[{"data":1,"prerenderedAt":1479},["ShallowReactive",2],{"post-en-nis2-lieferkette-lieferanten-laufend-uberwachen":3,"related-en-nis2-lieferkette-lieferanten-laufend-uberwachen":437},{"id":4,"title":5,"author":6,"body":7,"category":403,"date":404,"description":405,"draft":406,"extension":407,"faq":408,"image":418,"imageAlt":419,"lang":420,"legacyUrl":421,"meta":422,"navigation":423,"path":424,"readingTime":425,"seo":426,"sitemap":427,"stem":432,"tags":433,"translation":435,"updated":421,"__hash__":436},"insightsEn\u002Fen\u002Finsights\u002Fnis2-lieferkette-lieferanten-laufend-uberwachen.md","NIS2 supply chain: what happens between two questionnaires","blacklens.io Team",{"type":8,"value":9,"toc":387},"minimark",[10,14,19,28,75,78,82,90,121,130,134,142,210,213,217,220,259,263,266,286,289,293,301,306,313,320,324,327,335,341,345,352,358,369,373,379],[11,12,13],"p",{},"A supplier questionnaire records how secure a supplier was on the day it was filled in. Your supply chain's security is decided on the other 364 days: by the IT provider that leaves its VPN gateway unpatched, the tax adviser whose domain can be spoofed, the logistics partner that turns up on a ransomware leak site. NIS2 requires you to account for exactly these weaknesses in every direct supplier. That means knowing them before the next questionnaire is due.",[15,16,18],"h2",{"id":17},"what-nis2-requires-for-the-supply-chain","What NIS2 requires for the supply chain",[11,20,21,22,27],{},"The ",[23,24,26],"a",{"href":25},"\u002Fen\u002Fwissen\u002Fnis2","NIS2 Directive"," makes supply chain security a mandatory risk management measure. Article 21(2)(d) names it; Article 21(3) requires organisations to consider the vulnerabilities specific to each direct supplier and the quality of its cybersecurity practices. Nationally and by sector:",[29,30,31,46,57,69],"ul",{},[32,33,34,38,39,45],"li",{},[35,36,37],"strong",{},"Austria:"," ",[23,40,44],{"href":41,"rel":42},"https:\u002F\u002Fwww.ris.bka.gv.at\u002FDokumente\u002FBundesnormen\u002FNOR40273893\u002FNOR40273893.html",[43],"nofollow","Section 32(4)(d) NISG 2026",", in force since 1 October 2026, adopts this wording, including the vulnerabilities of each supplier.",[32,47,48,38,51,56],{},[35,49,50],{},"Germany:",[23,52,55],{"href":53,"rel":54},"https:\u002F\u002Fwww.gesetze-im-internet.de\u002Fbsig_2025\u002F__30.html",[43],"Section 30(2) no. 4 of the BSI Act"," names supply chain security, in force since 6 December 2025.",[32,58,59,62,63,68],{},[35,60,61],{},"Digital providers"," such as cloud, data centre and managed service providers: under point 5.1.6 of the annex to ",[23,64,67],{"href":65,"rel":66},"https:\u002F\u002Feur-lex.europa.eu\u002Feli\u002Freg_impl\u002F2024\u002F2690\u002Foj\u002Feng",[43],"Implementing Regulation (EU) 2024\u002F2690",", they monitor and evaluate changes in suppliers' cybersecurity practices, for example after significant incidents, and act where necessary.",[32,70,71,74],{},[35,72,73],{},"Financial sector:"," DORA covers ICT third-party risk in Articles 28 to 30.",[11,76,77],{},"ISO 27001 control A.5.22 is more specific: supplier security practices must be monitored, reviewed and evaluated regularly. None of these rules prescribes a tool or an interval. All assume you notice changes at a supplier when they happen.",[15,79,81],{"id":80},"why-the-questionnaire-alone-falls-short","Why the questionnaire alone falls short",[11,83,84,85,89],{},"A questionnaire is a dated self-declaration: it records what a supplier says about itself, once. It keeps its place in ",[23,86,88],{"href":87},"\u002Fen\u002Fwissen\u002Fthird-party-risk-management","third-party risk management",", because nobody sees processes, backups or training from outside. For the systems a supplier exposes to the internet, it has three gaps:",[29,91,92,109,115],{},[32,93,94,97,98,102,103,108],{},[35,95,96],{},"It goes stale."," In 2026, the US agency CISA added 283 vulnerabilities to its ",[23,99,101],{"href":100},"\u002Fen\u002Fwissen\u002Fcisa-kev","catalogue of known exploited vulnerabilities"," by early November, more than six a week (",[23,104,107],{"href":105,"rel":106},"https:\u002F\u002Fwww.cisa.gov\u002Fknown-exploited-vulnerabilities-catalog",[43],"as of 3 November 2026","). More than two dozen hit firewalls, VPN and remote access gateways, the systems service providers use to reach customer networks.",[32,110,111,114],{},[35,112,113],{},"It doesn't measure."," \"We patch promptly\" is an answer, not a finding. No questionnaire tells you whether the provider's VPN gateway reports a vulnerable version.",[32,116,117,120],{},[35,118,119],{},"It doesn't scale."," With a few hundred suppliers, one round a year is already a project, for you and for suppliers asked the same questions by many customers.",[11,122,123,124,129],{},"Verizon's ",[23,125,128],{"href":126,"rel":127},"https:\u002F\u002Fwww.verizon.com\u002Fabout\u002Fnews\u002Fbreach-industry-wide-dbir-finds",[43],"2026 Data Breach Investigations Report"," puts the risk in numbers: a third party was involved in 48 per cent of confirmed breaches, up from 30 per cent in the previous report.",[15,131,133],{"id":132},"what-an-outside-in-rating-shows-and-what-it-doesnt","What an outside-in rating shows, and what it doesn't",[11,135,136,137,141],{},"An outside-in rating, also called a ",[23,138,140],{"href":139},"\u002Fen\u002Fwissen\u002Fsecurity-rating","security rating",", measures what a supplier's internet-facing infrastructure reveals, without access to its systems or its involvement. It answers part of the questionnaire with a measurement, not a statement:",[143,144,145,158],"table",{},[146,147,148],"thead",{},[149,150,151,155],"tr",{},[152,153,154],"th",{},"Questionnaire question",[152,156,157],{},"Measurable from outside",[159,160,161,170,178,186,194,202],"tbody",{},[149,162,163,167],{},[164,165,166],"td",{},"Do you apply security updates promptly?",[164,168,169],{},"Outdated software and known vulnerabilities on reachable systems",[149,171,172,175],{},[164,173,174],{},"Is remote access secured?",[164,176,177],{},"Exposed remote maintenance, VPN and admin access",[149,179,180,183],{},[164,181,182],{},"Do you encrypt data in transit?",[164,184,185],{},"Certificates, TLS versions and cipher suites",[149,187,188,191],{},[164,189,190],{},"Is your e-mail domain protected against spoofing?",[164,192,193],{},"SPF, DKIM and DMARC records",[149,195,196,199],{},[164,197,198],{},"Have you had security incidents?",[164,200,201],{},"Leaked credentials, listings on ransomware leak sites",[149,203,204,207],{},[164,205,206],{},"Do you have backups, incident plans and training?",[164,208,209],{},"Not measurable; stays with questionnaire and audit",[11,211,212],{},"The last row is the key limit. A good grade means no obvious