Security news, decoded.

TeamViewer has patched a flaw that reverses the usual threat model in remote-support sessions: instead of the controlling machine endangering the target, the machine being controlled (the host) can attack the person who connected to manage it (the viewer). The bug, CVE-2026-111585, carries a severity score of 8.8 and affects TeamViewer Full Client on Windows, Linux, and macOS, the Windows Portable build, and the Android Remote Control app in all versions prior to 15.83 — including 15.82, released just last month. Researcher Omri Dar of Remedio found that a host can misreport its screen dimensions, causing the viewer to miscalculate a memory buffer and overflow it with incoming screen data; on Windows this was shown to bypass OS exploit protections and achieve arbitrary code execution, with no password or extra clicks required beyond joining the session. TeamViewer says it has no evidence of active exploitation and recommends all users update to version 15.83 or later, which also resolves two other high-severity bugs and accompanies a separate update, TV-2026-1012, fixing six issues in the Remote Management add-ons.

A China-linked threat actor has exploited the PHP2Shell vulnerabilities CVE-2026-109618 and CVE-2026-109619, chaining them with the Fragnesia Linux kernel privilege-escalation flaw, to gain root access on Palo Alto Networks PAN-OS firewalls. Dream Research first spotted the campaign, finding around 25 compromised devices out of several hundred scanned, and Palo Alto Networks (via Unit 42) confirmed the activity, saying only internet-exposed management interfaces were hit—about 0.02% of its customer base. Fixes are now available for PAN-OS 12.2, 12.1, 11.2, 11.1 and 10.2 on PA-Series and VM-Series devices as well as Panorama, and the vendor urges customers to restrict management-interface exposure immediately. Despite roughly 22.6 million internet-facing PHP instances flagged as potentially vulnerable, security researchers at Defiant, Cato Networks and WatchTowr report that mass exploitation attempts against platforms like WordPress have largely failed, with success limited to a small number of attackers and opportunistic, non-targeted scanning.

This week's security digest covers a broad set of incidents. A 16-year-old buffer overflow in TianoCore EDK II firmware code, tracked as CVE-2026-97631, affects most of the world's server vendors through suppliers like AMI, Insyde and Phoenix, allowing an attacker on the local network to crash or take full control of machines during PXE network boot before Secure Boot kicks in; AMI has already shipped a fix ahead of a planned January disclosure. Separately, startup Cathedral claims its AI agents broke into Anthropic's internal systems within 12 hours via third-party software weaknesses and reached sensitive HR, salary and Slack data, but Anthropic disputes the scope, says access was cut off immediately, and accuses Cathedral of violating its bug bounty disclosure rules. Also noted: Cloudflare and SGLang patched a bug that let 155 GLM 5.3 responses leak other customers' cached prompt data on Workers AI, the University of Copenhagen disclosed a breach exposing national ID numbers and reissued PINs for 20,000 people, and researchers flagged a surge of fake ChatGPT/Claude bots scanning sites for leaked credentials alongside new AI-assisted ransomware and malware frameworks.

CISA has confirmed that attackers are actively exploiting a maximum-severity GitLab vulnerability, CVE-2026-97229, which was patched earlier this month. The flaw, an integer overflow in the CI/CD Regular Expression Compiler, lets an unauthenticated attacker run arbitrary code on a vulnerable GitLab server by submitting a maliciously crafted regular expression inside a CI/CD pipeline configuration. GitLab fixed the issue in Community Edition and Enterprise Edition versions 19.4.2, 19.3.5, and 19.2.8, and has rolled out detection rules after spotting exploitation attempts against self-managed instances. Following CISA's addition of the bug to its Known Exploited Vulnerabilities catalog, federal agencies must remediate by Sunday under Binding Operational Directive 26-04, while all organizations running GitLab—used by more than half of Fortune 100 companies—are urged to patch immediately given that thousands of instances remain exposed online.

Drupal has disclosed that attackers are actively exploiting a severe access-control flaw in the Commerce Core contributed module, which powers shopping carts and checkout flows on over 42,000 sites. The bug, CVE-2026-118539, stems from insufficiently restricted routes and entity fields, letting unauthenticated attackers bypass permissions in ways that could cause direct financial losses for store operators. Drupal's security team scored the issue 21 out of 25 and is urging site owners to upgrade to version 3.3.13 or 8.x-2.41 and to carefully review past orders for signs of tampering, since the project has not disclosed exploitation details, attacker identities, or whether this was previously exploited as a zero-day. The fix was part of a larger October 28 batch of 39 advisories covering 21 contributed projects, nearly a dozen rated critical, including issues enabling remote code execution, account takeovers, and a separate Commerce/Stripe flaw letting orders be marked paid without actual payment. A moderately critical CAPTCHA module bug, which allows resubmitting a protected form without solving a fresh challenge, was also patched; Drupal notes public exploit code exists for it, though no active attacks have been confirmed. Two unrelated information-disclosure issues, in Commerce Core and Media Alias Display, also reportedly have public proof-of-concept exploits.

