← All threat briefs

Daily Cybersecurity Brief — 2026-10-31

SECURITY // 2026-10-31

Daily Cybersecurity Brief — 2026-10-31

Threat Intelligence & Malware Analysis

  • Attackers Chain Three Ivanti Connect Secure Flaws to Gain Unauthenticated Root Access — Attackers Chain Three Ivanti Connect Secure Flaws to Gain Unauthenticated Root Access Ravie LakshmananOct 31, 2026Vulnerability / Cyber Attack The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Friday added two security flaws impacting Ivanti Connect Secure (ICS) to its Known Exploited Vulnerabilities (KEV) catalog, following active exploitation in the wild. The vulnerabilities… (Source: The Hacker News)
  • Cloudflare Reports 18.2 Million Network-Layer DDoS Attacks in Q3, Up 38% — Cloudflare Reports 18.2 Million Network-Layer DDoS Attacks in Q3, Up 38% Ravie LakshmananOct 31, 2026Threat Intelligence / Network Security Threat actors are launching about 8,226 network-layer distributed denial-of-service (DDoS) attacks per hour, Cloudflare revealed Thursday. The web infrastructure and security company said it autonomously mitigated 18.2 million network-layer (L3) DDoS… (Source: The Hacker News)
  • The Good, the Bad and the Ugly in Cybersecurity - Week 44 (2026) — Blog/ The Good, the Bad and the Ugly/ The Good, the Bad and the Ugly in Cybersecurity - Week 44 (2026) The Good, the Bad and the Ugly 4 min readOct 30, 2026 The Good, the Bad and the Ugly in Cybersecurity - Week 44 (2026) By SentinelOne Table of Contents Table of Contents The Good | Global Response Continues for PHP2SHELL Exploit Attempts & Defenders Dismantle Global Cybercrime Rings The Bad |… (Source: SentinelOne Blog)
  • Chinese Hackers Use AI-Powered ARTEX to Target Over 200 Organizations Worldwide — Chinese Hackers Use AI-Powered ARTEX to Target Over 200 Organizations Worldwide Ravie LakshmananOct 30, 2026Cyber Espionage / Artificial Intelligence Chinese state-sponsored threat actors have been observed using a Go-based artificial intelligence (AI)-powered penetration testing framework called ARTEX in attacks aimed at high-value targets simultaneously. The activity has been attributed by… (Source: The Hacker News)
  • WordPress RCE Flaw Draws Nearly 63,000 Attack Attempts in Just 24 Hours — WordPress RCE Flaw Draws Nearly 63,000 Attack Attempts in Just 24 Hours Ravie LakshmananOct 30, 2026Vulnerability / Web Security Threat actors have been observed attempting to exploit a high-severity security flaw in WordPress Core shortly after patches were released. The vulnerability, which does not have a CVE identifier, relates to a case of remote code execution impacting WordPress Core… (Source: The Hacker News)
  • Claude Code extension poisoned with persistent SSH backdoor — Sinisa Markovic, Managing Editor, Help Net Security October 30, 2026 Share Claude Code extension poisoned with persistent SSH backdoor A tampered build of Anthropic’s Claude Code extension for VS Code-compatible editors planted an SSH backdoor on developers’ machines, researchers at macOS security firm Phorion have found. The company spotted the malicious package, version 2.1.313, on Open VSX, an… (Source: Help Net Security)
  • Official Claude Code Extension on Cursor Marketplace Trojanized with Persistent SSH Backdoor — Official Claude Code Extension on Cursor Marketplace Trojanized with Persistent SSH Backdoor Ravie LakshmananOct 30, 2026Malware / Artificial Intelligence Cybersecurity researchers have disclosed that a trojanized version of Anthropic's official Claude Code extension was distributed through the Cursor Marketplace as a legitimate update, attempting to install a persistent SSH backdoor on… (Source: The Hacker News)
  • Binance hit by $6.3 billion theft in what could be the biggest crypto heist on record — Sinisa Markovic, Managing Editor, Help Net Security October 30, 2026 Share Binance hit by $6.3 billion theft in what could be the biggest crypto heist on record About $6.3 billion in cryptocurrency was stolen from Binance in what might be the biggest crypto hack in history. “Binance’s initial investigation suggests that the security incident may involve a compromised DevOps engineer’s laptop,… (Source: Help Net Security)
  • Hackers Actively Exploit Highly Critical Drupal Commerce Core Authorization Bypass Flaw — Hackers Actively Exploit Highly Critical Drupal Commerce Core Authorization Bypass Flaw Ravie LakshmananOct 30, 2026Vulnerability / Web Security Drupal has warned that threat actors are exploiting a "highly critical" security flaw in its Commerce Core component. The vulnerability, tracked as CVE-2026-118539 (CVSS score: N/A), is a case of missing authorization affecting Commerce Core versions… (Source: The Hacker News)
