Weekly situation report: 11/2/26

• The publicly disclosed Brotli denial-of-service and remote code execution issue known as Node2Shell has so far seen only limited exploitation in real-world environments.

• CISA has added a vulnerability affecting Arista VeloCloud Orchestrator to its Known Exploited Vulnerabilities catalog, indicating that the flaw has been confirmed as actively exploited.

• Reports indicate a rising number of compromises affecting CCTV camera systems across several regions, suggesting broader targeting of surveillance infrastructure.

• A publicly disclosed Oracle PeopleSoft exploit associated with ShinyHunters has been reported, highlighting the group’s continued use of the vulnerability.

1. Disclosed Brotli Dos and RCE “Node2Shell” Sees Limited Exploitation in the Wild

Summary

A critical vulnerability in Brotli, CVE-2026-111497, also known as”Brotli2Shell” or “Node2Shell,” allows remote code execution and impacts numerous software applications. Fixes are available, but deployment remains ongoing across various platforms and distributions.

Category: Known Exploited Vulnerabilities

Industry: Multiple

Analyst comments

A vulnerability in the Brotli compression library, tracked as CVE-2026-111497 and also known as”Node2Shell,” “Broccoli2Shell,” or “HTTP2Shell,” allows remote code execution through a flaw in the Brotli decoder. This vulnerability was disclosed by Node.js and has been fixed in Brotli versions 1.2.1, 1.1.1, and 1.0.10, with corresponding Node.js versions 26.12.1, 24.22.1, and 22.23.4 addressing the issue. Various software and applications, including Node.js, .NET, Bun, Envoy Proxy, Istio, and more, are potentially at risk if they decompress attacker-controlled Brotli data with a vulnerable decoder. Proof-of-concept exploits have been published, but successful exploitation requires specific information about the target host. This significantly limits the vulnerability’s exploitability and makes successful attacks at scale unlikely.

Exploitation of this vulnerability in the wild has been very limited. Our honeypot network has observed minimal traffic associated with exploitation attempts. However, most of the traffic was attributed to benign crawlers associated with the Shadowserver Foundation and other well-known scanner activity. We have seen only one IP address associated with malicious activity between October 26th and 27th.

We tested several PoCs, but only one was successful. Due to differences in lab setup, we observed only crash behavior, confirming the vulnerability. This likely limits the impact and scalability of exploitation, especially if reliant on memory offset values (this is a similar issue with PHP2Shell exploitation). We created three lab environments using different combinations of Node.js (22.23.3 and 24.22.0), Body Parser (2.0.0 and 2.0.2), Express (5.0.1 and 5.1.0), and Brotli (1.0.0). Notable artifacts from exploitation attempts were POST requests to endpoints with large malformed bytecode payloads and Content-Encoding headers with the value of “br”.

Actionable guidance

Update vulnerable versions of Brotli to the currently fixed versions. For software that uses the compression library, patches should be available from relevant vendors. Organizations using Node.js should upgrade to the fixed versions available.

A high volume of POST requests or large payloads with Content-Encoding: “br” indicates a high likelihood of exploitation attempts. Fixed Versions:

Brotli:

    1.2.1
    1.1.1
    1.0.10

Node.js:

    26.12.1
    24.22.1
    22.23.4

2. CISA Adds Arista VeloCloud Orchestrator Flaw to Known Exploited Vulnerabilities Catalog

Summary

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a critical SQL Injection vulnerability in Arista VeloCloud Orchestrator (CVE-2026-114625) to its Known Exploited Vulnerabilities catalog.

Category: Known Exploited Vulnerabilities

Industry: Technology, Public Sector and Government Administration, Telecommunications

Analyst comments

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a critical SQL Injection vulnerability (CVE-2026-114625, CVSS score 9.4) in Arista VeloCloud Orchestrator to its Known Exploited Vulnerabilities catalog. This flaw affects both on-premises and hosted versions of VeloCloud Orchestrators, allowing any authenticated user to gain operator privileges and potentially compromise the system and managed data. From the CVSS vector, the exploitation requires a low-privileged user to be logged in before exploitation may occur.

There is currently no publicly known PoC available that exploits this vulnerability. Both of the IP addresses included in the advisory trace back to Japanese-hosted infrastructure. This could indicate primary intent against Japanese targets, although potential gaps in malicious infrastructure scanning in other regions may limit the accuracy of this assessment. No definitive attribution is available at this time, however Volt Typhoon has previously targeted and exploited VeloCloud hosts, most recently through CVE-2026-16812 in July 2026. If attributed to Volt Typhoon, the group has used VeloCloud Orchestrator hosts when compromising the telecommunications sector. Given the Japan-related infrastructure and the threat actor’s known interest in the region, we assess with low confidence that this activity may be attributable to Volt Typhoon. The current public footprint of VeloCloud Orchestrator hosts is minimal according to Shodan data. Based on advisory data, this is likely limited to exploitation attempts at this time, with no confirmed post-exploitation activity observable.

