CISA confirmed exploitation of PHP2Shell, the Brotli decoder and GitLab this week, three flaws reported in earlier editions, and MySQL login attempts on the decoys rose 87.0%.
SECTION 01
What the signals mean
Events recorded on the Venus decoys fell 9.2% this week, to 874,619 from 963,151. Distinct sources rose 7.2%, to 5,704 from 5,321, and sessions rose 2.2%, to 14,865 from 14,539. The Windows surface lost 88,796 events, and every other surface together rose 0.4%, to 74,222 from 73,958. 3,077 sources were new and 2,627 had been seen before, against 3,015 and 2,306 in Edition 013.
Three flaws reported earlier reached the exploited list
Between 26 and 30 October, CISA added nine vulnerabilities to its catalogue of flaws confirmed as exploited. Three had been reported here before CISA confirmed exploitation: PHP2Shell and the Brotli decoder in Edition 013, GitLab in Edition 012. Both PHP2Shell flaws were added on 26 October, with remediation due 29 October, about nine days after the first reported exploitation attempts (Bleeping Computer). The Brotli decoder flaw followed on 27 October, five days after publication, and CISA warned of exploitation the next day (SecurityWeek). GitLab’s CVE-2026-97229 was added on 29 October, 16 days after publication. Alpine Linux said an attacker tried it against its own GitLab server a week after the fix shipped.
The slowest three had been public for months
The Linux kernel flaw Fragnesia, CVE-2026-46300, was published on 23 May and added to the catalogue on 28 October, 158 days later, and reporting says it was chained with PHP2Shell (Bleeping Computer). Adobe Commerce CVE-2026-48356 was added 105 days after publication. The VMware ESX flaw CVE-2026-41709 was added after 90 days and carries a CVSS score of 2.7, yet reporting says a China-linked group used it as a zero-day to reduce audit trail visibility (SecurityWeek). Cisco’s firewall VPN flaw was added the day after publication; it makes the device reload (The Hacker News).
Forecasts rose on flaws added months ago
EPSS estimates the chance that a flaw is exploited in the next 30 days. 91 vulnerabilities qualified this week, against 25 in Edition 013, and 80 of them carry a forecast rise. Linux kernel CVE-2026-31431 rose from 0.034 to 0.981, Apache Tomcat CVE-2026-34486 from 0.066 to 0.985, Citrix NetScaler CVE-2026-3055 from 0.040 to 0.915, Atlassian CVE-2026-21589 from 0.127 to 0.995 and Apache ActiveMQ CVE-2026-34197 from 0.155 to 0.983. All five have been on the catalogue since between 30 March and 15 October.
Database logins and VPN events rose on the decoys
MySQL credential attack requests rose 87.0%, to 1,576 from 843, from 88 sources. Database events rose 63.8%, to 1,947 from 1,189, VPN events 53.7%, to 5,691 from 3,703, and Shell events 20.8%, to 21,484 from 17,787. Venus recorded 4 gateway fingerprinting requests from 1 source and no gateway exploit requests.
Secrets requests fell while distinct paths doubled
Requests for secrets and configuration files fell 15.5%, to 19,461 from 23,036, while distinct paths rose to 1,930 from 970. /.env drew 366 requests against 606, /.git/config 239 against 316, /.env.local 179 against 270 and /.env.production 170 against 229. /.env.backup entered the leading five with 175. Terraform state drew 40 and 35 requests on its two paths, against 46 and 37. Traversal requests fell 38.4%, to 1,190 from 1,933, and the leading paths now use /....//....//....//..../.env, a form that survives a filter removing ../ once. Three paths under a log-download route ended at /proc/self/environ with 32 requests each.
The fingerprint cluster rose
The remote desktop tool identified by fingerprint 73ede1f461b6 ran from 135 addresses and produced 4,056 sessions, against 116 addresses and 3,007 sessions in Edition 013. It is the first rise in the address count since Edition 011. The cookie value rdp-async rose to 1,016 sessions from 29 sources, against 373 from 15.
