Cybersecurity News Briefing: October 29, 2026
Thursday, October 29, 2026 · 23 stories · 2 exploited vulnerabilities
This briefing highlights a surge in active exploitation of critical flaws across enterprise and network infrastructure. Unauthenticated SQL injection in Oracle E‑Business Suite, chained PeopleSoft vulnerabilities, PHP2Shell attacks on firewalls and VPNs, and newly catalogued Adobe Commerce, Magento and Brotli issues are all being leveraged in the wild. Espionage groups continue using covert infrastructure, while phishing campaigns abuse cloud authentication flows. Today’s priority is to deploy the available patches for these critical vulnerabilities.
Top Stories
- CriticalData BreachGlobalTechCrunch
Binance investigates suspected hot wallet hack as Tether and Circle freeze stablecoins
On-chain trackers saw billions of dollars leave Binance hot wallets on 29 October, starting around 20:24 UTC. Binance has not confirmed a breach or a loss total. Its spokesperson said it is aware of a "potential security issue" and actively investigating, that user funds are safe, and that withdrawals were temporarily suspended on multiple networks as a precaution. Estimates of the amount moved vary widely, from about $2 billion to as much as $5.8 billion, because sources measure different things. Tether CEO Paolo Ardoino said it froze more than 1.567 billion USDT, and Circle CEO Jeremy Allaire said it froze more than 800 million USDC in coordination with law enforcement. Analysts say the attacker used an EIP-7702 delegation to take control of a Binance wallet; the cause, such as a compromised key, signing system or insider, is unconfirmed and no one has been named. Former CEO Changpeng Zhao wrote that it looks like a hack and that he expects all user funds to be fully covered.
Why it matters: Exchange hot wallets are a single point of failure, so do not keep more on an exchange than you are prepared to have delayed, move long-term holdings to your own wallet, secure your account with a passkey or authenticator app, and treat any "recovery" message or withdrawal link as a likely scam.
- InformationalMalwareGlobalGitHub Changelog
GitHub launches an npm package firewall that blocks malicious packages before they install
GitHub has put a package firewall into public preview for all GitHub Enterprise Cloud customers, including data-resident Enterprise Cloud. It sits between developer machines, CI/CD runners and coding agents and the public npm registry, inspecting metadata requests and downloads as an install-time policy gate. Default controls block versions with known malware advisories, critical vulnerabilities, attestation downgrades and newly added install scripts, plus versions younger than a configurable cooldown (1 day by default, up to 365). Blocked users can request an exception that administrators approve. Only npm is supported, the service is free during the preview, and GitHub says it will be billed on metered usage, similar to Actions, at general availability.
Why it matters: Most npm supply chain attacks push a poisoned version of a trusted package and run code at install time. Enterprise teams should test the firewall now; everyone else can get similar protection with lockfiles and npm ci, disabled install scripts, release-age delays and signature checks.
- CriticalVulnerabilityEuropeThe Register
Oracle E-Business Suite unauthenticated SQL injection (CVE-2026-101767) observed in the wild
An unauthenticated SQL injection bug in Oracle E-Business Suite’s Thin Client Framework servlet, identified as CVE-2026-101767, can be chained to remote code execution. Exploit attempts were recorded on October 27, showing attackers can execute OS commands with the privileges of the EBS application account. Oracle released a patch in its October update.
Why it matters: Apply Oracle’s October patch immediately to block SQL injection and RCE attempts on E-Business Suite.
- CriticalVulnerabilityGlobalBleepingComputer
InfraTrust report identifies active exploitation of PHP2Shell flaws in network devices
An InfraTrust analysis reports that attackers are actively exploiting a PHP vulnerability dubbed PHP2Shell, which affects web management interfaces of firewalls, VPNs, application delivery controllers and similar appliances. The ongoing exploitation highlights the risk to critical network infrastructure components.
Why it matters: Patching or mitigating PHP2Shell on exposed management interfaces is essential to prevent compromise.
- CriticalVulnerabilityGlobalThe Hacker News
Oracle PeopleSoft zero-day comprises three chained flaws exploited by ShinyHunters
Researchers reported that the Oracle PeopleSoft vulnerability exploited by ShinyHunters since May consists of three linked flaws rather than a single issue. Oracle issued a patch covering all three under CVE-2026-35273 in June. The chain begins with a server-side request forgery that leverages PeopleSoft’s trust of its loopback address.
Why it matters: Patching PeopleSoft to address the SSRF chain is essential to prevent remote code execution.
- CriticalVulnerabilityGlobalThe Hacker News
CISA adds Adobe Commerce, Magento and Brotli decoder flaws to KEV catalog
CISA added two vulnerabilities affecting Adobe Commerce, Magento and Google’s Brotli decoder library to its Known Exploited Vulnerabilities catalog, citing evidence of active exploitation. The Adobe Commerce issue is identified as CVE-2026-111497 with a CVSS score of 9.2 and involves an unchecked return value. The vulnerabilities are now publicly listed for organizations to address.
