Palo Alto Networks now reports PHP2Shell exploitation against PAN-OS management interfaces that face the internet, and the KEV deadline for both PHP2Shell CVEs is today. Cisco disclosed a second exploited ASA/FTD VPN flaw. CISA added the Fragnesia kernel bug, which an attacker chained with PHP2Shell to root firewalls, and a low-severity ESXi logging bypass that a China-nexus group used as a zero-day. Talos and Lumen also published new research on Cisco SD-WAN, and AI agent tooling had another busy day of advisories.

Do today

  • PAN-OS: take management interfaces off the internet, then apply the PHP2Shell hotfix for your train. Some trains have ETAs of 29–30 October. The KEV deadline for CVE-2026-109618 and CVE-2026-109619 is today. (Palo Alto Networks advisory)
  • Cisco ASA/FTD: if SSL VPN is enabled and any tunnel group uses secondary authentication, upgrade to a fixed release. Where you can’t upgrade yet, remove secondary authentication. (Cisco advisory cisco-sa-asaftd-tunnel-dos-s6mgkb75)
  • Linux kernel: confirm your kernels include the May fix for Fragnesia (CVE-2026-46300), starting with internet-facing appliances that run PHP. The KEV deadline is 31 October. (CISA KEV alert)
  • Self-managed GitLab: if you build GitLab yourself or bring your own Ruby, upgrade Ruby to 3.3.13, 3.4.12 or 4.0.9 as well as GitLab. (Alpine Linux incident report)
  • AWS Lambda (Node.js and .NET ZIP functions): after Phase 1 lands, make a real configuration change, such as adding an environment variable, so each function picks up the Brotli fix. A zero-change update does not count. (AWS bulletin 2026-155-AWS)
  • Cisco Catalyst SD-WAN: check controllers for the KeyDrift file paths and Snort signatures Talos published. (Cisco Talos)

