Thursday 29 October 2026

Major Incidents or Breaches

• Sony Network Communications, a subsidiary ISP, confirmed a data breach exposing approximately 2.5 to 2.6 million customer records, including personal information, 54,401 email account passwords, and 16 bank account records ^[22][29].
• Over 41,000 US Department of Homeland Security (DHS) employee records, including undercover ICE agents, were leaked online by a hacktivist group, exposing names, offices, contact details, and assignments. The data was reportedly stolen from an Okta single sign-on system earlier in 2026 and published by DDoSecrets ^{[28][43][66][72]}.
• The Belgian Federal Public Service Finance temporarily suspended tax services following a cyberattack, which occurred just before a filing deadline ^[45].
• Japan Airlines disclosed a breach affecting about 2,000 customers, with stolen passport numbers, frequent flyer numbers, email addresses, and phone numbers ^[48].
• The University of New Mexico restored hospital systems after a cyberattack that forced ambulance diversions and class cancellations at its medical school ^[46].

Newly Discovered Vulnerabilities

• A critical vulnerability in UEFI firmware, widely used in servers and data centers, allows attackers to execute code early in the boot process, impacting most servers globally ^[42].
• Cisco released patches for a high-severity flaw in ASA and FTD VPN software that has been actively exploited to crash firewalls via remote, unauthenticated access. This marks the second exploited Cisco firewall VPN zero-day since August ^[6][19][31].
• A flaw in Telegram for Android allowed attackers to execute code on a victim’s device when answering a voice call. Only an ordinary phone number was needed for exploitation ^[3].
• Attackers attempted to exploit a critical GitLab vulnerability (CVE-2026-9783) on Alpine Linux’s GitLab server shortly after a patch was released ^[8].
• Adobe, Veeam, and Juniper Networks issued patches for critical vulnerabilities that could lead to arbitrary code execution, authorization bypass, and privilege escalation ^[26].
• Oracle E-Business Suite flaw CVE-2026-101767 is under active exploitation attempts, with decoys recording exploratory exploits ^[63][52].
• Apple released a security update for older iPhones and iPads, backporting a fix for a CoreGraphics flaw reportedly exploited in targeted attacks ^[90].
• Researchers demonstrated that logic bugs alone, without memory corruption, can be chained to escape the Microsoft Edge sandbox and execute code on Windows systems ^[14].
• Researchers found vulnerabilities in the browsers built into several AI coding assistants (VS Code, Cursor, Copilot, Codex, Claude Desktop), allowing web pages to break out of the assistant’s browser sandbox ^[61].

Notable Threat Actor Activity

• The China-linked APT group Volt Typhoon used a covert, ephemeral access network known as “Silent Train,” built from rapidly rotating chains of compromised devices, to conduct zero-day exploitation and strategic intrusions targeting hundreds of critical infrastructure networks ^{[12][23][62][74][30]}.
• Volt Typhoon also exploited a Cisco Catalyst SD-WAN flaw to deploy custom malware (KeyDrift) designed to steal encryption keys, with infrastructure overlapping the Silent Train network ^[9][30][87].
• Chinese state-sponsored actors exploited a VMware ESX zero-day logging flaw (CVE-2026-41709) to reduce audit trail visibility, allowing operations by attackers with administrative privileges to go unlogged ^[10][33].
• A suspected China-nexus threat actor leveraged PHP2Shell vulnerabilities to root 25 servers and breach a US government-affiliated network, including chaining with a high-severity Fragnesia Linux kernel privilege escalation bug ^[11][15][17].
• The GOLD OGRE threat group used AI in the development, orchestration, and execution of Aur0ra ransomware operations ^[84].
• A Ukrainian affiliate of Hive and Nefilim ransomware gangs was sentenced to 70 months in US prison for attacks targeting businesses and hospitals ^[34][53].
• Attackers used fake ChatGPT and Claude projects to distribute Yoba malware, hiding malicious code behind signed binaries ^[60].
• Malicious Firefox extensions impersonated popular crypto wallets to steal recovery phrases and private keys ^[89].
• A threat actor impersonated AI bots from OpenAI, Anthropic, and Meta to scan for exposed credentials ^[39].
• Attackers abused legitimate Mobile Device Management (MDM) platforms to deploy rogue remote management tools, turning device management into a pathway for remote access and persistence ^[93].
• GitHub issues were weaponized in a supply chain attack campaign targeting 61 public repositories in less than an hour, exploiting vulnerable workflows ^[50].