weaknesses from outside, not that the supplier is secure, and only what can be attributed to its domain is rated. The rating does not replace the questionnaire. It shows which supplier to ask, and when.",[15,214,216],{"id":215},"how-to-set-up-continuous-supplier-monitoring","How to set up continuous supplier monitoring",[11,218,219],{},"Continuous supplier monitoring needs no big project, just six decisions you make once:",[221,222,223,229,235,241,247,253],"ol",{},[32,224,225,228],{},[35,226,227],{},"Start from procurement's list."," The vendor list in your ERP beats any list from memory; what counts is each supplier's domain.",[32,230,231,234],{},[35,232,233],{},"Rank by criticality."," Does the supplier access your systems? Does it process confidential data? Would your operation stop without it? Two yeses make it critical.",[32,236,237,240],{},[35,238,239],{},"Record the baseline."," Change matters more than the absolute value: a supplier falling from B to D deserves more attention than one steady at C for a year.",[32,242,243,246],{},[35,244,245],{},"Define triggers and owners."," Triggers might be a new known exploited vulnerability, a leak-site listing or a D or F grade for a critical supplier; owners can be security, procurement or the business unit.",[32,248,249,252],{},[35,250,251],{},"Review weekly."," A fixed weekly slot is enough when alerts cover the urgent cases.",[32,254,255,258],{},[35,256,257],{},"File the evidence."," A monthly report with date, grade distribution and your responses to declines belongs in the ISMS.",[15,260,262],{"id":261},"what-to-do-when-a-supplier-gets-worse","What to do when a supplier gets worse",[11,264,265],{},"A worse rating is a reason to ask, not a verdict. How urgently you respond depends on the cause:",[29,267,268,274,280],{},[32,269,270,273],{},[35,271,272],{},"Known exploited vulnerability:"," Send the supplier's security contact the finding with system, CVE and date, and agree a fix date. Until then, restrict its VPN accounts or API keys on your side.",[32,275,276,279],{},[35,277,278],{},"Ransomware leak-site listing:"," Treat it as a possible incident of your own. Establish which of your data the supplier holds, rotate shared credentials and check whether your own services are significantly disrupted. If they are, your reporting duty under NIS2 Article 23 may apply.",[32,281,282,285],{},[35,283,284],{},"Unprotected e-mail domain:"," Without an enforced DMARC policy, e-mails in the supplier's name are easier to forge, invoices with changed bank details included. Until the next review, have accounts confirm bank detail changes via a known phone number.",[11,287,288],{},"Record every response: who contacted whom and when, what the supplier answered and what you decided. This chain of finding, contact and decision shows you actually take your suppliers' vulnerabilities into account.",[15,290,292],{"id":291},"how-blacklensio-takes-over-continuous-monitoring","How blacklens.io takes over continuous monitoring",[11,294,295,296,300],{},"In blacklens.io, the ",[23,297,299],{"href":298},"\u002Fen\u002Fsolutions\u002Fsupply-chain-monitoring","Supply Chain Monitoring"," module handles the steps that take time: measuring, repeating, comparing. Your supplier has nothing to install or approve. The images show the demo workspace with fictional suppliers.",[302,303,305],"h3",{"id":304},"import-and-rank-suppliers","Import and rank suppliers",[11,307,308,309,312],{},"Under ",[35,310,311],{},"Supply Chain → Suppliers"," you add suppliers one by one, as a list or as a CSV file from procurement. URLs and e-mail addresses are reduced to the registrable domain, and a preview shows every entry before anything is added. Criticality (Low to Critical) and tags are set during import.",[11,314,315],{},[316,317],"img",{"alt":318,"src":319},"The Add suppliers drawer in blacklens.io: a URL, an e-mail address and a subdomain become domains, a duplicate and an IP address are rejected","\u002Fimages\u002Finsights\u002Fnis2-lieferkette-lieferanten-laufend-uberwachen-2.webp",[302,321,323],{"id":322},"rating-and-baseline","Rating and baseline",[11,325,326],{},"Each supplier gets a grade from A to F and a score from 0 to 100 across nine rating areas, from software patching to e-mail and DNS security. The first rating starts automatically and is the baseline; a new one follows every 7 days. Areas that cannot be measured do not count as 0. Every finding states what was found and how to fix it; pass it on as a CSV export or Supplier Report (PDF).",[11,328,329,330,334],{},"In the demo workspace, a managed service provider rated Critical, which runs the Microsoft 365 tenant, operates a VPN gateway with ",[331,332,333],"code",{},"CVE-2024-3400",", in the CISA KEV catalogue since April 2024. While the finding stands, the grade is capped at D. Without the cap, it would be a C.",[11,336,337],{},[316,338],{"alt":339,"src":340},"Demo supplier in blacklens.io: grade capped at D, below it the finding CVE-2024-3400 with what was found and how to fix it","\u002Fimages\u002Finsights\u002Fnis2-lieferkette-lieferanten-laufend-uberwachen-3.webp",[302,342,344],{"id":343},"alerts-and-the-weekly-review","Alerts and the weekly review",[11,346,347,348,351],{},"When a rating is worse than the last, the alert ",[35,349,350],{},"Supplier risk increased"," reports it by e-mail, push or to Microsoft Teams, Slack, Jira or ServiceNow. Triggers are a lower grade, a new known exploited vulnerability, a new critical finding or a ransomware leak-site listing. For Critical suppliers, severity rises to High. A falling score without a grade change raises no alert.",[11,353,354],{},[316,355],{"alt":356,"src":357},"Supplier risk increased alert with severity High: demo supplier dropped from B to D with a new known exploited vulnerability","\u002Fimages\u002Finsights\u002Fnis2-lieferkette-lieferanten-laufend-uberwachen-4.webp",[11,359,360,361,364,365,368],{},"For the weekly review, the supplier list shows the grade distribution, the last seven days' changes and tiles such as ",[35,362,363],{},"At risk"," (grade D or F). BQL filters such as ",[331,366,367],{},"criticality = critical and kev_findings > 0"," find critical suppliers with known exploited vulnerabilities. The ransomware watchlist also checks leak sites, about every 30 minutes.",[302,370,372],{"id":371},"evidence","Evidence",[11,374,21,375,378],{},[35,376,377],{},"Supply Chain Report"," summarises the last 30 days of the portfolio as a PDF, with changes, risk concentrations and required action, one-off or scheduled monthly to fixed recipients. With the rating and alert history, it provides evidence for NIS2 and DORA.",[11,380,381,382,386],{},"blacklens.io does not cover questionnaires, self-assessments or a supplier portal. Each workspace