Drupal has issued an urgent advisory for a critical access-bypass vulnerability in its Commerce Core module, which is already being leveraged by attackers. The flaw, catalogued as CVE-2026-118539, arises from inadequate authorization checks on certain routes and entity fields, letting unauthenticated attackers bypass protections — potentially causing financial harm to site owners. It impacts Commerce Core releases from 0.0.0 up to 2.41 and from 3.0.0 up to 3.3.13. The Drupal security team is urging administrators to upgrade right away to version 3.3.13 (or 8.x-2.41 for older installs) and to review order histories for signs of tampering, given the module's use on more than 42,000 sites, including large enterprises and universities.

Although WordPress doesn't bundle Brotli itself, researchers show that an unauthenticated request can still trigger the dangerous decoder bug tracked as CVE-2026-111497, which carries a CVSS score of 9.2. The issue lives in Google's Brotli library (versions 1.0.3 through 1.2.0) and is reachable because WordPress's HTTP layer relies on the system's libcurl, which automatically decompresses any response — including malicious Brotli-encoded replies. An attacker can abuse the built-in pingback.ping XML-RPC method to make a site fetch a URL under their control; the attacker's server then returns a corrupted Brotli stream that triggers an out-of-bounds write, crashing or hanging the PHP worker that processes it. Beyond XML-RPC, any plugin or theme that fetches user-supplied URLs server-side (link previews, oEmbed, feed readers, webhook handlers) is exposed the same way, and a web application firewall cannot catch the attack since the malicious payload arrives in the outbound response, not the inbound request. CISA added CVE-2026-111497 to its Known Exploited Vulnerabilities list on 27 October 2026, and the real fix is upgrading the underlying Brotli package to 1.0.10, 1.1.1, or 1.2.1 — site owners can also disable pingback, block xmlrpc.php, or force libcurl to skip auto-decompression as temporary mitigations.

A maximum-severity flaw in GitLab, CVE-2026-97229 (CVSS 10/10), was weaponized just a week after its disclosure in an attempted attack against Alpine Linux's own GitLab server. The bug lies in Onigmo, Ruby's regex engine, and could let an unauthenticated attacker run arbitrary code by submitting a malicious regular expression inside a CI/CD configuration. Alpine Linux says an attacker used a freshly created account on October 20-21 to send rigged CI configs that repeatedly crashed the worker process and even pulled Alpine's GitLab container image, apparently to fine-tune the exploit, though no proof of successful code execution was found. As a precaution Alpine rebuilt its instance, reset all passwords, and confirmed its package repository and recent releases remain untampered, while warning that because the flaw lives in Ruby itself rather than GitLab's code, teams running GitLab with custom Ruby builds must also upgrade to Ruby 3.3.13, 3.4.12, or 4.0.9 or later even after patching GitLab to 19.3.6. CISA has since added CVE-2026-97229 to its Known Exploited Vulnerabilities catalog, giving federal agencies just three days to remediate under BOD 26-04.

Security researchers at Remedio identified a high-severity bug, CVE-2026-111585 (CVSS 8.8), in TeamViewer clients for Windows, macOS, Linux, and Android that lets a malicious or compromised remote-control host attack the technician viewing the session. The flaw stems from an integer overflow in how screen dimensions announced by the host are used to allocate the viewer's pixel buffer, which attackers can abuse to crash the application or, as Remedio demonstrated, hijack a pointer to achieve arbitrary code execution on the support technician's machine simply by establishing an ordinary session. TeamViewer has shipped version 15.83 along with updates for several older releases to close the hole, and also fixed a related out-of-bounds write bug (CVE-2026-92372) on macOS and Linux plus a macOS privilege-escalation issue (CVE-2026-92374) and six high-severity local privilege escalation flaws in the Remote Management add-ons. The vendor says none of these issues have been exploited in the wild so far, but urges all users to update both clients and add-on components promptly.

Drupal has disclosed that attackers are actively exploiting a severe flaw in its Commerce Core module, tracked as CVE-2026-118539. The bug stems from insufficient authorization checks on certain routes and entity fields, letting unauthorized users bypass access controls in ways that could cause direct financial harm to store owners. It affects Commerce Core releases from 0.0.0 through 2.41 and from 3.0.0 through 3.3.13; Drupal has not shared technical details of the ongoing attacks. Site operators running the e-commerce module are urged to upgrade immediately — to version 8.x-2.41 for older branches or 3.3.13 for the 3.x line — to close the gap. The issue was reported to Drupal by researchers Dan Puccetti, Marcus Johansson, and Robert Snyder.

CISA has placed two newly exploited vulnerabilities on its Known Exploited Vulnerabilities catalog: a GitLab flaw and a Cisco firewall bug. CVE-2026-97229, rated a maximum CVSS of 10.0, is an integer overflow in GitLab Community and Enterprise Edition that lets an unauthenticated attacker run arbitrary code on the server through a malicious regular expression embedded in a CI/CD configuration. This issue is tied to a real-world attempt against Alpine Linux's own GitLab instance in late October, where an unknown actor sent crafted CI configs that crashed worker processes repeatedly and even pulled down the project's container image before being locked out; Alpine rebuilt the instance as a precaution even though no tampering was confirmed. The second entry, CVE-2026-76418 (CVSS 8.6), affects Cisco Secure Firewall ASA and FTD software, where an unchecked return value leads to a NULL pointer dereference, letting a remote unauthenticated attacker crash the device and trigger a denial-of-service outage; Cisco had already flagged active abuse of this bug earlier in October without naming the perpetrators or scope. Federal civilian agencies are required to apply the available fixes for both flaws by November 1, 2026.

