Brotli joins the known-exploited list

Kia ora, this is It's probably nothing for 29 October. We've got two additions to CISA's known-exploited catalogue, and a health privacy breach that didn't need a network intrusion.

CISA added the Brotli flaw affecting Node.js to its known-exploited catalogue on 27 October. That's the consequential change here: evidence of active exploitation, rather than another affected-product announcement.

Node.js says an attacker has to supply Brotli data that an application decompresses through its zlib module. The resulting process-memory corruption can cause crashes, disclose memory or allow remote code execution. Having Node.js installed isn't, by itself, the whole exposure story.

Fixed releases are available for the Node.js 22, 24 and 26 lines. If you're running a service that decompresses untrusted Brotli input, that decoding path is worth checking against the fixed releases. The catalogue addition doesn't establish when attacks began or how widespread they are. Use in ransomware campaigns remains unknown.

The other CISA addition is an unrestricted-upload flaw affecting Adobe Commerce and Magento Open Source. Adobe's July bulletin said it knew of no exploits for the issues it addressed; CISA now cites evidence of active exploitation.

There's an important wrinkle. Adobe's entry for this particular flaw requires neither authentication nor administrator privileges, but its CVSS vector does require user interaction. CISA describes possible code execution in the current user's context, and elevated access or control over their account or session. That isn't the same claim as an interaction-free storefront takeover.

The fixes are in July's security releases, not a fresh patch drop.

Meanwhile, ABC reports that NT Health has paused its medical-observer programme following a maternity privacy breach at Royal Darwin Hospital. Instagram photos and videos exposed patient names, identification numbers, medical conditions and other sensitive information.

Health Minister Steve Edgington said on Wednesday morning that he'd referred the breach to the NT Information Commissioner and NT Police to determine whether criminal offences had occurred. That referral isn't a finding that an offence occurred.

The patient-count revision came on Tuesday. NT Health said specialist ICT assistance had unlocked previously inaccessible files, taking its acknowledged total from five affected patients to twelve. Four affected patients told ABC the department hadn't notified them before the outlet contacted them.

This wasn't a network intrusion, but information handling and notification failures are quite capable of doing harm without one.

That's it for this edition. Thanks for listening.

Don't forget, all our threat intelligence comes from Mallory dot A I and open sources. If you want intelligence your team can act on, reach out for a chat.