My view
Three of the nine flaws had been reported as exploited here before CISA confirmed it. For PHP2Shell the forecast rose from 0.118 and 0.062 to 1.000 in the week CISA added them, so a queue driven by the catalogue or the forecast started about nine days after the first reported exploitation. I start from the reporting and use the catalogue to set the deadline.
One identifier in the Venus mapping is among the 91 Medulus qualified, and it drew no requests this week. 98.7% of the CVE-identified hits on the decoys carry identifiers from 2022 or earlier, while 67 of the 91 qualifiers are from 2026. A queue built only from the news misses the old flaws the decoys are asked about.
Every file named in both weeks drew fewer requests, while the number of distinct paths requested rose to 1,930 from 970. I assume any secret sitting on a web-reachable path has already been requested.
What to act on
Patch PHP2Shell first. Brotli libraries, GitLab and the Cisco ASA and FTD flaw follow. Ivanti Connect Secure, VMware ESX, Adobe Commerce and the Linux kernel flaw come next, with remediation dates from 31 October to 11 November. Confirm that firewall management interfaces cannot be reached from the internet. Remove environment files, Git directories, Terraform state and site archives from any path a web server can reach.
26 Oct – 1 Nov 2026
26 Oct – 1 Nov 2026
874,619 external events (−9.2%). 5,704 distinct sources (+7.2%). 14,865 sessions (+2.2%).
Against Edition 013’s published figures, events fell from 963,151 to 874,619, sources rose from 5,321 to 5,704 and sessions from 14,539 to 14,865. New sources rose 2.1%, to 3,077 from 3,015, and returning sources 13.9%, to 2,627 from 2,306. By surface, Windows fell 10.0% to 800,397 from 889,193, Web fell 10.4% to 38,025 from 42,416, Shell rose 20.8% to 21,484 from 17,787, API fell 21.8% to 2,459 from 3,144, Portal fell 21.8% to 2,453 from 3,136, Database rose 63.8% to 1,947 from 1,189, Auth fell 16.3% to 2,163 from 2,583 and VPN rose 53.7% to 5,691 from 3,703. 1,479 campaigns were active against 1,035, and 1,069 are flagged recurring, against 596.
Ranked signals
| Rank | Signal | Events | Ed. 013 | Change | Sources | Score |
|---|---|---|---|---|---|---|
| 1 | AI Workflow Builder Exploit Attempts | 6 | 109 | −94.5% | 2 | 0.5500 |
| 2 | MySQL Credential Attack | 1,576 | 843 | +87.0% | 88 | 0.3885 |
| 3 | Webshell / RCE Script Probing | 4,999 | 3,828 | +30.6% | 152 | 0.3746 |
| 4 | AI Workflow Builder Probing | 2 | 25 | −92.0% | 2 | 0.3500 |
| 5 | PHP Injection / Remote Include | 82 | 75 | +9.3% | 19 | 0.2986 |
| 6 | Sensitive File & Secret Exposure | 19,461 | 23,036 | −15.5% | 147 | 0.2713 |
| 7 | Automated Scanner / Recon Tooling | 763 | 939 | −18.7% | 102 | 0.2670 |
| 8 | Directory / Path Traversal | 1,190 | 1,933 | −38.4% | 21 | 0.2631 |
| 9 | SSH Invalid-User Enumeration | 20,740 | 17,008 | +21.9% | 602 | 0.1765 |
| 10 | Admin Console Discovery | 1,714 | 1,574 | +8.9% | 118 | 0.1549 |
| 11 | SMB Access Probing | 123,623 | 136,445 | −9.4% | 2,474 | 0.1534 |
| 12 | SSH Access Probing | 21,484 | 17,787 | +20.8% | 996 | 0.1517 |
| 13 | SSH Campaign Targeting | 1,616 | 1,526 | +5.9% | 200 | 0.1400 |
| 14 | SMB Credential Attack | 110,891 | 124,784 | −11.1% | 47 | 0.1388 |
| 15 | VPN Gateway Fingerprinting | 4 | 7 | −42.9% | 1 | 0.1187 |
WordPress plugin probing fell to 0 from 2. Atlassian Data Center exploit attempts and SQL injection probing stayed at 0.
