{"id":3487,"date":"2026-10-28T11:09:44","date_gmt":"2026-10-28T18:09:44","guid":{"rendered":"https:\/\/cyber.mag212.com\/?p=3487"},"modified":"2026-10-30T13:20:28","modified_gmt":"2026-10-30T20:20:28","slug":"when-trust-becomes-access-mag212-cyber-october-28-2026","status":"publish","type":"post","link":"https:\/\/cyber.mag212.com\/fr\/when-trust-becomes-access-mag212-cyber-october-28-2026\/","title":{"rendered":"When Trust Becomes Access: Brotli, Tailscale, Magento, Oracle EBS and SkyW4lker"},"content":{"rendered":"<p class=\"has-text-align-center has-small-font-size wp-block-paragraph\">MAG212 CYBER \u00b7 Intelligence Edition \u00b7 28 October 2026 \u00b7 28 pages<\/p>\n\n\n\n<div class=\"wp-block-buttons is-content-justification-center is-layout-flex wp-container-core-buttons-is-layout-fe48e5de wp-block-buttons-is-layout-flex\">\n<div class=\"wp-block-button\"><a class=\"wp-block-button__link wp-element-button\" href=\"\/wp-content\/uploads\/2026\/10\/MAG212-CYBER-2026-10-28-When-Trust-Becomes-Access.pdf\" target=\"_blank\" rel=\"noreferrer noopener\">Read the full magazine (PDF, 28 pages) \u2192<\/a><\/div>\n<\/div>\n\n\n\n<h2 class=\"wp-block-heading\">Flip through the magazine<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Turn the pages below, or use full-screen mode for the best reading experience. Prefer a file? Use the download button above.<\/p>\n\n\n<div class=\"_df_book df-lite\" id=\"0\"  data-title=\"\" wpoptions=\"true\" thumbtype=\"\" source=\"\/wp-content\/uploads\/2026\/10\/MAG212-CYBER-2026-10-28-When-Trust-Becomes-Access-flipbook.pdf\" height=\"auto\" webgl=\"true\" ><\/div>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>MAG212 CYBER | October 28, 2026<\/strong><br>By El Mostafa Ouchen<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Security headlines arrive as names and numbers. Defenders need a different view: which component accepts untrusted input, which permission boundary fails, which assets are reachable, and what proves a fix is actually running. This 28-page Intelligence Edition follows that chain across a JavaScript runtime, a private-network agent, a storefront database, an enterprise resource-planning suite and the Microsoft 365 sign-in itself. Every story was re-verified against vendor advisories and original research on October 28, 2026.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">The briefing: what to act on first<\/h2>\n\n\n\n<figure class=\"wp-block-table\"><table><thead><tr><th>Issue<\/th><th>Gravit\u00e9<\/th><th>Exploitation<\/th><th>Fix<\/th><\/tr><\/thead><tbody><tr><td><strong>CVE-2026-111497<\/strong><br>Node.js bundled Brotli decoder<\/td><td>CVSS v4 9.2 (Google CNA)<br>CVSS v3.1 8.1 (Red Hat)<\/td><td>Added to CISA KEV on Oct 27 (reported), due Nov 10. Honeypot attempts only<\/td><td>Node 22.23.4 \/ 24.22.1 \/ 26.12.1; libbrotli 1.0.10 \/ 1.1.1 \/ 1.2.1<\/td><\/tr><tr><td><strong>CVE-2026-48356 \u201cPolyShell\u201d<\/strong><br>Adobe Commerce \/ Magento<\/td><td>9.6 (Adobe) \/ 9.3 (CVE record)<\/td><td>Mass exploitation since March; KEV Oct 27 (reported)<\/td><td>APSB26-73 date builds (2.4.x-2026-jul)<\/td><\/tr><tr><td><strong>CVE-2026-101767<\/strong><br>Oracle E-Business Suite<\/td><td>CVSS 3.1 9.8<\/td><td>Attempts since Oct 22; not in KEV at press<\/td><td>October 2026 CPU (12.2.3\u201312.2.15)<\/td><\/tr><tr><td><strong>TS-2026-014 \u2026 017<\/strong><br>Tailscale SSH &amp; Serve<\/td><td>No CVE \/ CVSS assigned<\/td><td>Requires an authorized foothold; PoC private<\/td><td>Tailscale v1.104.4<\/td><\/tr><tr><td><strong>SkyW4lker<\/strong><br>Microsoft 365 device-code phishing<\/td><td>No CVE: protocol abuse<\/td><td>618 sandbox analyses, June to Oct 21<\/td><td>Conditional Access: block device code flow<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">Read the full analysis<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li><a href=\"\/fr\/skyw4lker-device-code-phishing-microsoft-365\/\"><strong>SkyW4lker device-code phishing<\/strong><\/a>: how it hijacks Microsoft 