← Back to CVE Catalog/UVI-2026-11-00000036

UVI-2026-11-00000036

CVSS 9.1 (CRITICAL)

Published: 11/2/2026

IPSum Multi-Blacklist Aggressor Digest (2026-11-02): 2,500 Host IPs (Max Score: 12/30+)

Affected PackagesPerimeter Threat Host (138.226.239.233), Perimeter Threat Host (138.226.239.234), Perimeter Threat Host (14.34.249.175), Perimeter Threat Host (103.159.2.113), Perimeter Threat Host (119.28.84.193), Perimeter Threat Host (167.94.146.58), Perimeter Threat Host (179.43.153.10), Perimeter Threat Host (18.218.118.203), Perimeter Threat Host (196.189.236.67), Perimeter Threat Host (199.165.159.89), Perimeter Threat Host (2.57.122.238), Perimeter Threat Host (220.80.223.144), Perimeter Threat Host (45.148.10.141), Perimeter Threat Host (45.148.10.240), Perimeter Threat Host (51.159.4.12), Perimeter Threat Host (77.239.124.2), Perimeter Threat Host (80.94.95.116), Perimeter Threat Host (102.220.161.85), Perimeter Threat Host (102.223.92.101), Perimeter Threat Host (107.0.200.227), Perimeter Threat Host (138.226.239.90), Perimeter Threat Host (147.185.132.219), Perimeter Threat Host (147.185.132.24), Perimeter Threat Host (164.30.17.82), Perimeter Threat Host (167.94.146.48), Perimeter Threat Host (167.94.146.50), Perimeter Threat Host (167.94.146.52), Perimeter Threat Host (167.94.146.54), Perimeter Threat Host (167.94.146.55), Perimeter Threat Host (167.94.146.56), Perimeter Threat Host (167.94.146.59), Perimeter Threat Host (170.231.236.98), Perimeter Threat Host (170.231.237.214), Perimeter Threat Host (185.191.236.38), Perimeter Threat Host (185.242.226.19), Perimeter Threat Host (189.204.230.91), Perimeter Threat Host (193.47.62.69), Perimeter Threat Host (197.221.232.44), Perimeter Threat Host (197.227.8.186), Perimeter Threat Host (199.165.159.105), Perimeter Threat Host (199.165.159.113), Perimeter Threat Host (199.165.159.185), Perimeter Threat Host (2.57.121.112), Perimeter Threat Host (2.57.121.25), Perimeter Threat Host (223.197.186.7), Perimeter Threat Host (3.129.187.38), Perimeter Threat Host (35.237.94.18), Perimeter Threat Host (37.187.35.26), Perimeter Threat Host (45.148.10.121), Perimeter Threat Host (45.148.10.151), Perimeter Threat Host (45.148.10.152), Perimeter Threat Host (45.148.10.157), Perimeter Threat Host (46.151.178.14), Perimeter Threat Host (51.75.253.68), Perimeter Threat Host (58.182.58.128), Perimeter Threat Host (64.62.197.137), Perimeter Threat Host (64.62.197.152), Perimeter Threat Host (64.62.197.167), Perimeter Threat Host (64.62.197.62), Perimeter Threat Host (64.62.197.77), Perimeter Threat Host (66.132.159.102), Perimeter Threat Host (66.132.186.172), Perimeter Threat Host (66.132.195.67), Perimeter Threat Host (77.90.185.20), Perimeter Threat Host (80.94.92.179), Perimeter Threat Host (80.94.92.234), Perimeter Threat Host (80.94.95.115), Perimeter Threat Host (81.28.167.30), Perimeter Threat Host (101.36.108.72), Perimeter Threat Host (101.96.202.144), Perimeter Threat Host (102.140.97.134), Perimeter Threat Host (102.209.76.136), Perimeter Threat Host (102.210.149.105), Perimeter Threat Host (102.220.161.119), Perimeter Threat Host (102.220.161.170), Perimeter Threat Host (102.220.161.86), Perimeter Threat Host (102.244.97.185), Perimeter Threat Host (102.88.137.213), Perimeter Threat Host (102.88.137.80), Perimeter Threat Host (103.112.54.86), Perimeter Threat Host (103.123.53.88), Perimeter Threat Host (103.159.199.43), Perimeter Threat Host (103.170.215.118), Perimeter Threat Host (103.187.165.26), Perimeter Threat Host (103.189.89.145), Perimeter Threat Host (103.189.89.196), Perimeter Threat Host (103.218.242.13), Perimeter Threat Host (103.237.144.204), Perimeter Threat Host (103.241.43.193), Perimeter Threat Host (103.243.27.155), Perimeter Threat Host (103.248.120.6), Perimeter Threat Host (103.255.109.151), Perimeter Threat Host (103.46.186.148), Perimeter Threat Host (103.48.192.48), Perimeter Threat Host (103.67.162.139), Perimeter Threat Host (103.70.40.36), Perimeter Threat Host (103.71.176.30), Perimeter Threat Host (103.95.40.58), Perimeter Threat Host (103.97.135.244), Perimeter Threat Host (103.98.176.164)