licence includes five suppliers, and the 14-day trial includes ",[23,383,385],{"href":384},"\u002Fen\u002Fplatform\u002Fsupplier-risk-rating","supplier risk rating",". The outside view makes sure the next questionnaire asks the right questions.",{"title":388,"searchDepth":389,"depth":389,"links":390},"",3,[391,393,394,395,396,397],{"id":17,"depth":392,"text":18},2,{"id":80,"depth":392,"text":81},{"id":132,"depth":392,"text":133},{"id":215,"depth":392,"text":216},{"id":261,"depth":392,"text":262},{"id":291,"depth":392,"text":292,"children":398},[399,400,401,402],{"id":304,"depth":389,"text":305},{"id":322,"depth":389,"text":323},{"id":343,"depth":389,"text":344},{"id":371,"depth":389,"text":372},"guide","2026-11-04","Supply chain security under NIS2: what Austria's NISG 2026 and Germany's BSIG require, where questionnaires end and how to monitor suppliers continuously.",false,"md",[409,412,415],{"q":410,"a":411},"How often do suppliers have to be assessed under NIS2?","NIS2 sets no fixed interval for assessing suppliers. Article 21 does require organisations to take into account the vulnerabilities specific to each direct supplier, which presupposes knowing their current state. For digital providers such as cloud and managed service providers, Implementing Regulation (EU) 2024\u002F2690 explicitly requires monitoring and evaluating changes in suppliers' cybersecurity practices. A workable combination is a questionnaire or audit for critical suppliers once a year, plus an outside-in rating that measures again every week.",{"q":413,"a":414},"What should you do when a supplier's security rating drops?","When a supplier's security rating drops, the reason sets the urgency. A known exploited vulnerability or a listing on a ransomware leak site calls for a response within days, while a missing DMARC policy belongs in the next supplier review. Send the supplier's security contact the specific finding with system, date and remediation advice, check in parallel what access the supplier has to your systems, and record contact, answer and decision as evidence.",{"q":416,"a":417},"How does blacklens.io monitor supplier security?","The Supply Chain Monitoring module in blacklens.io rates every supplier from the outside by its domain, with nothing for the supplier to install or approve. Each supplier receives a grade from A to F and a score from 0 to 100 across nine rating areas and is re-rated every 7 days. When a rating gets worse, the alert \"Supplier risk increased\" reports it by e-mail, push or integration. blacklens.io does not cover questionnaires or self-assessments.","\u002Fimages\u002Finsights\u002Fnis2-lieferkette-lieferanten-laufend-uberwachen.webp","Supplier list in blacklens.io with the A to F grade distribution, risk tiles and fictional demo suppliers","en",null,{},true,"\u002Fen\u002Finsights\u002Fnis2-lieferkette-lieferanten-laufend-uberwachen",6,{"title":5,"description":405},{"loc":424,"images":428},[429,430,431],{"loc":319},{"loc":340},{"loc":357},"en\u002Finsights\u002Fnis2-lieferkette-lieferanten-laufend-uberwachen",[434],"Guide","nis2-lieferkette-lieferanten-laufend-uberwachen","TlbMtKdts05TT42a1sUEUi4OxMGRzs_ppMPZypu3wng",[438,858,1214],{"id":439,"title":440,"author":6,"body":441,"category":834,"date":835,"description":836,"draft":406,"extension":407,"faq":837,"image":846,"imageAlt":847,"lang":420,"legacyUrl":421,"meta":848,"navigation":423,"path":849,"readingTime":850,"seo":851,"sitemap":852,"stem":853,"tags":854,"translation":856,"updated":421,"__hash__":857},"insightsEn\u002Fen\u002Finsights\u002Fhttp2shell-brotli-lucke-jenseits-von-node-js.md","HTTP2Shell: the Brotli flaw reaches far beyond Node.js",{"type":8,"value":442,"toc":825},[443,455,459,477,481,484,600,615,619,630,645,652,656,698,710,714,726,733,737,740,805,809,822],[11,444,445,446,449,450,454],{},"On 23 October, Node2Shell became HTTP2Shell – a new name, not a new flaw. It still means ",[331,447,448],{},"CVE-2026-111497"," in the Brotli decoder, whose consequences for Node.js are covered in ",[23,451,453],{"href":452},"\u002Fen\u002Finsights\u002Fnode2shell-warum-node-patchen-nicht-reicht","yesterday's post",". What is new is how far the same library reaches: into Python packages, Bun, Envoy, curl and Git for Windows. There it becomes dangerous under one condition that many warnings leave out. The software has to decompress Brotli data from an untrusted source.",[15,456,458],{"id":457},"what-is-http2shell","What is HTTP2Shell?",[11,460,461,462,464,465,468,469,472,473,476],{},"HTTP2Shell is the name the security firm Aikido gave, on 23 October 2026, to the reach of ",[331,463,448],{}," beyond Node.js: an out-of-bounds write in Google's Brotli decoder, affecting releases 1.0.3 to 1.2.0. The name shifts the focus from the runtime to the protocol. Any software that decompresses Brotli-compressed HTTP data can be affected. The bug, the fix and the corrected releases ",[331,466,467],{},"1.0.10",", ",[331,470,471],{},"1.1.1"," and ",[331,474,475],{},"1.2.1"," are the same as on 21 October. Google itself issued the CVE record.",[15,478,480],{"id":479},"who-is-affected-and-under-which-condition","Who is affected – and under which condition",[11,482,483],{},"Software is affected only if it contains a vulnerable Brotli release and uses it to decompress data an attacker can supply. For most of the projects now being named, exactly that is optional:",[143,485,486,499],{},[146,487,488],{},[149,489,490,493,496],{},[152,491,492],{},"Component",[152,494,495],{},"Affected if",[152,497,498],{},"Fix",[159,500,501,523,542,564,586],{},[149,502,503,512,515],{},[164,504,505,506,468,509],{},"Python ",[331,507,508],{},"brotli",[331,510,511],{},"brotlicffi",[164,513,514],{},"requests, httpx or aiohttp find them installed",[164,516,517,519,520],{},[331,518,475],{}," or ",[331,521,522],{},"1.2.1.0",[149,524,525,528,537],{},[164,526,527],{},"Bun",[164,529,530,519,533,536],{},[331,531,532],{},"fetch",[331,534,535],{},"node:zlib"," decodes Brotli",[164,538,539],{},[331,540,541],{},"1.4.4",[149,543,544,547,550],{},[164,545,546],{},"Envoy",[164,548,549],{},"the Brotli decompressor is configured",[164,551,552,468,555,468,558,468,561],{},[331,553,554],{},"1.37.8",[331,556,557],{},"1.38.6",[331,559,560],{},"1.39.3",[331,562,563],{},"1.40.0",[149,565,566,569,575],{},[164,567,568],{},"Istio",[164,570,571,572],{},"Brotli decompression is enabled, e.g. via ",[331,573,574],{},"EnvoyFilter",[164,576,577,468,580,468,583],{},[331,578,579],{},"1.29.9",[331,581,582],{},"1.30.6",[331,584,585],{},"1.31.2",[149,587,588,591,597],{},[164,589,590],{},"curl, libcurl",[164,592,593,594],{},"built with Brotli and run with ",[331,595,596],{},"--compressed",[164,598,599],{},"update the Brotli library or the build",[11,601,602,603,606,607,610,611,614],{},"For