AI and agent security7 stories

  • 26,400 live cloud and AI keys found in public Gitee repositories — Ben Zimmermann scanned 7,256,531 public repositories on China’s largest Git platform, working with MongoDB’s Kingfisher team, and verified 26,400 unique credentials as still live. Alibaba Cloud AccessKey pairs led with about 9,473, followed by YouTube API keys (3,805) and DeepSeek keys (3,170). Most were committed in the last two years. The author reported the findings to the most-affected vendors but did not notify individual committers, and revocation had not been confirmed when the post went up. Our take: AI provider keys are now among the most common leaked secrets, and deleting a commit revokes nothing. Treat model API keys like cloud keys: scope them, cap their spend and rotate them. Note also that the two scanners overlapped on only 1,001 findings, so a single scanner misses a lot. (MongoDB research post)
  • Three MCP servers let a prompt-injected agent run commands (CVE-2026-117567, CVE-2026-117558, CVE-2026-44192) — NVD published two VulnCheck-reported command injections on 27 October. In esp-mcp (through commit 28afddf), tool parameters such as target and project_path reach a shell subprocess. In the ai-sdlc plugin’s MCP server (through 0.31.2), the repo argument is placed into gh commands run through execSync(). Red Hat separately lists a path-traversal flaw in the Ansible Lightspeed MCP server, a VS Code extension, that lets indirect prompt injection write files to unauthorized locations. Red Hat rates it 6.6 Moderate, lists no fix yet, and says it ships in no AAP artifact. Our take: an MCP tool argument is attacker-controlled input whenever the agent reads untrusted content. Run these servers as low-privilege users and keep them off machines that hold credentials. (NVD CVE-2026-117567, NVD CVE-2026-117558, Red Hat CVE-2026-44192)
    CVSS 7.8 (v3.1, VulnCheck, both NVD entries) CVSS 6.6 (v3.1, Red Hat, Lightspeed) EPSS 0.0065 / 0.0069 KEV no
  • Strands Agents Tools: a prompt could switch off secret masking (CVE-2026-115415) — AWS says the environment tool in strands-agents-tools exposed its masking setting to the model through the tool schema. Crafted content the agent processed could make it dump host environment variables, cloud credentials and API keys included. Versions 0.1.0 up to 0.8.6 are affected. Version 0.8.6 moves the masking control to the operator and deprecates the tool. AWS advises rotating credentials that were present in the environment of any agent that loaded the tool. Our take: any safety setting the model can change is not a safety setting. Audit your own tool schemas for similar parameters. (AWS bulletin 2026-154-AWS)
    CVSS not stated by AWS EPSS not yet scored KEV no
  • vLLM: a forged shared-memory handle reaches pickle.loads() (CVE-2026-115912) — On deployments that enable the shared-memory multimodal processor cache (--mm-processor-cache-type shm), an authenticated low-privilege caller can forge the handle a worker uses to read shared memory, and the worker deserializes whatever bytes the caller points it at. The default insecure-serialization flag does not prevent this. The advisory rates it 7.5 and the fix is vLLM 0.32.0. It is one of five vLLM advisories that GitHub reviewed on 28 October; the other four are a permissive default CORS setting and denial-of-service bugs (one, CVE-2026-115915, was covered here on 27 October). Our take: if you set that cache flag on a shared inference cluster, treat this as code execution in the worker. (GitHub advisory GHSA-6757-hggm-hp2w)
    CVSS 7.5 (v3.1, GHSA) EPSS 0.0048 KEV no
  • Mem0: a crafted run_id reads another tenant’s conversation (CVE-2026-116575) — The session-scope key builder joins user, agent and run IDs with & and = and does not escape them, so a caller who controls only their own run_id can collide with another tenant’s key. Exploiting this lets an attacker read the victim’s recent raw messages, which then feed the attacker’s extraction prompt, and write into the victim’s message history. The pip package is fixed in 2.0.18 and the npm package in 3.1.6. This is a separate bug from the stored-memory SQL injection covered on 26 October. Our take: in multi-tenant memory layers, isolation lives in key construction, so check how your memory store derives its namespaces. (GitHub advisory GHSA-5324-3w58-qpp2)
    CVSS 6.3 (v3.1, GHSA) EPSS 0.0011 KEV no
  • Gemini 4 Carbon: Google’s security-focused model goes first to defenders — Google launched Gemini 4 Carbon on 28 October as a frontier model for software engineering and security. It reports 88.2% on SEC-bench Pro, 54.8% on ExploitGym and 71.0% on CWE-bench, says the external cyber evaluations ran without guardrails, and reports 0.0% attack success on Gray Swan’s indirect prompt-injection benchmark. Access starts with a subset of cyber defenders and widens through a trusted-partner programme. Our take: these are Google’s own figures plus partner claims, and the Chrome comparison is against an unnamed model. Until independent evaluations appear, read the ExploitGym number as a statement about dual-use capability, not only about defence. (Google announcement)
  • GitHub adds code scanning for AI applications — Among GitHub’s 28 October Universe releases is a public preview that flags code paths where untrusted content can reach a model with access to tools, data or business systems. It targets indirect prompt injection, sensitive information disclosure and excessive agency, and runs on pull requests next to CodeQL. It requires GitHub Advanced Security and is not yet available on Enterprise Server. Our take: static flow analysis for prompt-injection paths is useful triage, but it cannot tell you what a model will do once untrusted text reaches it. Keep runtime controls on tool permissions. (GitHub changelog)

