVE-2026-109618 and CVE-2026-109619 allow unauthenticated remote code execution in affected PHP runtimes, and CISA added both flaws to its Known Exploited Vulnerabilities catalog on October 26.
04:02 [VULNERABILITY] Brotli Decoder Flaw Expands Across Node.js, .NET, Python, Java and Cloud Runtimes
CVE-2026-111497 is an out-of-bounds write vulnerability in the native Google Brotli decoder that can be reached when an application decompresses attacker-controlled Brotli data. The flaw can corrupt adjacent decoder state, disclose process memory, crash the process or potentially permit code execution without authentication.
06:41 [THREAT ACTOR] Volt Typhoon Silent Train Infrastructure Linked to Cisco SD-WAN Zero-Day Exploitation and KeyDrift Malware
Last week, Black Lotus Labs disclosed Silent Train, a covert operational framework attributed to China-linked Volt Typhoon following nearly three years of observation. The framework uses a distributed relay architecture that leverages compromised SOHO routers, IoT devices and enterprise systems to establish temporary, multi-hop connections that conceal the intrusion origin and operator location.
11:24 [VULNERABILITY] Oracle E-Business Suite SQL Injection Is Probed One Week After Patching
Researchers have reported exploratory attempts against CVE-2026-101767, one week after Oracle addressed the vulnerability in its October Critical Patch Update. The flaw affects Oracle E-Business Suite Application Object Library versions 12.2.3 through 12.2.15 and carries a CVSS score of 9.8. Oracle describes it as remotely exploitable over HTTP without authentication, while Horizon3.ai, which discovered the flaw, identified the mechanism as an SQL injection in the Thin Client Framework servlet.
14:58 [CAMPAIGN] Compromised Camera Management Software Opens a Path into Corporate Windows Networks
Huntress linked a handful of September and October intrusions to a compromised camera-management application running as CMS.exe. The incidents crossed multiple customer environments and shared a consistent process chain, leading the researchers to assess the software as the initial access vector. The precise product, vendor and mechanism of compromise were not confirmed, leaving organizations unable to rely on a product name alone when checking exposure.
17:30 [SUPPLY CHAIN] GMO Cloud Desktop Breach Escalates into Data Publication and Threats Against Trading Customers
GMO Internet disclosed a security incident affecting its Onamae.com Desktop Cloud service, in which attackers exploited security vulnerabilities, deployed malicious software in some customer server environments and stole customer information.
Dive deeper:
Kroll’s Monthly Threat Intelligence Spotlight Report: https://www.kroll.com/en/reports/cyber/threat-intelligence-reports/cti-spotlight-trends-report
Kroll’s Cyber Threat Intelligence: https://www.kroll.com/en/services/cyber/threat-intelligence-services
Kroll’s 2025 Cyber Threat Landscape Report: Cybercrime in the Crypto Era: https://www.kroll.com/Reports/Cyber/Threat-Intelligence-Reports/Threat-Landscape-Report-Lens-on-Crypto
Playlist of Kroll's Weekly Cyber Threat Intelligence Briefings: https://www.youtube.com/playlist
Kroll Cyber Blog: https://www.kroll.com/en/insights/cyber
Kroll Threat Intelligence Reports: https://www.kroll.com/en/reports/cyber/threat-intelligence-reports
Kroll Cyber and Data Resilience: https://www.kroll.com/en/services/cyber
#krollcyber #threatintelligence #cyberthreats