Daily Cybersecurity Briefing — October 31, 2026

Saturday, October 31, 2026

ACTIVELY EXPLOITED VULNERABILITIES

• CVE-2026-97229 | GitLab CE/EE | CVSS 10.0 | Integer overflow enabling unauthenticated RCE via crafted CI/CD pipeline regex. Added to CISA KEV Oct 29. FCEB patch deadline: November 1, 2026. Alpine Linux confirmed exploitation attempts Oct 20-26 (8 worker process crashes). Source: The Hacker News

• CVE-2026-76418 | Cisco Secure Firewall ASA & FTD | CVSS 8.6 | Unchecked return value / NULL pointer dereference; unauthenticated remote DoS causing device reload. Added to CISA KEV Oct 29. FCEB patch deadline: November 1, 2026. Cisco confirmed active exploitation. Source: The Hacker News / CISA

• CVE-2026-104935 | Ivanti Connect Secure | CVSS 8.6 | Authentication bypass via crafted header; exploited by threat actor UTA0576 since early October. Added to KEV Oct 13. (FCEB deadline Oct 16 passed.) Source: The Hacker News

• CVE-2026-111357 | Ivanti Connect Secure | CVSS 8.8 | Missing authentication for critical function; local privilege escalation. Part of three-CVE chain enabling unauthenticated root RCE when combined with CVE-2026-104935 and CVE-2026-118527. Added to CISA KEV Oct 30. FCEB deadline: November 2, 2026. Fixed: 25.1.1.3 and 22.8R2.6. Source: Volexity / The Hacker News

• CVE-2026-118527 | Ivanti Connect Secure | CVSS 4.3 | Predictable identifiers allow attacker to upload files to known disk locations. Third CVE in UTA0576 chain. Added to CISA KEV Oct 30. FCEB deadline: November 13, 2026. Source: CISA / Volexity

• CVE-2026-111585 | TeamViewer Full Client (Windows/Linux/macOS/Android) | CVSS 8.8 | Memory corruption via crafted screen-image size from a controlled host enables crash and potential code execution on the viewer. Researcher Omri Dar (Remedio) disclosed Oct 29 with Windows code execution demo. Fix: version 15.83. No active exploitation yet; not in KEV. Source: The Hacker News

• CVE-2026-109618 & CVE-2026-109619 | PHP ('PHP2Shell') | CVSS 9.2 | Memory-management flaws enabling unauthenticated RCE. Active exploitation confirmed Oct 17; added to CISA KEV. Also chained in attacks against OT/ICS products with embedded PHP. Fixed: 8.2.35, 8.3.36, 8.4.27, 8.5.12 (PHP 8.1 gets no upstream patch). Source: CISA / OT Security Weekly / The Hacker News

• CVE-2026-96652/96654/96655/96656 | Plex Media Server | Chain enabling admin access and RCE. Public PoC Oct 16; active exploitation confirmed on honeypots Oct 17. Added to CISA KEV Oct 20. Observed payloads: crypto miners and proxy software. Fixed: 1.43.3.10861. Source: Unosecur / CISA

• CVE-2026-102764 | BeyondTrust Remote Support | CVSS 9.3 | Zero-day: improper origin validation in internal messaging component exploited by China-nexus ARMORY CASTLE (Mandiant). SaaS patched Oct 9; advisory BT26-05 Oct 15. Added to CISA KEV Oct 16. Admin credential vault contents at risk. Source: Start With Identity / Mandiant

• Juniper Session Smart Router | 18 vulnerabilities disclosed; two rated CVSS 9.8 (unauthenticated RCE and privilege escalation). Widely deployed in carrier and OT-adjacent networks. Patch immediately to 7.0.5, 7.1.7, or 7.2.3. Source: CISA / Juniper

BR3ACHES

• Binance — $6.3 billion in cryptocurrency stolen Oct 29 in what TRM Labs calls the largest crypto theft on record (~4x the $1.5B Bybit hack). Attributed with high confidence to North Korea's TraderTraitor (Lazarus Group / APT38) via a compromised DevOps engineer's laptop. ~$2.67B frozen by Tether, Circle, Ripple, World Liberty Financial, and Arbitrum Security Council. Binance suspended deposits/withdrawals; will cover all losses from SAFU fund. Source: BleepingComputer / TRM Labs / Chainalysis

