Canadian Centre for Cyber Security
CompanyThreat actors named alongside
Source: RedTeamDaily stories that mention bothSecurity timeline
- Vulnerability reported by The Hacker NewsDrupal Commerce Core access bypass flaw CVE-2026-118539 under active exploitation
- Vulnerability reported by Canadian Centre for Cyber SecurityCanadian Cyber Centre flags vulnerabilities in Laravel MongoDB versions before 5.12.0
- Vulnerability reported by Canadian Centre for Cyber SecurityHashiCorp fixes Nomad symlink escape and Boundary SSRF flaws in new security advisory
- Vulnerability reported by Horizon3.aiAttackers probe critical Oracle E-Business Suite flaw CVE-2026-101767 after October patch
- Vulnerability reported by CSO OnlineCritical Brotli decoder flaw CVE-2026-111497 (Broccoli2Shell) exploited, added to CISA KEV
Recent news
Drupal Commerce Core access bypass flaw CVE-2026-118539 under active exploitation
Drupal reports active exploitation of CVE-2026-118539, a missing authorization flaw in the Commerce Core module, rated highly critical (21 out of 25 on Drupal's own scale, not CVSS). It affects versions before 2.41 and 3.0.0 up to but not including 3.3.13, and needs no authentication. Administrators should update to 2.41 or 3.3.13 and audit orders against expected prices and payment records.
Canadian Cyber Centre flags vulnerabilities in Laravel MongoDB versions before 5.12.0
The Canadian Centre for Cyber Security issued advisory AV26-1107 on 30 October 2026, stating that as of 28 October 2026 Laravel MongoDB versions prior to 5.12.0 are affected by vulnerabilities. It encourages administrators to review the linked references and apply any necessary updates as they become available. The advisory text provides no further detail on the flaws.
HashiCorp fixes Nomad symlink escape and Boundary SSRF flaws in new security advisory
The Canadian Centre for Cyber Security has published advisory AV26-1106 covering HashiCorp vulnerabilities as of 29 October 2026. HCSEC-2026-52 affects Nomad, where dispatch payload writes can escape the allocation directory through symlinks. HCSEC-2026-54 affects Boundary, which is vulnerable to server-side request forgery in the Vault credential store. Administrators should review the vendor advisories and apply updates.
Attackers probe critical Oracle E-Business Suite flaw CVE-2026-101767 after October patch
CVE-2026-101767 is an unauthenticated SQL injection in Oracle E-Business Suite's Thin Client Framework servlet that chains to remote code execution, with a CVSS score of 9.8. Oracle patched it in its October 2026 Critical Patch Update, and Defused Cyber decoys recorded exploratory exploitation on 27 October. The Canadian Centre for Cyber Security has updated its advisory to say open source reporting indicates exploitation in the wild.
Critical Brotli decoder flaw CVE-2026-111497 (Broccoli2Shell) exploited, added to CISA KEV
CVE-2026-111497, nicknamed Broccoli2Shell, is an out-of-bounds write in the Google Brotli decoder that can be exploited remotely without authentication. It can cause memory corruption, information disclosure, crashes or code execution. CISA added it to its Known Exploited Vulnerabilities catalogue on 27 October 2026. Software that bundles Brotli, including Node.js, .NET, PowerShell, Bun, Envoy Proxy, Istio and Python packages, may be affected.