SB Sentinel · BreachWatch
BreachWatch — Incident Alert System
BreachWatch, an SB Sentinel product: plain-language alerts for the breach and cyber incidents that touch your accounts, providers and business.
Wire generated 2026-10-28T11:15:00Z · BreachWatch wire — the same entries the site's registers carry
Latest on the wire
CRITICAL
Adobe Commerce and Magento unrestricted file upload allows arbitrary code execution
Adobe Commerce and Magento contain an unrestricted upload of file with dangerous type vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session.
U.S. impact: Added to the national exploited-vulnerability catalogue on 27 October 2026 with a federal remediation deadline of 10 November 2026. Unlike the PHP entries beneath it, this one does not carry the forensic-triage flag, so the guidance is to apply the vendor's mitigations rather than to hunt for evidence of compromise. Magento sits under a large share of mid-size online stores, so the exposure reaches the merchant's own server, order history and customer records rather than a third-party platform. The flaw class matters: an unrestricted upload ends in a web shell on the store's own host. Apply the vendor's mitigations, and discontinue use where none are available.
Exploited-vulnerability catalogue — CVE-2026-48356 · Tier 1 · Exploited-vulnerability catalogue · 2026-10-27
CRITICAL
Google Brotli unchecked return value corrupts decoder memory
Google Brotli contains an unchecked return value vulnerability that allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.
U.S. impact: Added to the national exploited-vulnerability catalogue on 27 October 2026 with a federal remediation deadline of 10 November 2026 and no forensic-triage flag. Brotli is a compression library rather than a product anyone chooses: it sits inside browsers, web servers and content delivery networks, so most affected organisations inherited it through something else. The catalogue notes it affects an open-source component that different products embed. A remote unauthenticated attacker can corrupt decoder memory and potentially execute code using a crafted compressed stream, which means the input is ordinary web traffic. Apply the vendor's mitigations, and discontinue use where none are available.
Exploited-vulnerability catalogue — CVE-2026-111497 · Tier 1 · Exploited-vulnerability catalogue · 2026-10-27
CRITICAL
PHP memory corruption flaw allows unauthenticated remote code execution
PHP contains an out-of-memory corruption vulnerability that allows for unauthenticated remote code execution.
U.S. impact: Added to the national exploited-vulnerability catalogue on 26 October 2026 with a federal remediation deadline of 29 October 2026, and it carries the catalogue's forensic-triage flag — the guidance is to look for evidence of compromise, not only to patch. PHP runs underneath a large share of the public web, including WordPress, Drupal, Joomla and Magento, so the exposure reaches small-business, school, clinic and municipal sites whose owners never touch the language directly. The catalogue notes the flaw affects an open-source component that different products can embed, so the affected list is wider than PHP itself. Apply the vendor's mitigations, and discontinue use where none are available.
Exploited-vulnerability catalogue — CVE-2026-109618 · Tier 1 · Exploited-vulnerability catalogue · 2026-10-26
CRITICAL
PHP stale internal request-state flaw allows unauthenticated remote code execution
PHP contains a stale internal request-state vulnerability that allows for unauthenticated remote code execution.
U.S. impact: Added to the national exploited-vulnerability catalogue on 26 October 2026 alongside CVE-2026-109618, with the same federal remediation deadline of 29 October 2026 and the same forensic-triage flag. The two are separate flaws in the same component and should be treated as one patching job: if you update PHP, you close both. Apply the vendor's mitigations, and discontinue use where none are available.
Exploited-vulnerability catalogue — CVE-2026-109619 · Tier 1 · Exploited-vulnerability catalogue · 2026-10-26
CRITICAL
Arista VeloCloud Orchestrator SQL injection reaches privileged internal functionality
Arista VeloCloud Orchestrator on-prem contains a SQL injection vulnerability that may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator.
U.S. impact: Added to the national exploited-vulnerability catalogue on 23 October 2026 with a federal remediation deadline of 26 October 2026, and it carries the catalogue's forensic-triage flag — the guidance is to look for evidence of compromise, not only to patch. The orchestrator is the control plane for an SD-WAN estate, so what is at risk is the data the orchestrator manages, not just the host it runs on. Apply the vendor's mitigations, and discontinue use where none are available.
Exploited-vulnerability catalogue — CVE-2026-114625 · Tier 1 · Exploited-vulnerability catalogue · 2026-10-23
CRITICAL
Collabora Online built-in CODE Server OS command injection allows remote code execution
Collabora Online — Built-in CODE Server, when used within the Nextcloud platform, contains an OS command injection vulnerability that allows for remote code execution when the CODE server isn't running.
