Security News — 28 October 2026

Inside KeyDrift: Analyzing historical UAT-11473 activity on Cisco SD-WAN

Exploited

Yes — CISA KEV

Product

Cisco Catalyst SD-WAN Controller and Manager

Impact

Authentication bypass

Audience

Network/firewall admins

Action

Patch per vendor / CISA KEV

Talos has identified UAT-11473, a highly sophisticated APT, who exploited CVE-2026-20127, an authentication bypass vulnerability in Cisco SD-WAN Catalyst Controller instances to bypass authentication and gain unauthorized access to affecte…

CISA Adds Two Known Exploited Vulnerabilities to Catalog

Exploited

Yes — CISA KEV

Product

Broadcom VMware ESX

Audience

Virtualization admins

Action

Patch per vendor / CISA KEV

CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog , based on evidence of active exploitation. CVE-2026-41709 Broadcom VMWare ESX Insufficient Logging Vulnerability CVE-2026-46300 Linux Kernel Missi…

CVE-2026-103409 — CRITICAL (CVSS 9.8)

Impact

Missing authentication

Audience

Network/firewall admins

Action

Patch when a fix is available; monitor exposure

CVSS 9.8 CRITICAL · Vendor: Juniper A Missing authentication for critical function vulnerability in Juniper Networks Session Smart Router allows an unauthenticated network-based attacker to obtain administrative privileges by passing craft…

CVE-2026-118690 — CRITICAL (CVSS 9.3)

Impact

Missing authentication

Action

Patch when a fix is available; monitor exposure

CVSS 9.3 CRITICAL Signal K Server before 2.33.0 contains a missing authentication vulnerability that allows unauthenticated remote attackers to download log archives via the /skServer/ziplogs endpoint. Attackers can extract the JWT secretK…

CVE-2026-117574 — CRITICAL (CVSS 9.1)

CVSS 9.1 CRITICAL A flaw was found in ai-gateway-payload-processing. An authenticated remote attacker can exploit this vulnerability by submitting a request specifying another tenant's model identifier in the request body or header. Becaus…

CVE-2026-118579 — HIGH (CVSS 8.9)

Product

D-Link DIR-505

Action

Patch when a fix is available; monitor exposure

CVSS 8.9 HIGH A weakness has been identified in D-Link DIR-505 1.10B02. The impacted element is the function main of the file /secmark1524.cgi of the component Web Management CGI. This manipulation of the argument accu/pass/code/hash/cmds…

Volt Typhoon Used Covert Silent Train Network in Four Zero-Day Exploitation Campaigns

The China-nexus cyber espionage group known as Volt Typhoon has been attributed to a now-disrupted covert access network dubbed Silent Train that has been put to use for zero-day exploitation and strategic access. "First identified in late…

Google to Allow One-Tap Android App Installs From Approved Third-Party Stores Outside U.S.

Third-party Android app stores can now apply to Google for permission to install apps with one tap, without Android's usual confirmation screens, and to update them in the background. To qualify, a store must pass identity checks and send…

Researcher Reveals How Logic Bugs Alone Cracked Microsoft Edge in $175,000 Pwn2Own Win

A chain of logic flaws, with no memory corruption, can turn a malicious web page into code running on a Windows computer outside Microsoft Edge's sandbox, a security researcher has shown. Orange Tsai of DEVCORE published the full method on…

Police seize Virtualine bulletproof service tied to ransowmare, cybercrime

U.S. law enforcement has seized the primary domain of Virtualine, a bulletproof hosting service advertised on cybercrime forums for facilitating illegal activities. [...]

Discord to let search engines index public server messages

Discord will allow search engines to index discussions in Discoverable Servers and make them accessible on the web to users outside the platform without an account or invitation. [...]

PHP2Shell Attack Roots 25 Servers, Breaches U.S. Government-Affiliated Network

Cybersecurity researchers have disclosed details of what appears to be an artificial intelligence (AI)-assisted attack orchestrated by a suspected China-nexus threat actor that has leveraged the PHP2Shell vulnerabilities to breach exposed…

The CISO’s evolving role: Protecting and defending in the agentic era

As AI and agents reshape the enterprise, CISOs face two critical priorities: enabling innovation with the right identity and data guardrails, and modernizing defense to keep pace with AI-powered threats. Aarti Borkar shares how security le…

Attacker Relentlessly Scans for Credentials by Impersonating AI Bots

The threat actor lurked behind bots posing as agents from OpenAI, Anthropic, Meta, and others to find exposed data.

Third Serengeti Sweep Tops 1,400 Arrests as Investigations Mature

Interpol's annual Operation Serengeti, now in its third iteration, led to 1,462 arrests across 20 African countries and the US, recovering $105 million in stolen funds.

Volt Typhoon hides zero-day attacks using 'Silent Train' framework

Chinese state-sponsored hacking group Volt Typhoon has been using a framework that relies on rotating chains of connected devices compromised on demand, including for zero-day attacks targeting high-value systems. [...]

GhostAction Hacking Wave Fizzles, But Attackers Lurk on in GitHub

The supply chain attack campaign's shift toward developer endpoints and cloud access signals what could be next for the cybercrime outfit.

Unwrapping Retail Peak Season Cyber Threats

Unit 42 explores key peak shopping season retail cyber threats, from ransomware to AI attacks, and shares how to defend operations and customer trust. The post Unwrapping Retail Peak Season Cyber Threats appeared first on Unit 42 .

Sony ISP subsidiary data breach exposes 2.5 million customer records

Sony Network Communications has confirmed a data breach that compromised approximately 2.5 million records containing current and former customers' personal information. [...]

ISC Stormcast For Wednesday, October 28th, 2026 https://isc.sans.edu/podcastdetail/10154, (Wed, Oct 28th)

Studying Fraudulent North Korean IT Workers

Researchers set up a fake start-up company to study fraudulent North Korean IT workers.