Four Customer Security Checks Before Your Next Call
October 30, 2026. Sales Engineer Briefing: four customer checks, led by actively exploited Drupal and Cisco flaws. Affected stores could face order or data exposure; qualifying VPN firewalls could lose availability.
Drupal Commerce Core has an actively exploited access-bypass flaw; affected stores should update and review orders. Cisco ASA and FTD face an exploited, high-severity VPN denial-of-service flaw under specific conditions. Palo Alto confirms exploitation of exposed PAN-OS management interfaces, where unauthenticated code execution could enable access beyond the firewall. Research also found credentials in public Gitee repositories that still worked when tested; teams with keys there should check and revoke or rotate them.
Sources checked through Oct 30, 4:41 AM PDT. Published Oct 30, 5:30 AM PDT.
Affected technology Drupal Commerce Core stores running affected releases · Cisco Secure Firewall ASA and FTD remote-access SSL VPN configurations meeting the reported conditions · Palo Alto Networks PAN-OS management interfaces, especially those reachable from the public internet · Organizations whose developers or teams committed credentials to public Gitee repositories
Item one. Drupal Commerce: store access controls and checkout orders
Item one. Drupal Commerce: check the module, then the orders. Commerce Core adds online-store functions such as carts and checkout to Drupal websites. Drupal says attackers are exploiting CVE-2026-118539, an access-bypass flaw that may expose protected routes or store data, with possible financial impact.
The flaw affects Commerce Core, not every Drupal site. Reported vulnerable releases are 3.x before 3.3.13 and earlier releases before 8.x-2.41. Drupal reports use on more than 42,000 sites; that’s adoption, not the number vulnerable or attacked. The attack method, number of targeted stores, and whether exploitation began before fixes were available are unknown.
Ask the application owner whether they run Commerce Core and which release. If it’s affected, update to a fixed release and review orders for inconsistencies, as Drupal advises. A patch closes the known path; it doesn’t prove the store wasn’t accessed earlier.
Item two. Cisco ASA and FTD: remote-access VPN availability
Item two. Cisco ASA and FTD: ask about VPN configuration, not just the firewall brand. These products provide firewall services and can host remote-access SSL VPNs, which connect users to an organization’s network. Cisco’s CVE-2026-76418 is a high-severity denial-of-service flaw; CISA added it to its Known Exploited Vulnerabilities catalog October 29, citing active exploitation.
An attack can make a vulnerable device reload and interrupt firewall and VPN availability. It requires an unpatched ASA or FTD release, a reachable SSL VPN login service, and secondary authentication in an affected tunnel group; successful VPN login isn’t required. Cisco’s cloud-delivered firewall and management offerings, Secure Access, and Secure Firewall Management Center are reported as not affected. CISA confirms exploitation but doesn’t provide customer build details.
Ask the network owner to check the exact product and release, VPN reachability, and tunnel-group configuration against Cisco’s advisory, then confirm the fixed-release plan. Cisco reportedly warns that removing secondary authentication reduces VPN security, so it isn’t an equivalent fix.
Item three. PAN-OS management interfaces: a material PHP2Shell update
Item three. PAN-OS management interfaces: exposure is the first question. PAN-OS runs Palo Alto Networks firewalls; its management web interface, including the HTTPS web UI and XML API, is separate from ordinary traffic-handling interfaces. Palo Alto confirms exploitation of PHP2Shell vulnerabilities against publicly accessible management interfaces. The flaws can allow unauthenticated remote code execution on affected versions. A dataplane interface is in scope only if a management profile is attached; GlobalProtect portal, gateway, and Clientless VPN aren’t impacted.
Dream reports that attackers rooted 25 PAN-OS firewall and management servers across four countries. In a U.S. government-affiliated environment, the report describes persistent access through a tunnel from a compromised firewall to an internal management server. Attackers compromised that server, extracted an LDAP service credential, enumerated Active Directory, and attempted further identity attacks. Dream says recovered artifacts confirm the credential extraction and directory enumeration, but it couldn’t determine whether password spraying, backdoor account creation, or other identity attacks succeeded. These are campaign findings, not evidence of a particular customer’s exposure. Dream updated its report October 29 to identify PAN-OS and note collaboration with Palo Alto; Palo Alto separately confirmed active exploitation.
Ask whether any PAN-OS management interface is publicly reachable. If so, remove public access, restrict management to trusted internal IP addresses, and apply the available fixes; by October 30, patches had been released for all affected PAN-OS branches. Check the exact release against the vendor advisory. If exposure existed before remediation, ask what investigation checked for prior access, credential exposure, and movement into internal identity systems. A patch doesn’t establish that earlier access didn’t occur.
Item four. Public Gitee repositories: check whether credentials need rotation
Item four. Public Gitee repositories: check for credentials to rotate, not a presumed breach. Gitee hosts public code; credentials can remain in older Git commit history after deletion from current files. An independent researcher, in a report published with MongoDB, says two scanners checked credentials against issuing services while scanning about 7.25 million public repositories. They found 26,400 unique credentials that still worked when tested, including cloud and AI service keys.
That’s a count of credentials, not customers, organizations, or confirmed compromises. Scan dates, other use, and whether the credentials have since been revoked aren’t established. A working key may allow actions within its permissions, but the report doesn’t show that happened in a customer environment.
Ask whether teams committed credentials to public Gitee repositories, including old history, and whether matching keys were revoked and replaced. Deleting text doesn’t invalidate a credential. The service owner can review available provider logs for use; the scan itself doesn’t establish customer-specific activity.
