Morning Review in IT Security — October 27, 2026

October 27, 2026 brings critical security developments across multiple fronts, from nation-state bootkit campaigns targeting diplomatic organizations to widespread vulnerabilities in compression libraries affecting major software platforms. Organizations face urgent patching requirements and emerging exploitation activity that demands immediate attention.

Hackers Revive BlackLotus Techniques to Bypass Windows Secure Boot and Deploy Malware

A new bootkit campaign has emerged leveraging techniques associated with the BlackLotus bootkit to circumvent Windows Secure Boot protections. The newly identified BlackX bootkit was discovered in attacks targeting diplomatic agencies across Central Asia, specifically in Tajikistan, Uzbekistan, and Turkmenium during early 2026. Investigators have attributed the campaign to APT41 with medium confidence, though attribution remains incomplete at this stage. The campaign exploits CVE-2022-21894 to deploy espionage malware against high-value government targets. Source: Cyber Security News

The revival of BlackLotus techniques represents a significant threat to organizations relying on Secure Boot as a primary defense mechanism. The targeting of diplomatic organizations suggests a coordinated intelligence-gathering operation with state-level resources and sophistication.

Brotli2Shell: Critical Remote Code Execution in Google Brotli Decoder

CVE-2026-111497, known as Brotli2Shell, represents a critical out-of-bounds write vulnerability in Google's Brotli decoder library that enables remote code execution. The vulnerability scored 9.2 under CVSSv4.0 and affects a broad ecosystem of software including Node.js, .NET, Bun, Envoy Proxy, Istio, Python HTTP clients, FFmpeg, Apache Arrow, and ClickHouse. Public proofs-of-concept are available, and threat intelligence firm ELLIO reported an exploitation attempt against Node.js 24.22.0 on October 26 combining public PoC code with an original exploit chain. Source: Tenable

The vulnerability was disclosed on October 21 when Node.js published its security advisory, with Google releasing fixed Brotli versions the same day. Akamai telemetry indicates that 61 percent of networks are running affected Node.js versions, representing widespread exposure. Applications that bundle their own copy of Brotli require individual fixes, complicating remediation efforts. Patching does not affect already-running processes, necessitating restarts, container image rebuilds, and redeployments to fully address the vulnerability.

Apple Patches for October 2026

Apple released patches addressing 304 vulnerabilities on October 26, maintaining a consistent volume with prior update cycles and occurring approximately one month after the previous Apple security release. The patch batch includes multiple actively exploited vulnerabilities requiring immediate attention from Apple device users and administrators. Source: SANS Internet Storm Center

The scale of this update underscores the ongoing security challenges facing Apple's ecosystem and the importance of timely patch deployment across macOS, iOS, and related platforms.

LiteLLM Supply Chain Attack Started with an Exposed Master Key

The LiteLLM supply chain attack originated from an exposed master key that attackers leveraged to compromise the project and inject malicious code into the PyPI package repository. The incident demonstrates critical risks associated with failing to rotate potentially compromised cryptographic credentials. The attack delivered both information-stealing malware and remote access trojans through the compromised package, affecting downstream users of the LiteLLM library. Source: The Register

This incident highlights the vulnerability of open-source supply chains to credential compromise and the cascading impact such breaches can have across the software ecosystem.

As organizations navigate these threats, immediate action is required for CVE-2026-111497 patching, Apple security updates, and review of any dependencies on compromised open-source projects. The combination of nation-state bootkit campaigns, widespread decoder vulnerabilities, and supply chain attacks reflects a diverse threat landscape demanding comprehensive security responses.