Supported Environmentsubuntu, debian, linux-mint, rocky, rhel, almalinux, oracle-linux, suse, alpine, arch, fedora, amazon-linux, kernel, gentoo, freebsd, openbsd, netbsd, macos, wolfi, nixos, void, photon, flatcar, talos, openwrt, openeuler, cloudlinux, kali, azure-linux, centos-stream, opensuse-leap, fedora-coreos, proxmox, truenas-scale, windows

Cryptographic ProvenanceSLSA Level 3 (Cosign OIDC Signed)

⚡ Autonomous Live Mitigation(Zero-Downtime • Sub-50ms Rollback)

Deploy this patch across production Linux or Windows Server fleets with pre-flight sentinels and instant rollback guarantee.

exultia.exe patch --vendor --os windows-server

Tier 1

Zero-Downtime Hot-Mitigation Script

No reboot or service downtime

Consolidated Daily IPSum Blocklist (2026-11-02): Atomically synchronize 100 multi-blacklist aggressor IPs into host firewall, kernel blackhole routes, and /etc/hosts.deny.

mkdir -p /etc/exultia/blocklists /var/lib/exultia/spool /var/spool/vantage
printf "%b\n" "138.226.239.233\n138.226.239.234\n14.34.249.175\n103.159.2.113\n119.28.84.193\n167.94.146.58\n179.43.153.10\n18.218.118.203\n196.189.236.67\n199.165.159.89\n2.57.122.238\n220.80.223.144\n45.148.10.141\n45.148.10.240\n51.159.4.12\n77.239.124.2\n80.94.95.116\n102.220.161.85\n102.223.92.101\n107.0.200.227\n138.226.239.90\n147.185.132.219\n147.185.132.24\n164.30.17.82\n167.94.146.48\n167.94.146.50\n167.94.146.52\n167.94.146.54\n167.94.146.55\n167.94.146.56\n167.94.146.59\n170.231.236.98\n170.231.237.214\n185.191.236.38\n185.242.226.19\n189.204.230.91\n193.47.62.69\n197.221.232.44\n197.227.8.186\n199.165.159.105\n199.165.159.113\n199.165.159.185\n2.57.121.112\n2.57.121.25\n223.197.186.7\n3.129.187.38\n35.237.94.18\n37.187.35.26\n45.148.10.121\n45.148.10.151" > /etc/exultia/blocklists/ipsum-2026-11-02.list
cp /etc/exultia/blocklists/ipsum-2026-11-02.list /var/lib/exultia/spool/threat_ips.table 2>/dev/null || true
cp /etc/exultia/blocklists/ipsum-2026-11-02.list /var/spool/vantage/threat_ips.table 2>/dev/null || true
touch /etc/hosts.deny && sed -i '/# BEGIN EXULTIA-IPBLOCK-2026-11-02/,/# END EXULTIA-IPBLOCK-2026-11-02/d' /etc/hosts.deny 2>/dev/null || true
printf "# BEGIN EXULTIA-IPBLOCK-2026-11-02\nALL: 138.226.239.233, 138.226.239.234, 14.34.249.175, 103.159.2.113, 119.28.84.193, 167.94.146.58, 179.43.153.10, 18.218.118.203, 196.189.236.67, 199.165.159.89, 2.57.122.238, 220.80.223.144, 45.148.10.141, 45.148.10.240, 51.159.4.12, 77.239.124.2, 80.94.95.116, 102.220.161.85, 102.223.92.101, 107.0.200.227, 138.226.239.90, 147.185.132.219, 147.185.132.24, 164.30.17.82, 167.94.146.48\n# END EXULTIA-IPBLOCK-2026-11-02\n" >> /etc/hosts.deny
(command -v nft >/dev/null 2>&1 && nft add table inet exultia_vantage 2>/dev/null && nft 'add set inet exultia_vantage threat_ips { type ipv4_addr; flags interval; }' 2>/dev/null && nft 'add chain inet exultia_vantage input { type filter hook input priority -10; policy accept; }' 2>/dev/null && nft add rule inet exultia_vantage input ip saddr @threat_ips drop 2>/dev/null && nft add element inet exultia_vantage threat_ips "{ 138.226.239.233, 138.226.239.234, 14.34.249.175, 103.159.2.113, 119.28.84.193, 167.94.146.58, 179.43.153.10, 18.218.118.203, 196.189.236.67, 199.165.159.89, 2.57.122.238, 220.80.223.144, 45.148.10.141, 45.148.10.240, 51.159.4.12, 77.239.124.2, 80.94.95.116, 102.220.161.85, 102.223.92.101, 107.0.200.227, 138.226.239.90, 147.185.132.219, 147.185.132.24, 164.30.17.82, 167.94.146.48, 167.94.146.50, 167.94.146.52, 167.94.146.54, 167.94.146.55, 167.94.146.56, 167.94.146.59, 170.231.236.98, 170.231.237.214, 185.191.236.38, 185.242.226.19, 189.204.230.91, 193.47.62.69, 197.221.232.44, 197.227.8.186, 199.165.159.105, 199.165.159.113, 199.165.159.185, 2.57.121.112, 2.57.121.25, 223.197.186.7, 3.129.187.38, 35.237.94.18, 37.187.35.26, 45.148.10.121, 45.148.10.151 }" 2>/dev/null) || true
(ip route replace blackhole 138.226.239.233/32 2>/dev/null || true; ip route replace blackhole 138.226.239.234/32 2>/dev/null || true; ip route replace blackhole 14.34.249.175/32 2>/dev/null || true; ip route replace blackhole 103.159.2.113/32 2>/dev/null || true; ip route replace blackhole 119.28.84.193/32 2>/dev/null || true; ip route replace blackhole 167.94.146.58/32 2>/dev/null || true; ip route replace blackhole 179.43.153.10/32 2>/dev/null || true; ip route replace blackhole 18.218.118.203/32 2>/dev/null || true; ip route replace blackhole 196.189.236.67/32 2>/dev/null || true; ip route replace blackhole 199.165.159.89/32 2>/dev/null || true; ip route replace blackhole 2.57.122.238/32 2>/dev/null || true; ip route replace blackhole 220.80.223.144/32 2>/dev/null || true; ip route replace blackhole 45.148.10.141/32 2>/dev/null || true; ip route replace blackhole 45.148.10.240/32 2>/dev/null || true; ip route replace blackhole 51.159.4.12/32 2>/dev/null || true; ip route replace blackhole 77.239.124.2/32 2>/dev/null || true; ip route replace blackhole 80.94.95.116/32 2>/dev/null || true; ip route replace blackhole 102.220.161.85/32 2>/dev/null || true; ip route replace blackhole 102.223.92.101/32 2>/dev/null || true; ip route replace blackhole 107.0.200.227/32 2>/dev/null || true; ip route replace blackhole 138.226.239.90/32 2>/dev/null || true; ip route replace blackhole 147.185.132.219/32 2>/dev/null || true; ip route replace blackhole 147.185.132.24/32 2>/dev/null || true; ip route replace blackhole 164.30.17.82/32 2>/dev/null || true; ip route replace blackhole 167.94.146.48/32 2>/dev/null || true)
(command -v pfctl >/dev/null 2>&1 && pfctl -t threat_ips -T replace -f /etc/exultia/blocklists/ipsum-2026-11-02.list 2>/dev/null) || true