Application security6 stories

  • Firefox 159 fixes 167 security bugs; Chrome 156 ships the same day — Mozilla’s MFSA 2026-118, dated 27 October, lists 167 CVEs fixed in Firefox 159: 108 high, 52 moderate and 7 low. Google released a Chrome 156 stable desktop update the same day. Press reports put it at 52 security fixes, four of them critical, including CVE-2026-118306 in FileSystem; the Chrome release page we loaded did not render its fix list, so treat those counts as unconfirmed. Neither vendor reports in-the-wild exploitation. Our take: this is routine, but the volume keeps rising as vendors use AI-assisted discovery, so managed browser fleets need fast update rings. (Mozilla MFSA 2026-118, Chrome Releases)
    CVSS not published (CVE-2026-118306) EPSS 0.0024 KEV no
  • EPICS Base: four unauthenticated network bugs in research-facility control software (CVE-2026-114595 and others) — CISA advisory ICSA-26-300-01 covers EPICS Base 7.0.10 and earlier, which runs control systems at particle accelerators and fusion experiments. The worst bug is an integer overflow rated 9.8 (v3.1). The other three are an out-of-bounds write and a read, each 8.2 or 7.5, and a type confusion. All four are in the Channel Access and pvAccess protocol handling. The fix is 7.0.11, and CISA has no reports of public exploitation. Causal Security says its autonomous system Cipher found all four bugs in under four hours. It showed a heap write and a crash but did not attempt a working exploit. Our take: the 9.8 rests on a possible code-execution path that no one has demonstrated. Even so, these ports (TCP 5064 and 5075) should never be reachable from outside a controls network. (CISA ICSA-26-300-01)
    CVSS 9.8 (v3.1, CISA) EPSS 0.0050 KEV no
  • Seroval: five advisories, including deserialization that calls attacker-chosen functions (CVE-2026-116580) — GitHub reviewed five advisories for the seroval serializer on 28 October. The most notable affects 1.6.7 and earlier: fromJSON called on() on a rebuilt async iterator’s source without checking its type. Earlier fixes in 1.6.4 to 1.6.7 could be bypassed by reusing a node ID. The others cover code and script injection through typed-array constructors and RegExp sources, plus two denial-of-service paths. Version 1.6.8 fixes the deserializer issue. Our take: if your framework uses seroval to move server state into the client, check the version in your lockfile, because it often arrives as a transitive dependency. (GitHub advisory GHSA-7rv5-mrxv-xcr9)
    CVSS 7.3 (v3.1, GHSA) EPSS 0.0034 KEV no
  • systeminformation: Unicode quotes slip past Windows command sanitizing (CVE-2026-116576) — On Windows, the npm package’s services() call builds a PowerShell command from caller input. Its sanitizer strips ASCII double quotes but not curly quotes (U+201C and U+201D), so crafted input can break out and run a PowerShell expression as the Node.js process. Versions below 5.33.16 are affected. The reporter found no network path inside the package itself. Our take: this is only serious if your application passes untrusted strings to services(), but the bypass technique is worth testing against any home-grown shell sanitizer. (GitHub advisory GHSA-3f7j-7jwc-fxfj)
    CVSS 7.8 (v3.1, GHSA) EPSS 0.0015 KEV no
  • Tornado 6.6: many tiny chunks freeze the event loop (CVE-2026-115927) — Before 6.6, Tornado processed every received chunk of a chunked HTTP/1.1 body without yielding to the event loop. An unauthenticated client sending millions of 1-byte chunks could therefore stall every connection the process serves, and small chunks used about 20 times their size in memory. SimpleAsyncHTTPClient is also exposed when it talks to a hostile server. The same release fixes a quadratic header-parsing bug and an open redirect. Our take: a buffering reverse proxy that forwards a Content-Length header is a solid stopgap, and the upgrade is the real fix. (GitHub advisory GHSA-r4j5-9xpp-3985)
    CVSS 5.3 (v3.1, GHSA) EPSS 0.0038 KEV no
  • Orange Tsai publishes his logic-bug-only Edge full chain — DEVCORE’s researcher has written up the Pwn2Own Berlin 2026 chain that escaped Edge’s sandbox on Windows without any memory corruption. It combined a trusted-origin check bypass, a popup allowlist, automatic sign-in, a CORS leak, a universal XSS and an internal WebUI that could write files. Microsoft fixed the bugs (CVE-2026-45492, 45494 and 45495) in Edge 148.0.3967.70 in May, so current Edge is not affected. The author says he built the chain without AI on purpose, so he could explore the attack surface first. Our take: there is nothing to patch today, but the write-up maps how browser-specific features add attack surface beyond what upstream Chromium hardening covers. (Orange Tsai write-up)