365 accounts, KQL hunts and how to block it<\/li>\n\n\n\n<li><a href=\"\/fr\/cve-2026-111497-nodejs-brotli-vulnerability\/\"><strong>CVE-2026-111497 (Node.js Brotli)<\/strong><\/a>: fixed versions, attack paths and runtime checks<\/li>\n\n\n\n<li><a href=\"\/fr\/cve-2026-101767-oracle-ebs-vulnerability\/\"><strong>CVE-2026-101767 (Oracle EBS)<\/strong><\/a>: the AppsTCFServer chain, indicators and mitigation<\/li>\n\n\n\n<li><a href=\"\/fr\/polyshell-cve-2026-48356-magento-cms-block-loader\/\"><strong>PolyShell (CVE-2026-48356)<\/strong><\/a>: the Magento cms_block loader, IOCs and clean-up checklist<\/li>\n\n\n\n<li><a href=\"\/fr\/tailscale-ssh-vulnerabilities-ts-2026-014-tailworm\/\"><strong>Tailscale SSH TS-2026-014 to 017<\/strong><\/a>: what v1.104.4 fixed and how to harden<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">Inside this issue<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>p. 03 \u00b7 Threat dashboard:<\/strong> every CVE with score, vector, CWE, KEV status and fixed version, plus an editorial priority matrix.<\/li>\n\n\n\n<li><strong>p. 04 \u00b7 Nine days in October:<\/strong> the overlapping timeline of disclosure, patching, exploitation and extortion, Oct 20\u201328.<\/li>\n\n\n\n<li><strong>p. 05 \u00b7 Brotli \/ Node.js:<\/strong> how one mis-classified error code becomes a heap write; reachable entry points, upstream exposure, inventory commands and a proxy mitigation.<\/li>\n\n\n\n<li><strong>p. 07 \u00b7 Tailscale SSH:<\/strong> four bulletins, the \u201cTailworm\u201d disclosure dispute, forwarding mitigation and policy hardening.<\/li>\n\n\n\n<li><strong>p. 09 \u00b7 Magento \/ PolyShell:<\/strong> a 953-store loader campaign hiding in <code data-no-translation=\"\">cms_block<\/code>; SQL triage, IOCs and a closure checklist.<\/li>\n\n\n\n<li><strong>p. 11 \u00b7 Oracle EBS:<\/strong> from an unauthenticated POST to SQL as APPS to a shell; Horizon3.ai indicators and a remediation proof plan.<\/li>\n\n\n\n<li><strong>p. 13 \u00b7 SkyW4lker (new):<\/strong> real Microsoft login, attacker-controlled authorization. The full attack chain, why MFA doesn&#8217;t stop it, KQL hunts, Conditional Access and eviction steps.<\/li>\n\n\n\n<li><strong>p. 17 \u00b7 GMO Desktop Cloud:<\/strong> a hosted trading-desktop breach, a refused US$50M demand and a US$1M cybercrime bounty.<\/li>\n\n\n\n<li><strong>p. 19 \u00b7 Intel \u00d7 Classiq &amp; post-quantum migration:<\/strong> NIST IR 8547 is final; RSA\/ECC deprecated after 2030 and disallowed after 2035.<\/li>\n\n\n\n<li><strong>p. 22\u201328:<\/strong> technology radar, detection engineering lab, the operator&#8217;s 72-hour plan, verification ledger, and sources.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">Spotlight: SkyW4lker device-code phishing<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">ANY.RUN&#8217;s October 27 analysis describes <strong>SkyW4lker x365 Sentinel<\/strong>, a Microsoft 365 phishing kit that never needs a fake login page. A password-protected PDF, DOCX or XLSX lure leads through a CAPTCHA to a page on trusted hosting. The kit&#8217;s backend starts an OAuth device-code sign-in and asks the victim to enter the code on Microsoft&#8217;s genuine device sign-in page. The victim completes MFA, and Microsoft issues access and refresh tokens to the attacker. Phishing-resistant MFA does not stop it; blocking the device code flow with Conditional Access does. <a href=\"\/fr\/skyw4lker-device-code-phishing-microsoft-365\/\">Read the full SkyW4lker analysis \u2192<\/a><\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Do this now<\/h3>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Hunt <code data-no-translation=\"\">SigninLogs<\/code> for <code data-no-translation=\"\">AuthenticationProtocol == \"deviceCode\"<\/code> over the last 30 days.<\/li>\n\n\n\n<li>Create a Conditional Access policy: Authentication flows \u2192 Device code flow \u2192 Block, in Report-only first, with narrow exclusions for Teams Rooms devices.