Executive assessment
Today's brief leads with Researchers Demonstrate Node2Shell RCE Exploit on Node.js Build Using Crafted Brotli Data. All 15 selected findings retain their own technical scope, action, observed status, and evidence limits.
Panel synthesis: Zimbra CVE-2026-73570 is actively exploited in the wild with clear detection and remediation guidance, making it the immediate tactical priority; Pillow's CRITICAL RCE with proof-of-concept is the parallel strategic concern due to supply-chain reach across Python environments. Themes: Remote code execution dominates this cycle's threat landscape; Supply-chain library vulnerabilities (Pillow, pypdf, Node.js, body-parser) compound exposure across industries; Network isolation and appliance hardening remain critical first controls. Patch order: Finding 07 (actively exploited in the wild; requires immediate incident response readiness and forensic monitoring); Finding 03 (CRITICAL RCE in Pillow (Python imaging library) with proof-of-concept; affects Python environments across industries); Finding 01 (CRITICAL RCE via Node.js with proof-of-concept available; affects web and application infrastructure); Finding 02 (CRITICAL severity: eight max-severity RCE and auth-bypass flaws across four HPE AOS versions); Finding 11 (Widely-used PDF processing library; fix available in 6.21.2 with workaround patches provided).
Also today: 9 more virtualenv CVEs (CVE-2026-115586, CVE-2026-113713, CVE-2026-113717, CVE-2026-113714, CVE-2026-113718, CVE-2026-113720, CVE-2026-113723, CVE-2026-113715, CVE-2026-113719) in the same disclosure wave as the virtualenv card of 2026-10-22; none reported exploited; carried as a note rather than a finding.
Finding 01 — Researchers Demonstrate Node2Shell RCE Exploit on Node.js Build Using Crafted Brotli Data
What changed: Malicious Brotli data can make an application on an official build of Node.js run attacker-supplied code, security researchers at Imperva have demonstrated.
Technical evidence: CVE-2026-111497; CVSS v4.0 9.2; weakness CWE-787, CWE-252; technical confidence High.
Why it matters: Public exploit code is available, so weaponisation is low-effort; prioritise exposure validation and patching ahead of routine cycles.
Analyst note: Where practical, temporarily limit untrusted Brotli traffic on affected paths while updates roll out. Prioritise investigation of unexpected process exits and decoder errors during decompression, correlating them with the runtime, application logs and compressed-data source. Imperva Threat Research reports that its standalone proof of concept ran code carried in a Brotli response or request body on the official Node.js 24.22.0 Linux arm64 image. ([imperva.com](https://www.imperva.com/blog/node2shell-from-brotli-data-to-remote-code-execution/), [nodejs.org](https://nodejs.org/en/blog/vulnerability/october-2026-security-releases))
Affected: Node.js 22.x, 24.x and 26.x. ([nodejs.org](https://nodejs.org/en/blog/vulnerability/october-2026-security-releases))
Fix: Node.js 22.23.4, 24.22.1 and 26.12.1. ([imperva.com](https://www.imperva.com/blog/node2shell-from-brotli-data-to-remote-code-execution/))
Action: Map CVE-2026-111497 to owned assets, confirm the affected and fixed versions in the cited source, deploy the applicable remediation, and retain evidence of the exposure decision.
[Evidence source: thehackernews.com](https://thehackernews.com/2026/10/researchers-demonstrate-node2shell-rce.html)
Finding 02 — Multiple vulnerabilities in HPE
What changed: HPE patched 72 ArubaOS vulnerabilities, including eight CVSS 10.0 authentication-bypass, command-injection, buffer-overflow, and SQL-injection flaws that can lead to remote code execution. HPE reported no public exploit code or known in-the-wild exploitation at release.
Technical evidence: CVE-2026-79844; CVSS v3.1 10; weakness CWE-288; technical confidence High.
Why it matters: The Critical priority moves this beyond routine tracking and requires exposure validation, remediation, and compromise assessment.
