CISA Issues Advisory on Siemens Desigo CC and Gridscale Products Affected by Critical Brotli Vulnerability

Siemens Warns of Critical RUGGEDCOM APE1808 Vulnerabilities Tied to PAN-OS PHP Flaws

Siemens has released an advisory detailing two high-severity vulnerabilities affecting the RUGGEDCOM APE1808 industrial device when running Palo Alto Networks PAN-OS software. The flaws, tracked as CVE-2026-109618 and CVE-2026-109619, both stem from Use After Free conditions in PHP handling of out-of-memory errors and global state management. Exploitation can lead to remote code execution with CVSS scores of 9.8 and 8.1 respectively. The issues impact all versions of PAN-OS from 10.2 through 12.2 when deployed on the RUGGEDCOM APE1808 platform. Siemens recommends upgrading to patched PAN-OS releases and implementing network segmentation as immediate defensive measures. CISA has republished the advisory to increase visibility across critical infrastructure sectors worldwide.

Critical Flaws in Red Hat Quay Expose All Private Container Images to Read and Overwrite Attacks

Red Hat has disclosed two critical vulnerabilities in its Quay container registry platform that allow attackers to read, overwrite, or delete private container images across all repositories. The first flaw, CVE-2026-123710 with a CVSS score of 9.8, enables an attacker to inject a persistent trusted signing key that bypasses authentication for any repository, even when anonymous access is disabled. The second issue, CVE-2026-110697 scoring 9.9, stems from an unescaped SQL LIKE pattern in robot account listing that lets any namespace creator steal decrypted tokens from other tenants. Both flaws affect every Quay 3 and Quay 5 release and impact standalone deployments, OpenShift-integrated registries, and the mirror registry. Red Hat recommends blocking the /keys endpoint at the proxy layer, auditing for suspicious service_key_rotate events, and restricting namespace creation containing underscores until patches are applied. The upstream fixes add token rotation validation, mandatory key expiry, and proper escaping for robot account searches.

SignDrop Zero-Day Exploit Abuses Windows CLFS Mitigation for SYSTEM Privileges

Security researcher Abdelhamid Naceri has publicly released a new Windows zero-day exploit named SignDrop that grants attackers SYSTEM-level privileges on vulnerable systems. The flaw stems from mitigations Microsoft introduced in October 2025 to address authentication attacks against the Common Log File System (CLFS) driver. Although the mitigation was intended to reduce CLFS-related exploits, its implementation introduced a logic flaw allowing privileged processes such as Windows Defender to be tricked into creating authentication files with SYSTEM permissions. Naceri demonstrated that the technique works against any antimalware engine's tamper protection because file creation requests appear to originate from the engine's own legitimate process. The exploit has been tested successfully on Windows 11 26H2, Windows 11 26H2 Experimental, and Windows Server 2025 Experimental, with an estimated 80 percent of Windows installations remaining vulnerable. No official patch is currently available, and disabling the mitigation would re-expose systems to prior memory corruption attacks in CLFS.