October 27, 2026

Today’s priorities span a supply-chain compromise, a broadly distributed library flaw, and unauthorized access affecting patient records. Across them, containment boundaries are more useful for triage than assuming a common attack path. [1][2][3]

What happened

JFrog researchers reported that the testmetest Miasma-family npm worm had armed 42 real GitHub repositories belonging to 11 owners, despite earlier findings that activity was limited to operator test accounts. [1]

The worm steals credentials, modifies repositories and CI configurations, spreads through npm packages, and can install a wiper that deletes the home directory when a victim revokes the stolen GitHub token. [1]

Why it matters

The payload blobs were 12.9–13.7 MB and reportedly large enough to evade GitHub search and API paths normally used to locate this type of compromise. [1]

What happened

CVE-2026-111497 is a critical buffer overflow in Google-developed Brotli, a decompression library bundled into many open-source components, applications, and cloud services; it can cause system crashes and remote code execution. [2]

OpenAI Codex Security discovered the vulnerability, and Node.js disclosed it in an October 21 security advisory. [2]

Why it matters

Wiz researchers reported that 91% of cloud environments had resources vulnerable to CVE-2026-111497 and 82% had publicly exposed Node.js instances; watchTowr said exploitation impact depends on how Brotli is implemented and used in each software component. [2]

What happened

COVESA vsomeip versions 3.7.3 and earlier contain a memory-allocation vulnerability in reliable (TCP) SOME/IP endpoints. [4]

Before validating that the declared bytes arrived, a reliable endpoint grows its receive buffer to the attacker-declared message size; a remote unauthenticated peer can therefore exhaust host memory and deny service. [4]

Why it matters

In the default configuration, reliable endpoints have no size limit, allowing a peer to declare up to roughly 4 GB; a single short message claiming a 3 GB payload OOM-killed a service limited to 1.5 GB. [4]

What happened

Quest Diagnostics confirmed unauthorized access to its Quanum Lab Services Manager, a platform used by healthcare professionals to order tests, view results and historical trends, and order supplies; personal information and patient records were affected. [3]

Quest learned of the unauthorized access on October 21, paused access to the platform, and said its core business operations remained up and running while its investigation continued. [3]

Why it matters

Pausing the platform while core operations continue frames this as both a data-exposure investigation and a continuity decision. [3]

What happened

CISA confirmed active exploitation of the recently patched PHP2Shell flaws and added them to its Known Exploited Vulnerabilities catalog. [5]

What happened

GMO Internet said vulnerabilities in its Onamae.com Desktop Cloud service were exploited, unauthorized access occurred, and customer information was taken; some customers reported unrecognized trading-account transactions. [6]

Reported trading-account activity raises downstream impact questions, but the supplied account does not establish how any password exposure related to those operations. [6]

What happened

Envoy v1.37.11 changes the distroless Docker image to use Debian bookworm’s patched ca-certificates package, 20250419~deb12u2. [7]