Analyst note: Restrict the CLI and web-based management interfaces to a dedicated layer 2 segment or VLAN, and/or control them with layer 3 or higher firewall policies. Enable accounting controls to track and log user activity and resource usage. HPE Networking reports that it was not aware of public discussion or exploit code targeting the listed vulnerabilities at release. ([support.hpe.com](https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05162en_us&docLocale=en_US))
Affected: AOS-10.8.x.x 10.8.1.1 and below; AOS-10.7.x.x 10.7.2.6 and below; AOS-10.4.x.x 10.4.1.13 and below; AOS-8.13.x.x 8.13.3.0 and below; AOS-8.10.x.x 8.10.0.23 and below. ([support.hpe.com](https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05162en_us&docLocale=en_US))
Fix: AOS-10.8.x.x 10.8.1.2 and later; AOS-10.7.x.x 10.7.2.7 and later; AOS-10.4.x.x 10.4.1.14 and later; AOS-8.13.x.x 8.13.3.1 and above; AOS-8.10.x.x 8.10.0.24 and above. ([support.hpe.com](https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05162en_us&docLocale=en_US))
Panel assessment: Patch within this week: whilst no public exploitation is reported and EPSS scores are moderate (33–42nd percentile), auth-bypass and RCE flaws in management interfaces are high-confidence targets whose compromise reaches across the network control plane. Attack path is direct: unauthenticated access to CLI or web management escalates to code execution and control of the AOS device and its managed infrastructure. (priority: this week)
Action: Map CVE-2026-79844 to owned assets, confirm the affected and fixed versions in the cited source, deploy the applicable remediation, and retain evidence of the exposure decision.
[Evidence source: support.hpe.com](https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05162en_us&docLocale=en_US)
Finding 03 — Critical Flaw in Python’s Popular Pillow Image Library Allows Code Execution via a Crafted Image
What changed: CVE-2026-112900 is an EPS filename command-injection flaw in Pillow's Ghostscript invocation that can allow operating-system command execution when a server processes a crafted image. The finding is single-source and requires confirmation against the upstream advisory before broad deployment claims are made.
Technical evidence: CVE-2026-112900; CVSS v4.0 9.2; weakness CWE-78, CWE-88; technical confidence High.
Why it matters: The Critical priority moves this beyond routine tracking and requires exposure validation, remediation, and compromise assessment.
Analyst note: If patching is not immediately possible, normalise every filename to an absolute path before it reaches Pillow's EPS handling, preventing leading '-', '--' or '@' tokens from reaching Ghostscript. The upstream Pillow GitHub advisory includes argument-injection and RCE proof-of-concept instructions attributed to Chanu Kang of CysecLab at KAIST. ([github.com](https://github.com/python-pillow/Pillow/security/advisories/GHSA-w889-685w-c8fh), [api.osv.dev](https://api.osv.dev/v1/vulns/GHSA-w889-685w-c8fh))
Affected: Pillow versions from 2.6.0 up to, but excluding, 13.0.0. ([api.osv.dev](https://api.osv.dev/v1/vulns/GHSA-w889-685w-c8fh))
Fix: Pillow 13.0.0. ([api.osv.dev](https://api.osv.dev/v1/vulns/GHSA-w889-685w-c8fh))
Action: Map CVE-2026-112900 to owned assets, confirm the affected and fixed versions in the cited source, deploy the applicable remediation, and retain evidence of the exposure decision.
[Evidence source: thehackernews.com](https://thehackernews.com/2026/10/critical-flaw-in-pythons-popular-pillow.html)
Finding 04 — Multiple vulnerabilities in Kiloview E3 NDI Encoder
What changed: Nine flaws in Kiloview E3 firmware before 1.30 include authenticated root command injection, unauthenticated information disclosure and configuration changes, path traversal, hard-coded credentials, and session weaknesses. CISA says successful exploitation can fully compromise the device and recommends updating to firmware 1.30; it reports no known public exploitation.
Technical evidence: CVE-2026-109122; CVSS v3.1 9.1; weakness CWE-78; technical confidence High.
Why it matters: The Critical priority moves this beyond routine tracking and requires exposure validation, remediation, and compromise assessment.