The advisory states that multiple requests are made to affected hosts, which may imply this is a Blind SQL injection issue requiring multiple rounds of requests to obtain stored information. Therefore, exploitation will likely follow a low-privileged user login followed by multiple requests to the same endpoint.

Actionable guidance

Apply vendor-provided patches to remediate this issue. If compromise is suspected, review logs for suspicious logins originating from unusual IP addresses, particularly those followed by multiple requests containing SQL-like data. In addition to maintaining logs locally on the device, organizations should implement external log collection and monitoring. This can help prevent threat actors from concealing their activity through anti-forensic actions, such as deleting or modifying logs, and preserve evidence for subsequent investigation. Having an external monitoring layer separate from the affected host device will ensure that network logging may survive despite threat actor efforts to clear logs.

Fixed Versions:

5.2.3.18 and above.
6.1.3.10 and above.
6.4.2.12 and above.

3. Increase in CCTV Camera Compromise in Multiple Regions

Summary

An increase in exploitation targeting cameras and their management control planes was observed between September and October. Some of this activity has been linked to the exploitation of Dahua cameras targeting organizations in Ukraine.

Category: Critical Vulnerabilities

Industry: Technology, Public Sector and Government Administration, Manufacturing

Analyst comments

An increase in exploitation in CCTV and camera management software has been seen in the wild. This correlates with traffic captured by public honeypots showing spikes in September and October with some slight rising trends. Several other external reports detail heightened exploitation of CCTV and camera-related infrastructure that corroborate the activity. Both Dahua and Hikvision cameras have been prominent targets.

CERT-UA has warned about two specific vulnerabilities (CVE-2021-33044 and CVE-2021-33045) that affect certain Dahua devices in addition to password stuffing and related credential abuse. Other vectors using the P2P/cloud access function (Easy4IP) on Dahua cameras have also been observed. The device independently initiates an outgoing connection to the manufacturer’s cloud infrastructure and registers in it by serial number. Access to the device is then established via the cloud by serial number, bypassing NAT and firewall, without published ports. Dahua equipment remains widely used in Ukraine, including by government and military entities, despite ongoing security concerns and allegations of the company’s involvement in human rights issues. Several external reports indicate that exploitation activity since September has primarily targeted Ukraine and NATO member countries, potentially by Russian affiliated threat actors. The attackers may also have used a publicly available Dahua camera scanning utility released in July, or a tool derived from its codebase, given the observed use of the P2P access vector.

Additional external reporting has identified exploitation of camera management during the same time period. Recent activity suggests that threat actors may be targeting DVR and camera management software associated with South Korean vendors K Vision and 3R Global, with 3R Global products sold internationally. The attackers used infrastructure hosted in the United States, suggesting possible targeting of US-based hosts, however full geographic scope remains unclear. Publicly available management software from these vendors dates to 2019, raising concerns that outdated or unsupported components may be contributing to recent exploitation. Analysis of binaries downloaded from kvision[.]ai found no evidence of malicious functionality at the time of investigation, indicating that a supply-chain compromise had not occurred. Instead, once the camera software is compromised, it is used to download a separate binary that completes the attack chain. Observed activity includes the use of legitimate wpcmon.exe executables, downloaded to user folders, to side-load malicious DLL files. Persistence was then established through Windows Registry Run keys. The initial access vector remains unknown, although external reporting suggests that publicly exposed DVR management components may have been involved.

Actionable guidance

Do not expose CCTV and camera devices to the public internet. Isolate CCTV and related technologies via a VLAN or similar network segmentation to limit the impact of a compromise. Update firmware to the latest available version where possible. If no patch is available and the device requires replacement, segregate it from the network or disable it until it can be migrated to a supported version. Disable P2P cloud functionality on cameras if not in use.

Do not expose camera management planes to the public internet. Keep management software up to date, hardened, and protected with regularly rotated, strong passwords. Monitor management hosts for unexpected changes to startup items and Windows registry keys, particularly those not associated with authorized administrator activity. Additionally, alert on the execution of legitimate Windows binaries, such as wpcmon.exe, from unusual locations, including user folders.