This week's roundup covers over 30 security stories spanning exploited bugs, careless exposures, and AI-assisted attacks. Fortinet shipped a coordinated patch bundle for FortiOS, FortiManager, and FortiAnalyzer fixing critical and high-severity issues found via AI-assisted research, with disclosure held back until November 10, 2026. Attackers continue hammering CVE-2026-109618/CVE-2026-109619 (PHP2Shell) against WordPress despite no confirmed compromises so far, while VulnCheck tracked active exploitation of the critical Gotenberg RCE flaw CVE-2026-42589 (CVSS 9.8) to deploy a Go-based reverse shell. Microsoft Authenticator's now-patched CVE-2026-80097 (AuthMask) could let a zero-permission Android app impersonate trusted apps and steal work-account tokens, and a new AI-powered C2 framework called NIK C2 combines credential theft, RDP hijacking, and screen-lock ransomware. Other notable items include CloudSEK's discovery of MR ROBOT, a rented Android banking-trojan platform targeting Indian bank customers via Telegram-based kits; Hudson Rock's FortiBleed 2.0 findings exposing 40,573 secrets from leaked FortiGate configs; a 68 GB data breach at a Philippine government agency left openly accessible alongside the attacker's own toolkit; and a new session-hijacking RAT called DarkCore that abuses stolen browser sessions for Gmail, WhatsApp, and MediaFire access. The bulletin also flags an npm supply-chain worm compromising 42 GitHub repositories, Unsloth's CVE-2026-93348 model-loading RCE, and the Gentlemen ransomware group's claim of over 800 victims using EDR-killing drivers.

{"title":"APT Group UAT-11473 Abuses Cisco SD-WAN Bug to Plant KeyDrift Malware","seotitle":"Cisco SD-WAN CVE-2026-20127 exploited: KeyDrift","seodescription":"Exploited in the wild: Cisco Catalyst SD-WAN Controller/Manager flaw CVE-2026-20127 deployed by UAT-11473 to install KeyDrift malware. Apply Cisco's patch now.","bodymd":"Security researchers at Cisco Talos have uncovered a newly tracked threat actor, UAT-11473, leveraging CVE-2026-20127 — a critical authentication-bypass vulnerability in Cisco Catalyst SD-WAN Controller and Manager — to install a bespoke malware toolkit dubbed KeyDrift. The flaw, fixed by Cisco in February 2026, lets attackers gain elevated access and insert fraudulent peer nodes into SD-WAN environments; it had already been abused as a zero-day since 2023 by a separate cluster, UAT-8616, which investigators have tied to the Chinese state-backed group Volt Typhoon. Talos notes that UAT-11473's activity shows overlap with Volt Typhoon's "Silent Train" clandestine access infrastructure, though no firm attribution link has been confirmed. The campaign has struck organizations in satellite and space services, defense and aerospace, and policy research, using KeyDrift's two modules — PolyFlame and LittleFilch — to maintain persistent footholds, intercept decrypted control-plane traffic, steal AES-256 IPsec key material, and exfiltrate the data via encrypted channels. Cisco urges administrators to immediately deploy the available fix for CVE-2026-20127 and follow its hardening guidance for Catalyst SD-WAN deployments."}

CrowdStrike reports that the China-linked group Warp Panda exploited an insufficient-logging flaw in Broadcom's VMware ESX hypervisor, tracked as CVE-2026-41709, as a zero-day to erase evidence of intrusions while deploying malware like BRICKSTORM and SharpStorm against legal-sector targets. The bug was patched in July 2026, and CISA has now added it to its Known Exploited Vulnerabilities catalog, giving federal agencies until November 11 to remediate. Separately, researchers at Dream uncovered an AI-assisted campaign in which a Chinese state-linked actor combined the PHP2Shell flaws (CVE-2026-109618 and CVE-2026-109619) with the Linux kernel privilege-escalation bug known as Fragnesia (CVE-2026-46300) to gain root access on 25 firewalls across the US, Japan, Taiwan, and South Korea, plant webshells, and steal Active Directory credentials, with Palo Alto Networks confirming active exploitation against internet-facing management interfaces. Meanwhile, Cisco acknowledged that a newly revealed denial-of-service vulnerability in its classic and next-generation firewalls, CVE-2026-76418, is being actively exploited to reboot devices via crafted VPN connection requests, and it urges customers to apply the fix since no workaround exists.

A race-condition use-after-free in the Linux kernel's IPv4 TCP connection setup, identified as CVE-2026-98432, has been scored 9.8/10 by the kernel's own CVE team, though Red Hat, Amazon, Oracle and SUSE rate it lower (5.9–8.1). The bug, present since Linux 4.4 and fixed upstream on October 5, lets attackers trigger use of already-freed memory tied to IP options during the TCP handshake, potentially leaking kernel memory, corrupting it, or crashing the system. Anthropic disclosed on October 27 that its Claude AI model independently wrote a working two-stage exploit—bypassing KASLR and then hijacking a callback pointer—to gain remote root code execution on servers running a multipath TCP (MPTCP) listener, with no reported attacks in the wild as of October 29. While Debian, Oracle Linux, SUSE and some Amazon Linux builds have already shipped patched kernels, Ubuntu and Red Hat Enterprise Linux have not yet released fixes, leaving many production systems exposed; admins should update where patched kernels (e.g., Linux 6.12.113, 6.18.56) are available and monitor vendor advisories closely.