  • CISA Adds Actively Exploited GitLab RCE and Cisco Firewall DoS Flaws to KEV — CISA Adds Actively Exploited GitLab RCE and Cisco Firewall DoS Flaws to KEV Ravie LakshmananOct 30, 2026Vulnerability / DevSecOps The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Thursday added two security flaws impacting Cisco and GitLab software to its Known Exploited Vulnerabilities (KEV), citing evidence of active exploitation. The vulnerabilities are listed below -… (Source: The Hacker News)
  • Fake IT help desk callers got by on little more than names and email addresses — Mirko Zorz, Director of Content, Help Net Security October 30, 2026 Share Fake IT help desk callers got by on little more than names and email addresses Attackers posing as IT help desk staff contacted employees by phone, email and Microsoft Teams in the third quarter of 2026 and talked them into opening remote access sessions, Cisco Talos Incident Response (Talos IR) found across several… (Source: Help Net Security)
  • What exactly is ISOC? And what does it mean for you? — Aimei Wei, CTO, Stellar Cyber Sponsored October 30, 2026 Share What exactly is ISOC? And what does it mean for you? Gartner recently released a new category of assessing security tools: the Integrated Security Operations Center (ISOC). Even though SIEM isn’t going anywhere, a rapidly evolving threat landscape is forcing a shift in industry logic that is reflected in the emergence of this new… (Source: Help Net Security)
  • Scammers rebuild fake shopping sites within hours of a takedown — Anamarija Pogorelec, Senior Staff Writer, Help Net Security October 30, 2026 Share Scammers rebuild fake shopping sites within hours of a takedown One retail scam used more than 1,200 look-alike .shop domains sharing a single IP address. The sites reused HTML, JavaScript and payment-page designs intended to harvest card numbers, expiry dates and security codes, according Akamai’s Fraud and Abuse… (Source: Help Net Security)
  • Binance Suffers Security Breach Affecting $6.3 Billion in Assets, Nearly $3 Billion Frozen — Binance Suffers Security Breach Affecting $6.3 Billion in Assets, Nearly $3 Billion Frozen Ravie LakshmananOct 30, 2026Cyber Attack / Cryptocurrency Cryptocurrency giant Binance said on Thursday that a "security incident" on its platform has impacted about $6.3 billion worth of assets. The world's biggest cryptocurrency exchange said nearly $3 billion of those assets have been frozen on-chain… (Source: The Hacker News)
  • ThreatsDay: Critical Firewall Flaws, Banking Trojans Rented, Weaponized PDF, Token Theft + 26 More Stories — ThreatsDay: Critical Firewall Flaws, Banking Trojans Rented, Weaponized PDF, Token Theft + 26 More Stories Ravie LakshmananOct 29, 2026Hacking News / Cybersecurity News Some attacks take real skill. Others just need someone to leave a door open. This week has both. Exposed passwords, old bugs still getting exploited, and trusted software doing things it shouldn't. There's a strange mix of… (Source: The Hacker News)
  • Threat Brief: Critical Vulnerabilities in PHP: CVE-2026-109618, CVE-2026-109619 (Updated October 29) — Threat Research Center High Profile Threats Vulnerabilities Vulnerabilities Threat Brief: Critical Vulnerabilities in PHP: CVE-2026-109618, CVE-2026-109619 (Updated October 29) 8 min read Related Products Advanced Threat PreventionAdvanced WildFireCloud-Delivered Security ServicesCortexCortex CloudCortex XDRCortex XpanseCortex XSIAMNext-Generation FirewallPrisma CloudPrisma Cloud ComputeUnit 42… (Source: Unit 42)
  • Fake ChatGPT and Claude Apps Abuse Signed Executables to Deploy Crypto Miners — Fake ChatGPT and Claude Apps Abuse Signed Executables to Deploy Crypto Miners Ravie LakshmananOct 29, 2026Cryptocurrency / Malware Threat actors are delivering malicious loaders and cryptocurrency miners under the guise of artificial intelligence (AI) desktop applications for Anthropic Claude and OpenAI ChatGPT as part of a campaign dubbed Yoba. The activity involves creating fake GitHub… (Source: The Hacker News)
  • Cisco Patches Actively Exploited ASA and FTD VPN Flaw That Can Crash Firewalls — Cisco Patches Actively Exploited ASA and FTD VPN Flaw That Can Crash Firewalls Ravie LakshmananOct 29, 2026Vulnerability / Network Security Cisco has released patches to address a high-severity security flaw in Secure Firewall Adaptive Security Appliance (ASA) Software and Secure Firewall Threat Defense (FTD) Software that it said has been exploited in the wild. The vulnerability, tracked as… (Source: The Hacker News)
  • GitHub Launches npm Firewall to Block Malicious Packages Before Installation — GitHub Launches npm Firewall to Block Malicious Packages Before Installation Ravie LakshmananOct 29, 2026DevSecOps / Vulnerability GitHub has announced that it's introducing a new package firewall as a preview to block installation of suspicious npm packages during installation time. "The firewall inspects both metadata requests and package downloads for signs of malicious activity, acting as… (Source: The Hacker News)
