Friday, October 30, 2026

Top story

Cisco Talos says a Volt Typhoon-linked actor exploited CVE-2026-20127 to install KeyDrift on Cisco SD-WAN controllers and steal keying material, including data-plane keys. The CVSS 10 authentication bypass gives unauthenticated administrative access; patches shipped in February 2026, and exploitation continued after disclosure.

Exploitation & threats

• CISA says Fragnesia, CVE-2026-46300, is chained with PHP2Shell to plant webshells and run as root.
• According to Dream Security, suspected Chinese attackers rooted 25 servers with that chain, including PAN-OS firewalls linked to US government-affiliated organizations.
• Wordfence logged more than 18,500 requests in 21 hours against a WordPress update-process RCE affecting Core 4.7 through 7.1.3.
• CISA confirmed exploitation of Node2Shell, CVE-2026-111497, a Brotli decoder flaw that can yield code execution.
• CISA added exploited Ivanti Connect Secure and GitLab flaws, CVE-2026-111357 and CVE-2026-97229, to KEV.
• CrowdStrike says Warp Panda used VMware ESX flaw CVE-2026-41709 as a zero-day to reduce audit visibility.

Patch priorities

• CVE-2026-20127: upgrade Catalyst SD-WAN Controller, Manager, and Validator to 20.9.8.2, 20.12.6.1, 20.15.4.2, or 20.18.2.1.
• CVE-2026-46300: install Linux kernel 5.10.257, 5.15.208, 6.1.174, 6.6.141, 6.12.91, 6.18.33, or 7.0.10.
• WordPress: upgrade to 7.1.4 or the patched release for the installed branch.
• CVE-2026-109618 and CVE-2026-109619: install PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35, or the distribution backport.
• CVE-2026-76418: install the fixed ASA or FTD release for the running train, including ASA 9.24.10.1 and FTD 10.1.1.
• CVE-2026-111497: install Node.js 22.23.4, 24.22.1, or 26.12.1, and update bundled Brotli to 1.0.10, 1.1.1, or 1.2.1.

Breaches & incidents

• Binance says a Thursday incident affected about $6.3 billion after a compromised DevOps laptop, with nearly $3 billion frozen and losses to be covered.
• Published records that WIRED says cover more than 41,000 DHS employees or contractors include emails, phones, and some undercover or surveillance roles.
• Alpine Linux rebuilt its GitLab server and reset passwords after CVE-2026-97229 probes, finding no proof of code execution.
• Leak sites claim victims including Susman Godfrey LLP, TDS Telecommunications, USClaims, Proterial, Circleville Police Department, and Terrebonne Parish Government.

AI

• Mistral published open weights for trillion-parameter Mistral Large 4, nicknamed Le Chonk, and claims 47 percent fewer tokens than GLM-5.3.
• Google released Gemini 4 Carbon to some cyber defenders and says it resisted every tested indirect prompt injection.
• Anthropic says an unreleased Claude built five exploit chains for Chrome, Safari, Android, Windows, and Linux, and that vendors have patched.
• Newly listed weights include Nanbeige4.3-33B, LiquidAI LFM3-1.7B, and baidu Unlimited-OCR-2.

Watchlist

• Federal civilian agencies face October 31 for CVE-2026-46300 and November 11 for CVE-2026-41709.
• Lumen says Silent Train relayed Volt Typhoon zero-days against Versa, N-able, VeloCloud, Cisco SD-WAN, and possibly Quest KACE.
• Earlier Binance reporting left a breach unconfirmed, with transfer estimates from about $3.55 billion to $5.8 billion.
• Drupal CVE-2026-108097 and NVIDIA CVE-2026-65145 have no fixed version stated; see the vendor advisories.