# Exploited infrastructure, runtime fixes and the Binance incident

Canonical: https://www.oktsec.com/radar/brief/2026-10-30
Publisher: Oktsec
Language: en
Reporting period: 2026-10-26T00:00:00Z to 2026-10-30T10:26:59Z
Updated: 2026-10-30T10:26:59Z

This week brought new exploitation evidence, revised vendor fixes and Binance’s first findings on unauthorized withdrawals. Here are the material changes in Radar’s published coverage and the checks they require.

## Coverage at the cutoff

12 advisories covered: 8 new to Radar and 4 follow-ups. 10 Act now; 7 vulnerability advisories with known exploitation. Groups overlap. Counts describe editorial coverage, not incidents detected by Oktsec.

Cutoff: 2026-10-30T10:26:59Z. Linked advisories retain subsequent updates.

### All advisories

- [Cisco ASA/FTD: active exploitation can restart VPN devices](https://www.oktsec.com/radar/cisco-asa-ftd-cve-2026-76418) — Act now; new to Radar.
- [PHP2Shell: investigate from October 17](https://www.oktsec.com/radar/php2shell) — Act now; follow-up.
- [Linux: patch the kernel used by the PHP2Shell escalation chain](https://www.oktsec.com/radar/linux-kernel-cve-2026-46300) — Act now; new to Radar.
- [GitLab CI/CD: exploited regex compiler flaw allows code execution](https://www.oktsec.com/radar/gitlab-cve-2026-97229) — Act now; new to Radar.
- [VMware ESX: an administrator can hide operations from logs](https://www.oktsec.com/radar/vmware-esx-cve-2026-41709) — Act now; new to Radar.
- [Adobe Commerce and Magento: verify the July security patch](https://www.oktsec.com/radar/adobe-commerce-magento-cve-2026-48356) — Act now; new to Radar.
- [Brotli: patch runtimes and proxies that decode untrusted data](https://www.oktsec.com/radar/nodejs-brotli-cve-2026-111497) — Act now; follow-up.
- [Binance estimates $6.3 billion impact; preliminary findings point to DevOps access](https://www.oktsec.com/radar/binance-hot-wallet-drain-october-2026) — Review this week; new to Radar.
- [Strands environment tool: update and rotate credentials](https://www.oktsec.com/radar/strands-environment-cve-2026-115415) — Review this week; new to Radar.
- [Railway: replace stored secrets after the platform incident](https://www.oktsec.com/radar/railway-october-2026-secrets) — Act now; follow-up.
- [Sophos UTM: manual patch for root command execution](https://www.oktsec.com/radar/sophos-utm-cve-2026-118633) — Act now; new to Radar.
- [eMudhra: replace affected certificates and review application trust](https://www.oktsec.com/radar/emudhra-chrome-root-removal) — Act now; follow-up.

### Act now at cutoff

- [Cisco ASA/FTD: active exploitation can restart VPN devices](https://www.oktsec.com/radar/cisco-asa-ftd-cve-2026-76418) — Act now; new to Radar.
- [PHP2Shell: investigate from October 17](https://www.oktsec.com/radar/php2shell) — Act now; follow-up.
- [Linux: patch the kernel used by the PHP2Shell escalation chain](https://www.oktsec.com/radar/linux-kernel-cve-2026-46300) — Act now; new to Radar.
- [GitLab CI/CD: exploited regex compiler flaw allows code execution](https://www.oktsec.com/radar/gitlab-cve-2026-97229) — Act now; new to Radar.
- [VMware ESX: an administrator can hide operations from logs](https://www.oktsec.com/radar/vmware-esx-cve-2026-41709) — Act now; new to Radar.
- [Adobe Commerce and Magento: verify the July security patch](https://www.oktsec.com/radar/adobe-commerce-magento-cve-2026-48356) — Act now; new to Radar.
- [Brotli: patch runtimes and proxies that decode untrusted data](https://www.oktsec.com/radar/nodejs-brotli-cve-2026-111497) — Act now; follow-up.
- [Railway: replace stored secrets after the platform incident](https://www.oktsec.com/radar/railway-october-2026-secrets) — Act now; follow-up.
- [Sophos UTM: manual patch for root command execution](https://www.oktsec.com/radar/sophos-utm-cve-2026-118633) — Act now; new to Radar.
- [eMudhra: replace affected certificates and review application trust](https://www.oktsec.com/radar/emudhra-chrome-root-removal) — Act now; follow-up.