Remote desktop fingerprint campaigns
| Client signature | Sessions | Ed. 013 | Change | Sources | Ed. 013 | Change |
|---|---|---|---|---|---|---|
TLS 73ede1f461b6 | 4,056 | 3,007 | +34.9% | 135 | 116 | +16.4% |
| RDP cookie "rdp-async" | 1,016 | 373 | +172.4% | 29 | 15 | +93.3% |
TLS 113d359fe776 | 588 | not published | – | 10 | not published | – |
| RDP cookie "hello" | 427 | not published | – | 72 | not published | – |
Fingerprint 73ede1f461b6 rose from 116 addresses to 135. The rdp-async cookie rose from 15 sources to 29. 113d359fe776 is not in Edition 013’s table and is flagged recurring. The "hello" cookie, at 417 sessions from 137 sources in Edition 012, returned at 427 sessions from 72. An address can carry several signatures, so the counts are not totalled.
Path families
| Family | Events | Ed. 013 | Change | Paths | Ed. 013 | Sources | Most requested |
|---|---|---|---|---|---|---|---|
| Sensitive File & Secret Exposure | 19,461 | 23,036 | −15.5% | 1,930 | 970 | 147 | /.env (366), /.git/config (239) |
| Backup & Archive Download Probing | 392 | 424 | −7.5% | 40 | 27 | 19 | /terraform.tfstate (40), /.terraform/terraform.tfstate (35) |
| Webshell / RCE Script Probing | 4,999 | 3,828 | +30.6% | 981 | 590 | 152 | /phpinfo.php (120), /index.php (99) |
| Admin Console Discovery | 1,714 | 1,574 | +8.9% | 205 | 157 | 118 | /admin/.env (85), /admin (69) |
| Directory / Path Traversal | 1,190 | 1,933 | −38.4% | 76 | 220 | 21 | /....//....//....//..../.env (32), /....//....//....//..../proc/self/environ (32) |
| SQL Injection Probing | 0 | 0 | – | 0 | 0 | 0 | – |
Distinct paths rose in the sensitive-file, backup, webshell and admin families, and fell in traversal, to 76 from 220. The sensitive-file list nearly doubled, to 1,930 from 970. Two of the five leading admin paths end in .env.
Representative paths
| Secrets and configuration | Events | Ed. 013 | Backup and archive | Events | Ed. 013 |
|---|---|---|---|---|---|
/.env | 366 | 606 | /terraform.tfstate | 40 | 46 |
/.git/config | 239 | 316 | /.terraform/terraform.tfstate | 35 | 37 |
/.env.local | 179 | 270 | /site.zip | 24 | 48 |
/.env.backup | 175 | not published | /www.zip | 24 | not published |
/.env.production | 170 | 229 | /backup.zip | 22 | 32 |
Every path present in both weeks fell. /.git/config fell 24.4%, /.env 39.6% and /site.zip 50.0%.
Behaviour progression
303 sessions carried behaviour from two or more distinct stages, against 300 in Edition 013.
| Ordering | Sessions | Ed. 013 | Change | Sources | Ed. 013 | Busiest source | Evasive |
|---|---|---|---|---|---|---|---|
| Discovery, then Exploitation | 245 | 250 | −2.0% | 143 | 156 | 19 (7.76%) | 7.30% |
| Exploitation, then Discovery | 58 | 50 | +16.0% | 52 | 49 | 4 (6.90%) | 5.45% |
Evasive sessions rose to 7.30% of the forward ordering from 4.66%, and fell to 5.45% of the reverse from 28.00%. The busiest source’s share fell in the forward ordering, to 7.76% from 8.00%, and rose in the reverse, to 6.90% from 4.00%.