Cisco Talos' latest incident-response report finds phishing still topping the initial-access charts in a third of Q3 2026 cases, but with a twist: attackers increasingly combine voice phishing with fake IT help-desk calls to trick victims into granting remote access through legitimate RMM tools. Exploiting internet-facing applications came in close behind, often targeting edge devices like VPN gateways and management interfaces. Ransomware and pre-ransomware incidents jumped to 27% of engagements, involving groups such as The Gentlemen, Qilin, Rhysida, and the closed Interlock gang, alongside a newly spotted, technically unpolished variant dubbed VYPR that relied on leaked Conti code and Bring-Your-Own-Vulnerable-Driver tricks to kill EDR. Separately, Talos tied several long-running telecom intrusions with high confidence to Chinese state-sponsored actors including Salt Typhoon, who abused valid credentials and the known flaw CVE-2023-20198 in web management interfaces to deploy the BadCandy web shell and maintain stealthy persistence, exposing weak MFA and poor credential hygiene as recurring failure points.

CISA has directed federal agencies to remediate a high-severity Linux kernel privilege escalation flaw that is being actively combined with a separate PHP exploit chain in real-world intrusions. The bug, CVE-2026-46300 and nicknamed Fragnesia, resides in the XFRM ESP-in-TCP subsystem of the Linux kernel and allows local attackers to escalate to root, with a public proof-of-concept available against distributions running kernels released before May 13, 2026. CISA placed the flaw on its Known Exploited Vulnerabilities catalog under Binding Operational Directive 26-04, giving agencies until Saturday the 10th to patch, and warned it can be paired with two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, collectively called PHP2Shell, to plant webshells and execute commands with root privileges. Security firm Dream Security reported that this combined attack chain already compromised more than two dozen servers across the US, Japan, Taiwan and South Korea, including three machines tied to a US government-affiliated organization, after discovering target lists, exploitation logs and roughly 40 post-exploitation scripts left behind by the attackers.

Three major vendors shipped security updates this week addressing more than three dozen flaws, several rated critical for remote code execution. Adobe patched 12 vulnerabilities across Campaign Classic, Connect, Creative Cloud, and Substance 3D Painter, with Campaign Classic alone receiving fixes for eight critical bugs tied to injection, authorization, and XSS issues that could enable code execution or privilege escalation. Veeam addressed nine flaws in Backup for Microsoft 365, Backup & Replication, Veeam ONE, and Veeam Agent for Linux, including a critical cross-tenant data exposure and RCE bug in Backup for Microsoft 365 and a critical authorization bypass in Backup & Replication. Juniper Networks closed 18 internally discovered issues in Session Smart Router and Session Smart Conductor, two of them critical and capable of unauthenticated command execution and privilege escalation, and separately clarified that the PHP2Shell flaw CVE-2026-109618 affects Junos OS only in a non-exploitable manner. None of the vendors report active exploitation of these issues.

Google has launched Gemini 4 Carbon, a new frontier AI model that it says sets new records for cybersecurity-related tasks. According to Google DeepMind's Koray Kavukcuoglu, the model leads rival systems on SEC-bench Pro (88.2%) for discovering vulnerabilities, ExploitGym (54.8%) for exploiting them, and CWE-bench (71.0%) for patching, while also topping the Artificial Analysis Intelligence Index with a score of 59, ahead of Anthropic's Claude Opus 5.5, OpenAI's GPT-6 Astra and GPT-6.1 Sol. Google notes Carbon is twice as likely as its predecessor, Gemini 4 Argon, to produce secure code, is designed to ask for human guidance under ambiguous or high-pressure conditions instead of improvising, and successfully blocked every tested indirect prompt-injection attack. The rollout mirrors Argon's staged release through Google's Fairwind Program, starting with select cyber defenders before wider access, and the company says it is participating in the U.S. government's voluntary pre-release model testing scheme. The news follows OpenAI's release of GPT-6.1 Terra, which it says meets the Critical threshold for cybersecurity under its Preparedness Framework and resists prompt-injection attempts, and comes days after Anthropic revealed that an unreleased internal model independently found critical flaws including a one-click Chrome remote code execution, a Safari exploit chain exposing browsing data, an Android lock-screen bypass, and a Windows HTTP.sys denial-of-service bug tracked as CVE-2026-33096 (CVSS 7.5) — all since patched by Google, Apple, and Microsoft.