🔍 Verification Sentinel Probe:

test -s /etc/exultia/blocklists/ipsum-2026-11-02.list && grep -q "BEGIN EXULTIA-IPBLOCK-2026-11-02" /etc/hosts.deny

⏪ Sub-50ms Deterministic Rollback:

sed -i '/# BEGIN EXULTIA-IPBLOCK-2026-11-02/,/# END EXULTIA-IPBLOCK-2026-11-02/d' /etc/hosts.deny 2>/dev/null || true; (ip route del blackhole 138.226.239.233/32 2>/dev/null || true; ip route del blackhole 138.226.239.234/32 2>/dev/null || true; ip route del blackhole 14.34.249.175/32 2>/dev/null || true; ip route del blackhole 103.159.2.113/32 2>/dev/null || true; ip route del blackhole 119.28.84.193/32 2>/dev/null || true; ip route del blackhole 167.94.146.58/32 2>/dev/null || true; ip route del blackhole 179.43.153.10/32 2>/dev/null || true; ip route del blackhole 18.218.118.203/32 2>/dev/null || true; ip route del blackhole 196.189.236.67/32 2>/dev/null || true; ip route del blackhole 199.165.159.89/32 2>/dev/null || true; ip route del blackhole 2.57.122.238/32 2>/dev/null || true; ip route del blackhole 220.80.223.144/32 2>/dev/null || true; ip route del blackhole 45.148.10.141/32 2>/dev/null || true; ip route del blackhole 45.148.10.240/32 2>/dev/null || true; ip route del blackhole 51.159.4.12/32 2>/dev/null || true; ip route del blackhole 77.239.124.2/32 2>/dev/null || true; ip route del blackhole 80.94.95.116/32 2>/dev/null || true; ip route del blackhole 102.220.161.85/32 2>/dev/null || true; ip route del blackhole 102.223.92.101/32 2>/dev/null || true; ip route del blackhole 107.0.200.227/32 2>/dev/null || true; ip route del blackhole 138.226.239.90/32 2>/dev/null || true; ip route del blackhole 147.185.132.219/32 2>/dev/null || true; ip route del blackhole 147.185.132.24/32 2>/dev/null || true; ip route del blackhole 164.30.17.82/32 2>/dev/null || true; ip route del blackhole 167.94.146.48/32 2>/dev/null || true); (command -v nft >/dev/null 2>&1 && nft delete table inet exultia_vantage 2>/dev/null) || true; rm -f /etc/exultia/blocklists/ipsum-2026-11-02.list /var/lib/exultia/spool/threat_ips.table /var/spool/vantage/threat_ips.table

Tier 3

Serialized 10% Canary Ansible Playbook

Fleet configuration management

Hardened Ansible playbook with staged canary progression (serial: 10%), configuration validation, and handler reload.