### Known exploitation at cutoff

- [Cisco ASA/FTD: active exploitation can restart VPN devices](https://www.oktsec.com/radar/cisco-asa-ftd-cve-2026-76418) — Act now; new to Radar.
- [PHP2Shell: investigate from October 17](https://www.oktsec.com/radar/php2shell) — Act now; follow-up.
- [Linux: patch the kernel used by the PHP2Shell escalation chain](https://www.oktsec.com/radar/linux-kernel-cve-2026-46300) — Act now; new to Radar.
- [GitLab CI/CD: exploited regex compiler flaw allows code execution](https://www.oktsec.com/radar/gitlab-cve-2026-97229) — Act now; new to Radar.
- [VMware ESX: an administrator can hide operations from logs](https://www.oktsec.com/radar/vmware-esx-cve-2026-41709) — Act now; new to Radar.
- [Adobe Commerce and Magento: verify the July security patch](https://www.oktsec.com/radar/adobe-commerce-magento-cve-2026-48356) — Act now; new to Radar.
- [Brotli: patch runtimes and proxies that decode untrusted data](https://www.oktsec.com/radar/nodejs-brotli-cve-2026-111497) — Act now; follow-up.

## Attacks against exposed infrastructure

Cisco confirmed active exploitation of ASA/FTD CVE-2026-76418: a reachable SSL VPN with secondary authentication can be forced to restart without a successful login. Separately, Palo Alto reports attacks against exposed management interfaces through PHP2Shell. CISA identifies a chain from the two original PHP CVEs to Linux kernel CVE-2026-46300 and root privileges.

What to check: Apply the correction for each deployed branch, restrict management access and verify the PHP workers and kernel actually running. PAN’s October 30 matrix lists 11.1.7-h12 without an ETA; confirm download availability. Keep the separate PHP session mitigation.

Advisory details (updated separately):

[Cisco ASA/FTD: active exploitation can restart VPN devices](https://www.oktsec.com/radar/cisco-asa-ftd-cve-2026-76418)

[PHP2Shell: investigate from October 17](https://www.oktsec.com/radar/php2shell)

[Linux: patch the kernel used by the PHP2Shell escalation chain](https://www.oktsec.com/radar/linux-kernel-cve-2026-46300)

## New exploitation evidence for GitLab, ESX and Commerce

CISA added GitLab CVE-2026-97229, VMware ESX CVE-2026-41709 and Adobe Commerce CVE-2026-48356 to KEV during this reporting period. The impacts differ: unauthenticated code execution in GitLab, operations missing from ESX logs when performed by a malicious administrator, and a Commerce flaw requiring its separate July security fix.

What to check: Install the latest supported GitLab patch and use the vendor’s detection guidance. Update ESX and review external telemetry. For Commerce, verify the patch itself, including cloud-patches delivery; a compatible base version is insufficient.

Advisory details (updated separately):

[GitLab CI/CD: exploited regex compiler flaw allows code execution](https://www.oktsec.com/radar/gitlab-cve-2026-97229)

[VMware ESX: an administrator can hide operations from logs](https://www.oktsec.com/radar/vmware-esx-cve-2026-41709)

[Adobe Commerce and Magento: verify the July security patch](https://www.oktsec.com/radar/adobe-commerce-magento-cve-2026-48356)

## Brotli fixes depend on the product

CISA listed CVE-2026-111497 as exploited on October 27. That evidence does not establish attacks against every product that bundles Brotli. PAN updated its corrected builds; AWS distinguishes Lambda runtime updates from the service itself. Solace reports Event Portal exposure resolved on October 28, while other product updates remain separate.

What to check: Check the exact PAN-OS branch. Rebuild and deploy affected Lambda containers and verify runtime patch identifiers; rollout targets do not prove completion. Follow the guidance for each Solace component.