  • Hackers Exploited Cisco SD-WAN Flaw to Plant Malware Built to Steal Encryption Keys — Hackers Exploited Cisco SD-WAN Flaw to Plant Malware Built to Steal Encryption Keys Swati KhandelwalOct 29, 2026Vulnerability / Cyber Espionage Hackers exploited a critical Cisco Catalyst SD-WAN flaw, fixed in February, to plant custom malware inside the systems that control an organization's SD-WAN network. The malware, called KeyDrift, is designed to copy the keys that encrypt traffic between… (Source: The Hacker News)
  • China-Linked Hackers Exploited VMware ESX Zero-Day to Reduce Audit Trail Visibility — China-Linked Hackers Exploited VMware ESX Zero-Day to Reduce Audit Trail Visibility Ravie LakshmananOct 29, 2026Vulnerability / Cyber Espionage The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Wednesday added a security flaw impacting Broadcom VMware ESX to its Known Exploited Vulnerabilities (KEV) catalog, after CrowdStrike revealed that it had been weaponized by a… (Source: The Hacker News)
  • Attackers Exploit PHP2Shell Flaws in Internet-Exposed Palo Alto Networks Management Interfaces — Attackers Exploit PHP2Shell Flaws in Internet-Exposed Palo Alto Networks Management Interfaces Ravie LakshmananOct 29, 2026Vulnerability / Network Security Palo Alto Networks on Wednesday warned that threat actors are exploiting the recently patched PHP2Shell vulnerabilities against publicly-accessible management interfaces. "Active exploitation has been observed targeting the Palo Alto… (Source: The Hacker News)
  • Volt Typhoon Used Covert Silent Train Network in Four Zero-Day Exploitation Campaigns — Volt Typhoon Used Covert Silent Train Network in Four Zero-Day Exploitation Campaigns Ravie LakshmananOct 28, 2026Cyber Espionage / Vulnerability The China-nexus cyber espionage group known as Volt Typhoon has been attributed to a now-disrupted covert access network dubbed Silent Train that has been put to use for zero-day exploitation and strategic access. "First identified in late 2023,… (Source: The Hacker News)
  • Unwrapping Retail Peak Season Cyber Threats — Threat Research Center Insights Hospitality Hacks and Retail Reality Checks Hospitality Hacks and Retail Reality Checks Unwrapping Retail Peak Season Cyber Threats 6 min read Related Products Advanced Threat PreventionAdvanced URL FilteringCortex XDRCortex XpanseCortex XSIAMIdiraNext-Generation FirewallPrisma AccessUnit 42 Continuous Frontier AI DefenseUnit 42 Deep and Dark Web ServiceUnit 42… (Source: Unit 42)
  • Google to Allow One-Tap Android App Installs From Approved Third-Party Stores Outside U.S. — Google to Allow One-Tap Android App Installs From Approved Third-Party Stores Outside U.S. Swati KhandelwalOct 28, 2026Mobile Security / App Security Third-party Android app stores can now apply to Google for permission to install apps with one tap, without Android's usual confirmation screens, and to update them in the background. To qualify, a store must pass identity checks and send Google… (Source: The Hacker News)
  • PHP2Shell Attack Roots 25 Servers, Breaches U.S. Government-Affiliated Network — PHP2Shell Attack Roots 25 Servers, Breaches U.S. Government-Affiliated Network Ravie LakshmananOct 28, 2026Vulnerability / Cyber Espionage Cybersecurity researchers have disclosed details of what appears to be an artificial intelligence (AI)-assisted attack orchestrated by a suspected China-nexus threat actor that has leveraged the PHP2Shell vulnerabilities to breach exposed systems. The… (Source: The Hacker News)
  • Hackers Target Critical Oracle E-Business Suite RCE Flaw Days After Security Patch — Hackers Target Critical Oracle E-Business Suite RCE Flaw Days After Security Patch Ravie LakshmananOct 28, 2026Vulnerability / Enterprise Security Threat actors are beginning to probe for a newly patched critical vulnerability in Oracle E-Business Suite (EBS), according to threat intelligence firm Defused Cyber. The vulnerability in question is CVE-2026-101767 (CVSS score: 9.8) , a case of… (Source: The Hacker News)
  • Adobe Fixes 8 Critical Campaign Classic Flaws Allowing Code Execution and Security Bypass — Adobe Fixes 8 Critical Campaign Classic Flaws Allowing Code Execution and Security Bypass Ravie LakshmananOct 28, 2026Vulnerability / Web Security Adobe has released patches to address multiple critical security flaws in Campaign Classic that, if successfully exploited, could result in arbitrary code execution, security feature bypass, and privilege escalation. The list of eight vulnerabilities… (Source: The Hacker News)
  • American Organizations Under Attack: Skyw4lker Device Code Phishing Campaign Exposed — American Organizations Under Attack: Skyw4lker Device Code Phishing Campaign Exposed The Hacker NewsOct 28, 2026Threat Intelligence / Phishing Modern phishing campaigns can compromise American businesses without relying on traditional credential theft. Attackers can abuse legitimate cloud services, authentication mechanisms, and trusted business workflows to gain access to corporate accounts… (Source: The Hacker News)