<\/li>\n\n\n\n<li>Check whether the Microsoft-managed \u201cBlock device code flow\u201d policy exists in your tenant and when it will be enforced.<\/li>\n\n\n\n<li>For any hit: disable the account, revoke sessions, remove attacker-registered devices, reset the password and clean inbox rules.<\/li>\n\n\n\n<li>Tell staff: never enter a code from an email, document or caller into a Microsoft page.<\/li>\n<\/ol>\n\n\n\n<h2 class=\"wp-block-heading\">The 72-hour plan, in brief<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>0\u20134 hours, identify and contain:<\/strong> inventory running Node versions; set <code data-no-translation=\"\">TS_SSH_DISABLE_FORWARDING=1<\/code>; run the Magento <code data-no-translation=\"\">cms_block<\/code> query; deny <code data-no-translation=\"\">\/OA_HTML\/AppsTCFServer<\/code> at the edge; hunt device-code sign-ins.<\/li>\n\n\n\n<li><strong>4\u201324 hours, patch and prove:<\/strong> rebuild images on fixed Node releases; roll Tailscale 1.104.4; apply APSB26-73 and the Oracle October CPU; put the device-code block in Report-only.<\/li>\n\n\n\n<li><strong>24\u201372 hours, hunt and harden:<\/strong> review crash loops, enrollments, CMS writes and EBS indicators; rotate secrets after containment; enforce the device-code block.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">How we verified this issue<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Each claim is labeled <strong>Verified<\/strong> (confirmed in a primary source), <strong>Reported<\/strong> (attributed to secondary reporting) or <strong>Editorial<\/strong> (MAG212 analysis and guidance). A verification ledger on page 25 lists every correction made to our draft. Where sources disagree, such as conflicting CVSS scores or KEV status, the magazine shows both. Some items remained open at press time: CISA&#8217;s catalog could not be read directly, and GMO&#8217;s own notices could not be loaded. Confirm deadlines before acting on them.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Primary sources<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/nodejs.org\/en\/blog\/vulnerability\/october-2026-security-releases\" target=\"_blank\" rel=\"noreferrer noopener\">Node.js October 2026 security releases<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tailscale.com\/blog\/tailscale-ssh-findings-fixes\" target=\"_blank\" rel=\"noreferrer noopener\">Tailscale: Tailscale SSH findings and fixes<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/sansec.io\/research\/magento-cms-block-loader-deepveindrilling\" target=\"_blank\" rel=\"noreferrer noopener\">Sansec: Magento CMS block loader hits 953 stores<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/www.adobe.com\/trust\/security\/products\/commerce\/apsb26-73.html\" target=\"_blank\" rel=\"noreferrer noopener\">Adobe Security Bulletin APSB26-73<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/horizon3.ai\/attack-research\/vulnerabilities\/cve-2026-101767\/\" target=\"_blank\" rel=\"noreferrer noopener\">Horizon3.ai: CVE-2026-101767<\/a> and <a href=\"https:\/\/www.oracle.com\/security-alerts\/cpuoct2026.html\" target=\"_blank\" rel=\"noreferrer noopener\">Oracle CPU October 2026<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/any.run\/cybersecurity-blog\/skyw4lker-phishing-kit-analysis\" target=\"_blank\" rel=\"noreferrer noopener\">ANY.RUN: SkyW4lker phishing kit analysis<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/learn.microsoft.com\/en-us\/entra\/identity\/conditional-access\/policy-block-authentication-flows\" target=\"_blank\" rel=\"noreferrer noopener\">Microsoft Learn: block authentication flows with Conditional Access<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/csrc.nist.gov\/pubs\/ir\/8547\/final\" target=\"_blank\" rel=\"noreferrer noopener\">NIST IR 8547 (final)<\/a><\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">The complete list of 30 numbered sources is on pages 26\u201327 of the magazine.