Exploited and critical CVEs6 stories

  • PHP2Shell now exploited on PAN-OS management interfaces; KEV deadline today (CVE-2026-109618, CVE-2026-109619) — Palo Alto Networks updated its advisory on 29 October to report active exploitation against PAN-OS management interfaces exposed to the internet. The HTTPS web UI and XML API are affected, and dataplane interfaces are affected only if a management profile is attached. GlobalProtect and Captive Portal are not affected. Hotfixes cover 10.2 through 12.2, but a few builds (for example 11.1.7-h12) still show an ETA of 30 October, and the advisory lists interim hardening for those. The KEV due date for both CVEs, added on 26 October, is today. Our take: a management interface open to the internet was already a finding before this. Restrict it first, then patch. (Palo Alto Networks advisory, CISA KEV feed)
    CVSS 9.2 (v4.0, Palo Alto Networks) EPSS 0.99999 KEV yes, due 29 Oct
  • Fragnesia kernel bug added to KEV after it was chained with PHP2Shell to root firewalls (CVE-2026-46300) — On 28 October CISA added CVE-2026-46300, a Linux kernel flaw from May in which coalesced socket buffers lose their shared-fragment flag, so ESP decryption can write over page-cache data. The federal deadline is 31 October. Dream Research, in a report dated 26 October, describes an attacker who chained a non-public PHP2Shell build with Fragnesia to gain root on 25 servers running one vendor’s firewall software. Two of those servers were in a US government-affiliated network, where the attacker reached the internal firewall management server and then Active Directory. Dream withholds the vendor’s name and calls the operation Chinese-nexus without naming an actor. Press reports say exploitation ran 23–24 October, while Dream describes activity from about 8 to 24 October. Our take: appliance kernels often lag far behind distribution kernels. Ask your vendors whether the May kernel fix is in their firmware, not just whether PHP is patched. (CISA KEV alert, NVD CVE-2026-46300, Dream Research report)
    CVSS 7.8 (v3.1, NVD) EPSS 0.1019 KEV yes, due 31 Oct
  • Cisco ASA and FTD: exploited SSL VPN flaw reloads firewalls (CVE-2026-76418) — Cisco’s advisory, first published 28 October, says its PSIRT learned of active exploitation this month. An unauthenticated attacker can make a device reload by sending a crafted request during an SSL remote-access VPN connection, provided secondary authentication is configured on any tunnel group, including DefaultWEBVPNGroup. Fixed releases include ASA 9.20.4.50, 9.22.3.200 and 9.24.1.27, and FTD 7.4.9, 7.6.7 and 10.0.3. Cisco lists no true workaround, only removing secondary authentication, which weakens the VPN. The flaw was not in the 28 October KEV catalog, which was published before the advisory. Our take: this flaw causes denial of service, not code execution. Still, repeated reloads of a perimeter VPN are an outage, and attackers have used crashes to clear the way for other activity. (Cisco advisory)
    CVSS 8.6 (v3.1, Cisco) EPSS not yet scored KEV no (as of 28 Oct catalog)
  • ESXi logging bypass, scored 2.7, was a China-nexus zero-day (CVE-2026-41709) — CISA added CVE-2026-41709 to KEV on 28 October with a due date of 11 November. Broadcom’s VMSA-2026-0006 fixed it in July and rated it 2.7 Low: a malicious administrator could perform some operations without them being logged. CrowdStrike’s 2026 legal-sector report, published the same day, says WARP PANDA exploited it as a zero-day in vCenter environments at US entities, as late as early 2026. Broadcom’s advisory does not mention exploitation. Our take: a low CVSS score doesn’t mean low priority when the bug hides an intruder who already has admin rights. If you run ESXi 8.0 below U3j or 9.x below the listed builds, assume hypervisor audit logs from early 2026 may be incomplete. (Broadcom VMSA-2026-0006, CrowdStrike report, CISA KEV alert)
    CVSS 2.7 (v3.1, Broadcom) EPSS 0.0030 KEV yes, due 11 Nov
  • Node2Shell: first exploit traffic seen, and the payload was broken (CVE-2026-111497) — The Brotli flaw entered KEV on 27 October. ELLIO has since reported a single exploit request against Node.js 24.22.0 on x86-64, sent the day after a scanner probed its sensors for Brotli decoding. The delivery code matched public PoCs, but the attacker’s own final stage produced no shell in 50 of ELLIO’s tests. ELLIO names the source as 94.154.43[.]7 and links that IP to mass exploitation of other CVEs, including PHP2Shell. ELLIO also warns that failed attempts can crash the process. Our take: an unreliable exploit is still a denial-of-service risk, and a working version is probably not far behind. Keep the KEV deadline of 10 November. (ELLIO analysis, CISA KEV feed)
    EPSS 0.8799 KEV yes, due 10 Nov
  • Alpine Linux rebuilds its GitLab after an exploit attempt that upgrading did not stop (CVE-2026-97229) — Alpine says an attacker registered an account on 20 October and, on 21 October, crashed GitLab workers eight times with crafted CI configurations; four of those crashes got partway through the exploit for the 10.0-rated regex-engine flaw. Alpine had upgraded to GitLab 19.3.6 on 22 October, but its image used standard Ruby, and GitLab ships the fix as a Ruby patch only in its own packages. Alpine found no evidence of code execution but cannot rule it out. It rebuilt the server, reset every password and replaced secret keys. Releases and packages built 20–24 October were checked against records outside GitLab and show no tampering, and signing keys were never on the server. Our take: this is the clearest sign so far that the GitLab regex bugs are being tried in the wild, and a version check alone will not tell you whether you are covered. (Alpine Linux incident report)
    CVSS 10.0 (per Alpine) EPSS 0.1843 KEV no (not found in CISA catalog search)

