by sig9
Hacker Wars - October 28, 2026
Your daily dose of infosec chaos
Patch Tuesday energy never really left this week: a Brotli flaw everyone was arguing about naming is now getting exploited for real, a fresh Oracle E-Business Suite hole is already being probed, and an unreleased AI model casually chained its way through Chrome, Safari, Windows, and Linux in the lab. Plus, one Japanese company decided the correct response to extortion is a million-dollar bounty, and the software running particle accelerators turns out to have been wobbly for years. Good times.
CISA Confirms Node2Shell Is Being Exploited In The Wild
The Brotli vulnerability variously known as Node2Shell, Broccoli2Shell, and HTTP2Shell (pick your vegetable) has been added to CISA’s known-exploited catalog after attackers started actively targeting it. Honeypots are already catching attempts in the wild, including one attacker who shipped a broken exploit - even the criminals are shipping half-finished code these days.
What to do: Patch the vulnerable Brotli dependency everywhere it appears, and treat internet-facing Node and HTTP stacks as your top priority this week.
Hackers Are Already Probing A Fresh Oracle E-Business Suite Flaw
A newly disclosed Oracle EBS vulnerability, CVE-2026-101767, is an unauthenticated SQL injection that can be pushed all the way to remote code execution. Oracle customers get zero breathing room - scanners are already sweeping the internet for vulnerable instances before most admins have even read the advisory.
What to do: Apply Oracle’s patch immediately, restrict access to EBS endpoints, and hunt your logs for suspicious SQL injection attempts targeting the affected components.
Unreleased AI Model Chains Bugs Into Working Chrome, Safari, Windows And Linux Exploits
An unreleased Anthropic model found and chained flaws into working proof-of-concept exploits across Chrome, Safari, Android, Windows, and Linux - all in the lab, none seen in the wild. The bugs were reported and patched, but a model quietly assembling zero-day chains is the kind of capability that used to take a nation-state team and a lot of coffee.
What to do: Keep browsers and OSes patched on a fast cadence, and remember that the window between “public research” and “weaponized” just keeps getting shorter.
Long-Hidden Flaws Haunt The Software Behind Particle Accelerators
Four flaws in EPICS Base - the control software used at particle accelerators and fusion labs - were found by an autonomous system and could let attackers crash critical research processes. Industrial and scientific control software hiding unfixed bugs for years is sadly not a new genre, but “you can crash a fusion lab’s control plane” is a fresh headline.
What to do: If you run EPICS or similar SCADA-adjacent tooling, patch now and segment those networks like the physical safety issue they actually are.
Ransomware Victim Puts A $1 Million Bounty On Its Attackers
Japan’s GMO Internet Group is offering up to $1 million for tips leading to the hackers behind its Onamae.com Desktop Cloud breach, having refused to pay the extortion demand. It is a refreshing inversion of the usual script - instead of quietly funding criminals, the victim is funding the manhunt, and the bounty only pays out if it leads to an arrest.
What to do: Revisit your extortion stance before an incident, not during one, and know in advance whether your playbook says pay, refuse, or offer a bounty instead.
That’s the chaos for today. Stay sharp out there.
Brought to you by sig9 - sig9.ch | Protecting the unseen, securing the unknown
This bulletin is provided for informational purposes. Contact us for tailored security analysis.