Trends, Tools, or Tactics of Interest

• AI is increasingly used both offensively and defensively in cybersecurity. Google introduced Gemini 4 Carbon, a frontier AI model outperforming predecessors in vulnerability discovery, exploitation, and patching ^[1][64].
• Cisco open sourced Project Quarry, a rules language to detect AI agent attacks that emerge across sequences of benign actions ^[25].
• Cisco Talos observed a new AI-enabled command-and-control framework in the wild, dubbed NIK C2 ^[86].
• AI agents are now capable of controlling authenticated browsers, interacting with corporate applications, and accessing sensitive data while mimicking legitimate users ^[16].
• The supply chain attack campaign “GhostAction” shifted toward targeting developer endpoints and cloud access, indicating evolving tactics among cybercrime groups ^[37].
• Online scam volumes have doubled and now outpace phishing, with over six million scam detections in Q2 2026 ^[55].
• Phishing remains the leading initial access technique, while ransomware and pre-ransomware cases have increased, with finance and public administration being the top-targeted industries ^[85].
• Attackers are increasingly hiding malware behind signed binaries of AI tools to evade detection ^[60].
• Credential exposure continues to be a significant risk, with 26,400 valid cloud and AI credentials found in public Gitee repositories ^[5].
• Attackers are turning GitHub issues into attack vectors for supply chain campaigns, automating exploitation of vulnerable workflows ^[50].
• The use of AI-enabled tools such as Gemini 4 Carbon and NIK C2, as well as AI-assisted attack orchestration by groups like GOLD OGRE, demonstrates the growing sophistication of threat actors ^{[1][64][84][86]}.

Regulatory or Policy Developments Affecting the Security Industry

• The UK released a shortlist of age verification methods for its upcoming under-16 social media ban, noting that some adults will also require verification ^[49].
• The UK Information Commissioner’s Office (ICO) reprimanded Staffordshire Police following a serious breach of personal information related to domestic abuse cases ^[56].
• CREST published a framework advocating a whole-ecosystem approach to strengthening cyber resilience across the financial services sector ^[54].
• The US National Institute of Standards and Technology (NIST) published guidance for federal agencies on prioritizing post-quantum cryptography adoption to meet the 2031 transition deadline ^[57].
• Microsoft again urged Entra ID administrators to migrate users to phishing-resistant authentication methods ahead of the planned retirement of SMS and voice authentication in February 2027 ^[24].
• A federal appellate court ruled that West Virginia’s law barring disclosure of public officials’ personal data is unconstitutional ^[47].
• US law enforcement seized the primary domain of Virtualine, a major bulletproof hosting provider used to facilitate cybercrime and ransomware operations ^[20][71].