Python, GitHub published a separate advisory on 22 October, ",[331,604,605],{},"GHSA-9v8h-qqgm-4m35",". The packages often enter an environment as an indirect dependency. Istio shipped the fix on 15 October, before disclosure. Copies built into a program need a new build: Git for Windows ",[331,608,609],{},"2.56.0.windows.3",", released on 22 October, still lists ",[331,612,613],{},"brotli 1.2.0-1"," in its package list.",[15,616,618],{"id":617},"server-and-client-direction-decides","Server and client: direction decides",[11,620,621,622,625,626,629],{},"The flaw works in both directions, and the second is easy to miss. On the server side, an application decompresses Brotli-compressed requests – in Node.js, for example, through the Express 5 parsers. On the client side, it decompresses the response of a server it calls itself. Bun and Node's ",[331,623,624],{},"fetch()"," do this automatically; urllib3, and with it requests, does so based on the response's ",[331,627,628],{},"Content-Encoding",".",[11,631,632,633,636,637,640,641,644],{},"On the client side, an attacker does not need to attack a server. They need to run one. Every feature that fetches an external address is such a route: webhooks, link previews, avatar imports, a ",[331,634,635],{},"git clone"," from an unknown server. A test published by the blog lilting.ch on 24 October shows urllib3 decoding a Brotli response even when the client asked for no compression with ",[331,638,639],{},"Accept-Encoding: identity",". A reverse proxy that rejects requests carrying ",[331,642,643],{},"Content-Encoding: br"," does not protect this direction.",[11,646,647,648,651],{},"Bun's advisory states explicitly that there is no process-wide workaround; individual calls can be protected with ",[331,649,650],{},"decompress: false",". The common web servers, on the other hand, are rarely the route. Apache and nginx compress with Brotli but, according to Aikido, do not decompress by default.",[15,653,655],{"id":654},"version-numbers-do-not-show-the-fix","Version numbers do not show the fix",[11,657,658,659,472,662,665,666,669,670,673,674,677,678,681,682,685,686,689,690,693,694,697],{},"Whether a component contains the fix cannot be read reliably from its Brotli version string. In ",[331,660,661],{},"24.22.1",[331,663,664],{},"26.12.1",", Node.js took over only the fix commit. The version file in its source tree still says ",[331,667,668],{},"1.2.0",", in ",[331,671,672],{},"22.23.4"," it says ",[331,675,676],{},"1.1.0",", and ",[331,679,680],{},"process.versions.brotli"," reports those values. Debian backported the fix: ",[331,683,684],{},"1.0.9-2+deb12u1"," for Bookworm (",[331,687,688],{},"DLA-4855-1",") and ",[331,691,692],{},"1.1.0-2+deb13u1"," for Trixie (",[331,695,696],{},"DSA-6582-1","), both dated 23 October. Anyone comparing only the upstream version will report patched systems as vulnerable.",[11,699,700,701,704,705,709],{},"Then there is the timeline. The fix commit ",[331,702,703],{},"0ed4268"," has been public in the Brotli repository since 27 February 2026, described as \"Detect and report invalid stream earlier.\" A release followed only on 21 October. For almost eight months the correction sat in the source code, but in no release that distributions and package managers ship. It was a silent fix, like Fortinet's recent ",[23,706,708],{"href":707},"\u002Fen\u002Finsights\u002Ffortinet-hardening-release-patchen-ohne-advisory","hardening release",", only longer.",[15,711,713],{"id":712},"how-critical-the-flaw-really-is","How critical the flaw really is",[11,715,716,717,721,722,725],{},"The situation has not escalated since 21 October; it has become clearer. It is now known where the decoder sits, and there are still no known attacks. Google rates the flaw ",[23,718,720],{"href":719},"\u002Fen\u002Fwissen\u002Fcvss","CVSS"," 9.2 under version 4.0, but the vector contains ",[331,723,724],{},"AT:P",": a successful attack depends on specific deployment conditions of the system. Others rate it lower. Node.js and Bun call it \"high\", Amazon Linux scores it 8.1 under CVSS 3.1, and Ubuntu gives it priority \"medium\".",[11,727,728,729,732],{},"CISA's assessment in the CVE record reads \"none\" for exploitation and \"no\" for automatable. As of 24 October, the flaw is not in the ",[23,730,731],{"href":100},"KEV catalogue",". The only documented code execution remains Imperva's exploit against Node.js, which did not succeed on every attempt. Since 21 October, more than 30 repositories with proofs of concept, test labs and check scripts for the CVE have appeared on GitHub. Whether any of them is a reliable exploit is unknown.",[15,734,736],{"id":735},"what-to-do-now","What to do now",[11,738,739],{},"The work shifts from asking about the version to asking who decompresses untrusted data:",[29,741,742,758,771,777,783,789],{},[32,743,744,747,748,472,750,752,753,472,755,757],{},[35,745,746],{},"Check Python environments",", not just the project files. Bring ",[331,749,508],{},[331,751,511],{}," to ",[331,754,475],{},[331,756,522],{},", in container images too.",[32,759,760,763,764,767,768,770],{},[35,761,762],{},"Rebuild embedded copies."," According to Bun, programs built with ",[331,765,766],{},"bun build --compile"," stay vulnerable until rebuilt with ",[331,769,541],{},". The same applies to statically linked curl.",[32,772,773,776],{},[35,774,775],{},"Search proxy configurations."," Envoy and Istio reach the decoder only with an active Brotli decompressor; where one is configured, the update comes first.",[32,778,779,782],{},[35,780,781],{},"Include outbound requests."," Services that fetch user-supplied addresses decompress responses from servers they do not control.",[32,784,785,788],{},[35,786,787],{},"Update distribution packages"," and restart processes. As of 24 October, Ubuntu lists the flaw as \"needs evaluation\" and Amazon Linux 2023 its Brotli package as \"pending fix\". Dynamically linked programs such as curl benefit from the library update without a release of their own.",[32,790,791,794,795,797,798,800,801,804],{},[35,792,793],{},"Check version findings against the fix level."," Brotli ",[331,796,668],{}," in Node ",[331,799,661],{},", or ",[331,802,803],{},"1.0.9"," in Debian Bookworm, is not a finding.",[15,806,808],{"id":807},"what-helps-and-why-visibility-decides","What helps – and why visibility decides",[11,810,811,812,816,817,821],{},"With HTTP2Shell, what matters is less which Brotli version is installed than which systems decompress untrusted data: public APIs, proxies, services that fetch user-supplied addresses. Through ",[23,813,815],{"href":814},"\u002Fen\u002Fplatform\u002Fattack-surface-management","Attack Surface Management",", blacklens.io continuously discovers from the outside which