Archived issue·10-09-2026

verified 1w ago

The Perimeter · Issue 10-09-2026

NetScaler zero-days exploited; Next.js patches Wednesday

Two NetScaler zero-days joined CISA KEV with in-the-wild exploitation confirmed, and Next.js pre-announced an out-of-band fix for two Critical upstream dependency flaws landing October 14. Meanwhile the supply-chain drumbeat continued: Sonatype logged 149k malicious packages in Q3 and a hijacked TensorLake npm release turned installs into credential-stealers. The Drupal security team shipped a ~20-advisory batch, headlined by a PHP object injection in Block AJAX reachable when Layout Builder is enabled, and two 2FA modules failed in ways that let logins proceed with a password alone. Contao's comments bundle shipped an unauthenticated stored XSS that runs in the admin origin. Recalibrate your patch calendar around Wednesday's Next.js release and your edge inventory against the KEV list before the week is out.

Published: Friday, October 9, 2026
Entries: 11
Cadence: Weekly · Sundays
Curator: Brad Anderson

Wire

cisa.govNew addition to the Known Exploited Vulnerabilities catalog·

github.comGHSA: critical npm package compromise affecting CI pipelines·

wordfence.comWordPress plugin vulnerability with active exploitation·

drupal.orgHighly critical core security advisory published·

aws.amazon.comAWS security bulletin: IAM policy evaluation update·

unit42.paloaltonetworks.comThreat actor expands toolkit targeting public-facing PHP apps·

krebsonsecurity.comBreach disclosure with named victim and confirmed initial vector·

snyk.ioComposer dependency advisory affecting production framework versions·

cisa.govNew addition to the Known Exploited Vulnerabilities catalog·

github.comGHSA: critical npm package compromise affecting CI pipelines·

wordfence.comWordPress plugin vulnerability with active exploitation·

drupal.orgHighly critical core security advisory published·

aws.amazon.comAWS security bulletin: IAM policy evaluation update·

unit42.paloaltonetworks.comThreat actor expands toolkit targeting public-facing PHP apps·

krebsonsecurity.comBreach disclosure with named victim and confirmed initial vector·

snyk.ioComposer dependency advisory affecting production framework versions·

Web Application

frameworks · browsers · authentication flows

3 entries

nextjs.org2w

▲ headline

Next.js pre-announces October 14 security release for Critical upstream flaws

The Next.js team will ship an out-of-band update on Wednesday, October 14, 2026, fixing two Critical and one High severity vulnerabilities in upstream dependencies. No CVEs or affected version ranges published yet; the advisory says details follow with the patch.

Next.js

Fruition take

Freeze non-essential Next.js deploys for Wednesday, assign someone to upgrade and regression-test the same day, and treat the Critical pair as network-exploitable until proven otherwise.

github.com1wCVSS 9.3

TinaCMS admin preview iframe trusts attacker-set origin, enabling content API takeover

CVE-2026-108261 (CVSS 9.3): the TinaCMS admin builds its preview iframe from a URL fragment, so #/~//attacker.example/p frames an external origin and makes it the trust anchor for the admin↔preview postMessage channel. One link opened by a logged-in editor lets an attacker submit arbitrary GraphQL with the editor's token. Related advisories cover code injection via Git branch names in @tinacms/cli (CVE-2026-108259) and stored XSS via javascript: hrefs in @tinacms/web-components (CVE-2026-108260).

CVE-2026-108261 CVE-2026-108259 CVE-2026-108260TinaCMS@tinacms/cli@tinacms/web-components

Fruition take

If you run TinaCMS, upgrade and audit editor onboarding mail for link-based workflows until then; the iframe bug needs only one click from an authenticated editor.

portswigger.net2w

PortSwigger: exfiltrating larger tokens with overlapping response fragments

PortSwigger research demonstrates a technique to exfiltrate tokens larger than previously shown limits by exploiting overlapping fragments in cached responses, extending the response-queue/cache-desync class of client-side token leaks. The writeup includes a working method and positions it against the size ceilings demonstrated in earlier cache-probing work.

Fruition take

If your WAF or logging assumes long JWTs can't leak through cache probing, revisit that assumption for admin-sized tokens and check which of your caches share connections across users.

Supply Chain

packages · build systems · dependency attacks

2 entries

sonatype.com2w

Hijacked [email protected] npm release exfiltrates developer credentials on install

A malicious release of TensorLake's TypeScript SDK used an install hook to search for developer credentials and accept remote commands, per Sonatype's code review. One code path could create a public GitHub repository and commit collected data; the malware could also modify accessible repos by committing .claude and .vscode files. The loader exits under several common CI environment markers, so the payload's GitHub Actions logic does not indicate broad CI infection, and Sonatype has not confirmed stolen data was published.

tensorlake (npm)

Fruition take

If [email protected] hit any developer workstation, rotate the GitHub and cloud credentials on that host and audit for new repos or unexpected .claude/.vscode commits before assuming the hook didn't run.

sonatype.com2w

Sonatype Q3 index: 149,329 malicious open source packages, npm at 89.5%

Sonatype logged 149,329 malicious open source packages in Q3 2026, bringing the running total near 2 million since 2017. npm's share of malicious packages fell from 96.6% to 89.5% while remaining dominant. Among packages with overt malware behavior, 74.5% were droppers, secret exfiltrators, or both, and the report notes shrinking time between initial compromise and follow-on impact.