Vulnerabilities & Exploits

  • A Shared ChatGPT Link Could Run Attacker Code in Your Session and Read Private Chats — A Shared ChatGPT Link Could Run Attacker Code in Your Session and Read Private Chats Swati KhandelwalOct 31, 2026Vulnerability / Web Security A malicious ChatGPT share link could run an attacker's code in the logged-in session of anyone who opened it, allowing them to read their private conversations, researchers at the security firm Parameter showed. The researchers reported the flaw through… (Source: The Hacker News)
  • TeamViewer Flaw Lets Remote Computers Attack Users Who Connect to Control Them — TeamViewer Flaw Lets Remote Computers Attack Users Who Connect to Control Them Swati KhandelwalOct 30, 2026Vulnerability / Endpoint Security TeamViewer has fixed a flaw that lets the machine being controlled in a remote session attack the computer that connected to control it. In a TeamViewer session, the computer that connects and takes control is the viewer, and the machine it controls is the… (Source: The Hacker News)
  • Shufti ties AI agent actions to verified owners and permissions — Industry News October 30, 2026 Share Shufti ties AI agent actions to verified owners and permissions Shufti launches Know Your Agent (KYA), an AI agent verification solution designed to verify autonomous AI agents acting on behalf of individuals and businesses. Agentic commerce enables AI agents to open accounts, place orders, and move funds for their owners. A business receiving one of these… (Source: Help Net Security)
  • Why Urgent Security Fixes Aren't Fixed. Observe, Prove, Act, Confirm Gets Them Moving — Why Urgent Security Fixes Aren't Fixed. Observe, Prove, Act, Confirm Gets Them Moving The Hacker NewsOct 30, 2026Intrusion Prevention / Endpoint Security The alert is critical. The fix is known. And the ticket sits in a queue for days. Security teams understand the risk, but the people who keep applications available need proof that the change won’t break anything. Their concerns are practical.… (Source: The Hacker News)
  • Open-weight AI model GLM-5.3 cheated its way to correct answers — Anamarija Pogorelec, Senior Staff Writer, Help Net Security October 30, 2026 Share Open-weight AI model GLM-5.3 cheated its way to correct answers Irregular evaluated Zhipu AI’s open-weight model GLM-5.3 across 13 offensive cyber scenarios using CyScenarioBench, the company’s framework for measuring an LLM’s ability to plan and execute multistage attacks under realistic constraints. The model… (Source: Help Net Security)
  • Smart TVs can harbor unpatched security flaws and track what you watch — Anamarija Pogorelec, Senior Staff Writer, Help Net Security October 30, 2026 Share Smart TVs can harbor unpatched security flaws and track what you watch Smart TVs and connected plugs accounted for a large share of recorded security weaknesses in household devices, according to Bitdefender’s 2026 IoT Security Landscape Report. The analysis covered approximately 10.4 million protected home routers… (Source: Help Net Security)
  • Linux Kernel TCP Flaw With 9.8 CVSS Score Affects Ubuntu, Red Hat and Other Distributions — Linux Kernel TCP Flaw With 9.8 CVSS Score Affects Ubuntu, Red Hat and Other Distributions Swati KhandelwalOct 29, 2026Vulnerability / Linux A flaw in the Linux kernel's TCP code, tracked as CVE-2026-98432, affects Ubuntu, Red Hat Enterprise Linux (RHEL), and other Linux distributions. The kernel's own CVE team rates it 9.8 out of 10 on the CVSS scale. Anthropic said on October 27 that its AI… (Source: The Hacker News)