---
- name: Kinetic Rapid Remediation - UVI-2026-11-00000036 (CRITICAL)
  hosts: all
  become: yes
  serial: "10%" # Canary Staged Rollout
  tasks:
    - name: Apply Hot-Mitigation Commands
      ansible.builtin.shell: |
        mkdir -p /etc/exultia/blocklists /var/lib/exultia/spool /var/spool/vantage
        printf "%b\n" "138.226.239.233\n138.226.239.234\n14.34.249.175\n103.159.2.113\n119.28.84.193\n167.94.146.58\n179.43.153.10\n18.218.118.203\n196.189.236.67\n199.165.159.89\n2.57.122.238\n220.80.223.144\n45.148.10.141\n45.148.10.240\n51.159.4.12\n77.239.124.2\n80.94.95.116\n102.220.161.85\n102.223.92.101\n107.0.200.227\n138.226.239.90\n147.185.132.219\n147.185.132.24\n164.30.17.82\n167.94.146.48\n167.94.146.50\n167.94.146.52\n167.94.146.54\n167.94.146.55\n167.94.146.56\n167.94.146.59\n170.231.236.98\n170.231.237.214\n185.191.236.38\n185.242.226.19\n189.204.230.91\n193.47.62.69\n197.221.232.44\n197.227.8.186\n199.165.159.105\n199.165.159.113\n199.165.159.185\n2.57.121.112\n2.57.121.25\n223.197.186.7\n3.129.187.38\n35.237.94.18\n37.187.35.26\n45.148.10.121\n45.148.10.151" > /etc/exultia/blocklists/ipsum-2026-11-02.list
        cp /etc/exultia/blocklists/ipsum-2026-11-02.list /var/lib/exultia/spool/threat_ips.table 2>/dev/null || true
        cp /etc/exultia/blocklists/ipsum-2026-11-02.list /var/spool/vantage/threat_ips.table 2>/dev/null || true
        touch /etc/hosts.deny && sed -i '/# BEGIN EXULTIA-IPBLOCK-2026-11-02/,/# END EXULTIA-IPBLOCK-2026-11-02/d' /etc/hosts.deny 2>/dev/null || true
        printf "# BEGIN EXULTIA-IPBLOCK-2026-11-02\nALL: 138.226.239.233, 138.226.239.234, 14.34.249.175, 103.159.2.113, 119.28.84.193, 167.94.146.58, 179.43.153.10, 18.218.118.203, 196.189.236.67, 199.165.159.89, 2.57.122.238, 220.80.223.144, 45.148.10.141, 45.148.10.240, 51.159.4.12, 77.239.124.2, 80.94.95.116, 102.220.161.85, 102.223.92.101, 107.0.200.227, 138.226.239.90, 147.185.132.219, 147.185.132.24, 164.30.17.82, 167.94.146.48\n# END EXULTIA-IPBLOCK-2026-11-02\n" >> /etc/hosts.deny
        (command -v nft >/dev/null 2>&1 && nft add table inet exultia_vantage 2>/dev/null && nft 'add set inet exultia_vantage threat_ips { type ipv4_addr; flags interval; }' 2>/dev/null && nft 'add chain inet exultia_vantage input { type filter hook input priority -10; policy accept; }' 2>/dev/null && nft add rule inet exultia_vantage input ip saddr @threat_ips drop 2>/dev/null && nft add element inet exultia_vantage threat_ips "{ 138.226.239.233, 138.226.239.234, 14.34.249.175, 103.159.2.113, 119.28.84.193, 167.94.146.58, 179.43.153.10, 18.218.118.203, 196.189.236.67, 199.165.159.89, 2.57.122.238, 220.80.223.144, 45.148.10.141, 45.148.10.240, 51.159.4.12, 77.239.124.2, 80.94.95.116, 102.220.161.85, 102.223.92.101, 107.0.200.227, 138.226.239.90, 147.185.132.219, 147.185.132.24, 164.30.17.82, 167.94.146.48, 167.94.146.50, 167.94.146.52, 167.94.146.54, 167.94.146.55, 167.94.146.56, 167.94.146.59, 170.231.236.98, 170.231.237.214, 185.191.236.38, 185.242.226.19, 189.204.230.91, 193.47.62.69, 197.221.232.44, 197.227.8.186, 199.165.159.105, 199.165.159.113, 199.165.159.185, 2.57.121.112, 2.57.121.25, 223.197.186.7, 3.129.187.38, 35.237.94.18, 37.187.35.26, 45.148.10.121, 45.148.10.151 }" 2>/dev/null) || true
        (ip route replace blackhole 138.226.239.233/32 2>/dev/null || true; ip route replace blackhole 138.226.239.234/32 2>/dev/null || true; ip route replace blackhole 14.34.249.175/32 2>/dev/null || true; ip route replace blackhole 103.159.2.113/32 2>/dev/null || true; ip route replace blackhole 119.28.84.193/32 2>/dev/null || true; ip route replace blackhole 167.94.146.58/32 2>/dev/null || true; ip route replace blackhole 179.43.153.10/32 2>/dev/null || true; ip route replace blackhole 18.218.118.203/32 2>/dev/null || true; ip route replace blackhole 196.189.236.67/32 2>/dev/null || true; ip route replace blackhole 199.165.159.89/32 2>/dev/null || true; ip route replace blackhole 2.57.122.238/32 2>/dev/null || true; ip route replace blackhole 220.80.223.144/32 2>/dev/null || true; ip route replace blackhole 45.148.10.141/32 2>/dev/null || true; ip route replace blackhole 45.148.10.240/32 2>/dev/null || true; ip route replace blackhole 51.159.4.12/32 2>/dev/null || true; ip route replace blackhole 77.239.124.2/32 2>/dev/null || true; ip route replace blackhole 80.94.95.116/32 2>/dev/null || true; ip route replace blackhole 102.220.161.85/32 2>/dev/null || true; ip route replace blackhole 102.223.92.101/32 2>/dev/null || true; ip route replace blackhole 107.0.200.227/32 2>/dev/null || true; ip route replace blackhole 138.226.239.90/32 2>/dev/null || true; ip route replace blackhole 147.185.132.219/32 2>/dev/null || true; ip route replace blackhole 147.185.132.24/32 2>/dev/null || true; ip route replace blackhole 164.30.17.82/32 2>/dev/null || true; ip route replace blackhole 167.94.146.48/32 2>/dev/null || true)
        (command -v pfctl >/dev/null 2>&1 && pfctl -t threat_ips -T replace -f /etc/exultia/blocklists/ipsum-2026-11-02.list 2>/dev/null) || true
      args:
        executable: /bin/sh
      register: kinetic_exec
      failed_when: kinetic_exec.rc != 0

