Thursday, October 29, 2026

Top story

CISA confirmed real-world exploitation of PHP2Shell, and Dream reports a China-linked actor chained those flaws with kernel bug Fragnesia to root 25 firewall servers, including three U.S. government-affiliated hosts. PHP2Shell campaign roots 25 servers Internet-facing PHP and firewall management interfaces are the immediate exposure.

Exploitation & threats

• CISA lists exploited Node2Shell CISA added CVE-2026-111497, an out-of-bounds write in Google’s Brotli decoder, after live exploit traffic hit Node.js servers.
• Volt Typhoon uses Silent Train relays Black Lotus Labs says Volt Typhoon used a rotating relay of compromised devices and four confirmed zero-days against edge and management systems.
• UAT-11473 planted KeyDrift Cisco Talos says UAT-11473 exploited CVE-2026-20127 in Cisco SD-WAN Catalyst Controller and installed the KeyDrift framework.
• Attackers probe Oracle E-Business Suite Defused Cyber says decoys recorded exploratory exploits on October 27 against unauthenticated SQL injection CVE-2026-101767.
• Alpine rebuilds GitLab after exploit attempts Alpine says crafted CI configurations crashed GitLab workers via CVE-2026-97229, with no proof of code execution or package tampering.
• CISA adds VMware ESX and Linux kernel flaws CISA cataloged actively exploited CVE-2026-41709 in VMware ESX and CVE-2026-46300 in the Linux kernel.

Patch priorities

• CVE-2026-109618 and CVE-2026-109619, PHP: upgrade to 8.2.35, 8.3.36, 8.4.27, or 8.5.12 and restart.
• CVE-2026-111497, Brotli and Node.js: upgrade Node.js to 22.23.4, 24.22.1, or 26.12.1, or Brotli to 1.0.10, 1.1.1, or 1.2.1.
• CVE-2026-101767, Oracle E-Business Suite: apply the October 2026 Critical Patch Update for Oracle Application Object Library.
• CVE-2026-97229, GitLab: use official packages from October 12, or Ruby 3.3.13, 3.4.12, or 4.0.9 or later.
• CVE-2026-48356, Adobe Commerce and Magento: apply the vendor update and check stores for a malicious CMS-block loader.
• CVE-2026-97631, EDK II UEFI PXE: apply vendor firmware updates that include the published fix.

Breaches & incidents

• Moldova investigates government data breach The Electronic Governance Agency said unauthenticated government services were exploited October 19–23, exposing data tied to about 750,000 identification numbers.
• Leak exposes DHS employee details Distributed Denial of Secrets published records on more than 40,000 DHS employees; the “Department of Peace” group claims an Okta source, which Okta denies.
• AI agents accessed Anthropic systems Anthropic confirmed limited sales, HR, and IT access via third-party software, and said Claude chats, source code, and weights were not exposed.
• Leak sites posted 28 claims, including Anubis on Santiam Hospital & Clinics, Akira on Trulife, and Rhysida on Noelker and Hull; these remain group claims.

AI

• Google announces Gemini 4 Carbon Google says Carbon leads Artificial Analysis Intelligence Index v5.0 at 59; selected cyber defenders get Fairwind access at $2 and $10 per million tokens.
• Unreleased Claude built exploit chains Anthropic says a lab-only Claude model produced Chrome, Safari, Android, Windows, and Linux exploit chains that vendors patched, including Chrome 156 and Linux CVE-2026-98432.

Watchlist

• Federal civilian agencies face a November 10 deadline for CVE-2026-111497 and an October 29 deadline for PHP2Shell; one CISA item also sets October 29 for the Brotli and Magento flaws.
• CVE-2026-20127 has no fixed build in these reports; review exposure of Catalyst SD-WAN Controller and follow Cisco’s advisory.
• CVE-2026-65145 in NVIDIA NeMo Agent Toolkit and CVE-2026-83938 in Azure Kubernetes Configuration Service have no published fixed version.
• TrendAI’s Zero Day Initiative says PeopleSoft CVE-2026-35273 bundles three bugs, and ShinyHunters used it for theft and extortion.