  • Google's Gemini 4 Carbon Leads Benchmarks for Finding, Exploiting, and Patching Vulnerabilities — Google's Gemini 4 Carbon Leads Benchmarks for Finding, Exploiting, and Patching Vulnerabilities Ravie LakshmananOct 29, 2026Artificial Intelligence / Cybersecurity Google on Wednesday took the wraps off Gemini 4 Carbon, its latest frontier model with state-of-the-art cybersecurity and long-horizon capabilities. "It shows significant gains across coding and agentic tasks as well as across key… (Source: The Hacker News)
  • Webinar: How to Build AI Threat Readiness Into Your Security Operations — Webinar: How to Build AI Threat Readiness Into Your Security Operations The Hacker NewsOct 29, 2026Artificial Intelligence / Webinar Security teams have spent years trying to detect threats faster. AI is changing the harder part: how much time defenders have left to act. Advanced AI models can now help attackers discover vulnerabilities, generate exploit code, and move through weaknesses faster… (Source: The Hacker News)
  • Telegram Android Flaw Lets Attackers Run Code When Users Answer Voice Calls — Telegram Android Flaw Lets Attackers Run Code When Users Answer Voice Calls Swati KhandelwalOct 29, 2026Vulnerability / Mobile Security A flaw in Telegram for Android could be chained with two other bugs to take full control of a victim's phone through a voice call, once the victim answered, according to security startup NebuSec. The attacker needed only an ordinary Telegram account. Telegram… (Source: The Hacker News)
  • 26,400 Valid Cloud and AI Credentials Found Exposed in Public Gitee Repositories — 26,400 Valid Cloud and AI Credentials Found Exposed in Public Gitee Repositories Swati KhandelwalOct 29, 2026Cloud Security / Artificial Intelligence 26,400 credentials that developers left in public code on Gitee, a Chinese code-hosting service, still worked when a researcher tested them. Anyone who copied one from that code could have used it. Independent researcher Ben Zimmermann found them… (Source: The Hacker News)
  • Attacker Tried to Exploit Alpine Linux’s GitLab via CVSS 10.0 Flaw Its Ruby Left Open — Attacker Tried to Exploit Alpine Linux’s GitLab via CVSS 10.0 Flaw Its Ruby Left Open Swati KhandelwalOct 29, 2026Vulnerability / Cyber Attack An attacker tried to exploit a critical GitLab vulnerability on the Alpine Linux project's own GitLab server a week after GitLab released a fix, Alpine Linux said on 28 October. The flaw, CVE-2026-97229 (CVSS score: 10.0), can let an attacker run code on… (Source: The Hacker News)
  • Researcher Reveals How Logic Bugs Alone Cracked Microsoft Edge in $175,000 Pwn2Own Win — Researcher Reveals How Logic Bugs Alone Cracked Microsoft Edge in $175,000 Pwn2Own Win Swati KhandelwalOct 28, 2026Vulnerability / Browser Security A chain of logic flaws, with no memory corruption, can turn a malicious web page into code running on a Windows computer outside Microsoft Edge's sandbox, a security researcher has shown. Orange Tsai of DEVCORE published the full method on October… (Source: The Hacker News)
  • Critical 16-Year-Old UEFI Flaw Can Run Code Before Secure Boot on Network-Booting Servers — Critical 16-Year-Old UEFI Flaw Can Run Code Before Secure Boot on Network-Booting Servers Swati KhandelwalOct 28, 2026Vulnerability / Network Security A critical 16-year-old flaw in EDK II, the open-source code that most hardware makers use to build UEFI firmware, can allow an attacker to run code on a machine before its operating system loads, but only while the machine is booting over the… (Source: The Hacker News)
  • Wazuh and AI for Enhanced SOC Workflows — Wazuh and AI for Enhanced SOC Workflows The Hacker NewsOct 28, 2026Artificial Intelligence / Threat Detection Artificial Intelligence (AI) has become one of this decade's defining technologies. From healthcare and finance to manufacturing and education, organizations increasingly rely on AI to automate repetitive tasks, uncover patterns hidden within large datasets, and support faster… (Source: The Hacker News)