Cloud and infrastructure5 stories

  • KeyDrift: SD-WAN controllers implanted to copy encryption keys, on Volt Typhoon-linked infrastructure — Cisco Talos published research on 28 October about UAT-11473, which exploited the SD-WAN authentication bypass CVE-2026-20127 and installed KeyDrift. The framework hooks the controller’s vdaemon process, extracts keying material from decrypted control traffic and stages it for exfiltration. Talos assesses with high confidence that the group’s infrastructure overlaps Silent Train, a covert network that Lumen’s Black Lotus Labs ties to Volt Typhoon. Talos does not say the two groups are the same. Talos calls the activity historical, gives no dates for it, and does not recommend rotating keys. Rotating keys after confirmed compromise is our own inference. Our take: patching does not remove an implant that is already there. Hunt using the file paths and Snort signatures (SIDs 67387–67416 and 7:44–7:73), and rebuild the controller if you find any. (Cisco Talos, Lumen Black Lotus Labs, Cisco advisory)
    CVSS unconfirmed in this run EPSS 0.8929 KEV status unconfirmed
  • AWS sets the Brotli rollout: Lambda ZIP functions need a real change — AWS bulletin 2026-155-AWS, dated 28 October, lays out the CVE-2026-111497 schedule. Lambda’s Node.js container images are updated now. Node.js ZIP functions pick up the fix on create or update from 28 October and update automatically from 30 October, and .NET follows a day later each time. App Runner was patched on 26 October, but services need one redeploy. CodeBuild curated images are due by 30 October, and Elastic Beanstalk’s Node.js platform 6.11.12 shipped on 22 October. Node.js on customer-managed EC2, ECS and EKS is the customer’s job. AWS offers a WAF sample rule that blocks Content-Encoding: br as a stopgap, to be run in Count mode first. Our take: check the runtime version in each function’s INIT_START log line; it is the only real proof a function took the fix. (AWS bulletin 2026-155-AWS)
  • EDK II PXE overflow: firmware code execution before Secure Boot, with no stable fix yet (CVE-2026-97631) — TianoCore’s advisory, dated 22 October, describes a 504-byte buffer in the UEFI PXE driver that overflows on an oversized ICMP error message, over IPv4 or IPv6. An unauthenticated attacker on the network during PXE boot can hang the boot. An attacker who knows the firmware build may be able to run code before OS security controls load. The bug dates to 2010. The fix is merged upstream (PR #13302), but the advisory still says “not patched currently” for releases, so operators depend on firmware vendors. The finders are credited to Anthropic and Google. Our take: if you don’t network-boot, disable PXE in firmware. If you do, keep the PXE network segment tightly isolated until your platform vendor ships a fixed build. (TianoCore advisory)
    CVSS 9.5 (v4.0, TianoCore) EPSS 0.0048 KEV no
  • GitHub Actions workflow lockfiles reach general availability — The gh actions-lock extension writes .github/workflows/actions.lock, which pins every action and its transitive dependencies to commits while workflows keep their readable tags. Dependabot updates the lockfile in the same PR, and admins can enforce a “require lockfile” policy. GitHub notes that locking does not make a dependency safe; it only stops a moved tag from changing what runs. The feature is available on Free, Team and Enterprise Cloud plans. Our take: after this month’s run of hijacked releases and moved tags, lockfiles are an easy, high-value way to make CI reproducible. Review a dependency before you lock it. (GitHub changelog)
  • Backstage: encoded dot segments bypass catalog location rules (CVE-2026-115923) — @backstage/plugin-catalog-backend checks catalog.rules against the raw URL, but its URL readers fetch the normalized one. As a result, a path containing %2e%2e can pass a trusted-scope rule while the content is fetched from somewhere else. Exploiting it requires catalog.location.create permission. Fixed versions are 3.9.2 (Backstage 1.54.10) and 4.0.2 (Backstage 1.56.1), and the advisory warns that 4.0.1 as published is not fixed. There is no complete workaround. Our take: in developer portals, catalog entities drive ownership, templates and sometimes automation, so limit who can register locations until you upgrade. (GitHub advisory GHSA-w658-mh9p-ww8f)
    CVSS 6.5 (v3.1, GHSA) EPSS 0.0032 KEV no