U.S. impact: Added to the national exploited-vulnerability catalogue on 23 October 2026. This is the document layer inside Nextcloud, so code execution here reaches the files a team shares rather than a single machine. The condition in the vendor description — exploitation when the CODE server isn't running — is worth noting for anyone whose deployment has the service stopped or partially configured.
Exploited-vulnerability catalogue — CVE-2026-110447 · Tier 1 · Exploited-vulnerability catalogue · 2026-10-23
Acting on the current record
Patch both before Monday.
BeyondTrust Remote Support and the Fortinet appliances. The federal deadline is not a suggestion — it is the point at which agencies must have this closed, and the same urgency applies to anyone running either.
Treat BeyondTrust as potentially compromised until you have checked.
Review appliance logs for unexpected file operations and authentication anomalies. Version numbers alone will not tell you whether someone was already inside.
Check your exposure.
Both products are perimeter-grade. If either is internet-facing, the risk is materially higher than an internal deployment.
What this record is
The SB Sentinel BreachWatch is one record inside the larger SB Sentinel network. SB Sentinel is the umbrella; BreachWatch is the incident desk within it, and other desks cover the national alerts, the daily briefing, the global incident tracker and the open comment tracker.
This record tracks publicly disclosed breaches and exploited software flaws that touch ordinary accounts and small organisations — the alert feed, the vulnerability board, the AI and SI watch, and the global incident tracker.
It reads the public record only. It cannot see inside anyone's systems, and it publishes confidence tags so a reader can tell a confirmed disclosure from an unverified claim. Silence is never a statement that nothing happened.
From the register
Confirmed
Change Healthcare claims-processing network
Change Healthcare, a claims-processing subsidiary of UnitedHealth Group. · Healthcare · Tier 1 · Official filing
| What | Health, billing and insurance-claims records were copied out of a claims-processing network, and parts of the health system that depend on it could not process claims for weeks. |
| When | 22 April 2024 |
| Where | Claims-processing, billing and prescription-related systems. The company has said roughly 190 million people had data in scope — a very large share of the United States. |
| How | Stolen remote-access credentials used to log in to a remote-access service that was not protected by multi-factor authentication. |
| Who | Self-claimed by ALPHV/BlackCat; a ransom was reportedly paid. A second group, RansomHub, later claimed it held the data. No government agency has published an attribution. |
| Exposure window | Intrusion is reported to have started around 12 February 2024. The network was disconnected on 21 February 2024, which is when the access ended. |
| Am I affected? | ['Look for a notice letter from Change Healthcare or UnitedHealth Group. If you were in scope you should have been offered identity-protection cover.', 'Read your insurance explanation-of-benefits statements and medical bills for treatment you never had. That is the signature of medical identity theft.', 'If you were notified, enrol in the monitoring and place a freeze or fraud alert with all three credit bureaus — it is free and takes about ten minutes each.', "Treat any call, text or email that cites this breach and asks you to 'verify' details as suspect. Ring your insurer on the number printed on your card."] |
Source: SEC EDGAR — Form 8-K filings
Confirmed
Microsoft corporate email accounts
Microsoft Corporation. · Cloud & Big Tech · Tier 2 · Victim organisation disclosure
| What | A small number of Microsoft employee email accounts were read, including accounts belonging to senior leadership and to staff who work on security and legal matters. |
| When | 19 January 2024 |
| Where | A legacy, non-production test tenant account, and through it a small number of corporate email accounts — including members of the senior leadership team and employees in cyber-security and legal functions. Customer systems and production services were not the target. |
| How | A password-spray attack against a legacy test account, then abuse of an over-permissive permission setting to move from that account to email. |
| Who | Attributed by Microsoft to Midnight Blizzard, a group Microsoft links to Russia's foreign-intelligence service, the SVR. Other national agencies track the same activity under their own names. |
| Exposure window | Access began in late November 2023 and continued until it was detected and cut off in January 2024. |
| Am I affected? | ["This one concerns Microsoft's own corporate email, not customer accounts — most people are not in scope.", 'If you are a Microsoft customer: no customer data was reported as taken, and no action is required on your part.', 'If you administer Microsoft 365 for an organisation, use this as a prompt: enforce phishing-resistant multi-factor authentication on mail, and remove legacy test tenants nobody owns.'] |
Source: Microsoft Security Blog
Confirmed
AT&T wireless call and text records
AT&T Inc. · Telecom · Tier 1 · Official filing
| What | Records showing who wireless customers called and texted, and when, were downloaded from a cloud platform. The contents of the calls and messages were not taken. |
| When | 12 July 2024 |