Analyst note: Minimise network exposure for the devices and ensure they are not internet-accessible. Place them behind firewalls, isolate them from business networks, and use an up-to-date VPN where remote access is required. CISA reports no known public exploitation specifically targeting these vulnerabilities. ([cisa.gov](https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-01))
Affected: Kiloview E3 firmware versions earlier than 1.30. ([cisa.gov](https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-01))
Fix: Kiloview E3 firmware version 1.30. ([cisa.gov](https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-01))
Action: Map CVE-2026-109122 to owned assets, confirm the affected and fixed versions in the cited source, deploy the applicable remediation, and retain evidence of the exposure decision.
[Evidence source: cisa.gov](https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-01)
Finding 05 — Multiple vulnerabilities in Laravel TokenGuard
What changed: Laravel TokenGuard carries 2 CVEs across 2 advisories: Improper Authentication; Unsafe Reflection. CVE coverage: CVE-2026-114509, CVE-2026-114508.
Technical evidence: CVE-2026-114509; CVSS v4.0 9.2; weakness CWE-287, CWE-1287; technical confidence High.
Why it matters: The Critical priority moves this beyond routine tracking and requires exposure validation, remediation, and compromise assessment.
Observed status: Observed in-the-wild exploitation status is unknown.
Action: Map CVE-2026-114509 to owned assets, confirm the affected and fixed versions in the cited source, deploy the applicable remediation, and retain evidence of the exposure decision.
Evidence limits: fixed version or patch state unknown
[Evidence source: github.com](https://github.com/advisories/GHSA-f9x3-7vq9-cph6)
Finding 06 — Multiple vulnerabilities in Wasmtime
What changed: CVE coverage: CVE-2026-115892, CVE-2026-115889. The cited advisories disclose: Panic lowering a host-created component model stream into a guest that expects a different payload type; Bit-packing in Cranelift compiler causes silent overflow and miscompilation.
Technical evidence: CVE-2026-115889; CVSS v3.1 9.9; weakness CWE-197, CWE-843; technical confidence Medium.
Why it matters: The Critical priority moves this beyond routine tracking and requires exposure validation, remediation, and compromise assessment.
Observed status: Observed in-the-wild exploitation status is unknown.
Analyst note: Until patched, do not run very large Wasm function bodies with the Cranelift backend. For component-model streams or futures, use only statically typed readers with concrete payload types throughout. ([github.com](https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-9pvw-hwfg-92h5), [github.com](https://github.com/advisories/GHSA-897f-g5gm-fmxm))
Fix: CVE-2026-115892: Wasmtime 48.0.7 and 49.0.4. CVE-2026-115889: Wasmtime 36.0.19 and 43.0.0. ([github.com](https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-9pvw-hwfg-92h5), [github.com](https://github.com/advisories/GHSA-897f-g5gm-fmxm))
Action: Map CVE-2026-115889 to owned assets, confirm the affected and fixed versions in the cited source, deploy the applicable remediation, and retain evidence of the exposure decision.
[Evidence source: github.com](https://github.com/advisories/GHSA-9pvw-hwfg-92h5)
Finding 07 — How CVE-2026-73570 turns a Zimbra log file into remote code execution
What changed: Elastic reproduced the Zimbra command-injection path and found that several public proofs of concept write a payload that Swatchdog never matches, which can make a vulnerable server appear patched during testing. The source records a remediation change and exploitation signal, but no Tier-0 corroboration was available in this cycle.
Technical evidence: CVE-2026-73570; CVSS v3.1 8.9; weakness CWE-78; technical confidence High.
Why it matters: Reported active exploitation elevates this above routine patching: validate exposure immediately, remediate, and assess for prior compromise.
Observed status: Observed in-the-wild exploitation is confirmed.
