Researchers Expose GPON Optical Network Eavesdropping via Modified ONU Devices at DEF CON
At DEF CON 34, researchers presented an attack technique called GPWN that exploits fundamental characteristics of GPON (Gigabit Passive Optical Network) infrastructure to eavesdrop on neighboring subscribers' downstream traffic.
The passive nature of these networks means that all clients connected to the same optical splitter receive identical data; separation occurs only at the Optical Network Unit (ONU) through software filtering of GEM frames carrying 12-bit port identifiers. Using approximately one hundred dollars' worth of hardware, the researchers modified commodity Realtek RTL960x SFP modules to override these filters.
They sequentially disabled multiple protective mechanisms: GEM port identifier reassignment, VLAN tagging enforcement, internal switch forwarding rules, and various checksum validations. The result was the ability to read traffic destined for as many as 128 other subscribers on the same splitter—an apparent hardware limit of consumer-grade ONUs.
Although most traffic is encrypted, the researchers showed that DNS queries remain visible and can indicate when a residence is unoccupied. In certain deployments, cellular base-station traffic and unencrypted SIP voice calls were also observable. Importantly, only downstream traffic could be intercepted; upstream traffic remained protected.
The presentation further examined the possibility of compromising the provider-side Optical Line Terminal (OLT). Analysis of the VSOL G100S OLT revealed multiple vulnerabilities that could allow root-level command execution and subsequent compromise of customer routers.
Physical access to splitters located in public spaces was also noted as a realistic attack vector that would enable bidirectional traffic interception. Recommended mitigations include mandatory provider-side encryption and consistent use of VPNs by subscribers.
Additional items covered in the same report include the Head Mare group's compromise of TrueConf conferencing servers, the EvilFontTool font-based evasion technique, an OpenAI disclosure regarding an accidental AI-driven attack on Hugging Face, a new Spectre-v2 bypass affecting Intel and AMD processors, and the 18-year-old SCTPhantom (CVE-2026-64564) Linux kernel vulnerability.
Related articles
Liferay Community Edition Misconfiguration Exposes Plaintext Passwords in Government Systems via CWE-319
A detailed analysis reveals how the use of Liferay Community Edition in a closed government information system led to the transmission of user passwords in plaintext through transactional emails. The issue stemmed from default notification templates that included the [$PASSWORD$] macro, combined with unadjusted system variables pointing to localhost instead of the production domain. Despite proper OAuth 2.0 delegation and CSRF protections, the misconfigured password change workflow sent permanent credentials in clear text to user inboxes. The root cause was traced to custom portlets that incorrectly reused the New Password Notification trigger intended only for administrator-initiated resets. Remediation involves removing the password macro from email templates and updating portal-ext.properties to enforce production host settings. The case highlights how open-source enterprise platforms require thorough hardening beyond initial code audits when deployed in high-security environments.
GitLab Critical Vulnerabilities Traced to Ruby Onigmo Regex Engine, Including Exploited CVE-2026-97229
GitLab has disclosed that four critical vulnerabilities, including the already-exploited CVE-2026-97229, originate from flaws in the Ruby programming language's Onigmo regular expression engine rather than in GitLab code itself. The most severe issue, CVE-2026-97229, is an integer overflow in regex processing within CI/CD configuration files and carries a maximum CVSSv3.1 base score of 10.0. GitLab released patches on October 8, 2026, covering versions 19.4.2, 19.3.5, and 19.2.8. Ruby's development team followed with its own advisory on October 23, 2026, addressing the same underlying defects. The remaining three vulnerabilities involve double-free memory errors and additional integer overflows during regex parsing and compilation. Because the root cause lies in a shared dependency, any application or environment relying on the affected Ruby Onigmo engine may also be exposed.
CISA Adds Cisco Secure Firewall and GitLab Flaws to Known Exploited Vulnerabilities Catalog
US authorities have warned that two vulnerabilities in Cisco Systems firewall products and the GitLab development platform are being actively exploited in the wild. The Cybersecurity and Infrastructure Security Agency added CVE-2026-76418 and CVE-2026-97229 to its Known Exploited Vulnerabilities catalog on October 29, 2026, urging immediate remediation. CVE-2026-76418 affects Cisco Secure Firewall ASA Software and Cisco Secure FTD Software, allowing unauthenticated attackers to trigger device reboots and cause denial-of-service conditions. CVE-2026-97229 is an integer overflow in GitLab stemming from insufficient validation of regular expressions in CI/CD configurations, enabling remote code execution without authentication. CISA noted that the GitLab issue originates from a dependency in Ruby/Onigmo and may impact other products beyond GitLab itself. Organizations are advised to apply patches or mitigations without delay to prevent further exploitation.
Cisco ASA and FTD Face DoS Vulnerability in SSL VPN Already Exploited in the Wild
Cisco Systems has disclosed a denial-of-service vulnerability affecting its Cisco Secure Firewall ASA and Cisco Secure Firewall FTD products. The flaw, tracked as CVE-2026-76418, resides in the SSL VPN remote access feature and carries a CVSS v3.1 base score of 8.6, rated High severity. Exploitation occurs when secondary authentication is configured on tunnel groups, allowing an attacker to send a crafted request that forces a device reboot without requiring authentication. Cisco confirmed active exploitation of the issue in October 2026. Security updates addressing the vulnerability are now available for both affected product lines. The advisory recommends immediate application of the patches to prevent service disruption.