    - name: Verify Post-Mitigation State
      ansible.builtin.shell: "test -s /etc/exultia/blocklists/ipsum-2026-11-02.list && grep -q "BEGIN EXULTIA-IPBLOCK-2026-11-02" /etc/hosts.deny"
      changed_when: false

Tier 2

Vendor OS Package Upgrade Commands

Native package manager reconciliation

ubuntuapt-get update -qq && apt-get install --only-upgrade -y perimeter 2>/dev/null || true

debianapt-get update -qq && apt-get install --only-upgrade -y perimeter 2>/dev/null || true

kaliapt-get update -qq && apt-get install --only-upgrade -y perimeter 2>/dev/null || true

linux-mintapt-get update -qq && apt-get install --only-upgrade -y perimeter 2>/dev/null || true

rockydnf upgrade -y perimeter 2>/dev/null || true

rheldnf upgrade -y perimeter 2>/dev/null || true

almalinuxdnf upgrade -y perimeter 2>/dev/null || true

oracle-linuxdnf upgrade -y perimeter 2>/dev/null || true

cloudlinuxdnf upgrade -y perimeter 2>/dev/null || true

amazon-linuxdnf upgrade -y perimeter 2>/dev/null || true

fedoradnf upgrade -y perimeter 2>/dev/null || true

openeulerdnf upgrade -y perimeter 2>/dev/null || true

azure-linuxtdnf update -y perimeter 2>/dev/null || true

photontdnf update -y perimeter 2>/dev/null || true

alpineapk add --upgrade perimeter 2>/dev/null || true

wolfiapk add --upgrade perimeter 2>/dev/null || true

susezypper --non-interactive update perimeter 2>/dev/null || true

archpacman -S --noconfirm perimeter 2>/dev/null || true

gentooemerge --update --oneshot perimeter 2>/dev/null || true

voidxbps-install -Su -y perimeter 2>/dev/null || true

nixosnix-env -u perimeter 2>/dev/null || true

openwrtopkg update && opkg upgrade perimeter 2>/dev/null || true

kernelmodprobe -r perimeter 2>/dev/null || true

macossoftwareupdate -i -a 2>/dev/null || true

talostalosctl upgrade-k8s 2>/dev/null || true

flatcarupdate_engine_client -check_for_update 2>/dev/null || true

freebsdpkg upgrade -y perimeter 2>/dev/null || true

openbsdsyspatch 2>/dev/null || true

netbsdpkgin -y upgrade 2>/dev/null || true

centos-streamdnf upgrade -y perimeter 2>/dev/null || true

opensuse-leapzypper --non-interactive update perimeter 2>/dev/null || true

fedora-coreosrpm-ostree install --apply-live -y perimeter 2>/dev/null || true

proxmoxapt-get update -qq && apt-get install --only-upgrade -y perimeter 2>/dev/null || true

truenas-scaleapt-get update -qq && apt-get install --only-upgrade -y perimeter 2>/dev/null || true

Full Standalone Hotfix Script

Complete, self-contained remediation script with privileges check, logging, pre-flight safety, and automatic rollback on verification failure:

#!/bin/sh
# ==============================================================================
# Exultia Surgical Remediation: UVI-2026-11-00000036
# Title: IPSum Multi-Blacklist Aggressor Digest (2026-11-02): 2,500 Host IPs (Max Score: 12/30+)
# CVSS Score: 9.1 (CRITICAL) | CISA KEV: NO
# Provenance: [email protected] (Cosign OIDC Keyless) | SLSA Level 3
# Generated by Exultia Autonomous Remediation Engine (https://exultia.tech/cve/UVI-2026-11-00000036)
# ==============================================================================
set -e

log() { echo "[Exultia] $(date +'%Y-%m-%d %H:%M:%S') $1"; }
err() { echo "[Exultia] ERROR: $1" >&2; exit 1; }

if [ "$(id -u)" -ne 0 ]; then
  err "Root privileges required. Run with sudo or as root."
fi

log "Initiating zero-downtime hot-mitigation for UVI-2026-11-00000036..."