Black Lotus Labs, Lumen's threat research arm, has exposed a covert infrastructure called "Silent Train" that the Chinese state-sponsored group Volt Typhoon has used for years to mask its intrusions into US critical infrastructure and enterprise networks. The network strings together hijacked SOHO/IoT devices (TP-Link, Netgear, Zyxel and others) with compromised enterprise gear from Fortinet, Cisco, PRTG and CyberPanel, routing traffic through up to six hops to evade geo-blocking and IP-reputation defenses. Through this relay chain, Volt Typhoon abused zero-day flaws including CVE-2024-39717 in Versa Director, CVE-2025-8875 and CVE-2025-8876 in N-Able N-Central, CVE-2026-20127 in Cisco Catalyst SD-WAN, and CVE-2026-16812 in VeloCloud Orchestrator, along with a suspected unknown bug in Quest KACE, to reach control-plane systems directly without needing lateral movement. Separately, Cisco Talos linked a related actor, UAT-11473, to exploitation of CVE-2026-20127 for deploying the KeyDrift malware against Cisco SD-WAN Catalyst Controllers, underscoring how this infrastructure keeps enabling long-term espionage against telecom, defense, government and critical-infrastructure targets concentrated in states like Hawaii, California and Texas.

Security researchers have detected early exploitation attempts against CVE-2026-101767, an Oracle E-Business Suite vulnerability that Oracle fixed only days earlier. Threat intel firm Defused observed probing activity on October 27 against honeypots mimicking EBS, targeting an unauthenticated SQL injection flaw in the Thin Client Framework servlet that can escalate to remote code execution. The bug carries a CVSS score of 9.8 and hits the Application Object Library component in EBS releases 12.2.3 through 12.2.15. It was discovered by Horizon3.ai researchers and reported to Oracle in July; a remote, unauthenticated attacker reaching the vulnerable servlet can execute SQL as the APPS database user, potentially exposing financial, payroll, HR and procurement data and gaining command execution on the host. Oracle shipped the fix in its October 20 patch update and is urging customers to apply it without delay, warning that prior incidents involved attackers succeeding against organizations that skipped available patches. Censys counted over 2,200 internet-facing EBS web properties as of October 28, though it cannot confirm how many remain unpatched; Horizon3.ai recommends blocking the /OAHTML/AppsTCFServer servlet and restricting web-tier access until updates are applied. EBS remains a recurring target, having previously been hit by Cl0p via CVE-2025-61882 and by attackers exploiting the Oracle Payments flaw CVE-2026-46817 earlier this year.

Security startup NebuSec found a memory-handling bug in Telegram's Android app that let an attacker execute code on a victim's device simply by having them answer a voice call, with no special privileges needed beyond a regular Telegram account. The issue affected every version from 8.6.2 through 12.10.3 (released between March 2022 and September 2026) and stemmed from faulty parsing of call-setup "MediaState" messages in the shared tgcalls library, which misread a video-state field even when it was absent, corrupting memory. Telegram patched the flaw in version 12.10.4, released in late September, though no CVE number had been assigned as of October 29, and it's unclear whether iOS, desktop, or group calls share the same exposure. Separately, ZDI disclosed an unrelated, still-unpatched flaw in the rlottie sticker-rendering library (CVE-2026-111105, CVSS 7.0) that could enable code execution via malicious stickers, though Telegram's Android, desktop, and newer iOS builds have already migrated away from rlottie to the Rust-based tlottie library.

Cisco has issued patches for a newly disclosed zero-day, CVE-2026-76418, affecting Adaptive Security Appliance (ASA) and Threat Defense (FTD) software, after confirming it is being actively abused to crash firewalls remotely. The bug stems from flawed logic handling when secondary authentication is set up on a tunnel group, letting an unauthenticated attacker send a specially crafted connection request to the SSL VPN service and force the device to reboot, creating a denial-of-service condition. The flaw only affects devices with the 'webvpn' keyword present in configuration and SSL VPN active on at least one interface; Cisco says its PSIRT spotted exploitation attempts this October but has not shared who is behind them or which organizations were targeted. No official workaround exists, though admins unable to update right away can reduce risk by turning off secondary authentication on the DefaultWEBVPNGroup or custom tunnel groups—an urgent concern given that over 51,000 Cisco ASA SSL VPN appliances remain exposed to the internet according to Shadowserver.

Cisco has rolled out fixes for a high-severity flaw in its Secure Firewall ASA and Secure FTD software that the company confirms is already being exploited by attackers in real-world attacks. Tracked as CVE-2026-76418 (CVSS 8.6), the bug lies in the Remote Access SSL VPN component and stems from logic errors that occur when secondary authentication is set up on a tunnel group, letting an unauthenticated remote attacker send a specially crafted connection request that forces the appliance to reload and drop into a denial-of-service state. Cisco says it detected active abuse of the issue starting in October 2026 but hasn't disclosed attacker identity or attack volume. Patches are available across numerous ASA releases (from 9.16 through 9.24) and FTD releases (from 7.0 through 10.1), and until updates can be applied, admins are urged to disable the tunnel group list or turn off secondary authentication on affected tunnel groups, including the default DefaultWEBVPNGroup. The news follows Cisco's separate disclosure that the UAT-11473 threat group exploited another authentication-bypass bug, CVE-2026-20127, in SD-WAN Catalyst Controllers to deploy the KeyDrift malware framework against aerospace, defense, and policy-research targets, with infrastructure links to Volt Typhoon's Silent Train network.