Advisory details (updated separately):

[Brotli: patch runtimes and proxies that decode untrusted data](https://www.oktsec.com/radar/nodejs-brotli-cve-2026-111497)

## Binance reports a $6.3 billion estimated impact

Binance’s October 30 statement reports an estimated $6.3 billion impact and about $3 billion frozen. Preliminary findings suggest a compromised DevOps laptop enabled access to a service container and unauthorized withdrawals. The investigation remains open. Frozen funds are not confirmed recoveries or a basis for calculating net loss.

What to check: Review which workstations and services can authorize withdrawals, persistent delegations, independent approval requirements and revocation paths. Keep the preliminary access path separate from a completed technical postmortem.

Advisory details (updated separately):

[Binance estimates $6.3 billion impact; preliminary findings point to DevOps access](https://www.oktsec.com/radar/binance-hot-wallet-drain-october-2026)

## Credentials need a separate response

AWS warns that Strands Agents Tools can return credentials through the environment tool without masking them. Updating the package does not replace the credentials. Railway’s preliminary report separately confirmed that some encrypted environment variables were decrypted and recommended replacing sensitive variables stored before October 21.

What to check: For agents that loaded the environment tool, update strands-agents-tools to 0.8.6 or later and rotate the credentials present in those environments. Remove the tool if upgrading is delayed. For Railway, replace affected secrets, revoke old access and review use at the issuing service.

Advisory details (updated separately):

[Strands environment tool: update and rotate credentials](https://www.oktsec.com/radar/strands-environment-cve-2026-115415)

[Railway: replace stored secrets after the platform incident](https://www.oktsec.com/radar/railway-october-2026-secrets)

## Manual patching and certificate replacement

Sophos issued an exceptional manual patch for unauthenticated root command execution in UTM when email proxy scanning is enabled. UTM remains outside support; exploitation is not established in the reviewed sources. Separately, AWS set October 28 for replacing affected identity provider certificates used with ALB OIDC or JWT authentication.

What to check: Follow the Sophos patch KB and plan migration; Radar has not verified the installation procedure. Check affected ALB identity provider chains and confirm replacement after the October 28 deadline. AWS trust store rollout dates do not replace that customer action.

Advisory details (updated separately):

[Sophos UTM: manual patch for root command execution](https://www.oktsec.com/radar/sophos-utm-cve-2026-118633)

[eMudhra: replace affected certificates and review application trust](https://www.oktsec.com/radar/emudhra-chrome-root-removal)

## Recommended checks

1. Confirm exposure before assigning work: SSL VPN configuration, management access, affected runtime and deployed branch.
2. Verify the corrected software is running. Installed packages and scheduled rollouts do not establish that a service has been updated.
3. Complete credential rotation, separate security patches and certificate replacement where required.
4. Preserve evidence where compromise is suspected. An update does not explain activity before the fix.

