Brotli exposure, NAS packages and sign-in evidence
Wednesday, October 28, 2026. Your Security Practitioner Briefing: four checks. Brotli is now on CISA's exploited list. Scope it and PHP to your deployed environment; Tailscale has a fix to verify.
First, where untrusted compressed data reaches a Brotli decoder. Second, PHP on storage packages and exposed appliances. Third, Tailscale versions and SSH configuration. Fourth, Microsoft device-code sign-ins, where a successful login can still authorize an attacker. Each check starts with what puts your environment in scope.
Item one. Continuing Brotli: find the decoder path. CISA listed this flaw as exploited yesterday. Malformed compressed input can overwrite decoder memory, potentially executing code inside the application. For Node.js, start with the deployed runtime and whether attacker-controlled Brotli data can reach it. The upstream fixes are 22.23.4, 24.22.1 and 26.12.1 for those release lines. Use distribution guidance for backported or system-linked builds.
ELLIO describes two important paths: compressed inbound request bodies, and compressed responses fetched by the server. Express body parsing can decompress before the route handler runs. An external fetch can also reach the decoder, so an inbound-only check misses a possible path.
For a hunt, correlate Brotli-encoded requests with application crashes or worker restarts. If your HTTP telemetry captures it, the request header is Content-Encoding: br. A header match is a lead, not proof of exploitation. ELLIO reproduced working code execution in its lab, but its replay of one captured attacker's chain produced no shell in fifty attempts. Separate observed attempts from demonstrated success. Also, process.versions.brotli can still say 1.2.0 on patched Node builds; that string alone cannot clear a host.
For PAN-OS, consult the branch-specific advisory rather than transplanting Node versions. It lists 11.1 and 10.2 as unaffected. Exposure requires both Brotli inspection and TLS decryption on the dataplane. Palo Alto reports no known malicious exploitation of its products. Where applicable, the documented show system setting brotli command reports whether Brotli inspection is enabled. Match the product build, configuration and current vendor mitigation. Disabling decompression changes inspection behavior; review that tradeoff with the network owner.
Item two. Continuing PHP: packages and appliances. Continuing the PHP web-runtime flaws that can let a request execute server code. On Synology, begin with installed packages. Today's vendor update extends PHP fixes to older DSM releases, including 7.1 and 7.0; 6.2 is scheduled for October 29. The advisory lists Hyper Backup as unaffected, and the press notice separately says Synology Drive is unaffected. Certain PHP-dependent packages are in scope. Use Package Center and the advisory's package-specific fixed builds; the DSM number alone doesn't answer it. MailStation needs its own manual update.
For exposed appliances, Dream's October 26 report adds an investigation lead: crafted multipart uploads and memory pressure in firewall management software, chained with a Linux privilege-escalation flaw to reach root. Dream reports 25 rooted servers, webshells, a persistent tunnel, and stolen directory-service credentials. Some later identity-attack outcomes remain unknown. Check for that reported access, not just whether a patch installed. Look for relevant upload anomalies and unexpected server-side files, then investigate the identity access the appliance could provide. These are leads from the reported chain, not universal indicators. The vendor and affected versions are withheld, so this report cannot clear or condemn a particular firewall. Follow that product's own response guidance. Patching won't remove stolen credentials or an existing webshell.
Item three. Continuing Tailscale: verify the running fix. The released fix is 1.104.4. For the SSH forwarding issue, check whether the node uses Tailscale's built-in SSH server and whether policy permits local or remote forwarding. Forwarding ran with the daemon's root privileges rather than the user's. An authorized peer could reach root-only Unix sockets; ordinary OpenSSH over Tailscale is a different implementation.
Confirm the running daemon is updated. If you still need the vendor's temporary forwarding restriction, TS_SSH_DISABLE_FORWARDING equals one in the tailscaled service environment requires a restart. The release also fixes Serve issues with their own configuration conditions. An update closes the software path; it doesn't prove there was no earlier misuse.
Item four. Microsoft 365: find device-code authorizations. ANY.RUN's SkyW4lker analysis describes a document lure that sends a user through genuine Microsoft authentication to approve an attacker-generated device code. The attacker receives access to the user's account and its accessible resources. A correct password and completed MFA therefore don't establish intended authorization.
In Microsoft sign-in logs, AuthenticationProtocol has a deviceCode value. Use that to find the flow, then correlate user, application, time, IP and the user's account of what they initiated. Legitimate tooling also uses this flow; a match alone isn't an incident. A starting query and field references are in the notes.
Microsoft recommends restricting unnecessary device-code use through Conditional Access. Review legitimate usage and test in report-only mode before enforcement. For suspected abuse, its published guidance includes revoking the user's sign-in sessions. That addresses issued access rather than assuming a password reset settled it. The new kit report describes observations from earlier months, not a count of organizations compromised today.
