Week 44, 2026

The week in five bullets — the five developments that mattered most, one sentence each.

• Anthropic researcher reported a PoC for remote root access on Linux servers with multipath TCP listeners. The Linux kernel has a use-after-free vulnerability in IPv4 TCP handshake handling, CVE-2026-98432.
• Binance will cover user losses, and close to $3 billion has already been frozen on-chain. Binance is investigating a compromised DevOps engineer’s laptop that enabled unauthorized withdrawals.
• CVE-2026-20127 (CVSS 10) gives unauthenticated admin access to SD-WAN controllers; KeyDrift malware siphoned keying material. Cisco Talos reported threat actor UAT-11473 exploited the SD-WAN flaw to deploy KeyDrift malware.
• InfraTrust tracked 133 new advisories covering 2,813 vulnerabilities in a month; 16 advisories involved actively exploited KEV-listed flaws. Attackers are actively exploiting vulnerabilities in critical network infrastructure including NetScaler, Ivanti and Cisco products.
• From October 17 the China-linked group hit ministries, telecoms, and U.S. defense-related targets; post-exploitation is confirmed at nine. CrowdStrike tracked China-based Vapor Panda using the ARTEX framework against more than 200 organizations.

Exploitation & threats

• Threat actors chained PHP2Shell flaws with Fragnesia to plant root webshells on at least 25 PAN-OS firewalls as tracked by Unit 42.
• Cloudflare recovered eMudhra intermediate private keys from certificates, enabling unpatched clients to accept attacker-issued certificates.
• CISA added 10 new KEVs including missing authentication in Ivanti Connect Secure, integer overflow in GitLab, and Brotli decoder issues in Node.js.
• UAT-11473 deployed KeyDrift malware on Cisco SD-WAN controllers after exploiting CVE-2026-20127.
• China-linked Vapor Panda used the Go-based ARTEX framework with DeepSeek to target over 200 organizations across 14 countries.
• Defused Cyber reported probes against the unauthenticated TCF servlet flaw in Oracle E-Business Suite deployments.

Patch priorities

• CVE-2026-111357, Ivanti Connect Secure, Upgrade to 25.1.1.3 and 22.8R2.6
• CVE-2026-118527, Ivanti Connect Secure, Upgrade to 25.1.1.3 and 22.8R2.6
• CVE-2026-76418, Cisco Secure Firewall ASA Software and Cisco Secure FTD Software, see vendor advisory
• CVE-2026-97229, GitLab Community Edition and Enterprise Edition, Upgrade to patched releases
• CVE-2026-41709, Broadcom VMware ESX, see vendor advisory
• CVE-2026-46300, Linux Kernel, see vendor advisory
• CVE-2026-111497, Google Brotli, Upgrade to Node.js 22.23.4, 24.22.1 or 26.12.1
• CVE-2026-109618, PHP Group PHP, Upgrade to patched PHP releases
• CVE-2026-109619, PHP Group PHP, Upgrade to patched PHP releases

Breaches & ransomware

• Binance is investigating large transfers of $3.55 billion to $5.8 billion from hot wallets with no breach confirmed but user funds declared safe.
• Moldova is investigating a cyberattack on government systems that extracted data linked to roughly 750,000 identification numbers.
• Distributed Denial of Secrets published an archive covering more than 41,000 DHS employees or contractors from Okta login records.
• Circle froze about $800 million and Tether about $1.56 billion after users reported wallet drains with watcher estimates unconfirmed.
• Ransomware groups active on leak sites include the gentlemen with 51 posts, qilin with 30, booba team with 16, and whitearmor with 13.

AI

• Google DeepMind announced Gemini 4 Carbon, its strongest model, ranking first on Artificial Analysis Intelligence Index v5.0.
• OpenAI introduced GPT-6.1 Terra for visual reasoning and desktop automation at about one-third the cost of GPT-5.6 Terra.
• Anthropic filed an S-1 for Nasdaq as ANT reporting $16.3 billion in H1 2026 revenue and an $80.7 billion net loss.
• Anthropic’s Frontier Red Team said an unreleased research model produced working exploit chains for Chrome, Safari, Android, Windows, and Linux.
• New models released include baidu/Unlimited-OCR-2, Pika-Labs/Pika-H3-Flex, speridlabs/idol, and nvidia/DeepSeek-V4.1-Flash-1017-NVFP4.

By the numbers

Metric	Value
stories	1957
cves	3663
kev	10
leaks	256
breaches	1
models	14

Outlook

• Federal agencies must patch PHP2Shell flaws by October 29, 2026, with CISA deadlines for civilian agencies.
• US agencies must apply Node.js patches by November 10, 2026, including releases 22.23.4, 24.22.1 and 26.12.1.
• Pending patches for Ivanti Connect Secure and Cisco Secure Firewall have no workaround for CVE-2026-76418.
• Open questions remain on ownership of frozen funds and whether October 29 transfers were authorized.