BrokenPipe PoC Exploits Steam Client Service for Silent SYSTEM Privilege Escalation on Windows
A new proof of concept called BrokenPipe shows how a standard user on Windows can elevate privileges to NT AUTHORITY\SYSTEM through the Steam Client Service without an administrator password or any UAC prompt.
The demonstration describes a path that lets any non-administrator user execute code as NT AUTHORITY\SYSTEM. Tests reproduced the behavior on Windows 10 and Windows 11 with Steam 10.96.30.42. The affected component is steamservice.exe, the executable behind the Steam Client Service.
This Windows service runs with maximum privileges and exposes an interface for maintenance and deployment tasks. The design, common in software that needs to update or install dependencies, becomes an attack surface when validation logic fails to close all vectors.
The technical explanation points to insufficient signature validation in VDF installation scripts. The service does not fully control the path it accepts and executes; part of that path remains outside signature coverage, allowing an attacker to dictate where the script is loaded from.
The exploit uses the service interface to add a malicious script to an allowlist and force its execution, resulting in the payload running with SYSTEM privileges. The flaw is not remotely exploitable; the attacker must first execute code locally with a standard account.
This scenario fits shared computers, library workstations, cybercafés, or corporate environments where some users should not be able to elevate privileges. A successful LPE can turn a limited intrusion into full machine control.
No public CVE is associated with the issue, and there is no confirmation of active exploitation in real campaigns. Valve received notification months before public disclosure, with March cited as the notification date.
Administrators should inventory Windows systems running Steam, evaluate whether the Steam Client Service is necessary on sensitive or shared endpoints, and apply compensating controls such as application allowlisting and script execution policies. Monitoring for SYSTEM-context processes tied to steamservice.exe and anomalous launches of cmd.exe from Steam paths is also recommended.
Related articles
Mitigating PHP2Shell RCE Vulnerabilities CVE-2026-109618 and CVE-2026-109619 on Legacy PHP 5.6 Stacks with Varnish, Docker and Apache mod_php
Two critical remote code execution vulnerabilities dubbed PHP2Shell (CVE-2026-109618 and CVE-2026-109619, CVSS 9.2) affect PHP before any application code executes, targeting the Zend Engine's longjmp() mechanism during OOM conditions and use-after-free issues with session upload progress. Official patches exist only for supported branches 8.2.35 and newer, leaving PHP 5.6 installations exposed, especially those using Apache with mod_php. An administrator of a high-traffic legacy enterprise application running PHP 5.6 inside Docker containers behind Varnish implemented a four-layer defense without rewriting the monolith. The approach disables session.upload_progress.enabled and sets memory_limit to -1 inside PHP, enforces strict cgroups memory limits and MaxConnectionsPerChild 1 in Apache, adds request-size and cookie-based blocks in Varnish VCL, and forces Connection: close on synthetic error responses. Testing revealed HTTP keep-alive drain issues and differing behavior between direct Apache requests and Varnish-routed traffic. The layered controls successfully neutralize both attack vectors while preserving production stability.
Node.js Fixes High-Severity Brotli Decoder Flaw Leading to Remote Code Execution
A high-severity vulnerability in the bundled Brotli decoder of Node.js allows out-of-bounds writes when processing attacker-controlled compressed data, potentially resulting in remote code execution. The flaw, tracked as CVE-2026-111497, affects all supported branches including 22.x, 24.x, and 26.x prior to the October 21, 2026 security release. Patched versions 22.23.4, 24.22.1, and 26.12.1 address the memory corruption issue that arises during Brotli decompression in services accepting third-party content. The same update resolves additional high-severity problems, notably hostname validation weaknesses in TLS. Organizations using unsupported branches such as 18.x, 20.x, 23.x, and 25.x must migrate to maintained releases, while those linking against system Brotli libraries should verify inclusion of upstream commit 0ed4268. Security teams are advised to audit all environments, including containers and CI pipelines, that process Brotli-encoded data.
Critical GitLab Flaw CVE-2026-110264 Allows Unauthenticated Remote Code Execution
GitLab has released patches for a maximum-severity vulnerability that permits unauthenticated remote code execution on self-managed installations. The flaw, tracked as CVE-2026-110264 with a CVSS score of 10.0, stems from an integer overflow during regular expression compilation. It affects every version starting from 7.0 released in 2014 and impacts both Community and Enterprise editions. The issue was reported through the company's HackerOne bug bounty program and has no available workaround. Patches are available in multiple recent releases, though earlier critical updates from October 12 do not cover this vulnerability. No exploitation has been observed as of October 22, and the flaw is not yet listed in the NVD or CISA's exploited vulnerabilities catalog.
PHP2Shell Vulnerabilities Targeted in Exploitation Attempts Four Days Before Public Disclosure
Amazon Threat Intelligence detected early exploitation attempts against PHP vulnerabilities on October 17, four days prior to the public disclosure and patch release. The activity was observed through the MadPot honeypot network, with initial requests originating from a commercial anonymization service. Additional probing with varied payloads occurred on October 21, indicating multiple threat actors were involved before fixes became available. OpenAI reported that researchers from the Calif team identified one critical flaw using GPT-5.6 Sol as part of the Patch the Planet initiative, while Wiz independently discovered and reported both issues. PHP developers prepared the patches with support from security researchers and infrastructure providers. Amazon advises organizations to investigate potential compromise traces dating back to at least October 17, as new proof-of-concept exploits appeared within hours of the advisory and were quickly deployed against company sensors.