4. Oracle Peoplesoft Exploit used by ShinyHunters Disclosed

Summary

CVE-2026-35273 in PeopleSoft PeopleTools 8.61/8.62 is three chained flaws that combine a server-side request forgery in the Integration Gateway with a loopback trust bypass and two code-execution paths in the Environment Management Hub. The exploit has been used in ShinyHunters attacks as recently as September and early October.

Category: Known Exploited Vulnerabilities

Industry: Multiple

Analyst comments

CVE-2026-35273 in Oracle PeopleSoft PeopleTools 8.61 and 8.62 is actually three chained vulnerabilities across the Integration Gateway (PSIGW) and Environment Management Hub (PSEMHUB), not a single flaw. The root cause is a server-side request forgery (SSRF) in PSIGW where the handler forwards a request to an attacker-controlled address with a fully attacker-controlled payload and performs no destination validation.

PSEMHUB uses an allowedhosts.properties file to validate trusted hosts, with 127.0.0.1 included by default. By exploiting the SSRF vulnerability to direct requests through the loopback address, an unauthenticated remote attacker can bypass this trust check and gain access to the internal administrative interface. From there, attackers can achieve remote code execution through two separate methods. The first exploits a PSEMHUB log writing command that allows the attacker to control both the file contents and the absolute file path. This enables the creation of a web shell and execution of commands as the PeopleSoft service account. The second method involves writing a malicious XML file that PSEMHUB processes through Java’s XMLDecoder when the service restarts, allowing code execution without requiring a persistent web shell. ShinyHunters (tracked as UNC6240) exploited the vulnerability as a zero day against universities between May 27 and June 9, followed by a broader campaign in September targeting the technology, healthcare, agriculture, transportation, and government sectors. During these attacks, the group bypassed WAF rules by encoding a single character in the /PSEMHUB/ URL path as /%50SEMHUB/. This allowed requests to evade WAF rules relying on plain text path matching while the PeopleSoft server decoded and processed them normally.

A patch has been available since June that addresses this vulnerability. The recent research disclosure may spur further exploitation in the wild, likely extending to other threat actors and ransomware groups.

Actionable guidance

Update Oracle PeopleSoft to address this vulnerability. A patch has been available since June that remediates the vulnerability for the following versions:

PeopleSoft Enterprise PeopleTools
8.61
8.62

If compromise is suspected, the following mitigations can be applied:

• Look for suspicious traffic to /PSEMHUB/ or requests to the same endpoint with URL-encoded characters (e.g., /%50SEMHUB/).
• Look for cmd/sh commands in URL strings and rogue files named x.jsp, j.jsp, or similar.
• Invalidate and rotate all credentials and sessions.
• Remove the PSEMHUB application entirely or disable the EMHub service in multi-service deployments per the original Oracle advisory.
• Look for unexpected MeshCentral agents or software not included in approved software or asset inventory lists.

5. Claude Code Supply Chain Extension Compromise

Summary

A Claude Code extension for version 2.1.313 was uploaded to extension marketplaces embedded with malicious code. The attack occurred on October 29th and resulted in the installation of SSH backdoor code.

Category: Known Exploited Vulnerabilities

Industry: Multiple

Analyst comments

The Claude Code extension version 2.1.313 serves SSH backdoor code. The malicious extension version was published sometime in the early morning hours of October 29th between 2:27 AM and 5:27 AM EST. The malicious extension gathers host details of the compromised host, such as OS, usernames, directories, environment variables, emails (especially in relation to Git), and public IP addresses. C2 activity uses SSH tunnels that are initiated with startup scripts or scheduled tasks (Windows) and LaunchAgents (macOS).

Currently, the attacker C2 server is no longer active and the malicious extension has been removed from various extension marketplaces. This is most likely to affect developer workstations during the times noted above that have auto-updates enabled. As the compromise relies on SSH, a confirmed artifact is the presence of an added SSH key in the authorized_keys folder.

Actionable guidance

The following should be undertaken in accordance with this supply chain compromise:

• Check the version of Claude Code extensions in use. If using version 2.1.313, terminate all network connections and search for compromise artifacts in authorized_keys that match “svc-telemetry”.
• Check for rogue scheduled tasks and start-up items named “sysmon”.
• Search for unfamiliar files in user folders under .config with filenames starting with “smt*”.
• Disable or restrict the SSH service from running until the infection is confirmed clear.
• Rotate all credentials and secrets if compromise is found.

Proactive measures to avoid a similar incident from occurring may include:

• Restricting or disabling SSH if not in use.
• Turning off auto-updates for VS Code, Cursor, and similar IDEs that use marketplace extensions.
• Vetting extension updates before installing.