Vulnerability mapping
| Identifier | Description | Hits | Ed. 013 | Change | Sources | KEV |
|---|---|---|---|---|---|---|
| CWE-312 | Cleartext secrets (.env) | 15,952 | 18,457 | −13.6% | 96 | no |
| CVE-2021-41773 | Apache traversal | 5,019 | 3,846 | +30.5% | 153 | yes |
| CVE-2019-0232 | Tomcat CGI | 4,999 | 3,828 | +30.6% | 152 | no |
| CWE-527 | Exposed Git | 1,373 | 2,084 | −34.1% | 90 | no |
| CVE-2017-9841 | PHPUnit eval-stdin | 453 | 480 | −5.6% | 21 | yes |
| CVE-2023-2982 | WordPress login bypass | 129 | 43 | +200.0% | 28 | no |
| CVE-2012-1823 | PHP-CGI argument injection | 82 | 75 | +9.3% | 19 | yes |
| CVE-2022-22963 | Spring Cloud Function | 40 | 38 | +5.3% | 8 | yes |
| CVE-2021-42013 | Apache traversal, second fix | 20 | 18 | +11.1% | 11 | yes |
| CVE-2025-3248 | Langflow code validation | 6 | 49 | −87.8% | 2 | yes |
15 identifiers were reached, against 17, and 7 are on the KEV catalogue, against 8. CVE-2026-0768 drew 6 hits, against 49, and Spring4Shell, CVE-2022-22965, 3 from 3 sources, against 19. CVE-2017-12629 and CVE-2021-27905 each drew 2, against 9, and CWE-22 drew 2, against 15. The Flowise identifier CVE-2025-59528 and CVE-2026-33017 recorded no hits, against 40 and 20.
Medulus correlation
91 vulnerabilities qualified this period, against 25 in Edition 013, and 80 carry a forecast rise. Nine entered the CISA Known Exploited Vulnerabilities catalogue between 26 and 30 October.
| Product | Identifier | CVSS | EPSS | Added | Due | Days after publication | Reported exploitation |
|---|---|---|---|---|---|---|---|
| PHP | CVE-2026-109618 | 9.8 | 1.0000 | 26 Oct | 29 Oct | 5 | Bleeping Computer, The Hacker News |
| PHP | CVE-2026-109619 | 8.1 | 1.0000 | 26 Oct | 29 Oct | 5 | Bleeping Computer, The Hacker News |
| Brotli | CVE-2026-111497 | 9.8 | 0.8264 | 27 Oct | 10 Nov | 5 | SecurityWeek, Rapid7 |
| Adobe Commerce | CVE-2026-48356 | 9.3 | 0.4458 | 27 Oct | 10 Nov | 105 | The Hacker News |
| Linux kernel | CVE-2026-46300 | 7.8 | 0.1613 | 28 Oct | 31 Oct | 158 | Bleeping Computer |
| VMware ESX | CVE-2026-41709 | 2.7 | 0.0069 | 28 Oct | 11 Nov | 90 | The Hacker News, SecurityWeek |
| GitLab CE and EE | CVE-2026-97229 | 10.0 | 0.2730 | 29 Oct | 1 Nov | 16 | Bleeping Computer, The Hacker News |
| Cisco ASA and FTD | CVE-2026-76418 | 8.6 | 0.0082 | 29 Oct | 1 Nov | 1 | The Hacker News, SecurityWeek |
| Ivanti Connect Secure | CVE-2026-111357 | 7.0 | 0.0053 | 30 Oct | 2 Nov | 15 | The Hacker News |
Four of the nine have an EPSS score above 0.4: both PHP2Shell flaws, Brotli and Adobe Commerce. Three are below 0.01: Cisco, Ivanti and VMware. Exploit-DB lists one entry each for CVE-2026-109618 and CVE-2026-46300. Metasploit changed its GitLab module, rated Good, on 29 October.