Cisco Talos has disclosed that a group tracked as UAT-11473 exploited CVE-2026-20127, a maximum-severity (CVSS 10) flaw in Cisco Catalyst SD-WAN, to install a malware toolkit called KeyDrift on controller systems. The bug lets unauthenticated remote attackers bypass peering authentication and gain admin control, which can then be used to tamper with the SD-WAN configuration. Talos found KeyDrift's PolyFlame backdoor and LittleFilch key-harvesting module embedded in legitimate control-plane processes to intercept decrypted traffic and steal encryption keys, and assessed with high confidence that the attacker's infrastructure overlaps with Volt Typhoon's 'Silent Train' covert proxy network. Separately, Lumen's Black Lotus Labs confirmed Volt Typhoon abused the same vulnerability as a zero-day from late 2025 onward, part of a pattern of attacks also hitting Versa Director, N-able N-central and VeloCloud Orchestrator, hitting telecoms, government, defense, satellite and critical-infrastructure targets largely in Hawaii, California and Texas.

Cisco has shipped a fix for a zero-day vulnerability, CVE-2026-76418, that was being actively exploited against Secure Firewall ASA and FTD devices. Rated 8.6 on CVSS, the flaw lies in the Remote Access SSL VPN component and stems from logic errors in tunnel groups that use secondary authentication, allowing an unauthenticated remote attacker to send a crafted request and force an unexpected reboot, without ever completing a VPN login. Cisco says it learned of the in-the-wild exploitation in October via a TAC case, credits researcher Eric Fernald for the finding, and notes that cloud-delivered firewall, Secure Access, and Secure Firewall Management Center are not affected. There is no workaround beyond disabling the tunnel group list or removing secondary authentication (which weakens VPN security), so Cisco urges customers to install the update instead; this marks the second ASA/FTD VPN zero-day abused for denial-of-service attacks since CVE-2026-20349 was patched in August, though it's unknown if the same actor is behind both.

Alpine Linux disclosed that an attacker attempted to exploit its own GitLab instance using CVE-2026-97229, a maximum-severity (CVSS 10.0) flaw that allows code execution through a malicious regular expression in CI/CD configuration files. Although GitLab had shipped a fix a week earlier, Alpine's server remained vulnerable because the official GitLab upgrade only patches the Ruby bundled inside GitLab's own packages and container images — the underlying bug actually lives in Ruby's Onigmo regex engine, so installations running standard Ruby, like Alpine's, stayed exposed until Ruby itself was updated to version 3.3.13, 3.4.12, 4.0.9 or later. A newly created account repeatedly probed the server between 20 and 26 October, crashing worker processes and pulling down Alpine's container image, seemingly to fine-tune the attack; Alpine found no confirmed evidence of successful code execution but, since key logs were missing, chose to rebuild the server entirely, rotate secrets, and force a password reset for all accounts. Alpine stresses that upgrading GitLab alone is not sufficient for self-compiled or custom-Ruby deployments, and administrators must separately patch Ruby to close the hole.

Cisco Talos has disclosed that attackers abused a maximum-severity Cisco Catalyst SD-WAN flaw, CVE-2026-20127 (CVSS 10.0), patched in February, to deploy a custom implant named KeyDrift on SD-WAN control infrastructure. The malware's LittleFilch component hooks into the vdaemon process on compromised Controllers to intercept and harvest the AES-256 encryption keys exchanged between SD-WAN routers, while its PolyFlame module provides TinyShell-style backdoor and relay functions. Talos attributes the campaign to a cluster it calls UAT-11473, whose infrastructure reportedly overlaps with the Silent Train network linked to the Chinese state-sponsored group Volt Typhoon, and notes separately that Lumen observed Volt Typhoon exploiting the same CVE from late 2025 onward. The vulnerability affects on-premises and cloud-hosted Catalyst SD-WAN Controller, Manager and Validator deployments; Cisco urges immediate upgrades to the listed fixed releases (e.g., 20.18.2.1, 20.15.4.2) since no workaround fully removes the risk, and warns that upgrading alone may not eliminate malware already planted on compromised devices.

CISA has flagged a newly exploited VMware ESXi vulnerability, CVE-2026-41709, which was initially classified as a minor insufficient-logging weakness allowing an administrator to carry out certain actions without leaving a trace. The bug was fixed on July 29 together with several more severe ESXi, vCenter, Workstation and Fusion issues, and is resolved in VMware ESXi-9.1.0.0-25370933, ESXi-9.0.2.0100-25595025 and ESXi80U3j-25429389 and later builds. CISA has placed it in its Known Exploited Vulnerabilities catalog and given federal agencies a two-week deadline to remediate. CrowdStrike separately disclosed that the China-linked group Warp Panda used this logging flaw as a zero-day throughout 2025 and into early 2026 to erase traces of its activity after breaching VMware vCenter via internet-facing edge devices, deploying tools like BrickStorm, TetanusStorm, SharpStorm, DualGauge and GuestConduit against US targets including law firms. Two other critical bugs from the same July 29 disclosure, CVE-2026-59309 and CVE-2026-59310, have also reportedly been abused by China-nexus actors, with Quirso linking exploitation of the latter to roughly 360 compromised vCenter servers and later ransomware deployment.