Why it matters: Organizations using Adobe Commerce, Magento or Brotli decoding should prioritize patching to stop active exploitation.
- HighData BreachGlobalThe Record
Japan Airlines discloses breach affecting roughly 2,000 customers' personal data
Japan Airlines announced that unauthorized actors accessed and exfiltrated personal information, including passport numbers, frequent-flyer identifiers, email addresses and phone numbers, belonging to approximately two thousand customers. The breach occurs amid a broader series of cyber incidents in the country.
Why it matters: Affected individuals should monitor accounts for identity theft while the airline strengthens data protection measures.
- HighThreat IntelligenceGlobalThe Hacker News
Volt Typhoon leveraged Silent Train network for multiple zero-day exploitation campaigns
The China-aligned espionage group Volt Typhoon was linked to a covert access infrastructure named Silent Train, which was employed in four separate campaigns that exploited zero-day vulnerabilities to gain strategic access. The network, first observed in late 2023, used rotating compromised devices across SOHO, IoT and enterprise environments before being disrupted.
Why it matters: Monitoring for anomalous device connections can help detect covert infrastructure used for zero-day exploits.
- HighMalwareGlobalThe Hacker News
AI-assisted PHP2Shell campaign compromises 25 servers and a US government-linked network
Researchers disclosed an AI-assisted attack that used the PHP2Shell vulnerability together with a kernel privilege escalation exploit to gain root access on 25 servers. The campaign, attributed to a suspected China-nexus actor, also breached a network affiliated with a US government entity on October 25. The activity demonstrates rapid exploitation of critical flaws.
Why it matters: Detect and block PHP2Shell and kernel exploits to prevent unauthorized root access on critical systems.
- HighPhishing & FraudNorth AmericaThe Hacker News
Skyw4lker device-code phishing campaign targets U.S. organizations using cloud services
Analysis by ANY.RUN uncovered the Skyw4lker device-code phishing campaign that leverages legitimate cloud services and authentication flows to gain access to corporate accounts without stealing credentials. The technique focuses on abusing trusted business workflows and leaves few obvious indicators. The campaign primarily targets organizations in the United States.
Why it matters: Implementing strict verification of cloud authentication flows can reduce risk from device-code phishing attacks.
- MediumThreat IntelligenceEuropeThe Record
Moldovan authorities probe foreign involvement in large-scale government cyberattack
Moldova's prime minister indicated that a recent extensive cyberattack on government systems, which may also have targeted citizens' personal data, could be part of a wider campaign potentially involving foreign actors. An investigation is underway to determine the source and scope of the intrusion.
Why it matters: Governments should strengthen defenses and monitor for coordinated attacks against public sector networks.
- MediumPhishing & FraudGlobalDark Reading
Threat actor uses AI-bot impersonation to scan for exposed credentials
A threat actor has been conducting continuous scans for login data while masquerading as agents from AI providers such as OpenAI, Anthropic and Meta. By posing as legitimate bots, the group attempts to locate and harvest exposed credentials across targeted environments.
Why it matters: Verifying the authenticity of automated requests and monitoring credential exposure can block credential-theft attempts.
- MediumVulnerabilityGlobalKaspersky Securelist
Unauthenticated DoS flaw in Intelbras IP cameras patched in firmware update
Researchers discovered a denial-of-service vulnerability in Intelbras IP cameras that allows anyone on the local Wi-Fi network to send a request to an unauthenticated firmware update endpoint, disrupting the device for up to a minute per request. Repeated requests can keep cameras offline indefinitely. Intelbras released firmware R.260804 to remediate the issue, and the flaw has been assigned a medium-severity CVSS score of 5.1.
Why it matters: Updating to the latest firmware eliminates the unauthenticated DoS risk for Intelbras cameras.
- InformationalPolicy & RegulationGlobalThe Record
U.S. Treasury sanctions Russian and North Korean individuals for IT earnings laundering
The U.S. Treasury Department imposed sanctions on several Russian and North Korean nationals accused of laundering income generated by illicit information-technology workers on behalf of the North Korean regime. The action targets financial channels used to support prohibited activities.
Why it matters: Screening transactions for links to sanctioned individuals helps avoid compliance violations.
- InformationalPolicy & RegulationEuropeHelp Net Security
Security teams adopt AI in SOC operations faster than anticipated
The author reflects that, contrary to expectations of slow adoption due to compliance concerns, security operations centers have begun to rely on AI tools more rapidly than anticipated. The piece discusses the tension between rapid innovation and strict compliance obligations in the context of AI deployment.