Crypto and Web34 stories

  • Treasury sanctions ten people and one entity behind North Korean IT-worker revenue — OFAC’s 28 October action designates two Russian nationals and one Russia-based entity accused of moving DPRK funds. Treasury says Vitold Obertas handled nearly $2 million in crypto conversions plus at least $1.25 million in other currency transactions since January 2025, and Ilya Boykov handled about $3.5 million in crypto exchanges since 2024. The entity is the First Financial and Technical Development Center, and six of its IT workers are also designated. Treasury says the networks used AI tools to get hired and that some workers deployed malware and stole data from employers. The Record put Obertas’s total at “at least $3.5 million”. That differs from Treasury’s breakdown, so we use Treasury’s figures. Our take: add the designated names to hiring and vendor screening, and keep checking identities on remote hires after onboarding, not only before. (US Treasury press release)
  • Initia: foundation to back $2.7M of forged balances while the chain stays halted — REKT’s 28 October analysis of the 23 October Initia incident puts the bridged-out loss at about $2.73M. The forged balances had a face value of about $7.48M, but not all of it was redeemable. On 28 October the Initia Foundation approved 1:1 backing for affected Noble USDC, WETH and AUSD0, capped at 1.08M USDC, 105 ETH and 1.4M AUSD0, subject to reconciliation; the transfers had not been completed. The attacker’s consolidation wallet moved 400 ETH on 27 October. Sources disagree on the bug: one co-founder said the attacker could “mint additional tokens”, while Initia’s statement says balances were spoofed and recorded supply did not change. Loss estimates range from $2.6M to $2.73M. The chain had no restart date. Our take: the backing plan covers the bridged-out assets, but not the forged balances left on-chain, which is where the rest of the risk now sits. (REKT analysis)
  • Fake Phantom, Jupiter and Bitget extensions on Firefox stole seed phrases — Socket reported on 27 October three Firefox add-ons that used Unicode lookalike names and copied branding. They captured recovery phrases and private keys from page inputs, the clipboard and page content. The Phantom clone loaded a second-stage stealer at runtime and bundled a drainer that swept funds to hardcoded addresses, and its rating appeared to be pumped with fake reviews. Socket says the stolen data went to brand-named subdomains of bonto[.]io, with subdomains also prepared for Coinbase Wallet and Exodus. All three listings were removed by publication. Our take: users and admins should only install wallet extensions from the vendor’s own link, and managed browsers should allowlist wallet extensions by extension ID. (Socket research)
  • TRM: Sihanoukville casinos took $1.07B in crypto this year despite Cambodia’s crackdown — TRM Labs counted about $1.07B in crypto flowing to 34 casinos in Sihanoukville between 1 January and 7 September. Of that, $687M (64%) went to casinos tied to networks OFAC has designated, and more than $320M arrived after designation. USDT on TRON made up 99.9% of the volume. Monthly inflows fell from about $148M to about $95M, but TRM says some of that drop may reflect wallet rotation rather than less activity. Our take: for exchanges and stablecoin issuers, sanctioned-address lists alone will miss most of this. Screen for indirect exposure to the entities and expect wallets to rotate. (TRM Labs analysis)

