Checklist
SIM swap: the first hour
Containment and verification steps when a customer’s number may have been hijacked.
Desk 04For Security engineers
The security engineering desk
What’s being exploited this week, and the identity signals worth wiring into detection.
For security engineers and soc teams.
What matters now
CISA’s Known Exploited Vulnerabilities catalog is the list federal agencies must patch against; each Wednesday Briefing lists the week’s additions.
Briefing: The Wednesday Briefing No. 7A carrier SIM-change check before trusting a phone number is one of the most direct account-takeover signals available.
Buyer’s guide: SIM swap detection: a buyer’s guideAdministrators and other high-risk users should get device-bound credentials, not synced passkeys.
Buyer’s guide: Phishing-resistant MFA: a buyer’s guide
Your reading path
Start at the top. Each step builds on the last.
Start here · Briefing
The Wednesday Briefing No. 7
Start here: this week’s exploited vulnerabilities and identity news.
Then · Field guide
SIM swap incident response: the first hour and the first week
Containment steps for a hijacked phone number.
Then · Buyer’s guide
Phishing-resistant MFA: a buyer’s guide
What to require for admins and high-risk staff.
Then · Explainer
Carrier-native authentication, explained: how a SIM can sign a login
What carrier signals can and can’t prove.
Exploited, most recently
The latest additions to CISA’s KEV catalog.
| CVE | Vendor and product | Vulnerability | Added | Due (federal) | Ransomware use |
|---|---|---|---|---|---|
| CVE-2026-118527 | Ivanti Connect Secure | Ivanti Connect Secure Generation of Predictable Numbers or Identifiers VulnerabilityCISA summaryIvanti Connect Secure contains a generation of predictable numbers or identifiers vulnerability that allows a remote authenticated attacker to upload files with attacker-controlled content to a known location on disk. This vulnerability can be chained with CVE-2026-104935 and CVE-2026-111357. | Unknown | ||
| CVE-2026-111357 | Ivanti Connect Secure | Ivanti Connect Secure Missing Authentication for Critical Function VulnerabilityCISA summaryIvanti Connect Secure contains a missing authentication for critical function vulnerability that could allow a local authenticated attacker to escalate their privileges. This vulnerability can be chained with CVE-2026-104935 and CVE-2026-118527. | Unknown | ||
| CVE-2026-97229 | GitLab Community Edition and Enterprise Edition | GitLab Community Edition and Enterprise Edition Integer Overflow or Wraparound VulnerabilityCISA summaryGitLab Community Edition and Enterprise Edition contain a integer overflow or wraparound vulnerability that could allow an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration, due to insufficient regular expression validation. | Unknown | ||
| CVE-2026-76418 | Cisco Secure Firewall ASA Software and Cisco Secure FTD Software | Cisco Secure Firewall ASA Software and Cisco Secure FTD Software Unchecked Return Value to NULL Pointer Dereference VulnerabilityCISA summaryCisco Secure Firewall ASA Software and Cisco Secure FTD Software contains an unchecked return value to NULL pointer dereference vulnerability that could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition. | Unknown | ||
| CVE-2026-46300 | Linux Kernel | Linux Kernel Missing Initialization of a Variable VulnerabilityCISA summaryLinux Kernel contains a missing initialization of a variable vulnerability that could allow for unintended modification of page-cache-backed data via failure to preserve the shared-fragment marker during socket buffer coalescing, causing ESP input processing to decrypt shared fragments in place. This vulnerability can be chained with CVE-2026-109618 and CVE-2026-109619 to implant PHP webshells and run commands as root. | Unknown | ||
| CVE-2026-41709 | Broadcom VMware ESX | Broadcom VMWare ESX Insufficient Logging VulnerabilityCISA summaryBroadcom VMWare ESX contains an insufficient logging vulnerability that could allow a malicious actor with admin access to perform certain operations without being logged. | Unknown | ||
| CVE-2026-48356 | Adobe Commerce and Magento | Adobe Commerce and Magento Unrestricted Upload of File with Dangerous Type VulnerabilityCISA summaryAdobe Commerce and Magento contain an unrestricted upload of file with dangerous type vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session. | Unknown | ||
| CVE-2026-111497 | Google Brotli | Google Brotli Unchecked Return Value VulnerabilityCISA summaryGoogle Brotli contains an unchecked return value vulnerability that allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream. | Unknown |
Source: CISA Known Exploited Vulnerabilities catalog, version 2026.10.30. Full weekly lists in the briefing archive.
Checklists for this desk
Checklist
Passkey launch readiness
What to settle before offering passkeys to customers or staff.
Rules that apply
Markets most relevant to this desk. Every row links to its primary source.
| Market | Regulator | Measure | Timing | Status | Primary source |
|---|---|---|---|---|---|
| United States | NIST | SP 800-63B-4: SMS OTP is a "restricted" authenticator | Final 2025 | Guidance | SP 800-63B-4: Authentication and Authenticator Management (NIST) |
Quick answers
How can banks stop OTP bot attacks?
The durable fix is to remove the code the bot asks for, using passkeys, in-app approval on a registered device or network-based verification. While codes remain, say in every message what the code approves and that the bank will never ask for it, and treat a new-device sign-in during an inbound call as a strong fraud signal.
How should a bank roll out passkeys to its customers?
Decide which passkeys you accept for which customers, offer enrollment right after a strong sign-in, make passkeys the default for returning users, and design account recovery that doesn’t fall back to an SMS code. Keep a non-SMS alternative for customers who can’t use passkeys, and a device-bound option for staff and other high-risk users.
How should a bank respond to a suspected SIM swap?
Treat the account as compromised until proven otherwise: stop trusting the phone number, revoke sessions, hold new payees and contact-detail changes, and reach the customer through a channel that isn’t the hijacked number. Then help them reclaim the number from their carrier, review everything that changed during the exposure window, and re-enroll them with a method that doesn’t depend on SMS.
What counts as phishing-resistant MFA?
Phishing-resistant MFA is authentication that a fake site or man-in-the-middle can’t capture and replay, because the credential is cryptographically bound to the real site. FIDO2 passkeys and hardware security keys are the common examples, and CISA also counts PKI-based smart cards. SMS codes, authenticator-app codes and simple push approvals are not phishing-resistant.
Buyer’s guides and vendor briefs
Approaches, evaluation criteria and pre-pilot questions. No scores, ratings or rankings.
Buyer’s guide
Phishing-resistant MFA: a buyer’s guide
Phishing-resistant MFA is authentication that a fake site or man-in-the-middle can’t capture and replay, because the credential is cryptographically bound to the real site. FIDO2 passkeys and hardware security keys are the common examples, and CISA also counts PKI-based smart cards. SMS codes, authenticator-app codes and simple push approvals are not phishing-resistant.
Buyer’s guide
SIM swap detection: a buyer’s guide
The most direct signal comes from the mobile operator: a SIM swap check reports whether the SIM tied to a number changed recently, and number verification confirms a request comes from that SIM. The CAMARA project standardizes both APIs. Banks combine them with their own device and session signals, and use them before trusting a number for recovery, new payees or high-risk payments.
Vendor brief
Evaluating Glide Identity: what each desk should ask before a pilot
The Security engineers question set, then the pilot plan and who owns each step. No scores or recommendations.