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Editor and author:<\/strong> El Mostafa Ouchen<br><strong>Publisher:<\/strong> MAG212 CYBER (cyber.mag212.com)<br><strong>Issue date:<\/strong> October 28, 2026<br><strong>Format:<\/strong> 28-page PDF, Intelligence Edition<br><strong>Visuals:<\/strong> AI-generated editorial illustrations and original schematics, all labeled; no incident photography.<\/p>\n\n\n\n<div class=\"wp-block-buttons is-content-justification-center is-layout-flex wp-container-core-buttons-is-layout-fe48e5de wp-block-buttons-is-layout-flex\">\n<div class=\"wp-block-button\"><a class=\"wp-block-button__link wp-element-button\" href=\"\/wp-content\/uploads\/2026\/10\/MAG212-CYBER-2026-10-28-When-Trust-Becomes-Access.pdf\" target=\"_blank\" rel=\"noreferrer noopener\">Download the PDF<\/a><\/div>\n<\/div>\n\n\n\n<h2 class=\"wp-block-heading mag212-related\">Related coverage on MAG212 CYBER<\/h2>\n\n\n\n<ul class=\"wp-block-list mag212-related-list\">\n<li><a href=\"https:\/\/cyber.mag212.com\/fr\/cve-2026-111497-nodejs-brotli-vulnerability\/\">CVE-2026-111497\u00a0: La faille Brotli de Node.js dans CISA KEV, expliqu\u00e9e, avec versions corrig\u00e9es et v\u00e9rifications<\/a><\/li>\n\n\n<li><a href=\"https:\/\/cyber.mag212.com\/fr\/tailscale-ssh-vulnerabilities-ts-2026-014-tailworm\/\">Vuln\u00e9rabilit\u00e9s SSH de Tailscale TS-2026-014 \u00e0 017 (\u201c\u00a0Tailworm\u00a0\u201d)\u00a0: Corrections apport\u00e9es dans la version\u00a01.104.4 et mesures de s\u00e9curit\u00e9<\/a><\/li>\n\n\n<li><a href=\"https:\/\/cyber.mag212.com\/fr\/polyshell-cve-2026-48356-magento-cms-block-loader\/\">PolyShell (CVE-2026-48356)\u00a0: Pourquoi les boutiques Magento corrig\u00e9es ex\u00e9cutent-elles toujours un chargeur JavaScript cach\u00e9\u00a0?<\/a><\/li>\n\n\n<li><a href=\"https:\/\/cyber.mag212.com\/fr\/cve-2026-101767-oracle-ebs-vulnerability\/\">CVE-2026-101767\u00a0: Une faille dans Oracle E-Business Suite permet \u00e0 une seule requ\u00eate HTTP d\u2019atteindre la base de donn\u00e9es et l\u2019h\u00f4te.<\/a><\/li>\n\n\n<li><a href=\"https:\/\/cyber.mag212.com\/fr\/skyw4lker-device-code-phishing-microsoft-365\/\">SkyW4lker Device-Code Phishing: How It Hijacks Microsoft 365 Accounts and How to Stop It<\/a><\/li>\n<\/ul>","protected":false},"excerpt":{"rendered":"<p>The October 28, 2026 Intelligence Edition of MAG212 CYBER: 28 verified pages on the Node.js Brotli flaw, Tailscale SSH, Magento PolyShell, Oracle EBS CVE-2026-101767, SkyW4lker device-code phishing, the GMO breach and post-quantum deadlines, with detection rules and a 72-hour plan.<\/p>","protected":false},"author":1,"featured_media":3485,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[19,13,21,15],"tags":[68,62,100,92,82,91,99,102,90,95,67,93,97,96,101,98,94,75],"class_list":["post-3487","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-critical-cves","category-cyber-incidents","category-digital-magazine","category-threat-intelligence","tag-brotli","tag-cisa-kev","tag-conditional-access","tag-cve-2026-101767","tag-cve-2026-111497","tag-cve-2026-48356","tag-device-code-phishing","tag-gmo","tag-mag212-cyber-magazine","tag-magento","tag-microsoft-365","tag-node-js","tag-oracle-ebs","tag-polyshell","tag-post-quantum-cryptography","tag-skyw4lker","tag-tailscale","tag-threat-intelligence"],"_links":{"self":[{"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/posts\/3487","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/comments?post=3487"}],"version-history":[{"count":6,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/posts\/3487\/revisions"}],"predecessor-version":[{"id":3666,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/posts\/3487\/revisions\/3666"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/media\/3485"}],"wp:attachment":[{"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/media?parent=3487"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/categories?post=3487"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/tags?post=3487"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}