Analyst note: Monitor /var/log/zimbra.log for malicious 'Service status change' entries and inspect files created by the zimbra user during the previous 30 days in /opt/zimbra/jetty/webapps/, /opt/zimbra/jetty_base/webapps/ and /tmp/. CERT Polska reports an active campaign exploiting CVE-2026-73570. ([moje.cert.pl](https://moje.cert.pl/komunikaty/2026/145/aktywnie-wykorzystywana-podatnosc-w-zimbra-collaboration-suite/), [cveawg.mitre.org](https://cveawg.mitre.org/api/cve/CVE-2026-73570), [elastic.co](https://www.elastic.co/security-labs/threat-command/command-injection-zimbra-cve-2026-73570))
Affected: Zimbra Collaboration before 10.1.20 when the optional zimbra-snmp package is installed and SNMP notifications are enabled. ([cveawg.mitre.org](https://cveawg.mitre.org/api/cve/CVE-2026-73570))
Fix: Zimbra 10.1.20 or later. ([elastic.co](https://www.elastic.co/security-labs/threat-command/command-injection-zimbra-cve-2026-73570))
Panel assessment: Actively exploited, CVSS 8.9 RCE affecting Zimbra deployments with optional SNMP notifications enabled. Public POCs evade detection, so patching validation requires direct inspection of /var/log/zimbra.log and recent files in /opt/zimbra/jetty/webapps/ and /tmp/. First action: check if zimbra-snmp is installed with notifications enabled; if yes, upgrade to 10.1.20 immediately. (priority: patch now)
Action: Map CVE-2026-73570 to owned assets, confirm the affected and fixed versions in the cited source, deploy the applicable remediation, and retain evidence of the exposure decision.
[Evidence source: elastic.co](https://www.elastic.co/security-labs/threat-command/command-injection-zimbra-cve-2026-73570)
Finding 08 — InterSystems IRIS for Health: Cleartext Transmission of Sensitive Information
What changed: Successful exploitation of this vulnerability could allow an attacker to view transmitted data and use that data to log into the device.
Technical evidence: CVE-2026-111594; CVSS v3.1 8.1; weakness CWE-319; technical confidence High.
Why it matters: The High priority moves this beyond routine tracking and requires exposure validation, remediation, and compromise assessment.
Analyst note: Configure the IRIS superserver to require SSL/TLS. Minimize network exposure, keep the system inaccessible from the internet, and place it behind a firewall isolated from business networks. CISA reports no known public exploitation specifically targeting this vulnerability. ([raw.githubusercontent.com](https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2026/icsma-26-295-01.json))
Action: Map CVE-2026-111594 to owned assets, confirm the affected and fixed versions in the cited source, deploy the applicable remediation, and retain evidence of the exposure decision.
Evidence limits: fixed version or patch state unknown
[Evidence source: cisa.gov](https://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-295-01)
Finding 09 — Multiple vulnerabilities in filelock ReadWriteLock
What changed: filelock ReadWriteLock carries 6 CVEs across 2 advisories: Race Condition Enabling Link Following; SoftFileLock evicts a fresh lock file whose watched age another local user's pre-dated file passed on through inode reuse; SoftFileLock stale-break restore follows a swapped-in symbolic link and hard-links a file of the user running the lock into the lock directory; ReadWriteLock on the hard-link route deletes any directory another user renames onto its .filelock- link directory name; ReadWriteLock on Windows acts on SQLite side files another local user places beside its database; On Windows an oplock on a soft lock's marker holds SoftFileLock.acquire past its timeout and blocks the stale break. CVE coverage: CVE-2026-112906, CVE-2026-112914, CVE-2026-112937, CVE-2026-112913, CVE-2026-112907, CVE-2026-112940.
Technical evidence: CVE-2026-112940; CVSS v3.1 7.1; weakness CWE-363; technical confidence High.
Why it matters: The High priority moves this beyond routine tracking and requires exposure validation, remediation, and compromise assessment.
Observed status: Observed in-the-wild exploitation status is unknown.
Action: Map CVE-2026-112940 to owned assets, confirm the affected and fixed versions in the cited source, deploy the applicable remediation, and retain evidence of the exposure decision.
Evidence limits: fixed version or patch state unknown
[Evidence source: github.com](https://github.com/advisories/GHSA-v4x8-3wr5-3wq8)
Finding 10 — Multiple vulnerabilities in vLLM
What changed: vLLM carries 2 CVEs across 2 advisories: Insufficient Verification of Data Authenticity; Uncontrolled Resource Consumption. CVE coverage: CVE-2026-114050, CVE-2026-114055.
Technical evidence: CVE-2026-114055; CVSS v4.0 8.7; weakness CWE-400; technical confidence High.
