Published vulnerability verdicts and every change to them, newest first. 2026-11-09T00:00:00Z tag:exposure-focus,2026:feed Exposure Focus tag:exposure-focus,2026:cisco-asa 2026-11-09T00:00:00Z

A crafted request to the SSL remote access VPN can make a Cisco ASA or FTD firewall reload, with no login, when secondary authentication is configured on a tunnel group. It is being exploited. The only effect is an outage, not a breach, so it matters most where the VPN is business-critical. Current headline tier: Urgent. Evidence as of 2026-11-09

tag:exposure-focus,2026:http2shell 2026-11-09T00:00:00Z

A memory-corruption flaw in the Brotli decoder can let an attacker crash, read from or possibly run code in applications that decompress attacker-supplied Brotli data. CISA lists it as exploited, but no source reviewed reports code execution in the wild. It is rated Tier 3, an editorial call. Current headline tier: Prioritised. Evidence as of 2026-11-09 Some facts are not yet confirmed.

tag:exposure-focus,2026:linux-ipv4-tcp-uaf 2026-11-09T00:00:00Z

Red Hat says a race in the Linux kernel's IPv4 TCP code lets an unauthenticated remote attacker corrupt kernel memory. Researchers report remote root against servers with an MPTCP listener, but the exploit is not public and no exploitation is reported. Current headline tier: Urgent. Evidence as of 2026-11-09 Some facts are not yet confirmed.

tag:exposure-focus,2026:php2shell 2026-11-09T00:00:00Z

Two flaws in the PHP runtime itself let an attacker run code from an ordinary web request with no login. Both are being exploited, so internet-facing PHP needs an out-of-cycle response and internal-only PHP does not. Current headline tier: Emergency. Evidence as of 2026-11-09 Some facts are not yet confirmed.