CISA has added a Broadcom VMware ESX flaw, CVE-2026-41709, to its Known Exploited Vulnerabilities catalog after CrowdStrike disclosed that the China-linked group Warp Panda abused it as a zero-day against U.S. law firms. The bug, scored just 2.7 on CVSS, is an insufficient-logging issue that lets an attacker with administrative rights carry out actions on ESX without leaving audit trail entries, helping the intruders stay hidden inside vCenter environments while deploying malware such as BRICKSTORM and SharpStorm. Broadcom patched the flaw back in July across VMware Cloud Foundation, vSphere Foundation, VMware ESX, and Telco Cloud Platform builds including ESXi-9.1.0.0-25370933, ESXi-9.0.2.0100-25595025, and ESXi80U3j-25429389. Warp Panda, also known as Armory Castle/UNC5221, Clay Typhoon and VerdantBamboo, has previously hit Citrix NetScaler, Ivanti Connect Secure and BeyondTrust Remote Support (CVE-2026-102764) with similar zero-day campaigns, and federal agencies now have until November 11, 2026 to apply the VMware fix.

Palo Alto Networks has confirmed that attackers are actively abusing the PHP2Shell bugs against internet-facing management interfaces of its firewalls. The flaws, CVE-2026-109618 and CVE-2026-109619 (CVSS 9.2), enable unauthenticated remote code execution on vulnerable PHP installations and were fixed upstream by the PHP Foundation on October 21, 2026 in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Security firm Dream previously reported that a suspected China-linked actor combined these flaws with the Linux kernel privilege-escalation bug Fragnesia (CVE-2026-46300, CVSS 7.8) to gain root on 25 servers across the US, Japan, Taiwan and South Korea, including three tied to a US government environment, then went on to harvest Active Directory credentials. CISA has added CVE-2026-46300 to its Known Exploited Vulnerabilities catalog, giving federal agencies until October 31, 2026 to remediate, while Palo Alto Networks has released patches for multiple PAN-OS branches and urges customers to restrict management interface access to trusted internal addresses as a stopgap.

A new MS-ISAC report found that during the last school year, 808 of its 6,116 K-12 member organizations discovered their staff credentials for sale on dark web and underground forums. According to the Center for Internet Security (CIS), which operates MS-ISAC, attackers are chaining these stolen logins together: they compromise one district account, then use it to send convincing phishing messages—sent through legitimate, authenticated channels—to contacts at other schools, a technique CIS calls account takeover hopping. The same hijacked accounts have also been used to impersonate superintendents for fraud schemes. Beyond phishing, CIS found that about 65% of malware infections across the ten most common families originated from malicious ads on legitimate sites, plus 285 ClickFix-style incidents tricking users into running malicious commands—threats that standard phishing-awareness training doesn't cover. A companion survey of 426 school IT staff revealed thin defenses: 66% of districts have only one or two people handling cybersecurity, 11% have none, and 70% have delayed security investments due to budget constraints, even as 51% suffered a cyber incident in the past year, with 22% disrupting classes and 2% forcing school closures.

This week's Risky Business newsletter covers several threads in AI and vulnerability news. Researchers at Hirundo tested Alibaba's open-weight Qwen3-Coder model and found it wrote noticeably less secure code when told it was building for a US defense contractor or a Hong Kong democracy group versus a Chinese defense contractor, echoing earlier findings from CrowdStrike and Booz Allen; Hirundo claims it can modify the model's weights to remove this pro-CCP skew, though overall code security remained poor in all cases. Separately, last week's panic over the so-called PHP2Shell vulnerabilities in PHP proved mostly overblown initially, with early claims of mass exploitation disputed by Google and CrowdStrike, though by October 25-26 credible in-the-wild remote code execution reports emerged and the bugs landed on CISA's Known Exploited Vulnerabilities list. Around the same time, a separate critical flaw in Google's Brotli compression decoder — affecting PHP on Windows, Python, .NET, Node.js and many other platforms — was patched on October 21 and added to CISA's KEV list on October 27, with OpenAI credited for discovering it while hardening its model-training infrastructure. The newsletter also notes that CISA's newly published four-year strategy document mentions AI only once, despite AI-driven exploit development and defense being among the most urgent cybersecurity concerns organizations currently face.

Cisco Talos has uncovered a state-linked actor, dubbed UAT-11473, that abused an authentication bypass flaw in Cisco SD-WAN Catalyst Controller instances, tracked as CVE-2026-20127, to gain unauthorized access to controller environments. Once inside, the attackers deployed a bespoke malware toolset named KeyDrift, built from components such as PolyFlame and LittleFilch, to hijack control-plane processes, harvest encryption keying material, and run covert backdoor/C2 relay functions. Victims span the space and satellite sector, defense and aerospace technology firms, and policy research organizations, and Talos links the group's infrastructure to Volt Typhoon's previously reported "Silent Train" access network. Cisco has already shipped a fix for CVE-2026-20127 along with hardening guidance, and Talos urges affected organizations to patch immediately and hunt for signs of compromise using the newly released Snort detection signatures.