Why it matters: The High priority moves this beyond routine tracking and requires exposure validation, remediation, and compromise assessment.
Observed status: Observed in-the-wild exploitation status is unknown.
Action: Map CVE-2026-114055 to owned assets, confirm the affected and fixed versions in the cited source, deploy the applicable remediation, and retain evidence of the exposure decision.
Evidence limits: fixed version or patch state unknown
[Evidence source: github.com](https://github.com/advisories/GHSA-gx7p-2j49-hfq4)
Finding 11 — Multiple vulnerabilities in pypdf
What changed: CVE coverage: CVE-2026-115572, CVE-2026-115580, CVE-2026-115585. The cited advisories disclose: repeated references to the same missing object; large xref table header limits.
Technical evidence: CVE-2026-115572; CVSS v4.0 7.1; weakness CWE-400; technical confidence High.
Why it matters: The High priority moves this beyond routine tracking and requires exposure validation, remediation, and compromise assessment.
Observed status: Observed in-the-wild exploitation status is unknown.
Analyst note: If upgrading is not possible, apply the changes from pypdf PR #4239 for CVE-2026-115580 and PR #4240 for CVE-2026-115572 and CVE-2026-115585. ([github.com](https://github.com/py-pdf/pypdf/security/advisories/GHSA-6c7f-9265-g8fw), [github.com](https://github.com/py-pdf/pypdf/security/advisories/GHSA-gmh7-3g9r-mjh5), [github.com](https://github.com/py-pdf/pypdf/security/advisories/GHSA-jr96-gvgh-j3r4), +3 more)
Affected: pypdf versions before 6.21.2. ([cveawg.mitre.org](https://cveawg.mitre.org/api/cve/CVE-2026-115572), [cveawg.mitre.org](https://cveawg.mitre.org/api/cve/CVE-2026-115580), [cveawg.mitre.org](https://cveawg.mitre.org/api/cve/CVE-2026-115585))
Fix: pypdf 6.21.2 fixes all three vulnerabilities. ([github.com](https://github.com/py-pdf/pypdf/security/advisories/GHSA-6c7f-9265-g8fw), [github.com](https://github.com/py-pdf/pypdf/security/advisories/GHSA-gmh7-3g9r-mjh5), [github.com](https://github.com/py-pdf/pypdf/security/advisories/GHSA-jr96-gvgh-j3r4))
Action: Map CVE-2026-115572 to owned assets, confirm the affected and fixed versions in the cited source, deploy the applicable remediation, and retain evidence of the exposure decision.
[Evidence source: github.com](https://github.com/advisories/GHSA-6c7f-9265-g8fw)
Finding 12 — body-parser vulnerable to Denial of Service via trailing bytes after a compressed request body.
What changed: GitHub Advisory Database published GHSA-27r3-jxmh-p828 for CVE-2026-111181 (body-parser): Uncaught Exception, CVSS v3.1 7.5; affected: body-parser versions before 1.20.9 and versions from 2.0.0 before 2.4.0.
Technical evidence: CVE-2026-111181; CVSS v3.1 7.5; weakness CWE-248; technical confidence High.
Why it matters: The High priority moves this beyond routine tracking and requires exposure validation, remediation, and compromise assessment.
Analyst note: If compressed request bodies are not needed, pass inflate: false to body-parser; this rejects encoded requests before a decompression stream is created. CISA ADP Vulnrichment reports exploitation as 'none'. ([raw.githubusercontent.com](https://raw.githubusercontent.com/github/advisory-database/main/advisories/github-reviewed/2026/10/GHSA-27r3-jxmh-p828/GHSA-27r3-jxmh-p828.json), [cveawg.mitre.org](https://cveawg.mitre.org/api/cve/CVE-2026-111181))
Affected: body-parser versions before 1.20.9 and versions from 2.0.0 before 2.4.0. ([cveawg.mitre.org](https://cveawg.mitre.org/api/cve/CVE-2026-111181))
Fix: body-parser 1.20.9 and 2.4.0. ([raw.githubusercontent.com](https://raw.githubusercontent.com/github/advisory-database/main/advisories/github-reviewed/2026/10/GHSA-27r3-jxmh-p828/GHSA-27r3-jxmh-p828.json))
Action: Map CVE-2026-111181 to owned assets, confirm the affected and fixed versions in the cited source, deploy the applicable remediation, and retain evidence of the exposure decision.