## Sources

- [Cisco ASA/FTD: active exploitation can restart VPN devices](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-tunnel-dos-s6mgkb75) — Cisco; Vendor notice; checked 2026-10-29T17:42:53Z
- [CISA KEV: CVE-2026-111497, added October 27, 2026](https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json) — CISA; Government advisory; checked 2026-10-28T09:42:12Z
- [PHP critical security advisory](https://www.php.net/archive/2026.php#2026-10-21-5) — PHP; Vendor notice; checked 2026-10-23T20:34:00Z
- [PHP2Shell observations in MadPot](https://aws.amazon.com/blogs/security/amazon-threat-intelligence-identifies-php2shell-exploitation-prior-to-public-disclosure-in-madpot/) — AWS; Vendor notice; checked 2026-10-23T20:34:00Z
- [Session upload progress follow up](https://www.php.net/archive/2026.php#2026-10-23-1) — PHP; Vendor notice; checked 2026-10-23T20:34:00Z
- [PHP security advisory: CVE-2026-109618](https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w) — PHP; Vendor notice; checked 2026-10-24T13:27:53Z
- [PHP security advisory: CVE-2026-109619](https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp) — PHP; Vendor notice; checked 2026-10-24T13:27:53Z
- [PHP2Shell attribution correction — October 25](https://unit42.paloaltonetworks.com/cve-2026-109618-cve-2026-109619/) — Unit 42; Research report; checked 2026-10-26T11:05:34Z
- [PHP incident response and runtime remediation](https://cloud.google.com/blog/products/identity-security/responding-to-core-php-vulnerabilities-cve-2026-109618-cve-2026-109619) — Google Cloud; Research report; checked 2026-10-26T11:05:34Z
- [Palo Alto: PHP2Shell exploitation and PAN-OS branch fixes](https://security.paloaltonetworks.com/CVE-2026-109618) — Palo Alto Networks; Vendor notice; checked 2026-10-30T10:26:59Z
- [Linux CNA record and branch fixes](https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/46xxx/CVE-2026-46300.json) — Linux; Vendor notice; checked 2026-10-28T23:38:45Z
- [Red Hat: local privilege escalation and distributor guidance](https://access.redhat.com/security/cve/CVE-2026-46300) — Red Hat; Vendor notice; checked 2026-10-28T23:38:45Z
- [GitLab October 12 security patch release and detection guidance](https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-2-released/) — GitLab; Vendor notice; checked 2026-10-30T10:26:59Z
- [GitLab CNA record: CVE-2026-97229](https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/97xxx/CVE-2026-97229.json) — GitLab / CVE Program; Vendor notice; checked 2026-10-30T10:26:59Z
- [Broadcom VMSA-2026-0006.2, section 3e](https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/38017) — Broadcom; Vendor notice; checked 2026-10-28T23:38:45Z
- [APSB26-73: affected products and July security update](https://www.adobe.com/trust/security/products/commerce/apsb26-73.html) — Adobe; Vendor notice; checked 2026-10-28T09:42:12Z
- [July isolated patch installation and cloud-patches guidance](https://experienceleague.adobe.com/en/docs/experience-cloud-kcs/kbarticles/ka-37421) — Adobe; Vendor notice; checked 2026-10-28T09:42:12Z
- [Adobe CNA record for CVE-2026-48356](https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/48xxx/CVE-2026-48356.json) — Adobe CNA; Vendor notice; checked 2026-10-28T09:42:12Z
- [October Node.js security releases](https://nodejs.org/en/blog/vulnerability/october-2026-security-releases) — Node.js; Vendor notice; checked 2026-10-24T02:44:01Z
- [Node2Shell research demonstration](https://www.imperva.com/blog/node2shell-from-brotli-data-to-remote-code-execution/) — Imperva; Research report; checked 2026-10-23T21:03:38Z
- [Brotli exposure, fixed releases and mitigations](https://patchtheplanet.org/brotli) — OpenAI · Patch the Planet; Research report; checked 2026-10-24T02:44:01Z
- [Brotli 1.2.1 security release](https://github.com/google/brotli/releases/tag/v1.2.1) — Google Brotli; Vendor notice; checked 2026-10-24T02:44:01Z
- [Brotli 1.1.1 security release](https://github.com/google/brotli/releases/tag/v1.1.1) — Google Brotli; Vendor notice; checked 2026-10-24T02:44:01Z