Fruition take

If your CI installs npm packages without a quarantine window on new releases, the Q3 numbers are your justification to add one for anything not pinned to a reviewed version.

Infrastructure

kubernetes · cloud · network · ingress

2 entries

blog.cloudflare.com2w

DNS root KSK rollover October 11: verify resolver trust anchors now

The DNS root zone switches to the new KSK-2024 trust anchor on October 11, 2026. Resolvers with stale or unmanaged trust anchors risk validation failures once the old key is removed. RFC 8509 trust anchor sentinels let operators test whether their resolvers have picked up the new key before the rollover date.

Fruition take

Run the RFC 8509 sentinel checks against your production and staging resolvers today; a resolver that fails the test on October 10 becomes an outage on October 12.

unit42.paloaltonetworks.com3w

Unit 42 OperTraitor: auditing Kubernetes operators for excessive RBAC

Unit 42 released OperTraitor, a tool for auditing Kubernetes operators' RBAC permissions and flagging excessive privileges on non-human identities, with walkthroughs of how over-permissioned operators can be abused to escalate within a cluster. The tool enumerates operator service accounts, their cluster and namespaced roles, and the CRUD surface each exposes.

Kubernetes

Fruition take

Run it against your clusters and pay attention to operators holding cluster-admin that only ever touch one namespace; that gap is where an SSRF in an operator webhooks turns into cluster takeover.

PHP & CMS

wordpress · drupal · plugins · php frameworks

1 entry

github.com1wCVSS 9.3

Contao patch wave: unauthenticated stored XSS in comments bundle, path traversal, CSRF family

Contao shipped fixes for a batch of issues including CVE-2026-107845 (CVSS 9.3): an unauthenticated comment injection that executes in the back end origin when an admin opens the Comments module, with no CSP on the admin to blunt it, and a documented path from backend write access to code execution. Also patched: path traversal in the images controller (CVE-2026-107844), CSRF in backend key= actions (CVE-2026-107848), and broken access-control voters including the table-access voter (CVE-2026-107851) and preview-link voter (CVE-2026-107850).

CVE-2026-107845 CVE-2026-107844 CVE-2026-107848Contao core-bundleContao comments-bundle

Fruition take

If you operate Contao, patch immediately and treat comment moderation as an attack surface; the XSS fires with no click from any backend user who opens the module.

Identity & Auth

oauth · saml · iam · session attacks

1 entry

drupal.org2w

Two Drupal 2FA modules broken: second factor bypassed, API key exposed

Authenticator Login Plus fails to enforce the second factor when a user logs in with core's one-time link (CVE-2026-107254, Critical) and can be bypassed entirely with a password when site-wide enforcement is on (CVE-2026-107261). Separately, miniOrange 2FA's headless login endpoint discloses the site's stored customer API key to unauthenticated users (CVE-2026-107268) when headless 2FA is enabled.

CVE-2026-107254 CVE-2026-107261 CVE-2026-107268Drupal auth_login_plusDrupal miniorange_2fa

Fruition take

If either module guards an admin surface, verify your installed version today and re-test one-time login links after upgrading; a module that enforces 2FA only on the password path is worse than none.

Threat Intel

active exploitation · breaches · ransomware

2 entries

unit42.paloaltonetworks.com3wKEV

▲ headline

NetScaler zero-days CVE-2026-88771 and CVE-2026-88772 exploited in the wild

Unit 42 and Citrix confirm CVE-2026-88771 and CVE-2026-88772, in NetScaler ADC and Gateway, are exploited in the wild: unauthenticated command execution and a memory-buffer flaw allowing RCE or denial of service. The KEV additions landed September 27 with federal patch deadlines under BOD 26-04. A third 2026 NetScaler entry, CVE-2026-88779 (denial of service), followed on October 4.

CVE-2026-88771 CVE-2026-88772Citrix NetScaler ADCCitrix NetScaler Gateway

Fruition take

If any client environment still exposes NetScaler ADC or Gateway interfaces, confirm the patched build this week and check appliance logs for the exploit pattern before assuming you missed the window.

krebsonsecurity.com2w

ShinyHunters leader "Rey" detained while extorting Boeing spin-off; Qilin operative extradited

KrebsOnSecurity reports the suspected ShinyHunters lead, a teenager using the handle "Rey" in Amman, was detained as the group extorted a recently divested Boeing business unit, and is reportedly cooperating with the FBI. Separately, Japan's National Police Agency confirmed the arrest and extradition to Germany of a Russian national tied to Qilin ransomware operations.

Fruition take

With Qilin's operational tempo disrupted, expect affiliate churn and rebranding in the ransomware-as-a-service market over the next quarter; brief your incident response retainers accordingly.