[Evidence source: github.com](https://github.com/advisories/GHSA-27r3-jxmh-p828)
Finding 13 — Strands Agents SDK: Exposure of data element to wrong session in the A2A Server
What changed: GitHub Advisory Database published GHSA-4v6f-7vjh-6x4m for CVE-2026-115419 (Strands Agents SDK): Exposure of Data Element to Wrong Session, CVSS v3.1 8.1; affected: strands-agents (Python): all versions containing the multiagent.a2a module below 1.43.0; @strands-agents/sdk (TypeScript): versions below 1.5.0.
Technical evidence: CVE-2026-115419; CVSS v3.1 8.1; weakness CWE-488; technical confidence High.
Why it matters: The High priority moves this beyond routine tracking and requires exposure validation, remediation, and compromise assessment.
Observed status: Observed in-the-wild exploitation status is unknown.
Analyst note: Until you upgrade, do not expose an A2A server to more than one user or tenant. If multiple callers need access, run a separate A2A server instance for each user or tenant. ([aws.amazon.com](https://aws.amazon.com/security/security-bulletins/2026-146-aws/))
Affected: strands-agents (Python): all versions containing the multiagent.a2a module below 1.43.0; @strands-agents/sdk (TypeScript): versions below 1.5.0. ([aws.amazon.com](https://aws.amazon.com/security/security-bulletins/2026-146-aws/))
Fix: strands-agents 1.43.0 and @strands-agents/sdk 1.5.0. ([aws.amazon.com](https://aws.amazon.com/security/security-bulletins/2026-146-aws/))
Action: Map CVE-2026-115419 to owned assets, confirm the affected and fixed versions in the cited source, deploy the applicable remediation, and retain evidence of the exposure decision.
[Evidence source: github.com](https://github.com/advisories/GHSA-4v6f-7vjh-6x4m)
Finding 14 — Fortinet Releases Security Hardening Release for Multiple Products
What changed: Fortinet issued advance hardening updates for FortiOS, FortiManager, FortiAnalyzer, FortiMail, and FortiAuthenticator before publishing full vulnerability details on 10 November. NHS England says the release addresses multiple critical and high-severity issues and is intended to narrow the patch-to-exploit window.
Why it matters: The cited reporting affects widely deployed technology, so exposure validation and source verification need explicit ownership.
Observed status: Observed in-the-wild exploitation status is unknown.
Action: Review the cited source, validate exposure of the affected technology in owned environments, apply available vendor guidance, and retain evidence of the exposure decision.
Evidence limits: grounded severity unavailable
[Evidence source: digital.nhs.uk](https://digital.nhs.uk/cyber-alerts/2026/cc-4879)
Finding 15 — Cisco Informational for Emergency Distrust of eMudhra Root and Intermediate Certificate Authorities
What changed: Between October 17 and October 20, 2026, a critical security compromise involving Certificate Authorities that are managed by eMudhra was uncovered. A security researcher demonstrated that the private keys for eight eMudhra intermediate certificates were fundamentally broken due to an unprecedented error in their Key Generation Ceremony (KGC) in April 2025.
Why it matters: The cited reporting affects widely deployed technology, so exposure validation and source verification need explicit ownership.
Observed status: Observed in-the-wild exploitation status is unknown.
Action: Review the cited source, validate exposure of the affected technology in owned environments, apply available vendor guidance, and retain evidence of the exposure decision.
Evidence limits:** grounded severity unavailable
fixed version or patch state unknown
[Evidence source: sec.cloudapps.cisco.com](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-emudhra-info-ScS22A1r?vs_f=Cisco%20Security%20Advisory%26vs_cat=Security%20Intelligence%26vs_type=RSS%26vs_p=Cisco%20Informational%20for%20Emergency%20Distrust%20of%20eMudhra%20Root%20and%20Intermediate%20Certificate%20Authorities%26vs_k=1)