services and web applications are reachable and which technologies, in which versions, run on them. The ",[23,818,820],{"href":819},"\u002Fen\u002Fplatform\u002Femerging-threats","Threat Center"," matches new CVEs against that inventory in real time and shows for each hit whether it rests on the exact version or only on the product.",[11,823,824],{},"The limit is narrower here than with Node2Shell. The CVE record names only Brotli as the affected product, a library that no service displays to the outside. What can be recognised are its carriers, such as Node.js applications and proxies. A Brotli package in a Python environment or a compiled program is found only by a check on the system. From the outside, you can narrow down where that check is needed first.",{"title":388,"searchDepth":389,"depth":389,"links":826},[827,828,829,830,831,832,833],{"id":457,"depth":392,"text":458},{"id":479,"depth":392,"text":480},{"id":617,"depth":392,"text":618},{"id":654,"depth":392,"text":655},{"id":712,"depth":392,"text":713},{"id":735,"depth":392,"text":736},{"id":807,"depth":392,"text":808},"threat","2026-10-24","HTTP2Shell is not a new flaw but CVE-2026-111497 in any software with a Brotli decoder. Who is affected, and why the version number misleads.",[838,840,843],{"q":458,"a":839},"HTTP2Shell is a name for CVE-2026-111497, an out-of-bounds write in Google's Brotli decoder in releases 1.0.3 to 1.2.0. The security firm Aikido introduced it on 23 October 2026 because the flaw affects not only Node.js, where it became known as Node2Shell, but also Python packages, Bun, Envoy and curl. It is the same vulnerability with the same fixes: Brotli 1.0.10, 1.1.1 and 1.2.1.",{"q":841,"a":842},"Are Python requests and httpx affected by HTTP2Shell?","Python requests and httpx are affected only if the same environment has the brotli package before 1.2.1 or brotlicffi before 1.2.1.0 installed. Neither ships its own Brotli decoder; both use these packages as soon as they are present, in httpx's case for example through the httpx[brotli] extra. They then decode Brotli responses from the servers they call automatically. Whether the packages are installed is shown by the environment itself, not by the project's dependency list.",{"q":844,"a":845},"How does blacklens.io help with HTTP2Shell?","blacklens.io continuously discovers from the outside, through Attack Surface Management, which services, web applications and technologies are reachable, and the Threat Center matches new CVEs against that inventory in real time, stating for each hit whether it rests on the exact version or only on the product. For HTTP2Shell this shows where carriers such as Node.js applications and proxies are reachable. The Brotli library itself is not visible from the outside and is checked on the system.","\u002Fimages\u002Finsights\u002Fhttp2shell-brotli-lucke-jenseits-von-node-js.webp","A person at a laptop with their head in their hands, behind a world map of red dots covered in warning symbols",{},"\u002Fen\u002Finsights\u002Fhttp2shell-brotli-lucke-jenseits-von-node-js",5,{"title":440,"description":836},{"loc":849},"en\u002Finsights\u002Fhttp2shell-brotli-lucke-jenseits-von-node-js",[855],"Threat landscape","http2shell-brotli-lucke-jenseits-von-node-js","QM7BlnvG1GTFBh9srilBTou1foA7VuZNEjggsveJJ0w",{"id":859,"title":860,"author":6,"body":861,"category":834,"date":1193,"description":1194,"draft":406,"extension":407,"faq":1195,"image":1205,"imageAlt":1206,"lang":420,"legacyUrl":421,"meta":1207,"navigation":423,"path":452,"readingTime":850,"seo":1208,"sitemap":1209,"stem":1210,"tags":1211,"translation":1212,"updated":835,"__hash__":1213},"insightsEn\u002Fen\u002Finsights\u002Fnode2shell-warum-node-patchen-nicht-reicht.md","Node2Shell: why patching Node alone is not enough",{"type":8,"value":862,"toc":1185},[863,869,873,882,894,898,909,919,923,932,978,991,995,1031,1110,1112,1115,1166,1168,1182],[11,864,865,866,868],{},"Node.js published security updates for ten vulnerabilities on 21 October 2026. The most severe, ",[331,867,448],{},", allows remote code execution through crafted Brotli data. But the faulty code is not in Node.js. It is in the compression library Node.js bundles – and that decides whether an updated Node version closes the hole at all.",[15,870,872],{"id":871},"what-node2shell-is","What Node2Shell is",[11,874,875,876,878,879,881],{},"Node2Shell is the name Imperva gave its 22 October analysis of ",[331,877,448],{},": an out-of-bounds write in the Brotli decoder that Node.js bundles in its 22.x, 24.x and 26.x lines. Node.js rates the flaw \"high\" and fixed it on 21 October. The CVE record is harsher: ",[23,880,720],{"href":719}," 9.2 under version 4.0, severity critical. Khai Tran and Sylvie Mayer of OpenAI Codex Security reported it; two members of the Node.js team wrote the fix.",[11,883,884,885,889,890,629],{},"The flaw landed on the same day as ",[23,886,888],{"href":887},"\u002Fen\u002Finsights\u002Fphp2shell-kritische-rce-lucken-in-php","PHP2Shell",", with the same score. Who reported them is worth noting: OpenAI researchers were among the reporters at PHP, and here it is that company's Codex Security team. The advisories do not say how much of this came from AI tooling – but AI vendors' security teams appearing in the acknowledgements has been routine since ",[23,891,893],{"href":892},"\u002Fen\u002Finsights\u002Fclaude-mythos-wenn-schwachstellen-schneller-kommen-als-patches","April",[15,895,897],{"id":896},"the-bug-is-in-brotli-not-in-nodejs","The bug is in Brotli, not in Node.js",[11,899,900,901,904,905,908],{},"The vulnerable code sits in the reference implementation of Brotli, Google's compression format, in ",[331,902,903],{},"c\u002Fdec\u002Fdecode.c",". While decompressing, the decoder checks whether a stream switches to a different block type. When that check reported an error, the responsible function did not pass it on along the fast decoding path: its callers had no return value for it. The decoder carried on with invalid internal state and wrote past its intended buffer. The CVE record files this as ",[331,906,907],{},"CWE-252",", unchecked return value. The fix makes those functions return a format error and aborts the stream.",[11,910,911,912,468,914,472,916,918],{},"What matters for the reach is the version range in the CVE record: Brotli releases 1.0.3 through 1.2.0 are affected \"on all platforms\", and what needs updating is \"any Brotli libraries or binaries\". The fixed releases are ",[331,913,467],{},[331,915,471],{},[331,917,475],{},", all published on 21 October. Node.js is the best-known consumer of that library, not the only one.",[15,920,922],{"id":921},"the-decoder-is-reachable-without-brotli-in-your-code","The decoder is reachable without Brotli in your code",[11,924,925,926,928,929,931],{},"An