Table of Contents
Additional Resources:
In this week’s Security Advisory
- Compromised eMudhra TLS Certificates Trigger Internet-Wide Security Response
- BeyondTrust Zero-Day Exploited in Attacks Since August
- Drupal Patches Critical Remote Code Execution Vulnerability
- Siemens Software Center Vulnerability Exploited in Attacks
- F5 Releases Out-of-Band Patches for Critical NGINX Vulnerabilities
Compromised eMudhra TLS Certificates Trigger Internet-Wide Security Response
eMudhra is an India-based certificate authority whose certificates are trusted for securing internet communications. Eight intermediate TLS certificates were discovered with extremely weak private keys, potentially allowing attackers to create fraudulent certificates trusted as legitimate for virtually any internet server. Browser vendors and several major applications have blocked the affected certificates, and there is currently no evidence from certificate transparency logs that the compromised keys were maliciously used. However, Linux distributions, embedded systems, containers, and IoT devices could take significantly longer to receive updated trust stores.
Affected Versions
- Systems and applications whose certificate stores continue to trust the eight compromised eMudhra intermediate certificates.
Recommendations
- Apply browser, operating system, application, and certificate trust-store updates as soon as they become available.
- Prioritize updating Linux systems, embedded/IoT devices, containers, VPN infrastructure, and applications that maintain independent certificate stores.
More Reading / Information
- https://arstechnica.com/security/2026/10/the-internet-goes-on-high-alert-after-discovery-of-8-compromised-tls-certs/
- https://www.darkreading.com/cyber-risk/tech-giants-emudhra-certificates-compromised-keys
BeyondTrust Zero-Day Exploited in Attacks Since August
BeyondTrust has patched CVE-2026-102764 (CVSS 9.3/10), a critical authentication bypass vulnerability affecting its Remote Support product. The vulnerability allows an unauthenticated remote attacker to perform file operations on vulnerable appliances and has been exploited as a zero-day since late August. Attackers escalated to root privileges, deployed webshell and tunneling malware, stole credentials, erased logs, and moved laterally into downstream systems.
Affected Versions
- BeyondTrust Remote Support 26.2.3 and earlier.
Recommendations
- Upgrade to BT26-05-RS patch for (v24.3.1 – v26.2.3).
More Reading / Information
- https://www.beyondtrust.com/trust-center/security-advisories/bt26-05
- https://www.bleepingcomputer.com/news/security/beyondtrust-patches-zero-day-exploited-in-attacks-since-august/
Drupal Patches Critical Remote Code Execution Vulnerability
Drupal has released patches for two critical severity vulnerabilities. The first vulnerability, CVE-2026-108097, affects Drupal Core’s Field UI module and can allow attackers to execute code on the underlying web server. The second vulnerability, CVE-2026-108099, affects Drupal’s Entity list and could allow attacker to execute code remotely. There are currently no reports of active exploitation or publicly available exploit code.
Affected Versions
- Drupal 11.4.x prior to 11.4.10.
- Drupal 11.3.x prior to 11.3.19.
- Drupal 10.6.x prior to 10.6.19.
Recommendations
- Upgrade to Drupal 11.4.10, 11.3.19, or 10.6.19.
More Reading / Information
- https://www.drupal.org/psa-2026-10-12
- https://thehackernews.com/2026/10/drupal-patches-critical-core-rce-flaw.html
Siemens Software Center Vulnerability Exploited in Attacks
Siemens Software Center is used to download, install, activate, and update Siemens software. The vulnerability, CVE-2026-110936 (CVSS 8.4/10), is a DLL side-loading flaw that allows an authenticated local attacker to place a malicious DLL where Software Center will load it and execute code with the application’s privileges. Attackers are actively exploiting the vulnerability by pairing a legitimate, digitally signed copy of Software Center with malicious DLL files. Siemens confirmed its software and distribution channels were not compromised.
Affected Versions
- Siemens Software Center versions prior to 4.0.9.8.
Recommendations
- Upgrade to version 4.0.9.8. Existing installations will receive the update automatically when Software Center is launched.
More Reading / Information
- https://productcert.siemens.com/productcert/html/ssa-580366.html
- https://www.securityweek.com/siemens-software-center-vulnerability-exploited-in-clickfix-malware-attacks/
F5 Releases Out-of-Band Patches for Critical NGINX Vulnerabilities
F5 has released out-of-band patches for multiple NGINX vulnerabilities, including three that are critical severity: CVE-2026-15176, CVE-2026-97205, and CVE-2026-93479. The vulnerabilities affect HTTP/3 processing and NGINX’s map directive and can be remotely exploited without authentication under non-default configurations, causing heap buffer overflows or use-after-free conditions that lead to denial-of-service and potentially arbitrary code execution when ASLR is disabled or bypassed. There are currently no reports of exploitation in the wild.
Affected Versions
- A full list of affected versions can be found here.
Recommendations
- Apply the latest patches.
More Reading / Information
- https://my.f5.com/manage/s/article/K000163408
- https://www.bleepingcomputer.com/news/security/f5-releases-out-of-band-patches-for-critical-nginx-vulnerabilities/
Recommendations
Please review your environment to ensure the above-mentioned issues are patched in a timely manner. It is security best practice to regularly update and/or patch software to the latest versions. The vulnerabilities above highlight the security benefits of limiting deployed software to “vendor-supported versions” only. This dramatically increases the likelihood that new vulnerabilities have a patch issued for them. Likewise, CyberMaxx strongly encourages maintaining an inventory of current software in your environment, which helps ensure and inform your patch and vulnerability management program.
