Cybersecurity News Briefing: October 28, 2026
Wednesday, October 28, 2026 · 15 stories · 2 exploited vulnerabilities
Today's briefing highlights critical vulnerabilities and active threats across multiple sectors. A flaw in Microsoft Authenticator for Android (CVE‑2026‑80097) allowed token harvesting, while a chain of bugs broke tenant isolation in a major cloud platform. CISA added two actively exploited CVEs to its KEV catalog, and Japan’s GMO Group warned of imminent ransomware. Supply‑chain breaches affected UK police data, and the Lazarus Group used compromised security software for post‑quantum encrypted malware. The Australian Signals Directorate disrupted the Amadey botnet. Readers should update the Microsoft Authenticator app immediately.
Top Stories
- CriticalVulnerabilityGlobalThe Hacker News
Microsoft Authenticator Android Flaw Allowed Permissionless Apps to Harvest Work Tokens
A vulnerability in the Microsoft Authenticator app for Android let a malicious application without any permissions impersonate a trusted Microsoft app and capture sign-in tokens for a victim’s work account. Microsoft assigned CVE-2026-80097 to the issue and released version 6.2606.4246 to remediate it. Users are advised to update the app promptly.
Why it matters: Unpatched token-stealing flaws can enable credential theft, so promptly applying security updates is essential.
- CriticalVulnerabilityRussia & Eastern EuropeKaspersky Securelist
Research reveals vulnerability chain that bypasses tenant isolation in major cloud platform
A penetration test uncovered a sequence of vulnerabilities and logic errors in a leading cloud provider that allowed an attacker to break tenant isolation and gain unrestricted access to other customers' resources. The findings were disclosed through a bug bounty program and fully remediated by the provider.
Why it matters: Regular pentests and bug bounty programs are essential to discover and fix isolation flaws before they are exploited.
- CriticalVulnerabilityNorth AmericaCISA Advisories
CISA adds two actively exploited vulnerabilities to KEV catalog
CISA added two CVEs to its Known Exploited Vulnerabilities catalog based on evidence of active exploitation. The flaws affect Adobe Commerce/Magento file upload handling and Google Brotli return-value processing. Federal agencies must prioritize remediation and CISA encourages all organizations to address the issues promptly.
Why it matters: Prioritizing patching of actively exploited flaws reduces the risk of compromise.
- HighRansomwareAsia-PacificBleepingComputer
Japan's GMO Group advises customers to shut down PCs amid imminent ransomware threat
After a breach of its Onamae Desktop Cloud service, the GMO Group warned customers to disconnect from the internet and power off computers because a threat actor claimed a ransomware attack would be launched that day. The advisory aims to prevent infection and data loss across affected systems.
Why it matters: Immediate isolation of systems can limit ransomware spread and protect data integrity.
- HighData BreachEuropeThe Record
UK Police Data Breached Multiple Times via Third-Party IT Suppliers
His Majesty’s Inspectorate of Constabulary and Fire & Rescue Services reported that British police information has been compromised on several occasions this decade through vulnerabilities in external IT suppliers. The repeated incidents underscore ongoing supply-chain security challenges for law-enforcement agencies.
Why it matters: Law-enforcement bodies should enforce stringent security standards on all suppliers to protect sensitive citizen data.
- HighMalwareAsia-PacificThe Hacker News
Lazarus Group Uses South Korean Security Software to Deploy Post-Quantum Encrypted Malware
Kaspersky attributes a cyber-espionage campaign named Operation FlashHole to the North Korea-linked Lazarus Group, which compromised at least three South Korean organizations in construction, software and wire-communication equipment sectors. The attackers leveraged a local security product to deliver malware employing post-quantum encryption, with activity observed since mid-2025.
Why it matters: Enterprises should verify the integrity of security tools and monitor for anomalous encrypted payloads to detect advanced espionage.
- HighVulnerabilityGlobalBleepingComputer
Apple backports CoreGraphics zero-day fix to older iPhone and iPad models
Apple released backported security patches for a CoreGraphics zero-day vulnerability that had been used in sophisticated targeted attacks, extending the fix to older iPhone and iPad devices. The update protects legacy hardware from exploitation of the flaw.
Why it matters: Updating older iOS devices with the backported patch blocks a known zero-day attack vector.
- HighMalwareAsia-PacificThe Hacker News
Australian Signals Directorate Cuts Off Amadey Botnet Controller, Halting Access to 180,000 Infected Machines
The Australian Signals Directorate gained access to the backend of the Amadey malware operation and disconnected it, preventing the criminal from reaching approximately 180,000 compromised computers worldwide, including devices in Australia. The takedown disrupts the botnet’s ability to steal data.