application does not have to call Brotli anywhere to reach the decoder. Imperva names three routes in: a direct call through ",[331,927,535],{},", Node's built-in ",[331,930,624],{},", which decompresses a Brotli response by itself, and the request parsers in Express 5.",[11,933,934,935,468,938,468,941,472,944,947,948,950,951,468,954,468,957,472,960,963,964,967,968,971,972,974,975,977],{},"The third route widens the attack surface most. The Express 5 migration guide lists Brotli decompression as an improvement that needs no migration step: ",[331,936,937],{},"express.json()",[331,939,940],{},"express.urlencoded()",[331,942,943],{},"express.text()",[331,945,946],{},"express.raw()"," accept ",[331,949,643],{},". body-parser documents that all parsers support \"automatic inflation\" of ",[331,952,953],{},"gzip",[331,955,956],{},"br",[331,958,959],{},"deflate",[331,961,962],{},"zstd","; the only option documented for it is ",[331,965,966],{},"inflate",", default ",[331,969,970],{},"true",". No switch for Brotli alone is documented. An application using ",[331,973,937],{}," that does not turn ",[331,976,966],{}," off therefore accepts Brotli bodies without that being visible in its own code. A bare HTTP server in Node, by contrast, does not decode incoming Brotli bodies merely by receiving them.",[11,979,980,981,984,985,987,988,629],{},"Imperva took this route to code execution: in the official Node image ",[331,982,983],{},"24.22.0"," for Linux\u002Farm64, a Brotli message created a file the test application had no code to create – with no debugger, but not on every attempt. ",[331,986,661],{}," rejected the same inputs. That is the only public demonstration so far. Neither Node.js nor Imperva reports attacks in the wild, and as of 23 October the flaw is not in the ",[23,989,990],{"href":100},"CISA KEV catalogue",[15,992,994],{"id":993},"why-a-patched-node-version-is-not-enough","Why a patched Node version is not enough",[11,996,997,998,1001,1002,1004,1005,1008,1009,1011,1012,1014,1015,1018,1019,685,1021,689,1023,693,1025,1027,1028,629],{},"Whether ",[331,999,1000],{},"node -v"," shows a corrected release settles the question only where Node uses its own Brotli code. Debian's package does not. Its security tracker notes on ",[331,1003,448],{}," that ",[331,1006,1007],{},"nodejs"," uses the system-provided Brotli library, and lists both packages accordingly: ",[331,1010,508],{}," as \"vulnerable\" and ",[331,1013,1007],{}," at urgency \"unimportant\". On those systems only the Brotli package closes the hole. When this post was published on the morning of 23 October, it was not available there. ",[35,1016,1017],{},"Update of 24 October:"," later that day Debian shipped ",[331,1020,684],{},[331,1022,688],{},[331,1024,692],{},[331,1026,696],{},"); the fix for Sid is still pending. How far the same flaw reaches beyond Node.js is covered in the follow-up on ",[23,1029,1030],{"href":849},"HTTP2Shell",[143,1032,1033,1045],{},[146,1034,1035],{},[149,1036,1037,1039,1042],{},[152,1038,492],{},[152,1040,1041],{},"Fixed release",[152,1043,1044],{},"Note",[159,1046,1047,1059,1071,1083,1094],{},[149,1048,1049,1052,1056],{},[164,1050,1051],{},"Node.js 26.x",[164,1053,1054],{},[331,1055,664],{},[164,1057,1058],{},"current line",[149,1060,1061,1064,1068],{},[164,1062,1063],{},"Node.js 24.x",[164,1065,1066],{},[331,1067,661],{},[164,1069,1070],{},"current LTS",[149,1072,1073,1076,1080],{},[164,1074,1075],{},"Node.js 22.x",[164,1077,1078],{},[331,1079,672],{},[164,1081,1082],{},"LTS",[149,1084,1085,1088,1091],{},[164,1086,1087],{},"Node.js 20.x and older",[164,1089,1090],{},"no fix",[164,1092,1093],{},"end of life, always affected per the advisory",[149,1095,1096,1099,1107],{},[164,1097,1098],{},"Brotli library",[164,1100,1101,468,1103,468,1105],{},[331,1102,467],{},[331,1104,471],{},[331,1106,475],{},[164,1108,1109],{},"decisive where Node uses the system library",[15,1111,736],{"id":735},[11,1113,1114],{},"These steps differ from an ordinary update in one respect: the Node version alone does not decide the exposure.",[29,1116,1117,1123,1133,1139,1154,1160],{},[32,1118,1119,1122],{},[35,1120,1121],{},"Update the runtimes"," and restart the processes afterwards. A running process keeps the old decoder in memory.",[32,1124,1125,1128,1129,1132],{},[35,1126,1127],{},"Check the Brotli library as well"," wherever Node comes from a distribution package. There, ",[331,1130,1131],{},"libbrotli"," is the binding version, not Node's.",[32,1134,1135,1138],{},[35,1136,1137],{},"Check every image individually",", not just the host. Version numbers go stale fastest in container images and appliances with a built-in runtime; a host package list does not show them.",[32,1140,1141,1144,1145,1148,1149,472,1151,1153],{},[35,1142,1143],{},"Limit Brotli traffic from unknown sources"," while the update waits. ",[331,1146,1147],{},"inflate: false"," rejects ",[331,1150,953],{},[331,1152,959],{}," too and may break existing clients; a limit on the affected paths, at the web server or in the web application firewall, is the narrower cut.",[32,1155,1156,1159],{},[35,1157,1158],{},"Do not lose sight of the other nine flaws."," The 21 October release fixes ten CVEs, three more of them rated \"high\": truncated DNS names containing a NUL character, and two bypasses of the TLS hostname check.",[32,1161,1162,1165],{},[35,1163,1164],{},"Do not read decoder errors as proof."," Crashed processes and decoder errors on their own are not a reliable sign of an attack, as Imperva points out. They carry weight only together with the release actually deployed and the origin of the compressed data.",[15,1167,808],{"id":807},[11,1169,1170,1171,1173,1174,1178,1179,1181],{},"The question on the day of an update like this is not how to update Node.js, but where a runtime is running at all. Through ",[23,1172,815],{"href":814},", blacklens.io continuously discovers from the outside which services and web applications are reachable and which technologies, in which versions, run on them; internal systems are covered by the ",[23,1175,1177],{"href":1176},"\u002Fen\u002Fplatform\u002Fsentry","Sentry Agent",". The ",[23,1180,820],{"href":819}," matches new CVEs against that inventory in real time and shows whether a hit rests on the exact version or only on the product.",[11,1183,1184],{},"One limit belongs in the picture: which Brotli library a Node process has loaded is not something any service reveals from the outside. That check stays on the system – which systems it applies to can be answered beforehand.",{"title":388,"searchDepth":389,"depth":389,"links":1186},[1187,1188,1189,1190,1191,1192],{"id":871,"depth":392,"text":872},{"id":896,"depth":392,"text":897},{"id":921,"depth":392,"text":922},{"id":993,"depth":392,"text":994},{"id":735,"depth":392,"text":736},{"id":807,"depth":392,"text":808},"2026-10-23","Node2Shell