Reporting also describes exploitation of Drupal Commerce Core, CVE-2026-118539 (Bleeping Computer), and probing of Oracle E-Business Suite, CVE-2026-101767, an unauthenticated SQL injection that can lead to code execution, days after its patch (The Hacker News). Neither is on the catalogue, and their forecasts are 0.0031 and 0.0061. Metasploit changed seven modules: GitLab, Flowise CVE-2025-58434 (forecast 0.505 to 0.764), Portainer, and scanners for Varnish, telnet, Redis and Microsoft mail services. CISA published four ICS advisories, for EPICS Base, two Hitachi Energy products and Siemens Mendix SAML. The Hitachi Energy CoreTec advisory includes CVE-2026-43284, forecast 0.9419.
Nine threat actors were named in reporting. TraderTraitor and Volt Typhoon drew three mentions each, and the FBI linked TraderTraitor to the $6.3 billion Binance theft (Bleeping Computer). Venus labelled 38 sessions as suspected agentic reconnaissance, against 32 in Edition 013. Reporting this week describes the ARTEX AI toolkit used against more than 200 organisations (The Hacker News) and a Chainalysis breach from offensive agentic techniques (Bleeping Computer).
Venus and Medulus together
One identifier in the Venus mapping, CVE-2026-33017, is among the 91 Medulus qualified. It recorded no hits this week.
| Subject | Medulus | Venus | Overlap |
|---|---|---|---|
| PHP2Shell | Both flaws added to the catalogue on 26 Oct, forecast 1.000 (Bleeping Computer) | Script file requests +30.6% to 4,999, PHP remote include +9.3% to 82 | No shared identifier |
| Langflow | CVE-2026-33017 forecast 0.248 to 0.962, on the catalogue since 25 Mar | Exploit requests −94.5% to 6; no hits for the identifier, against 20 | Opposite directions |
| Atlassian | CVE-2026-21589 forecast 0.127 to 0.995, on the catalogue since 15 Oct | No requests in Editions 013 or 014, against 2 in Edition 012 | Opposite directions |
| Secrets | 26,400 cloud and AI credentials in public Gitee repositories (The Hacker News), customers’ AI API keys abused at Northflank (Bleeping Computer) | Secrets requests −15.5% to 19,461 across 1,930 paths against 970 | Same target |
| Gateways | Cisco ASA and FTD, Ivanti Connect Secure and Palo Alto management interfaces reported exploited | VPN events +53.7% to 5,691; 4 fingerprinting requests, no exploit requests | No shared identifier |
| WordPress | Core flaw CVE-2026-87902 forecast 0.400 to 0.958; nearly 63,000 attack attempts in 24 hours reported (The Hacker News) | CVE-2023-2982 hits +200.0% to 129; plugin probing 0 | Different identifiers |
Technical checks for the week
- Patch: PHP to the 21 October emergency release, and PHP for Windows to the rebuilt packages that fix Brotli. Brotli libraries to 1.0.10, 1.1.1 or 1.2.1. GitLab to 19.2.8, 19.3.5 or 19.4.2.
- Patch: Cisco ASA and FTD, Ivanti Connect Secure, VMware ESX, Adobe Commerce and the Linux kernel flaw CVE-2026-46300, per their vendors.
- Prioritise: Oracle E-Business Suite CVE-2026-101767 and Drupal Commerce Core CVE-2026-118539. Each has reported exploitation or probing, and neither is on the catalogue.
- Review: Audit logging on VMware ESX hosts. The listed flaw lets an administrator act without a log entry.
- Remove: Terraform state, site archives,
.gitdirectories and every.envvariant from web-reachable paths. - Check: Request filters normalise a path until it stops changing. A single pass removing
../leaves....//as../.
Venus records activity reaching Elytra-operated decoy observation infrastructure. Medulus provides public vulnerability and threat-intelligence context. Every observed request is an attempt. Week-on-week comparisons are drawn from the figures published in Edition 013.