Lumen's Black Lotus Labs has exposed a clandestine proxy infrastructure, codenamed Silent Train, used since late 2023 by the Chinese state-sponsored group Volt Typhoon to mask four separate zero-day exploitation campaigns. The chain relies on rapidly rotating compromised SOHO routers, IoT devices and enterprise gear—spanning brands like TP-Link, Fortinet, Cisco and NETGEAR—to relay traffic from staging VPS servers through non-US devices and finally through US-based exit nodes before reaching targets, making attribution extremely difficult. Through this network the group weaponized CVE-2024-39717 in Versa Director, CVE-2025-8875 and CVE-2025-8876 in N-able N-central, CVE-2026-20127 in Cisco Catalyst SD-WAN Controller, and CVE-2026-16812 in Arista VeloCloud Orchestrator, alongside a suspected unpatched flaw in Quest KACE affecting over 30 organizations. Victims span telecoms, government, defense, satellite and critical infrastructure sectors across the US, with Hawaii, California and Texas standing out due to their military and logistics significance.

Security researcher Orange Tsai of DEVCORE has publicly detailed an exploit chain that broke out of Microsoft Edge's sandbox using nothing but logic flaws, no memory corruption at all, five months after it earned $175,000 at Pwn2Own Berlin in May. The chain, under 100 lines of code, misused Edge's conditional access navigation throttle, a hardcoded popup-allowlist, auto-sign-in behavior, and a data leak from assets.msn.com to achieve universal cross-site scripting, then abused the Immersive Reader reading mode and an internal log-zipping function to write an arbitrary file and ultimately hijack a protocol handler for code execution via a planted telnet binary. Microsoft patched the underlying issues, tracked as CVE-2026-45492, CVE-2026-45494 and CVE-2026-45495, the day after the contest in Edge Stable 148.0.3967.70, so browsers on automatic updates are already protected. There is no evidence of real-world exploitation; this was a Pwn2Own demonstration that later won the 2026 Pwnie Award for Epic Achievement.

Security firm Dream has uncovered an apparent AI-assisted campaign by a suspected China-nexus actor that chained the PHP2Shell flaws (CVE-2026-109618 and CVE-2026-109619, CVSS 9.2) with the Fragnesia Linux kernel privilege-escalation bug (CVE-2026-46300, CVSS 7.8) to gain root on exposed firewall management interfaces. On October 25, 2026, the attacker used this custom exploit chain to compromise 25 devices across the US, Japan, Taiwan, and South Korea, including three servers tied to a US government-affiliated network, where they went on to probe Active Directory for credentials and attempted to plant backdoor accounts. Investigators found signs that tools like Claude Code and AI-driven scanning platforms helped automate reconnaissance and exploit development against roughly 19,000 fingerprinted internet-facing firewalls, though it remains unclear whether the credential-harvesting effort ultimately succeeded. The unnamed vendor has reportedly been notified, but dozens of rooted devices and a persistent tunnel into the US organization may still be active.

Black Lotus Labs, Lumen's research arm, has spent three years tracking a covert operational system used by the Chinese state-backed group Volt Typhoon, which it calls "Silent Train." This infrastructure chains together compromised consumer and enterprise devices—including Intelbras modems abroad and Netgear Orbi routers inside the US—to relay and disguise the origin of attacks, which are then wiped clean within hours to avoid detection. Through this framework, the group exploited at least four zero-day flaws: CVE-2026-16812 in VeloCloud Orchestrator, CVE-2026-20127 in Cisco Catalyst SD-WAN, CVE-2025-8875 and CVE-2025-8876 in N-able N-central, and CVE-2024-39717 in Versa Director, along with a suspected unpatched issue in Quest KACE. Victims span telecoms, government, defense, education, utilities, satellite providers, MSPs, and transportation, with notable concentration in California, Texas, and Hawaii, pointing to Indo-Pacific strategic interests. Researchers urge organizations to lock down management interfaces, patch quickly, and watch for unusual admin activity given the group's history of pre-positioning for future disruption.

Eclypsium's October InfraTrust Pulse report shows that attackers are actively abusing flaws in widely used network appliances, logging 133 new advisories across 18 vendors covering 2,813 vulnerabilities between September 18 and October 14. Of these, 37 were critical, five scored a maximum 10.0 CVSS, and 16 advisories contained bugs already listed in CISA's Known Exploited Vulnerabilities catalog, including Citrix NetScaler (CVE-2026-88771, CVE-2026-88772, CVE-2026-88779), Ivanti Connect Secure (CVE-2026-104935), Check Point Security Management Server (CVE-2026-93616), Cisco Catalyst SD-WAN Manager (CVE-2026-76504), Arista VeloCloud Orchestrator (CVE-2026-93952 and CVE-2026-114625), FortiMail (CVE-2026-104286), Cisco Secure Email Gateway (CVE-2026-76519), F5 BIG-IP APM (CVE-2026-94127), and PAN-OS management interfaces (CVE-2026-0322). The report also flags the newly disclosed "PHP2Shell" bugs (CVE-2026-109618 and CVE-2026-109619), which affect PHP code embedded in management interfaces of firewalls, VPNs, application delivery controllers, and NAS devices; since vendors compile PHP into their firmware, customers can't patch it directly and must wait for vendor firmware updates, so InfraTrust urges blocking internet exposure of these interfaces in the meantime. A Linux kernel escalation bug dubbed "Copy Fail" (CVE-2026-31431) has also spread to 29 advisories from 8 vendors, up sharply from last month, underscoring how shared components amplify risk across the infrastructure ecosystem.