Cybersecurity News Briefing: October 30, 2026
Friday, October 30, 2026 · 7 stories · 2 exploited vulnerabilities
Today's briefing highlights active exploitation of critical infrastructure flaws, including a Chinese APT targeting VMware ESX, Linux kernel and Cisco firewalls, and multiple high‑severity vulnerabilities in Hitachi Energy products. Researchers also reported five embedded‑browser bugs in AI developer tools, many still unpatched, and the discovery of 26,400 active cloud and AI credentials exposed in public Gitee repositories. Prioritize applying all available vendor patches for these vulnerabilities immediately.
Top Stories
- CriticalVulnerabilityGlobalHelp Net Security
Chinese APT exploits VMware ESX zero-day and Linux kernel bug to root firewalls
A Chinese advanced persistent threat group leveraged an insufficient logging vulnerability (CVE-2026-41709) in Broadcom’s VMware ESX hypervisor to hide activity and combined PHP2Shell flaws with the Fragnesia Linux kernel bug to obtain root access on servers and firewalls. Cisco also reported exploitation of a newly disclosed flaw to crash its firewalls. Active exploitation of these vulnerabilities has been observed.
Why it matters: Organizations using VMware ESX or Cisco firewalls must apply patches promptly to prevent remote compromise and service disruption.
- HighAI SecurityEuropeThe Register
Researchers uncover five embedded-browser flaws in AI developer tools, two remain unpatched
Security researchers identified five vulnerabilities across popular AI developer tools-Cursor, GitHub Copilot, Anthropic Claude Desktop, Microsoft VS Code, and OpenAI Codex-originating from overly permissive embedded browsers. The flaws can enable arbitrary code execution, data theft, or address-bar spoofing, and the issues in Codex and VS Code remain unpatched. Four of the bugs were disclosed to vendors, and GitHub independently patched its Copilot issue.
Why it matters: Developers should limit embedded browser capabilities and apply vendor patches to prevent remote code execution and data exfiltration.
- HighVulnerabilityNorth AmericaCISA Advisories
Hitachi Energy CoreTec products contain OS command injection and Dirty Frag flaws
Hitachi Energy disclosed two vulnerabilities in its CoreTec product line-an OS-command injection (CVE-2026-13162) affecting authenticated users with certain roles, and a “Dirty Frag” issue (CVE-2026-43284). Successful exploitation could allow attackers to execute arbitrary system commands and impact the product’s confidentiality, integrity, and availability. Mitigation steps and patches have been provided.
Why it matters: Organizations using CoreTec must update to patched versions to block command injection and related attacks.
- HighVulnerabilityNorth AmericaCISA Advisories
Hitachi Energy TRO600 series vulnerable to authentication bypass and remote code execution
Hitachi Energy reported two vulnerabilities in its TRO600 series-CVE-2026-10756, which allows an authenticated attacker to bypass local-only service restrictions, and CVE-2026-106087, which enables remote code execution. Exploitation could expose sensitive functions and affect system availability. The vendor has released patches and mitigation guidance.
Why it matters: Applying the provided updates blocks attackers from gaining unauthorized access or executing code on TRO600 devices.
- HighData BreachGlobalThe Hacker News
26,400 active cloud and AI credentials exposed in public Gitee repositories
An independent researcher identified 26,400 active cloud and AI service credentials embedded in publicly accessible Gitee repositories after scanning over seven million projects. The exposed keys, primarily for cloud platforms and AI services, were functional and could be harvested by anyone reviewing the code. The findings underscore the prevalence of credential leakage in open-source code hosting.
Why it matters: Organizations should enforce secret scanning and remove hard-coded credentials to prevent unauthorized access to cloud and AI resources.
- HighMalwareAsia-PacificKaspersky Securelist
NetamLoader supply-chain malware targets custom Windows 10 builds used by Asian governments
Researchers uncovered a sophisticated infection chain named NetamLoader that leverages a .config file with AppDomainManager injection to load arbitrary .NET assemblies from a CAB archive placed in the Windows update directory of a custom Windows 10 build used by Asian government entities. The archive contains legitimate Patch My PC components alongside malicious code, enabling a stealthy supply-chain compromise. Kaspersky detects the threat under multiple signatures.
Why it matters: Monitoring for unexpected configuration files and validating update packages can help detect and block supply-chain attacks on customized operating systems.
- InformationalPolicy & RegulationAfricaTechCabal
Safaricom dismisses 118 employees for fraud, reflecting increased insider threat controls
Kenya’s largest telecom, Safaricom, reported dismissing 118 employees for fraud in the fiscal year ending March, representing about 2 % of its workforce and a fourfold increase over 2021. The dismissals stem from offenses such as theft, falsifying records and unauthorized access to customer call data, reflecting heightened internal controls despite an overall drop in fraud incidents. The company also noted a rise in law-enforcement referrals.
Why it matters: Strengthening employee monitoring and access controls can reduce insider fraud and protect customer data.
Newly Added Known Exploited Vulnerabilities
Vulnerabilities CISA has confirmed are being exploited in the wild. If you run any of these products, patch or mitigate first.
| CVE | Product | Vulnerability | Ransomware use |
|---|---|---|---|
| CVE-2026-97229 | GitLab Community Edition and Enterprise Edition | GitLab Community Edition and Enterprise Edition Integer Overflow or Wraparound Vulnerability | Unknown |
| CVE-2026-76418 | Cisco Secure Firewall ASA Software and Cisco Secure FTD Software | Cisco Secure Firewall ASA Software and Cisco Secure FTD Software Unchecked Return Value to NULL Pointer Dereference Vulnerability | Unknown |