- [Brotli 1.0.10 security release](https://github.com/google/brotli/releases/tag/v1.0.10) — Google Brotli; Vendor notice; checked 2026-10-24T02:44:01Z
- [Bun 1.4.4 Brotli dependency](https://github.com/oven-sh/bun/blob/bun-v1.4.4/scripts/build/deps/brotli.ts) — Bun; Vendor notice; checked 2026-10-24T02:44:01Z
- [Envoy Brotli decompressor advisory](https://github.com/envoyproxy/envoy/security/advisories/GHSA-3wvj-j6qm-62mr) — Envoy; Vendor notice; checked 2026-10-24T02:44:01Z
- [Istio security advisory and fixed releases](https://istio.io/latest/news/security/istio-security-2026-007/) — Istio; Vendor notice; checked 2026-10-24T02:44:01Z
- [IO::Compress::Brotli 0.023 security release](https://github.com/timlegge/perl-IO-Compress-Brotli/releases/tag/0.023) — IO::Compress::Brotli maintainers; Vendor notice; checked 2026-10-25T13:12:31Z
- [PAN-OS October 29 matrix and Transporter correction](https://security.paloaltonetworks.com/CVE-2026-111497) — Palo Alto Networks; Vendor notice; checked 2026-10-29T13:22:43Z
- [Updated PHP Windows builds for Brotli security fix](https://www.php.net/archive/2026.php#2026-10-26-1) — PHP; Vendor notice; checked 2026-10-26T23:22:16Z
- [PAN-OS 12.2.4-h1 addressed issues](https://docs.paloaltonetworks.com/ngfw/release-notes/12-2/pan-os-12-2-4-known-and-addressed-issues/pan-os-12-2-4-h1-addressed-issues) — Palo Alto Networks; Vendor notice; checked 2026-10-27T15:32:05Z
- [PAN-OS 12.1.7-h11 addressed issues](https://docs.paloaltonetworks.com/ngfw/release-notes/12-1/pan-os-12-1-7-known-and-addressed-issues/pan-os-12-1-7-h11-addressed-issues) — Palo Alto Networks; Vendor notice; checked 2026-10-27T15:32:05Z
- [AWS 155: Brotli runtime updates and verification](https://aws.amazon.com/security/security-bulletins/2026-155-aws/) — AWS; Vendor notice; checked 2026-10-29T13:22:43Z
- [Solace Brotli product scope and release targets](https://solace.com/support/brotli-decoder-security-vulnerabilities/) — Solace; Vendor notice; checked 2026-10-29T17:42:53Z
- [Binance October 30 statement: estimated impact, initial investigation and response](https://www.binance.com/en/support/announcement/detail/c5a8729a97ac486d963784d96c5642d7) — Binance; Vendor notice; checked 2026-10-30T10:26:59Z
- [Binance: investigation into a potential security issue](https://x.com/binance/status/2115915483832832425) — Binance; Vendor notice; checked 2026-10-30T00:00:29Z
- [Binance: $2.54 billion frozen, not a final loss estimate](https://x.com/binance/status/2115947325617299903) — Binance; Vendor notice; checked 2026-10-30T00:00:29Z
- [Binance 14: EIP-7702 delegation at 20:20:59 UTC](https://etherscan.io/tx/0xad99264d5532ae0dd04b2004eebda05f25657e70dacb764f7ac8d4ccd051298b) — Etherscan; Research report; checked 2026-10-30T00:00:29Z
- [Binance 14: ETH and token transfers at 20:24:23 UTC](https://etherscan.io/tx/0x53bd38b816c23e74134786c29a8c18d792777998a3b9326047b583100e88e2f3) — Etherscan; Research report; checked 2026-10-30T00:00:29Z
- [Binance Hot Wallet 34: 780 million USDC transfer](https://etherscan.io/tx/0xdc102dd89dded5a83f1008906883ffb7c81ff3b7d7965d8c7277d170b5e17481) — Etherscan; Research report; checked 2026-10-30T00:00:29Z
- [EIP-7702 delegation and transfer analysis](https://x.com/odysseas_eth/status/2115910280140276155) — Odysseas / Phylax; Research report; checked 2026-10-30T00:00:29Z
- [Circle: more than 800 million USDC frozen](https://x.com/jerallaire/status/2115916207463481846) — Jeremy Allaire / Circle; Vendor notice; checked 2026-10-30T00:00:29Z
- [Tether: more than 1.567 billion USDT frozen](https://x.com/paoloardoino/status/2115918000373346709) — Paolo Ardoino / Tether; Vendor notice; checked 2026-10-30T00:00:29Z
- [EIP-7702: account code delegation and security considerations](https://eips.ethereum.org/EIPS/eip-7702) — Ethereum Improvement Proposals; Research report; checked 2026-10-30T00:00:29Z
- [BWEnews tally reported by BBX: $5.643 billion in outflows at 21:22 UTC](https://bbx.com/news-detail/3158067) — BBX / BWEnews; Media report; checked 2026-10-30T00:46:36Z
- [Binance 14: second transfer at 21:44:11 UTC](https://etherscan.io/tx/0x55ba4dabc41b468e580751373ad31acdee6f5ba398682df2c93e5a8340870556) — Etherscan; Research report; checked 2026-10-30T00:46:36Z