Sources

1. Sony ISP subsidiary data breach exposes 2.5 million customer records - bleepingcomputer.com
2. Hackers Steal 2.6 Million Records From Sony’s Japanese ISP So-net - securityweek.com
3. Over 41,000 DHS Employee Records Leaked Online - securityweek.com
4. Massive Leak Exposes 41,000 Homeland Security Workers—Including Undercover ICE Agents - wired.com
5. Hacktivists leak 41,000 DHS staff records, revealing undercover ICE agents - helpnetsecurity.com
6. Leak site publishes data on more than 41,000 DHS employees obtained by hacktivists - cyberscoop.com
7. Cyberattack disrupts Belgian tax services before filing deadline - therecord.media
8. Japan Airlines warns of data breach as country grapples with multiple cyber incidents - therecord.media
9. University of New Mexico restores hospital systems, urges no contact with hackers - therecord.media
10. Most Servers on the Planet Are Vulnerable to This Firmware Code-Execution Flaw - wired.com
11. Cisco Patches Actively Exploited ASA and FTD VPN Flaw That Can Crash Firewalls - thehackernews.com
12. New Cisco firewall zero-day exploited to crash SSL VPN devices - bleepingcomputer.com
13. Attackers Exploit Second Cisco Firewall VPN Zero-Day Since August - securityweek.com
14. Telegram Android Flaw Lets Attackers Run Code When Users Answer Voice Calls - thehackernews.com
15. Attacker Tried to Exploit Alpine Linux’s GitLab via CVSS 10.0 Flaw Its Ruby Left Open - thehackernews.com
16. Adobe, Veeam, Juniper Networks Patch Critical Vulnerabilities - securityweek.com
17. Exploitation attempts against recently patched Oracle EBS flaw have begun (CVE-2026-101767) - helpnetsecurity.com
18. Oracle celebrates end of Cybersecurity Awareness Month with quadruple trouble - theregister.com
19. Have an older iPhone or iPad? Apple has a security update for you - malwarebytes.com
20. Researcher Reveals How Logic Bugs Alone Cracked Microsoft Edge in $175,000 Pwn2Own Win - thehackernews.com
21. Researchers broke the browsers built into VS Code, Cursor, Copilot, Codex and Claude Desktop - helpnetsecurity.com
22. Volt Typhoon Used Covert Silent Train Network in Four Zero-Day Exploitation Campaigns - thehackernews.com
23. Volt Typhoon hides zero-day attacks using 'Silent Train' framework - bleepingcomputer.com
24. Volt Typhoon targeted enterprise control planes via ever-changing “Silent Train” relay network - helpnetsecurity.com
25. Researchers uncover Volt Typhoon’s covert, ephemeral network - cyberscoop.com
26. Cisco SD-WAN Zero-Day Exploitation Tied to Volt Typhoon’s ‘Silent Train’ Network - securityweek.com
27. Hackers Exploited Cisco SD-WAN Flaw to Plant Malware Built to Steal Encryption Keys - thehackernews.com
28. Inside KeyDrift: Analyzing historical UAT-11473 activity on Cisco SD-WAN - blog.talosintelligence.com
29. China-Linked Hackers Exploited VMware ESX Zero-Day to Reduce Audit Trail Visibility - thehackernews.com
30. Chinese Hackers Quietly Used Low-Severity ESXi Logging Flaw as Zero-Day - securityweek.com
31. Attackers Exploit PHP2Shell Flaws in Internet-Exposed Palo Alto Networks Management Interfaces - thehackernews.com
32. PHP2Shell Attack Roots 25 Servers, Breaches U.S. Government-Affiliated Network - thehackernews.com
33. CISA warns of Fragnesia Linux flaw chained in PHP2Shell attacks - bleepingcomputer.com
34. AI used in Aur0ra ransomware testing and execution - sophos.com
35. Ukrainian Hive and Nefilim Ransomware Affiliate Gets 70 Months in US Prison - securityweek.com
36. Serial ransomware crook gets 70 months behind bars for Nefilim, Hive roles - theregister.com
37. Attackers Hide Malware Behind Signed ChatGPT and Claude Binaries - infosecurity-magazine.com
38. Malicious Firefox extensions impersonate popular crypto wallets - malwarebytes.com
39. Attacker Relentlessly Scans for Credentials by Impersonating AI Bots - darkreading.com
40. Managed for Malice: How Attackers Turn MDM into Remote Access - huntress.com
41. Attackers turn GitHub issues into supply chain campaign against 61 public repos in less than an hour - theregister.com
42. Google's Gemini 4 Carbon Leads Benchmarks for Finding, Exploiting, and Patching Vulnerabilities - thehackernews.com
43. Google says Gemini 4 Carbon beats its predecessors at finding and fixing security flaws - helpnetsecurity.com
44. Cisco Open Sources Quarry to Catch AI Agent Attacks Hidden in Harmless Steps - securityweek.com
45. NIK C2: The new AI-enabled command-and-control framework - blog.talosintelligence.com
46. 3 Ways AI Agents Already Operate in Your Browser - bleepingcomputer.com
47. GhostAction Hacking Wave Fizzles, But Attackers Lurk on in GitHub - darkreading.com
48. Online Scam Volumes Double to Overtake Phishing - infosecurity-magazine.com
49. IR trends Q3 2026: Actors impersonate IT help desks in vishing attacks as ransomware activity increases - blog.talosintelligence.com
50. 26,400 Valid Cloud and AI Credentials Found Exposed in Public Gitee Repositories - thehackernews.com
51. Shortlist of age checks for the UK's under-16 social media ban is out, 'some' adults will need verifying - theregister.com
52. ICO Reprimands Staffordshire Police After Domestic Abuse Breach - infosecurity-magazine.com
53. CREST Urges Whole-Ecosystem Approach to Financial Cyber Resilience - infosecurity-magazine.com
54. NIST Publishes Guidance to Meet Federal Post-Quantum Deadlines - infosecurity-magazine.com
55. Microsoft urges Entra ID admins to migrate users to passkeys - bleepingcomputer.com
56. Court strikes down West Virginia law barring disclosure of public officials’ personal data - therecord.media
57. Police seize Virtualine bulletproof service tied to ransowmare, cybercrime - bleepingcomputer.com
58. Officials seize domain of top bulletproof hosting provider Virtualine - cyberscoop.com