| Where | Customer call and text metadata — phone numbers and timestamps — held on a third-party cloud data platform. Names were not included, and neither was the content of any call or message. |
| How | Credentials for an account on a cloud data platform, used without multi-factor authentication — the same pattern seen across a cluster of mid-2024 incidents at other companies that used the same platform. |
| Who | Unknown. Neither the company nor any agency has published a credible attribution, and no group has been publicly confirmed as responsible. |
| Exposure window | Call and text records from 1 May to 31 October 2022, plus single-day records from 2 January 2023. |
| Am I affected? | ['These are metadata records: who you called, not what was said. Expect phishing that names a real contact or an organisation you really deal with — that detail is now cheap for an attacker to get.', 'Verify any unexpected message by ringing the organisation back on a number you already have, not one in the message.', 'Ask your carrier to add a port-freeze and an account passcode. That makes SIM-swap fraud much harder.', 'Move your important accounts — email first, then banking — off SMS codes and onto an authenticator app or a hardware key.'] |
Source: SEC EDGAR — Form 8-K filings
Confirmed
MOVEit Transfer file-theft campaign
Progress Software (the product vendor), and the many organisations using its MOVEit Transfer product — the campaign reached victims across several countries. · Government & Infrastructure · Tier 1 · Official advisory
| What | Organisations that used a particular file-transfer product had files stolen straight out of it — client lists, payroll files, health records and benefit data held by government agencies, banks, universities and hospitals. |
| When | 2 June 2023 |
| Where | Files stored inside MOVEit Transfer instances: client records, employee and health data, benefit files. Data was taken in batches rather than all at once. |
| How | A flaw in the product's web interface that let an attacker run their own database commands and pull files out without logging in through the front door. |
| Who | Self-claimed by Cl0p, the group Microsoft tracks as Lace Tempest. CISA and the FBI confirmed widespread exploitation but published no formal state attribution. |
| Exposure window | Exploitation was confirmed from late May 2023 and continued well past the first patch, for as long as organisations were unpatched or had not rotated credentials. |
| Am I affected? | ['The signal here is a notice from an organisation you have been a customer, patient or employee of. MOVEit took files, so the notice is the only reliable way to know.', 'Check whether an insurer, pension scheme, university or state agency you deal with published a MOVEit notice — many did, at different times.', 'Watch for phishing that quotes details an organisation would hold about you. That is the extra leverage a stolen file gives an attacker.', 'If you get a notice, ask plainly what was taken. In most jurisdictions you are entitled to be told.'] |
Source: CISA cybersecurity advisories
Analysis
Exploited vulnerability · 21 October 2026
A flaw that hands over root on an appliance — and the federal deadline is tomorrow
CISA added CVE-2026-106931 to its Known Exploited Vulnerabilities catalogue on 20 October. The deadline is 23 October.
Active exploitation · 21 October 2026
The PHP flaws are being exploited. Here is what is established — and what is not yet
Working exploits are public and in use. A verified outage count is not yet published, and we will not estimate one.
State-linked operations · 21 October 2026
Sandworm helped wipe a grain logistics company. Food is infrastructure
A destructive attack on food logistics, not a theft. The same war, a different sector.
Get the desk
- Plans are built on seats, integrations and SLAs.
- Free board for one reader. BreachWatch at $9.99 a month, and BreachWatch Pro at $49.99 a month with one integration.
- Operations adds routing into your stack and a 99.9% delivery SLA. Enterprise is custom — seats, integrations and SLA negotiated.
BreachWatch
$9.99/month
Access to the live, graded breach and vulnerability feed, exactly as this site publishes it today.
- Access to the live, graded breach and vulnerability feed
Payment is taken on our secure QuickBooks payment page (card or bank transfer). We activate your access as soon as your payment confirms — usually the same business day. Subscriptions don't renew automatically; we email you each month to renew.
BreachWatch Pro
$49.99/month
- Everything in BreachWatch
- Push notifications for new CRITICAL and HIGH items
- 1 integration included — Slack or generic webhook, so alerts land in your team's channel
- Built for teams: alerts reach the whole channel, not just one reader
- Email support, best effort
Payment is taken on our secure QuickBooks payment page (card or bank transfer). We activate your access as soon as your payment confirms — usually the same business day. Subscriptions don't renew automatically; we email you each month to renew.
Recent briefings
- 14 Oct 2026 — Ivanti Connect Secure and Windows Shell updates added to the exploited list
- 8 Oct 2026 — Five updates pass their federal deadline
- 4 Oct 2026 — Citrix NetScaler flaw under active exploitation
- 2 Oct 2026 — Zammad pair chains to full administrative control
- 1 Oct 2026 — Fortinet FortiMail arbitrary file write
- 30 Sep 2026 — Cisco SD-WAN reachable without signing in
- 29 Sep 2026 — Apple CoreGraphics flaw across iOS, macOS and iPadOS
- 27 Sep 2026 — Two Citrix NetScaler flaws exploited before a patch existed
Presented by Sunny Burns · SB Sentinel Breach Watch