Cyber Alert: Critical Patches & Canada Breaches — October 26, 2026
Updated: 13 hours ago
October 26, 2026 | Alberta Radio Cyber Security Update | Roundup of critical patches and Canada breach news
Over the past five days, emergency patches landed for .NET, Python, Fortinet, Cisco and Chrome, while PHP "php2shell" exploitation remains active against Canadian systems. In Canada, Burnaby schools confirmed ransomware fallout, Save-On-Foods updated More Rewards customers, and an unverified MedusaLocker listing named Calgary-based ATCO. Leak-site claims stay unverified until companies confirm.
Critical patches this week
Defenders should treat the items below as priority. Patch versions are from vendor advisories; restart services and rebuild containers after updates.
.NET emergency patch (Oct 25): Out-of-band fixes for .NET 8, 9 and 10. CVE-2026-111497 (Brotli memory bug) and CVE-2026-114148 (Linux tarball privilege escalation). Update to 8.0.33, 9.0.22 or 10.0.14. The Oct 13 Patch Tuesday alone is not enough.
Python emergency releases (Oct 26): CVE-2026-115557 blocks compromised eMudhra intermediate CA keys; CVE-2026-114583 is a tarfile.tar_filter bypass. Update to 3.15.2, 3.14.10, 3.13.18, 3.12.16 or 3.11.18, plus certifi, pip and uv.
PHP php2shell still active: CVE-2026-109618 and CVE-2026-109619 allow unauthenticated code execution. Public PoC; mass exploit attempts. Cyber Centre AL26-026; CyberAlberta CAA-2026-0025 saw failed attempts in Alberta Oct 21–22. Fix: PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35. A third flaw, CVE-2026-115560 (Oct 23), is not covered by last week’s PHP updates.
Fortinet hardening (Oct 23): Critical/high updates for FortiOS, FortiManager, FortiAnalyzer, FortiMail and FortiAuthenticator. Details withheld until Nov 10. Keep admin interfaces off the internet until patched.
Cisco (Oct 22): 34 fixes including Expressway root command execution (CVE-2026-76466) and critical Snort 3 flaws affecting ASA, FTD and Meraki MX.
Chrome 156 (Oct 20): Six critical among hundreds of fixes. Update and restart the browser.
Azure Pipelines CVE-2026-105014 (Oct 22): Critical command injection (CVSS 9.1). Patch status is unclear; limit who can trigger pipelines.
CISA known-exploited: Arista VeloCloud Orchestrator CVE-2026-114625 (SQL injection, CVSS 9.9, added Oct 23); earlier Oct 20 additions include Plex Media Server flaws.
Citrix and SSH context
No brand-new Citrix bulletins landed Oct 21–26, but NetScaler ADC/Gateway flaws from earlier in the fall (including CVE-2026-88771 and CVE-2026-88772) remain under active exploitation. OpenSSH has no new release this week; distros are still rolling out OpenSSH 10.6 fixes from Oct 6.
Alberta concerns
ATCO Ltd. (Calgary) appeared on a MedusaLocker leak-site listing dated Sept 28. That claim is unverified; ATCO has not publicly confirmed an incident. CyberAlberta’s current public advisory remains CAA-2026-0025 on failed PHP exploit attempts. There is no newer public update on the Alberta Court of Appeal CAMS outage beyond Oct 22 reporting.
Canada-wide concerns
Burnaby School District 41: Confirmed ransomware discovered Sept 21 that stole student, parent and staff files; reported to RCMP and B.C.’s privacy office. Qilin listed the district on a leak site dated Oct 26 — that listing is unverified as proof of what attackers hold.
Save-On-Foods / More Rewards (Oct 23 update): Confirmed stolen customer names and, where provided, addresses, phones, emails and birthdates. Passwords, payment cards and purchase history were not included.
Ongoing: Crime Stoppers / Navigate360 leak continues to disrupt some Ontario programs; Calgary and Edmonton Crime Stoppers have kept taking tips. Loblaw continues credit-monitoring enrolment for roughly two million shoppers after the earlier breach.
Older unverified leak claims: CAS Paper Mill and ServiceMaster of Ottawa (The Gentlemen), Shediac Lobster Shop (Akira).
What Albertans and Canadian orgs should do
Patch PHP, .NET, Python, Fortinet, Cisco, Chrome and Azure Pipelines exposure as applicable.
Keep Fortinet and NetScaler admin UIs off the public internet; monitor for exploit traffic on PHP.
Treat leak-site claims (ATCO, Burnaby Qilin listing, etc.) as unverified until the organization confirms.
Watch official channels for Loblaw, Save-On-Foods and Crime Stoppers notices; beware phishing that impersonates breach emails.
Alberta Radio will keep watching CyberAlberta, the Canadian Centre for Cyber Security, and open-source ransomware trackers. This article is an open-source roundup for public awareness; it is not a substitute for vendor guidance or incident response.
Support Alberta Radio. Your $50 donation helps cover broadcasting and website costs, grow our news coverage, showcase music artists, and bring you more local updates and programming.
Thank you for helping Alberta Radio keep growing.
