Cybersecurity Newsfeed - 28/10/26
Daily cybersecurity news covering vulnerabilities, adversaries, trends, breaches, and other notable security developments.
Cybersecurity Newsfeed
📅 28/10/26
🛡️ Vulnerabilities
CISA Adds Two PHP Remote Code Execution Flaws to KEV Catalog (CVE-2026-109618, CVE-2026-109619): CISA added two critical PHP vulnerabilities to its Known Exploited Vulnerabilities catalog involving memory corruption and internal request-state handling. Both allow unauthenticated attackers to execute arbitrary code remotely on web servers. Federal agencies must patch immediately under operational binding deadlines. More info More info AI Security Agent Discovers 4 Severe ICS Flaws in Under 4 Hours: An autonomous AI security tool successfully discovered four high-severity vulnerabilities in widely deployed industrial control system (ICS) software within four hours. The flaws allow authentication bypasses and remote code execution across operational technology environments. More info
Critical Brotli “Node2Shell / Brotli2Shell” Out-of-Bounds Write Flaw (CVE-2026-111497): A severe memory corruption flaw in Google’s open-source Brotli compression library exposes Node.js, .NET, Bun, Envoy Proxy, and Python HTTP clients to remote code execution. Threat intelligence confirms active exploitation in the wild against unpatched instances. More info More info Microsoft Distrusts eMudhra Digital Certificates via Out-of-Band Update: Microsoft issued emergency updates to revoke trust from seven root and intermediate digital certificates linked to eMudhra CA due to sub-256 key cryptographic weaknesses, preventing mathematical key recovery and MITM decryption. More info
GoAhead Web Server TLS Authentication Flaws (CVE-2026-115881): EmbedThis patched GoAhead web server v6.1.1 to fix OpenSSL backend failures that permitted revoked client certificates to authenticate under mTLS, alongside LibreSSL and Mbed TLS certificate validation bugs. More info
Apple Backports iOS/iPadOS 18.7.11 Fix for Zero-Day (CVE-2026-86950): Apple released emergency updates backporting fixes for a CoreGraphics out-of-bounds write flaw that allowed arbitrary code execution, which was actively exploited against individuals running iOS versions prior to iOS 27. More info
Tailscale “Tailworm” Flaws Allow Root Remote Code Execution: Cyberdione Labs disclosed 11 unpatched vulnerabilities in Tailscale mesh VPN and Headscale control servers, including an embedded SSH Unix-socket forwarding flaw that grants authorized users root execution and enrollment key theft. More info
HPE Patches 72 Vulnerabilities Across Aruba AOS-8 and AOS-10: Hewlett Packard Enterprise resolved 72 security flaws, including eight critical RCE and authentication bypass vulnerabilities (CVE-2026-79844 through CVE-2026-79851) impacting mobility conductors, controllers, and access points. More info
Apple Releases macOS Tahoe 26.7.2 Patches: Security advisories detail fixes for APFS, CoreGraphics, CoreAudio, and AppleAVD memory corruption flaws alongside Gatekeeper bypasses and sandbox escape vectors in macOS. More info
Microsoft Issues Emergency .NET Patches for Brotli Vulnerability: Out-of-band updates were pushed for .NET 8 through .NET 11 RC3 to patch CVE-2026-111497 in ASP.NET Core request decompression and HttpClient response processing. More info
- Critical Wasmtime WebAssembly Runtime Sandbox Escapes (CVE-2026-115889, CVE-2026-115893): Wasmtime patched two Cranelift compiler vulnerabilities rated CVSS 9.9 involving value tracking overflows and ARM64 branch index truncations that permit host sandbox escapes. More info
🎯 Adversaries
CyberStrikeAI Deploying 44 Autonomous AI Agents in Japanese Attacks: Threat actors are using CyberStrikeAI, an open-source framework leveraging 44 autonomous AI agents, to execute end-to-end multi-stage attacks including automated Japanese phishing, C2, and exfiltration. More info
Email Spam Flooding Combined with Social Engineering via Microsoft Teams: Attackers are flooding victim inboxes with spam before contacting them via Microsoft Teams external chat, posing as internal IT help desk staff to gain Quick Assist remote desktop access. More info
Aokigahara Stealer Targets AI Tool Tokens and Developer Keyrings: Check Point discovered Aokigahara, a Windows infostealer specifically engineered to harvest session tokens for Claude, ChatGPT Desktop, Codex, Cursor, GitHub Copilot, and Gemini CLI along with cloud SSH/Git credentials. More info
Lazarus Group Abuses South Korean Initech Software in Operation FlashHole: North Korean state-sponsored threat actors are exploiting INISAFE CrossWeb EX software vulnerabilities to sideload malicious DLLs in memory and deploy the Cubridge framework using post-quantum ML-KEM-1024 encryption for C2. More info
Cyberattacks Hijack Dahua IP Cameras via Easy4IP Cloud Platform: Ukraine’s CERT-UA warned of active attacks brute-forcing device serial numbers and abusing legacy authentication bypass flaws (CVE-2021-33044, CVE-2021-33045) on Dahua IP cameras and NVRs to establish backdoor admin access. More info
LiteLLM Open-Source Framework Hit by Supply Chain Attack: Maintainers of LiteLLM resolved a supply chain compromise after an exposed master API key allowed threat actors to push malicious package updates aimed at stealing environment variables and secrets. More info
📈 Trends
Huntress “Tragic Quadrant” Highlights RMM Software Abuse: Huntress released a threat landscape report showing that legitimate Remote Monitoring and Management tool hijacking accounted for 45% of SMB endpoint incidents alongside AitM MFA bypasses and ClickFix attacks. More info
DNSFilter Launches LUMINATE Security Platform: A new platform integrating DNS filtering, shadow AI controls, and remote workforce protection into a single console without requiring traditional VPN architectures. More info
FireMon Integrates Agentic AI into Network Policy Management: FireMon announced FireMon Agentic AI to assist security teams with natural language policy queries, multi-vendor firewall access analysis, and Model Context Protocol integration. More info
ThreatAware Introduces Dimension for AI App Governance: Dimension provides a governed workspace to build, test, and manage custom AI-generated security applications with built-in RBAC, isolated multi-tenancy, and API execution approvals. More info
💥 Breaches & Leaks
Developer Tool Provider Warp Discloses Data Incident: Warp disclosed a security breach resulting from third-party vendor exploitation that exposed AI agent decision logs and user telemetry for ~1% of its user base. More info
French Energy Giant ENGIE Discloses Customer Data Breach: Unauthorized actors accessed a partner marketing platform, exposing customer names, postal/email addresses, phone numbers, and energy metering IDs across France. More info