exploits a flaw in the Brotli decoder that Node.js bundles. The fix ships in Node 22.23.4, 24.22.1 and 26.12.1 – and in Brotli itself.",[1196,1199,1202],{"q":1197,"a":1198},"What is Node2Shell?","Node2Shell is the name the security firm Imperva gave its analysis of CVE-2026-111497, an out-of-bounds write in the Brotli decoder that Node.js bundles. An attacker who can send crafted Brotli data to an application that decompresses it can overwrite memory and, in the end, run their own code. Node.js fixed the flaw on 21 October 2026; the CVE record rates it CVSS 9.2 under version 4.0.",{"q":1200,"a":1201},"Which versions close CVE-2026-111497?","Node.js ships the fix in 22.23.4, 24.22.1 and 26.12.1; the 20.x line and older are end of life and will not receive it. The faulty code comes from the Brotli library, however, which is fixed in 1.0.10, 1.1.1 and 1.2.1. Where Node uses the system Brotli library, as the Debian package does, that library's version decides the matter, not the output of node -v.",{"q":1203,"a":1204},"Is my application affected if it does not use Brotli?","Possibly, yes. The decoder is also reached without Brotli appearing anywhere in your own source. Node's built-in fetch() decompresses Brotli responses by itself, and the request parsers in Express 5 and body-parser 2 accept Brotli bodies as long as the inflate option sits at its default of true. A bare Node HTTP server, according to Imperva, does not decode incoming Brotli bodies merely by receiving them.","\u002Fimages\u002Finsights\u002Fnode2shell-warum-node-patchen-nicht-reicht.webp","Brightly coloured lines of source code on a dark screen, photographed at an angle",{},{"title":860,"description":1194},{"loc":452},"en\u002Finsights\u002Fnode2shell-warum-node-patchen-nicht-reicht",[855],"node2shell-warum-node-patchen-nicht-reicht","4v3d9D542yTKcAPksT30uUYA4p9-Nducsghmqi7awZs",{"id":1215,"title":1216,"author":6,"body":1217,"category":834,"date":1458,"description":1459,"draft":406,"extension":407,"faq":1460,"image":1470,"imageAlt":1471,"lang":420,"legacyUrl":421,"meta":1472,"navigation":423,"path":707,"readingTime":850,"seo":1473,"sitemap":1474,"stem":1475,"tags":1476,"translation":1477,"updated":421,"__hash__":1478},"insightsEn\u002Fen\u002Finsights\u002Ffortinet-hardening-release-patchen-ohne-advisory.md","Fortinet hardening release: patching without an advisory",{"type":8,"value":1218,"toc":1449},[1219,1222,1226,1235,1310,1329,1333,1336,1349,1353,1359,1362,1366,1369,1377,1379,1382,1408,1411,1415,1430,1432,1444],[11,1220,1221],{},"Fortinet is shipping security updates for FortiOS, FortiManager and FortiAnalyzer on 22 October 2026, a day after FortiMail and FortiAuthenticator. Rated critical and high severity — but with no CVE id, no CVSS score and no description of the attack. The advisories only follow on 10 November. Anyone patching this week is closing holes they cannot name.",[15,1223,1225],{"id":1224},"what-fortinet-shipped-on-22-october","What Fortinet shipped on 22 October",[11,1227,1228,1229,1234],{},"The security hardening release is a bundled set of security updates for five product lines, announced on 21 October 2026 by Fortinet CISO Carl Windsor on ",[23,1230,1233],{"href":1231,"rel":1232},"https:\u002F\u002Fwww.fortinet.com\u002Fblog\u002Fciso-collective\u002Ffortinet-releases-security-hardening-release-for-multiple-products",[43],"Fortinet's CISO blog",". On the contents, one sentence: \"These releases include critical and high-severity fixes.\"",[143,1236,1237,1250],{},[146,1238,1239],{},[149,1240,1241,1244,1247],{},[152,1242,1243],{},"Branch",[152,1245,1246],{},"FortiOS",[152,1248,1249],{},"FortiManager and FortiAnalyzer",[159,1251,1252,1266,1280,1295],{},[149,1253,1254,1257,1262],{},[164,1255,1256],{},"8.0",[164,1258,1259],{},[331,1260,1261],{},"8.0.2",[164,1263,1264],{},[331,1265,1261],{},[149,1267,1268,1271,1276],{},[164,1269,1270],{},"7.6",[164,1272,1273],{},[331,1274,1275],{},"7.6.8",[164,1277,1278],{},[331,1279,1275],{},[149,1281,1282,1285,1290],{},[164,1283,1284],{},"7.4",[164,1286,1287],{},[331,1288,1289],{},"7.4.13",[164,1291,1292],{},[331,1293,1294],{},"7.4.12",[149,1296,1297,1300,1305],{},[164,1298,1299],{},"7.2",[164,1301,1302],{},[331,1303,1304],{},"7.2.14",[164,1306,1307],{},[331,1308,1309],{},"7.2.13",[11,1311,1312,1313,468,1315,472,1318,1321,1322,472,1325,1328],{},"Everything below each fixed version is affected. FortiMail is fixed in ",[331,1314,1261],{},[331,1316,1317],{},"7.6.7",[331,1319,1320],{},"7.4.9",", FortiAuthenticator in ",[331,1323,1324],{},"8.0.4",[331,1326,1327],{},"6.6.11","; FortiMail 7.2 gets no fix and has to move to the 7.4 branch. Fortinet updates FortiSASE itself, while FortiManager Cloud may need a manual step.",[15,1330,1332],{"id":1331},"why-there-are-no-cve-ids","Why there are no CVE ids",[11,1334,1335],{},"The advisories only appear at the next Patch Tuesday, 10 November, on the advisory page of Fortinet's Product Security Incident Response Team — part of an \"ongoing commitment to responsible transparency while balancing customer security\".",[11,1337,1338,1339,1344,1345,1348],{},"The origin of the flaws explains the bundling: not outside researchers, but Fortinet's own AI-assisted testing programme, with thanks to Anthropic, OpenAI, Google and SpaceX for the collaboration. Windsor ",[23,1340,1343],{"href":1341,"rel":1342},"https:\u002F\u002Fwww.fortinet.com\u002Fblog\u002Fciso-collective\u002Fupdate-on-fortinet-use-of-frontier-ai",[43],"described the process in June 2026",": frontier models review the source code against a threat model of the firmware built beforehand; what survives is validated in penetration testing. Of the source-code findings from more than 100 tests across 30 product families, 40 per cent were true positives and 30 per cent false positives. What ",[23,1346,1347],{"href":892},"Claude Mythos"," sketched out in April now arrives as a firmware update.",[15,1350,1352],{"id":1351},"a-patch-without-a-cve-id-is-invisible-to-scanners-and-policies","A patch without a CVE id is invisible to scanners and policies",[11,1354,1355,1356,1358],{},"Vulnerability scanners, patch policies and ticket systems all work from CVE ids. Without the id, everything attached to it is missing too: no NVD entry, no EPSS score, no entry in the ",[23,1357,990],{"href":100},", no CVSS score for a patch policy to trigger on. A change request that normally draws its justification from a CVE id and a severity rating has nothing but the vendor announcement for 19 days.",[11,1360,1361],{},"The question shifts: no longer which CVE affects us, but which version runs on which reachable device, and whether it is older than the fixed one. The risk assessment loses