Why it matters: Coordinated takedowns of command-and-control infrastructure can effectively neutralize large-scale malware threats.
- HighThreat IntelligenceEuropeThe Hacker News
Ukrainian CERT Alerts to Unauthorized Access of Dahua IP Cameras via P2P and Weak Auth
The Computer Emergency Response Team of Ukraine warned that threat actors are remotely accessing Dahua video surveillance cameras and DVRs by exploiting peer-to-peer access methods and authentication weaknesses, allowing them to view streams, alter configurations and create unauthorized accounts.
Why it matters: Securing default credentials and disabling unnecessary remote access on IoT cameras can prevent unauthorized surveillance and device takeover.
- HighMalwareAsia-PacificThe Register
Japanese ISP Reports Cloud Desktop Service Compromised, Trading Accounts Potentially Accessed
GMO Internet disclosed that its Onamae.com Desktop Cloud, a virtual Windows desktop platform used for foreign-exchange trading, was accessed by an unauthorized third party who installed malicious programs on customer servers. Some users reported unauthorized trading operations and possible exposure of trading passwords, prompting a recommendation to change passwords on separate devices.
Why it matters: Cloud service providers must enforce strong isolation and promptly address vulnerabilities to protect sensitive financial operations.
- MediumThreat IntelligenceMiddle EastCheck Point Research
Check Point tracks Yoba campaign leveraging fake AI tool installers and DLL sideloading
Researchers identified a campaign that distributes malware through counterfeit GitHub projects posing as AI desktop applications such as GPT-5.6 and Claude Opus. The malicious dropper uses DLL sideloading alongside legitimate OpenAI and Anthropic executables and communicates via Telegram, Tor and DNS over HTTPS, avoiding traditional C2 infrastructure.
Why it matters: Validating software signatures and monitoring for unauthorized DLL loading can block this sideloading technique.
- InformationalAI SecurityEuropeHelp Net Security
Exeon releases AgentGuard to monitor shadow AI and autonomous agent activity
Exeon Analytics introduced AgentGuard, a security solution that provides organizations with insight into both authorized and unauthorized AI usage, autonomous agents, and associated data flows across tools and services. The product builds on the company's AI-driven behavioral analytics to address emerging risks from rapid AI adoption.
Why it matters: Gaining visibility into shadow AI helps prevent data leakage and rogue agent behavior.
- InformationalPolicy & RegulationNorth AmericaHelp Net Security
CISA Unveils 2030 Strategy to Strengthen Defense of U.S. Critical Infrastructure
The Cybersecurity and Infrastructure Security Agency released the CISA 2030: Defend, Harden, Prevail plan, outlining actions to improve resilience of critical infrastructure against cyber, physical and geopolitical threats. The strategy includes enhancing operational technology security, advancing software security, supporting secure technology adoption and ensuring continuity of national security communications.
Why it matters: Implementing the outlined measures can help organizations protect essential services from evolving cyber threats.
- InformationalAI SecurityGlobalSchneier on Security
Research Shows AI Models Can Hide Encrypted Capabilities Behind Backdoor Triggers
A study demonstrates that adversaries can embed encrypted neural networks within a host model’s weights, activating them only when a secret trigger is presented, making hidden capabilities provably difficult to elicit. The proof-of-concept was implemented in PyTorch and evaluated using a chemical reaction prediction task, highlighting limits of capability audits based on elicitation.
Why it matters: Defenders should assume models may contain concealed functions and employ robust verification beyond surface testing.
- InformationalVulnerabilityGlobalSecurityWeek
NetScaler zero-day disclosures highlight need for robust patch management
Recent NetScaler zero-day vulnerabilities underscore the importance of maintaining ready patch pipelines so organizations can quickly apply updates when new releases arrive. The article advises keeping patch management processes primed for upcoming Citrix releases to reduce exposure time.
Why it matters: Efficient patch workflows reduce exposure time to newly disclosed critical flaws.
Newly Added Known Exploited Vulnerabilities
Vulnerabilities CISA has confirmed are being exploited in the wild. If you run any of these products, patch or mitigate first.
| CVE | Product | Vulnerability | Ransomware use |
|---|---|---|---|
| CVE-2026-48356 | Adobe Commerce and Magento | Adobe Commerce and Magento Unrestricted Upload of File with Dangerous Type Vulnerability | Unknown |
| CVE-2026-111497 | Google Brotli | Google Brotli Unchecked Return Value Vulnerability | Unknown |