Node2Shell Exploitation, 123 Reg Breach, and Teams Attack Surge

CISA has added Node2Shell to its Known Exploited Vulnerabilities catalogue, confirming active exploitation of a critical flaw in Node.js Brotli compression handling that enables remote code execution without authentication. UK domain registrar 123 Reg has disclosed a customer data breach attributed to sophisticated threat actors with suspected China nexus, exposing domain ownership records and billing information for hundreds of thousands of small businesses. Arctic Wolf has documented over 400 incidents involving Microsoft Teams external chat abuse for initial access, with attackers using fake IT support personas and device-code phishing to bypass multi-factor authentication. Additional coverage includes scanning activity targeting Oracle E-Business Suite vulnerability CVE-2026-101767 and technical analysis of Qilin ransomware operations targeting VMware ESXi infrastructure. Mauven provides actionable guidance on immediate patch verification, registrar account security, Teams federation controls, and phishing-resistant MFA deployment for UK small businesses.

Chapters

• Introduction Overview of three critical UK threat developments: active exploitation of Node2Shell vulnerability, 123 Reg customer data breach, and widespread Microsoft Teams attack pattern.
• Node2Shell: CISA Confirms Active Exploitation Analysis of CISA’s KEV catalogue addition for Node2Shell (CVE-2026-76461), a critical Brotli compression vulnerability in Node.js enabling unauthenticated remote code execution. Guidance on patch verification, exposure assessment for UK web infrastructure, and managed service provider accountability.
• Call to Action Listener engagement prompt to follow the show and share with relevant contacts.
• 123 Reg Customer Data Breach Examination of 123 Reg breach disclosure, suspected China-nexus threat actor attribution, scope of exposed domain registrar data, and implications for UK small businesses. Actionable steps for credential rotation, MFA enablement, and domain security verification.
• Microsoft Teams External Chat Attacks Detailed analysis of 400+ documented incidents using Teams external chat for initial access, including email bombing tactics, fake IT support personas, and SkyW4lker device-code phishing kit bypassing standard MFA. Configuration guidance for Teams federation controls and phishing-resistant authentication.
• Oracle EBS and Qilin Ransomware Brief coverage of scanning activity targeting Oracle E-Business Suite CVE-2026-101767 and technical analysis of Qilin ransomware operations against VMware ESXi infrastructure, with supply chain risk considerations.
• Closing Summary of key actionable items: Node2Shell patch verification and Teams external access configuration review with IT providers.

Links

• https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• https://arcticwolf.com/resources/blog/microsoft-teams-external-chat-attacks
• https://www.123-reg.co.uk/
• https://www.microsoft.com/security/blog/
• https://www.oracle.com/security-alerts/
• https://www.sentinelone.com/labs/qilin-ransomware-analysis