# Apply mitigation commands
log "Executing: mkdir -p /etc/exultia/blocklists /var/lib/exultia/spool /var/spool/vantage"
mkdir -p /etc/exultia/blocklists /var/lib/exultia/spool /var/spool/vantage
log "Executing: printf \"%b\n\" \"138.226.239.233\n138.226.239.234\n14.34.249.175\n103.159.2.113\n119.28.84.193\n167.94.146.58\n179.43.153.10\n18.218.118.203\n196.189.236.67\n199.165.159.89\n2.57.122.238\n220.80.223.144\n45.148.10.141\n45.148.10.240\n51.159.4.12\n77.239.124.2\n80.94.95.116\n102.220.161.85\n102.223.92.101\n107.0.200.227\n138.226.239.90\n147.185.132.219\n147.185.132.24\n164.30.17.82\n167.94.146.48\n167.94.146.50\n167.94.146.52\n167.94.146.54\n167.94.146.55\n167.94.146.56\n167.94.146.59\n170.231.236.98\n170.231.237.214\n185.191.236.38\n185.242.226.19\n189.204.230.91\n193.47.62.69\n197.221.232.44\n197.227.8.186\n199.165.159.105\n199.165.159.113\n199.165.159.185\n2.57.121.112\n2.57.121.25\n223.197.186.7\n3.129.187.38\n35.237.94.18\n37.187.35.26\n45.148.10.121\n45.148.10.151\" > /etc/exultia/blocklists/ipsum-2026-11-02.list"
printf "%b\n" "138.226.239.233\n138.226.239.234\n14.34.249.175\n103.159.2.113\n119.28.84.193\n167.94.146.58\n179.43.153.10\n18.218.118.203\n196.189.236.67\n199.165.159.89\n2.57.122.238\n220.80.223.144\n45.148.10.141\n45.148.10.240\n51.159.4.12\n77.239.124.2\n80.94.95.116\n102.220.161.85\n102.223.92.101\n107.0.200.227\n138.226.239.90\n147.185.132.219\n147.185.132.24\n164.30.17.82\n167.94.146.48\n167.94.146.50\n167.94.146.52\n167.94.146.54\n167.94.146.55\n167.94.146.56\n167.94.146.59\n170.231.236.98\n170.231.237.214\n185.191.236.38\n185.242.226.19\n189.204.230.91\n193.47.62.69\n197.221.232.44\n197.227.8.186\n199.165.159.105\n199.165.159.113\n199.165.159.185\n2.57.121.112\n2.57.121.25\n223.197.186.7\n3.129.187.38\n35.237.94.18\n37.187.35.26\n45.148.10.121\n45.148.10.151" > /etc/exultia/blocklists/ipsum-2026-11-02.list
log "Executing: cp /etc/exultia/blocklists/ipsum-2026-11-02.list /var/lib/exultia/spool/threat_ips.table 2>/dev/null || true"
cp /etc/exultia/blocklists/ipsum-2026-11-02.list /var/lib/exultia/spool/threat_ips.table 2>/dev/null || true
log "Executing: cp /etc/exultia/blocklists/ipsum-2026-11-02.list /var/spool/vantage/threat_ips.table 2>/dev/null || true"
cp /etc/exultia/blocklists/ipsum-2026-11-02.list /var/spool/vantage/threat_ips.table 2>/dev/null || true
log "Executing: touch /etc/hosts.deny && sed -i '/# BEGIN EXULTIA-IPBLOCK-2026-11-02/,/# END EXULTIA-IPBLOCK-2026-11-02/d' /etc/hosts.deny 2>/dev/null || true"
touch /etc/hosts.deny && sed -i '/# BEGIN EXULTIA-IPBLOCK-2026-11-02/,/# END EXULTIA-IPBLOCK-2026-11-02/d' /etc/hosts.deny 2>/dev/null || true
log "Executing: printf \"# BEGIN EXULTIA-IPBLOCK-2026-11-02\nALL: 138.226.239.233, 138.226.239.234, 14.34.249.175, 103.159.2.113, 119.28.84.193, 167.94.146.58, 179.43.153.10, 18.218.118.203, 196.189.236.67, 199.165.159.89, 2.57.122.238, 220.80.223.144, 45.148.10.141, 45.148.10.240, 51.159.4.12, 77.239.124.2, 80.94.95.116, 102.220.161.85, 102.223.92.101, 107.0.200.227, 138.226.239.90, 147.185.132.219, 147.185.132.24, 164.30.17.82, 167.94.146.48\n# END EXULTIA-IPBLOCK-2026-11-02\n\" >> /etc/hosts.deny"
printf "# BEGIN EXULTIA-IPBLOCK-2026-11-02\nALL: 138.226.239.233, 138.226.239.234, 14.34.249.175, 103.159.2.113, 119.28.84.193, 167.94.146.58, 179.43.153.10, 18.218.118.203, 196.189.236.67, 199.165.159.89, 2.57.122.238, 220.80.223.144, 45.148.10.141, 45.148.10.240, 51.159.4.12, 77.239.124.2, 80.94.95.116, 102.220.161.85, 102.223.92.101, 107.0.200.227, 138.226.239.90, 147.185.132.219, 147.185.132.24, 164.30.17.82, 167.94.146.48\n# END EXULTIA-IPBLOCK-2026-11-02\n" >> /etc/hosts.deny
log "Executing: (command -v nft >/dev/null 2>&1 && nft add table inet exultia_vantage 2>/dev/null && nft 'add set inet exultia_vantage threat_ips { type ipv4_addr; flags interval; }' 2>/dev/null && nft 'add chain inet exultia_vantage input { type filter hook input priority -10; policy accept; }' 2>/dev/null && nft add rule inet exultia_vantage input ip saddr @threat_ips drop 2>/dev/null && nft add element inet exultia_vantage threat_ips \"{ 138.226.239.233, 138.226.239.234, 14.34.249.175, 103.159.2.113, 119.28.84.193, 167.94.146.58, 179.43.153.10, 18.218.118.203, 196.189.236.67, 199.165.159.89, 2.57.122.238, 220.80.223.144, 45.148.10.141, 45.148.10.240, 51.159.4.12, 77.239.124.2, 80.94.95.116, 102.220.161.85, 102.223.92.101, 107.0.200.227, 138.226.239.90, 147.185.132.219, 147.185.132.24, 164.30.17.82, 167.94.146.48, 167.94.146.50, 167.94.146.52, 167.94.146.54, 167.94.146.55, 167.94.146.56, 167.94.146.59, 170.231.236.98, 170.231.237.214, 185.191.236.38, 185.242.226.19, 189.204.230.91, 193.47.62.69, 197.221.232.44, 197.227.8.186, 199.165.159.105, 199.165.159.113, 199.165.159.185, 2.57.121.112, 2.57.121.25, 223.197.186.7, 3.129.187.38, 35.237.94.18, 37.187.35.26, 45.148.10.121, 45.148.10.151 }\" 2>/dev/null) || true"