Why it matters: Aligning AI integration with compliance frameworks enables safe acceleration of security automation.
- InformationalAI SecurityEuropeHelp Net Security
Digitate launches ignio Hummingbird AI agents for patch planning and SAP operations
Digitate introduced ignio Hummingbird, an update to its AIOps platform that adds AI agents capable of handling tasks such as patch planning, service-desk support and SAP operations. The agents move from diagnosis to approved action and verification while complying with enterprise change, approval and audit controls, and the platform now supports custom agent creation with built-in Model Context Protocol and Agent-to-Agent servers.
Why it matters: AI agents that respect change and audit controls can streamline IT work while maintaining governance.
- InformationalPolicy & RegulationEuropeHelp Net Security
VikingCloud releases AI Governance Services to assess and remediate AI risk
VikingCloud introduced AI Governance Services, a suite of compliance and risk assessments that inventory AI tools used within an organization, identify security control gaps, and provide remediation plans. The offering addresses challenges faced by multi-location enterprises where decentralized adoption and vendor-enabled AI features can create shadow AI and inconsistent security standards.
Why it matters: Structured AI governance helps detect and remediate hidden AI risks across distributed environments.
- InformationalPolicy & RegulationGlobalBleepingComputer
Token Security stresses limiting service account and AI agent access despite PHP2Shell exploits
Analysis of the PHP2Shell exploit highlights that attackers can quickly leverage critical vulnerabilities before patches are applied. Token Security advises that restricting permissions for service accounts, API keys and AI agents can reduce breach impact even when vulnerabilities are present. The guidance focuses on mitigating blast radius rather than CVSS scores.
Why it matters: Restricting privileges of service accounts and AI agents limits damage from rapid exploitation.
- InformationalAI SecurityEuropeThe Register
Cisco open-sources Project Quarry to detect malicious AI agent behavior
Cisco released Project Quarry, an open-source behavior detection engine that monitors AI agents for suspicious activity across entire sessions. The tool aims to provide contextual analysis similar to Snort and YARA, helping security teams identify rogue agents that may perform prompt injection, call attack tools, or exfiltrate data. Quarry evaluates sequences of actions rather than isolated events.
Why it matters: Deploying Quarry enables organizations to spot and block rogue AI agents before they cause data theft or system compromise.
- InformationalThreat IntelligenceLatin AmericaESET WeLiveSecurity
ESET publishes APT activity overview for Q2-Q3 2026
ESET Research released a report summarizing the observed behaviors and campaigns of selected advanced persistent threat groups during the second and third quarters of 2026. The document provides analysis of tactics, techniques and procedures employed by the groups.
Why it matters: Staying informed on APT tactics helps organizations adapt defenses against emerging threat patterns.
- InformationalAI SecurityGlobalThe Hacker News
Anthropic AI model generated proof-of-concept exploits for major browsers and OSes
Anthropic reported that an unreleased AI model identified vulnerabilities in Chrome, Safari, Android, Windows and Linux and combined them into functional proof-of-concept exploits created in a lab environment. The company disclosed each flaw to the respective vendors, and all have been patched before any public exploitation.
Why it matters: Rapid patching of AI-discovered flaws limits the window of exposure to emerging exploits.
- InformationalPolicy & RegulationNorth AmericaThe Hacker News
DOJ seizes Virtualine domain linked to bulletproof hosting and money-laundering
The U.S. Department of Justice announced the seizure of a domain used by the Virtualine bulletproof hosting service, which authorities allege facilitated criminal activities including the distribution of illicit content and the laundering of cryptocurrency proceeds. The action aims to disrupt the provider's role in supporting illegal operations.
Why it matters: Avoiding services with questionable compliance histories reduces exposure to illicit activity.
- InformationalThreat IntelligenceGlobalThe Hacker News
GMO Internet Group announces up to $1 million bounty for information on FX cloud breach
GMO Internet Group launched a reward program offering a total of up to one million dollars for tips that lead to the identification and arrest of the attackers who compromised its Onamae.com Desktop Cloud service, which provides Windows desktops for foreign-exchange trading. The bounty is payable only if a contribution results in an arrest or an international wanted notice.
Why it matters: Financial institutions should pursue proactive threat hunting and cooperate with law enforcement to mitigate breach impacts.
Newly Added Known Exploited Vulnerabilities
Vulnerabilities CISA has confirmed are being exploited in the wild. If you run any of these products, patch or mitigate first.
| CVE | Product | Vulnerability | Ransomware use |
|---|---|---|---|
| CVE-2026-41709 | Broadcom VMware ESX | Broadcom VMWare ESX Insufficient Logging Vulnerability | Unknown |
| CVE-2026-46300 | Linux Kernel | Linux Kernel Missing Initialization of a Variable Vulnerability | Unknown |