SECURITYINTEL DAILY BRIEF ■ ThreatIntel BriefSunday, October 25, 2026 INTEL CONFIDENCE 100% | THREAT LEVEL CRITICAL |
|
THREAT OF THE DAY Widespread Brotli Decoder Flaw Enables Cross-Platform RCE | CRITICAL |
|
5 C2 IPs | 26 OTX IOCs | 6 ARTICLES |
|
■ ANALYST TLDR Today's intelligence highlights widespread supply chain, edge infrastructure, and boot-level threats. Critical remote code execution vulnerabilities were flagged, including a widespread memory corruption bug in Google's Brotli decoder (CVE-2026-111497) impacting Bun, Python, and Envoy, alongside CISA KEV additions for Collabora Online and Arista VeloCloud. Additionally, espionage campaigns are deploying the BlackX UEFI bootkit to bypass Secure Boot and blind endpoint security solutions, while credential leaks on GitHub led to a supply chain compromise of the LiteLLM Python package. |
|
■ CRITICAL STORIES Brotli Decoder Flaw Behind Node.js RCE Also Affects Bun, Python and Envoy A memory-corruption vulnerability in Google's Brotli decoder (CVE-2026-111497) exposes runtimes, proxies, and web services to remote code execution when decompressing untrusted inputs. |
CISA Flags Actively Exploited Flaws in Collabora Online and Arista VeloCloud CISA added actively exploited vulnerabilities in Collabora Online CODE Server and Arista VeloCloud Orchestrator to its Known Exploited Vulnerabilities catalog, signaling immediate patch imperatives. |
BlackX UEFI Bootkit Exploits Baton Drop Flaw to Bypass Secure Boot Espionage threat actors deployed a novel bootkit named BlackX to neutralize Kaspersky and Avast security products before OS loading via Secure Boot bypasses. |
Leaked LiteLLM Master Key Enables Supply Chain Hijack An accidentally published GitHub credential allowed an adversary to steal release pipeline tokens and deploy malicious versions of the widely used LiteLLM Python library. |
|
■ CVEs IDENTIFIED CVE-2026-111497 Google Brotli Decoder (Bun, Python, Envoy, Node.js) — Remote Code Execution / Memory Corruption |
[CVE-TBD] UEFI Secure Boot / Baton Drop — Secure Boot Bypass / Arbitrary Driver Loading |
[CVE-TBD] Collabora Online Built-in CODE Server — Remote Code Execution / Active Exploitation |
[CVE-TBD] Arista VeloCloud Orchestrator (VCO) — Remote Code Execution / Active Exploitation |
|
■ THREAT ACTORS BlackX Operators | Cyber Espionage |
Deployed the BlackX UEFI bootkit exploiting Baton Drop to bypass Secure Boot and disable endpoint security solutions. |
Unidentified Supply Chain Attacker | Cybercriminal / Espionage |
Stole GitHub credentials from LiteLLM's public repository to push compromised Python packages. |
Unidentified Exploit Operators | Cybercriminal / Advanced Threat |
Actively exploiting vulnerabilities in Collabora Online CODE Server and Arista VeloCloud Orchestrator. |
|
|
|
■ ATT&CK TTPs | T1542.003 | | Pre-OS Boot: Bootkit | BlackX bootkit deployed to compromise boot process and bypass Secure Boot controls. |
| T1562.001 | | Impair Defenses: Disable or Modify Tools | BlackX driver deployed specifically to interfere with Kaspersky and Avast security products. |
| T1195.002 | | Supply Chain Compromise: Compromise Software Dependencies | Adversaries hijacked the LiteLLM Python package release pipeline to push malicious builds. |
| T1552.001 | | Unsecured Credentials: Credentials In Files | Master API keys exposed publicly in a GitHub repository. |
| T1190 | | Exploit Public-Facing Application | Active exploitation of public-facing Collabora CODE Server, Arista VeloCloud Orchestrator, and Brotli-enabled Envoy proxies. |
| T1203 | | Exploitation for Client Execution | Brotli memory corruption triggered during payload decompression in affected applications. |
|
■ PATCH PRIORITY Collabora — Collabora Online Built-in CODE Server — Active exploitation confirmed by CISA KEV listing — [THN] |
Arista Networks — VeloCloud Orchestrator (VCO) — Active exploitation confirmed by CISA KEV listing — [THN] |
Google / Bun / Envoy — Brotli Decoder (CVE-2026-111497) — RCE/Memory corruption impacting critical web infrastructure and runtimes — [THN] |
LiteLLM — Python Package / Agent Platform — Supply chain compromise caused by leaked GitHub master key — [THN] |
|
|
|
■ RECOMMENDED ACTIONS TODAY | 1 | [P1] Immediate Patching: Apply emergency updates to all environments running Google Brotli libraries, Bun, Envoy proxies, and Python brotli/brotlicffi packages to remediate CVE-2026-111497. |
| 2 | [P1] CISA KEV Compliance: Immediately patch or isolate internet-exposed instances of Collabora Online Built-in CODE Server and Arista VeloCloud Orchestrator (VCO). |
| 3 | [P1] Revocation & Incident Response: Revoke all exposed LiteLLM secrets, rotate related GitHub tokens, and audit installed LiteLLM Python package versions for supply chain tampering. |
| 4 | [P2] Firmware Hardening: Apply vendor updates for UEFI firmware to patch the Baton Drop vulnerability and update the Secure Boot Forbidden Signature Database (DBX) to block BlackX drivers. |
| 5 | [P3] Policy Review: Audit enterprise privacy and data sharing settings regarding Google Gemini, Gmail, and Photos integrations to restrict corporate data usage in advertising engines. |
|
|
|
C2 IP BLOCKLIST · AbuseCH Feodo · Showing 5 of 5 IP ADDRESS 162.243.103.246 | PORT 8080 | STATUS OFFLINE | MALWARE Emotet | COUNTRY US |
IP ADDRESS 50.16.16.211 | PORT 443 | STATUS ONLINE | MALWARE QakBot | COUNTRY US |
IP ADDRESS 34.204.119.63 | PORT 443 | STATUS OFFLINE | MALWARE QakBot | COUNTRY US |
IP ADDRESS 178.62.3.223 | PORT 443 | STATUS OFFLINE | MALWARE QakBot | COUNTRY GB |
IP ADDRESS 27.133.154.218 | PORT 443 | STATUS OFFLINE | MALWARE QakBot | COUNTRY JP |
|
FULL IOC EXPORT — GOOGLE SHEET All live IOCs with full SHA256 hashes (OTX), IPs, and domains. 2 tabs: C2 IPs · OTX IOCs
Updated daily · Export as CSV to import directly into your tools ■ Open Full IOC Sheet → |
|
IOC SOURCES: AbuseCH Feodo · AlienVault OTX
NEWS: THN · KRB · SANS · REC · BC · SW · AWS · GCP · MSFT · U42 · SCH · MWB |