its basis too: nothing can be said about attack prerequisites or exploitability before 10 November. What remains is reachability from outside: a FortiManager sitting on the internet is the problem, with or without a CVE id.",[15,1363,1365],{"id":1364},"patch-diffing-the-clock-starts-at-release","Patch diffing: the clock starts at release",[11,1367,1368],{},"The head start withholding the advisories is meant to create applies only to readers, not to attackers who compare. Fortinet names the risk itself: once the update is public, the fix shows where the code changed. Per the June post, this is exactly what the models excel at — \"analyzing firmware, assessing changes between versions, and developing proof-of-concept exploits\". Fortinet expects exploits in hours or days rather than weeks; the FortiGuard 2026 report puts time to exploit for critical outbreaks at 24 to 48 hours, down from 4.76 days on average in 2024.",[11,1370,1371,1372,1376],{},"That Fortinet devices are a preferred target is on record: the CISA KEV catalogue held 32 entries for Fortinet products as of 21 October 2026, two of them added this month. ",[23,1373,1375],{"href":1374},"\u002Fen\u002Finsights\u002Ffortibleed-wenn-zehntausende-firewalls-zur-offenen-tur-werden","FortiBleed"," showed how methodically attackers work through exposed management interfaces. No exploitation is known for the flaws in this release; Fortinet calls the fixes pre-emptive.",[15,1378,736],{"id":735},[11,1380,1381],{},"Fortinet recommends treating the release as a priority change rather than routine maintenance, and names four steps:",[29,1383,1384,1390,1396,1402],{},[32,1385,1386,1389],{},[35,1387,1388],{},"Inventory:"," identify every FortiManager installation and FortiOS instance, internet-facing ones first.",[32,1391,1392,1395],{},[35,1393,1394],{},"Maintenance windows:"," schedule 22 and 23 October for exposed systems.",[32,1397,1398,1401],{},[35,1399,1400],{},"Back up configurations:"," before the upgrade, not after.",[32,1403,1404,1407],{},[35,1405,1406],{},"Check logs:"," for unusual administrative access and unapproved configuration changes, before and after patching.",[11,1409,1410],{},"Where an immediate upgrade is not possible: restrict management access over HTTPS and SSH to trusted addresses, keep FortiManager off the internet entirely, and enforce MFA on every administrator account. Fortinet on that: \"These steps reduce risk but do not replace the need for a timely upgrade.\"",[15,1412,1414],{"id":1413},"not-to-be-confused-php2shell-runs-in-parallel","Not to be confused: PHP2Shell runs in parallel",[11,1416,1417,1418,1421,1422,1425,1426,1429],{},"The two PHP flaws from 21 October are not part of this release. Fortinet tracks them separately in advisory ",[331,1419,1420],{},"FG-IR-26-186"," and rates ",[331,1423,1424],{},"CVE-2026-109618"," critical at CVSS 9.8 there. According to an overview by Help Net Security on 22 October, Fortinet lists twelve products as not affected, among them FortiOS, FortiManager, FortiAnalyzer, FortiMail and FortiWeb, and twelve more as under review. Palo Alto Networks reports PAN-OS and Panorama as affected in all versions, still without a fix. Mechanism and immediate measures are in our ",[23,1427,1428],{"href":887},"PHP2Shell post",". Fortinet operators are running two separate patch tracks.",[15,1431,808],{"id":807},[11,1433,1434,1435,1437,1438,1440,1441,1443],{},"As long as the CVE ids are missing, the version inventory is the only solid basis. Through ",[23,1436,815],{"href":814},", blacklens.io records from the outside which services are reachable and which technologies run on them in which version; the inventory filters by vendor and product, and the ",[23,1439,1177],{"href":1176}," covers internal installations. That answers the question that matters this week: where is a version older than ",[331,1442,1275],{}," running, and is it reachable from the internet?",[11,1445,21,1446,1448],{},[23,1447,820],{"href":819}," matches new CVEs against that inventory in real time and shows whether a hit rests on the exact version or only on the product — for this release that starts on 10 November, because before then there are no ids to match. This week the release is an inventory question. The vulnerability question arrives in November.",{"title":388,"searchDepth":389,"depth":389,"links":1450},[1451,1452,1453,1454,1455,1456,1457],{"id":1224,"depth":392,"text":1225},{"id":1331,"depth":392,"text":1332},{"id":1351,"depth":392,"text":1352},{"id":1364,"depth":392,"text":1365},{"id":735,"depth":392,"text":736},{"id":1413,"depth":392,"text":1414},{"id":807,"depth":392,"text":808},"2026-10-22","Fortinet shipped critical fixes for FortiOS, FortiManager and FortiAnalyzer on 22 October 2026. The advisories with CVE ids only follow on 10 November.",[1461,1464,1467],{"q":1462,"a":1463},"What is Fortinet's October 2026 security hardening release?","The security hardening release is a bundled set of security updates that Fortinet shipped on 21 and 22 October 2026 for FortiMail, FortiAuthenticator, FortiOS, FortiManager and FortiAnalyzer. Fortinet rates the fixed flaws critical and high severity, but publishes no CVE ids, no CVSS scores and no attack prerequisites for now. The advisories are announced for 10 November 2026. The flaws came out of Fortinet's own AI-assisted testing programme.",{"q":1465,"a":1466},"Which Fortinet versions fix the vulnerabilities?","According to Fortinet's announcement the fixes ship in FortiOS 8.0.2, 7.6.8, 7.4.13 and 7.2.14, and in FortiManager and FortiAnalyzer 8.0.2, 7.6.8, 7.4.12 and 7.2.13. FortiMail is fixed in 8.0.2, 7.6.7 and 7.4.9, FortiAuthenticator in 8.0.4 and 6.6.11. FortiMail 7.2 gets no fix and has to move to the 7.4 branch. Fortinet updates FortiSASE itself; FortiManager Cloud may need a manual step.",{"q":1468,"a":1469},"Why is a patch without a CVE id a problem for vulnerability scanners?","A patch without a CVE id stays invisible to everything that steers vulnerabilities by CVE id: vulnerability scanners, patch policies, ticket systems. Without the id there is no NVD entry, no EPSS score, no CISA KEV status and no CVSS score for a patch policy to trigger on. Until the advisories appear, only the version comparison is left: which Fortinet version runs on which reachable system? A continuously updated technology inventory answers that question.","\u002Fimages\u002Finsights\u002Ffortinet-hardening-release-patchen-ohne-advisory.webp","Tablet showing the Fortinet website in front of a blurred monitor displaying source code",{},{"title":1216,"description":1459},{"loc":707},"en\u002Finsights\u002Ffortinet-hardening-release-patchen-ohne-advisory",[855],"fortinet-hardening-release-patchen-ohne-advisory","QyzVByPDaT-j8SlgBQrV6xv8fCW8Qn5_n4hTJ6WGhm8",1793792275234]