(command -v nft >/dev/null 2>&1 && nft add table inet exultia_vantage 2>/dev/null && nft 'add set inet exultia_vantage threat_ips { type ipv4_addr; flags interval; }' 2>/dev/null && nft 'add chain inet exultia_vantage input { type filter hook input priority -10; policy accept; }' 2>/dev/null && nft add rule inet exultia_vantage input ip saddr @threat_ips drop 2>/dev/null && nft add element inet exultia_vantage threat_ips "{ 138.226.239.233, 138.226.239.234, 14.34.249.175, 103.159.2.113, 119.28.84.193, 167.94.146.58, 179.43.153.10, 18.218.118.203, 196.189.236.67, 199.165.159.89, 2.57.122.238, 220.80.223.144, 45.148.10.141, 45.148.10.240, 51.159.4.12, 77.239.124.2, 80.94.95.116, 102.220.161.85, 102.223.92.101, 107.0.200.227, 138.226.239.90, 147.185.132.219, 147.185.132.24, 164.30.17.82, 167.94.146.48, 167.94.146.50, 167.94.146.52, 167.94.146.54, 167.94.146.55, 167.94.146.56, 167.94.146.59, 170.231.236.98, 170.231.237.214, 185.191.236.38, 185.242.226.19, 189.204.230.91, 193.47.62.69, 197.221.232.44, 197.227.8.186, 199.165.159.105, 199.165.159.113, 199.165.159.185, 2.57.121.112, 2.57.121.25, 223.197.186.7, 3.129.187.38, 35.237.94.18, 37.187.35.26, 45.148.10.121, 45.148.10.151 }" 2>/dev/null) || true
log "Executing: (ip route replace blackhole 138.226.239.233/32 2>/dev/null || true; ip route replace blackhole 138.226.239.234/32 2>/dev/null || true; ip route replace blackhole 14.34.249.175/32 2>/dev/null || true; ip route replace blackhole 103.159.2.113/32 2>/dev/null || true; ip route replace blackhole 119.28.84.193/32 2>/dev/null || true; ip route replace blackhole 167.94.146.58/32 2>/dev/null || true; ip route replace blackhole 179.43.153.10/32 2>/dev/null || true; ip route replace blackhole 18.218.118.203/32 2>/dev/null || true; ip route replace blackhole 196.189.236.67/32 2>/dev/null || true; ip route replace blackhole 199.165.159.89/32 2>/dev/null || true; ip route replace blackhole 2.57.122.238/32 2>/dev/null || true; ip route replace blackhole 220.80.223.144/32 2>/dev/null || true; ip route replace blackhole 45.148.10.141/32 2>/dev/null || true; ip route replace blackhole 45.148.10.240/32 2>/dev/null || true; ip route replace blackhole 51.159.4.12/32 2>/dev/null || true; ip route replace blackhole 77.239.124.2/32 2>/dev/null || true; ip route replace blackhole 80.94.95.116/32 2>/dev/null || true; ip route replace blackhole 102.220.161.85/32 2>/dev/null || true; ip route replace blackhole 102.223.92.101/32 2>/dev/null || true; ip route replace blackhole 107.0.200.227/32 2>/dev/null || true; ip route replace blackhole 138.226.239.90/32 2>/dev/null || true; ip route replace blackhole 147.185.132.219/32 2>/dev/null || true; ip route replace blackhole 147.185.132.24/32 2>/dev/null || true; ip route replace blackhole 164.30.17.82/32 2>/dev/null || true; ip route replace blackhole 167.94.146.48/32 2>/dev/null || true)"
(ip route replace blackhole 138.226.239.233/32 2>/dev/null || true; ip route replace blackhole 138.226.239.234/32 2>/dev/null || true; ip route replace blackhole 14.34.249.175/32 2>/dev/null || true; ip route replace blackhole 103.159.2.113/32 2>/dev/null || true; ip route replace blackhole 119.28.84.193/32 2>/dev/null || true; ip route replace blackhole 167.94.146.58/32 2>/dev/null || true; ip route replace blackhole 179.43.153.10/32 2>/dev/null || true; ip route replace blackhole 18.218.118.203/32 2>/dev/null || true; ip route replace blackhole 196.189.236.67/32 2>/dev/null || true; ip route replace blackhole 199.165.159.89/32 2>/dev/null || true; ip route replace blackhole 2.57.122.238/32 2>/dev/null || true; ip route replace blackhole 220.80.223.144/32 2>/dev/null || true; ip route replace blackhole 45.148.10.141/32 2>/dev/null || true; ip route replace blackhole 45.148.10.240/32 2>/dev/null || true; ip route replace blackhole 51.159.4.12/32 2>/dev/null || true; ip route replace blackhole 77.239.124.2/32 2>/dev/null || true; ip route replace blackhole 80.94.95.116/32 2>/dev/null || true; ip route replace blackhole 102.220.161.85/32 2>/dev/null || true; ip route replace blackhole 102.223.92.101/32 2>/dev/null || true; ip route replace blackhole 107.0.200.227/32 2>/dev/null || true; ip route replace blackhole 138.226.239.90/32 2>/dev/null || true; ip route replace blackhole 147.185.132.219/32 2>/dev/null || true; ip route replace blackhole 147.185.132.24/32 2>/dev/null || true; ip route replace blackhole 164.30.17.82/32 2>/dev/null || true; ip route replace blackhole 167.94.146.48/32 2>/dev/null || true)
log "Executing: (command -v pfctl >/dev/null 2>&1 && pfctl -t threat_ips -T replace -f /etc/exultia/blocklists/ipsum-2026-11-02.list 2>/dev/null) || true"
(command -v pfctl >/dev/null 2>&1 && pfctl -t threat_ips -T replace -f /etc/exultia/blocklists/ipsum-2026-11-02.list 2>/dev/null) || true