AI/ML Security

  • Bedrock Data routes data exposure fixes to owners and verifies results — Industry News October 30, 2026 Share Bedrock Data routes data exposure fixes to owners and verifies results Bedrock Data has announced AI-assisted remediation, which federates the work of fixing data exposure to the data owners across the enterprise. Bedrock Data discovers who owns each exposed dataset, opens a ticket for that owner in the Jira or ServiceNow workflow the enterprise already runs… (Source: Help Net Security)
  • The Rise of the Threat Operator: How AI Will Redefine Security Operations and Careers — The Rise of the Threat Operator: How AI Will Redefine Security Operations and Careers The Hacker NewsOct 29, 2026Agentic AI / Security Operations AI is beginning to take over much of the work that has traditionally defined the security analyst's job. Investigating alerts, collecting evidence, correlating activity across tools, and executing response actions are becoming tasks that AI systems… (Source: The Hacker News)

Policy & Regulation

  • Assad regime hacker who caused $136 billion market drop sentenced to 42 months — Sinisa Markovic, Managing Editor, Help Net Security October 30, 2026 Share Assad regime hacker who caused $136 billion market drop sentenced to 42 months A Syrian man who used a hijacked news agency Twitter account to post a fake report of explosions at the White House has been sentenced to 42 months in prison, the US Department of Justice has announced. Ahmad Umar Agha, also known as “Th3Pr0”,… (Source: Help Net Security)
  • Trezor Warns of Suspected Hardware Implant in One of Its Wallets Sold by CryptoBilis — Trezor Warns of Suspected Hardware Implant in One of Its Wallets Sold by CryptoBilis Ravie LakshmananOct 30, 2026Hardware Security / Cryptocurrency A Trezor Safe 5 hardware wallet bought from the reseller CryptoBilis has an extra circuit board that sends out the recovery phrase over a mobile network, a customer has reported. Trezor has not yet examined the device. It is telling everyone who… (Source: The Hacker News)
  • Syrian Hacker Behind Fake Tweet That Triggered $136 Billion Market Drop Gets 42 Months in Prison — Syrian Hacker Behind Fake Tweet That Triggered $136 Billion Market Drop Gets 42 Months in Prison Swati KhandelwalOct 30, 2026Cyber Crime / Cyber Espionage Ahmad Umar Agha, a Syrian Electronic Army hacker known online as "Th3Pr0," has been sentenced by a U.S. federal court to 42 months in prison for his role in a hacking conspiracy that targeted Western news outlets. The conspiracy was organized… (Source: The Hacker News)

Reports & Analysis

  • Cohere’s Qwen Story: Looks More Like Model Jaggedness — Latest Research by our Team (Source: Check Point Research)