- [AWS bulletin 2026-154: environment masking and credential rotation](https://aws.amazon.com/security/security-bulletins/2026-154-aws/) — AWS; Vendor notice; checked 2026-10-28T23:38:45Z
- [Strands Tools GHSA-qjx4-hg6g-2f34](https://github.com/strands-agents/tools/security/advisories/GHSA-qjx4-hg6g-2f34) — Strands Agents; Vendor notice; checked 2026-10-28T23:38:45Z
- [Preliminary report: October security incident](https://blog.railway.com/p/preliminary-report-october-security-incident) — Railway; Vendor notice; checked 2026-10-26T23:22:16Z
- [Platform outage resolution and remaining customer actions](https://status.railway.com/incident/QH8L8B3E) — Railway; Vendor notice; checked 2026-10-25T13:12:31Z
- [Sophos UTM: manual patch for root command execution](https://www.sophos.com/en-us/security-advisories/sophos-sa-20261028-utm-rce) — Sophos; Vendor notice; checked 2026-10-29T17:42:53Z
- [Chrome and Android response to compromised eMudhra intermediates](https://blog.google/security/protecting-chrome-and-android-users-from-compromised-emudhra-intermediate-ca-certificates/) — Google; Vendor notice; checked 2026-10-26T11:05:34Z
- [Java security alert CVE-2026-91403](https://www.oracle.com/security-alerts/alert-cve-2026-91403.html) — Oracle; Vendor notice; checked 2026-10-25T13:12:31Z
- [Java follow-up alert: root certificate removal](https://www.oracle.com/security-alerts/alert-cve-2026-114820.html) — Oracle; Vendor notice; checked 2026-10-27T15:32:05Z
- [Runtime checks and mitigations for eMudhra certificates](https://ops.java/emudhra) — Oracle; Vendor notice; checked 2026-10-27T15:32:05Z
- [Python ssl certificate denylist announcement](https://mail.python.org/archives/list/security-announce@python.org/message/FNAJMZV6XQYLVPABNINDMF3VF66AYLW4/) — Python; Vendor notice; checked 2026-10-25T13:12:31Z
- [CPython certificate denylist merged change](https://github.com/python/cpython/pull/160042) — Python; Vendor notice; checked 2026-10-25T13:12:31Z
- [MongoDB Compass 1.53.1 release](https://github.com/mongodb-js/compass/releases/tag/v1.53.1) — MongoDB; Vendor notice; checked 2026-10-25T13:12:31Z
- [Electron 44.9.1 certificate mitigation](https://releases.electronjs.org/release/v44.9.1) — Electron; Vendor notice; checked 2026-10-25T13:12:31Z
- [Python 3.15.2 security release](https://www.python.org/downloads/release/python-3152/) — Python; Vendor notice; checked 2026-10-26T11:05:34Z
- [Python 3.14.10 security release](https://www.python.org/downloads/release/python-31410/) — Python; Vendor notice; checked 2026-10-26T11:05:34Z
- [Python 3.13.18 security release](https://www.python.org/downloads/release/python-31318/) — Python; Vendor notice; checked 2026-10-26T11:05:34Z
- [Python 3.12.16 security release](https://www.python.org/downloads/release/python-31216/) — Python; Vendor notice; checked 2026-10-26T11:05:34Z
- [Python 3.11.18 security release](https://www.python.org/downloads/release/python-31118/) — Python; Vendor notice; checked 2026-10-26T11:05:34Z
- [Application updates for compromised eMudhra certificates](https://firebase.google.com/support/guides/compromised-emudhra-intermediate-ca) — Google; Vendor notice; checked 2026-10-26T11:05:34Z
- [AWS trust bundle updates: ALB certificates and Lambda deployment actions](https://aws.amazon.com/security/security-bulletins/2026-150-aws/) — AWS; Vendor notice; checked 2026-10-28T15:05:20Z
- [MongoDB CNA record: Compass CVE-2026-115929](https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/115xxx/CVE-2026-115929.json) — MongoDB; Vendor notice; checked 2026-10-28T15:05:20Z

## Scope and corrections

Radar is a selected editorial collection, not a complete vulnerability database or a scan of your environment. Priorities are Oktsec analysis. Source confirmation and checklist completion do not establish whether your systems are compromised or secure.

[Sources and methodology](https://www.oktsec.com/radar/about). Report corrections with supporting sources to info@oktsec.com. Do not send secrets or private incident data.