# Execute verification sentinel probe
log "Executing verification sentinel probe..."
if test -s /etc/exultia/blocklists/ipsum-2026-11-02.list && grep -q "BEGIN EXULTIA-IPBLOCK-2026-11-02" /etc/hosts.deny; then
  log "SUCCESS: Verification passed. UVI-2026-11-00000036 successfully mitigated."
else
  log "CRITICAL: Verification sentinel failed! Initiating emergency rollback..."
  sed -i '/# BEGIN EXULTIA-IPBLOCK-2026-11-02/,/# END EXULTIA-IPBLOCK-2026-11-02/d' /etc/hosts.deny 2>/dev/null || true; (ip route del blackhole 138.226.239.233/32 2>/dev/null || true; ip route del blackhole 138.226.239.234/32 2>/dev/null || true; ip route del blackhole 14.34.249.175/32 2>/dev/null || true; ip route del blackhole 103.159.2.113/32 2>/dev/null || true; ip route del blackhole 119.28.84.193/32 2>/dev/null || true; ip route del blackhole 167.94.146.58/32 2>/dev/null || true; ip route del blackhole 179.43.153.10/32 2>/dev/null || true; ip route del blackhole 18.218.118.203/32 2>/dev/null || true; ip route del blackhole 196.189.236.67/32 2>/dev/null || true; ip route del blackhole 199.165.159.89/32 2>/dev/null || true; ip route del blackhole 2.57.122.238/32 2>/dev/null || true; ip route del blackhole 220.80.223.144/32 2>/dev/null || true; ip route del blackhole 45.148.10.141/32 2>/dev/null || true; ip route del blackhole 45.148.10.240/32 2>/dev/null || true; ip route del blackhole 51.159.4.12/32 2>/dev/null || true; ip route del blackhole 77.239.124.2/32 2>/dev/null || true; ip route del blackhole 80.94.95.116/32 2>/dev/null || true; ip route del blackhole 102.220.161.85/32 2>/dev/null || true; ip route del blackhole 102.223.92.101/32 2>/dev/null || true; ip route del blackhole 107.0.200.227/32 2>/dev/null || true; ip route del blackhole 138.226.239.90/32 2>/dev/null || true; ip route del blackhole 147.185.132.219/32 2>/dev/null || true; ip route del blackhole 147.185.132.24/32 2>/dev/null || true; ip route del blackhole 164.30.17.82/32 2>/dev/null || true; ip route del blackhole 167.94.146.48/32 2>/dev/null || true); (command -v nft >/dev/null 2>&1 && nft delete table inet exultia_vantage 2>/dev/null) || true; rm -f /etc/exultia/blocklists/ipsum-2026-11-02.list /var/lib/exultia/spool/threat_ips.table /var/spool/vantage/threat_ips.table
  err "Rollback complete. System restored to baseline state."
fi