Incidents and industry6 stories

  • “Icepick”: records of more than 41,000 DHS staff published, including undercover-related groups — DDoSecrets published on 28 October an internal Department of Homeland Security directory. It says the hacktivist group “Department of Peace” pulled the data from an Okta single sign-on service that DHS uses. Press reports say Okta disputes that its systems were breached. The searchable copy indexes 41,191 people and 55,603 internal groups, including groups that appear to grant undercover status and access to forensic tools. Reporting cites a DHS statement that it is aware of a “potential breach” and is working on it. Our take: directory and group-membership data is valuable for targeting and impersonation even without passwords. Any organization whose staff could be targeted should restrict who can enumerate SSO directories and groups. (DDoSecrets release)
  • Moldova: attackers pulled citizen data through government services that required no login — Moldova’s government says attacks on public digital services ran from 19 to 23 October, and at least one data element was extracted in about 750,000 cases. It also says further attempts on 25 and 27 October were blocked. It assessed 82 services and disconnected 30 as a precaution. The head of the e-government agency is stepping down, and authorities are examining possible foreign state involvement without attributing it. Sources disagree on scale: the government’s statement says about 1 million identification numbers were targeted, while The Record cites about 11 million access requests. The two may be measuring different things. Our take: unauthenticated lookup services that query back-end registries are essentially scraping APIs, and they need rate limits and anomaly detection. (MOLDPRES government statement)
  • AfD breach reaches Have I Been Pwned: 345,000 addresses — Have I Been Pwned added the breach of the German political party AfD on 27 October: about 345,400 unique email addresses, plus email contents published online. Have I Been Pwned says intrusions were detected on 9 September and again five days later, through infrastructure at the party-owned IT provider Alternita, and it has flagged the breach as sensitive. AfD’s own statement places the attack at the end of September, which conflicts with that timeline. Our take: party and campaign infrastructure, often a WordPress site next to a mail server, remains a soft target in election years. (Have I Been Pwned entry)
  • CIS K-12 report: half of US school districts had a cyber incident last year — The 2026 State of K-12 Cybersecurity report from CIS, MS-ISAC and CoSN, released on 27 October, finds that 51% of surveyed districts had an incident in the past year and about a third had one that affected operations. More than 11,600 incidents needed escalation. Only 33% have a formal AI policy, though 83% have deployed MFA and email security. Press coverage of the report highlights attackers using one district’s hijacked staff account to phish neighbouring districts, which gets past email filters. Our take: authenticated mail between trusted organizations is now a common attack path for small public bodies, so watch for impossible-travel and mass-send patterns, not just inbound reputation. (CIS press release)
  • Huntress: compromised camera-management software as an initial access route — Huntress described several September and October incidents in which a camera-management application (CMS.exe, vendor unconfirmed) dropped a reverse shell into AppData. Attackers then copied the legitimate WpcMon.exe to sideload modified DLLs and added Run-key persistence. Huntress publishes file hashes and one command-and-control address, 144.172.116[.]37, seen in every incident. It could not determine how the software itself was compromised. Our take: video and physical-security tools often run on ordinary Windows desktops with broad network access and little monitoring. Inventory them and apply application control to AppData. (Huntress research)
  • noyb files five GDPR complaints against Scale AI over worker tracking — The privacy group noyb and partner organizations filed complaints on 27 October in France, Italy, the Netherlands and Austria. They allege that Scale AI’s Outlier platform loaded third-party trackers on freelancers’ devices without consent and required repeated biometric checks through Persona. They also say four access requests went unanswered. Press reports say Scale AI calls the claims unfounded. These are allegations, and no regulator has ruled. Our take: the AI training-data supply chain now faces regular GDPR scrutiny. If you buy labelling services, ask suppliers how they monitor workers and on what legal basis. (noyb press release)

Bottom line

  1. Exposed management planes are today’s theme. PHP2Shell on PAN-OS, KeyDrift on SD-WAN controllers and the Dream firewall chain all started at an interface that should not have been reachable. Fix the exposure before you finish patching.
  2. Severity scores misled twice this week. A 2.7-rated ESXi logging bug was a zero-day used to hide intrusions, and Fragnesia, a May kernel fix, turned web-tier code execution into root on appliances. Use KEV listings and attacker behaviour to set priority, not CVSS alone.
  3. Agent tooling keeps failing the same way. MCP servers pass tool arguments to shells, a masking setting was exposed to the model, and memory layers build tenant keys from unescaped strings. Treat every model-controlled parameter as untrusted input and every agent host as a credential store.