• Sony So-net / plala (Japan) — 2,585,481 total records exposed (2,141,986 So-net + 443,495 plala users). Includes 54,401 email/password pairs for So-net mail services, 16 bank account records. Oct 19 intrusion detected Oct 23, disclosed Oct 27. Credit cards not affected. Intrusion method under investigation. Source: Unosecur

• PwC — Everest ransomware group claims theft of ~590 GB from an external employee learning platform. Claim unverified. PwC acknowledged Oct 23; confirmed core network and operations unaffected. Source: Unosecur

• Warp (AI Developer Environment) — Third-party infrastructure provider incident; ~1% of users affected. AI agent execution traces and telemetry potentially exposed. CrowdStrike engaged. Source: Unosecur

• State Bank of India (SBI) — ~375,000 records found on dark web; 3,897 containing PII. Disclosed to stock exchanges Oct 21. Breach source under investigation. Source: Unosecur

• ConnectWise Cloud Backup (formerly SkyKick) — Stolen Entra app credential used to pull Microsoft Graph tokens from 162 M365 tenants; Global Admin granted in affected environments. Oct 15-16 incident. Seven app identities disabled. Source: Huntress / Start With Identity

• Railway (Cloud Platform) — Attacker accessed encrypted customer secrets Oct 20-22, specifically targeting AI provider API keys. Identified Oct 20 19:53 UTC, removed Oct 22 03:32 UTC. All Railway API tokens revoked. Customers registered before Oct 21 advised to rotate all credentials. Source: Unosecur / Railway blog

• Zeabur — 3.2 million environment variable records accessed Oct 14-15 via leaked internal credentials. Attack facilitated by failure to fully rotate credentials after a prior August 2026 incident. Platform shutting down Dec 31, 2026. Source: Start With Identity / Unosecur

THREATS & POLICY

• Vapor Panda (China-linked, aka VexatiousTemper / Earth Estries) — Using AI-powered ARTEX pentest framework (Go-based, orchestrating DeepSeek LLM + commercial LLM) against 200+ organizations globally since Oct 17. Targets: foreign ministries (Latin America, Europe, Asia, Middle East), US semiconductor/defense/pharma/nuclear firms, global telecoms. Post-exploitation confirmed at 9 orgs; BLOODALCHEMY (ShadowPad derivative) deployed. One intrusion consumed 1.4 billion input tokens. Source: CrowdStrike / The Hacker News

• North Korea TraderTraitor (Lazarus Group / APT38) — Attributed by TRM Labs and Chainalysis to $6.3B Binance theft (Oct 29). Separately, DOJ charged 14 individuals and dismantled 40+ Texas laptop farms used by North Korean IT workers embedded at 70+ US companies; 187+ computers and KVM devices seized. Source: BleepingComputer / DOJ

• CISA 2030 Strategy Released: 'CISA 2030: Defend, Harden, Prevail' published Oct 26 — pivoting from passive to aggressive, anticipatory defense of critical infrastructure. Three pillars: Defend (OT modernization, supply chain security), Harden (targeted intelligence + tooling), Prevail (resilient encrypted emergency comms). Implementation plan due within 180 days. Source: CISA / Infosecurity Magazine

• CrowdStrike names four new China-linked threat clusters: Hollow Panda, Overcast Panda (FlowCloud backdoor via DLL sideloading; targeting travelers in China), Titan Panda (exploited hard-coded IIS machine key in Intapp Time Server to breach North American law firms since 2021, deploying IceGiant in-memory framework), and Veiled Panda. Source: CrowdStrike / The Hacker News

• UK ICO reprimanded Ogi Networks and Data Cymru for a Nov 2024 ransomware attack enabled by a test account ('Test2' / password 'Password1'), exposing data on 3,300 individuals. Highlights regulatory accountability for basic credential hygiene failures. Source: Start With Identity

• Denmark CPR Register Breach: 8.8 million Danes' names, addresses, and national ID numbers pulled via a private company's lawful search access; reported password was '123456'. Demonstrates persistent third-party data access risk at national scale. Source: Start With Identity

CLOUD & SAAS SECURITY

• Supply Chain: Claude Code VS Code Extension Trojanized on Cursor Marketplace (Oct 29-30) — Malicious version 2.1.313 distributed to up to 5,000 users. Implanted persistent SSH backdoor (~/.ssh/authorized_keys), established reverse tunnel to 134.209.82[.]225, installed persistence (cron/LaunchAgent/scheduled task), and harvested env vars matching KEY/TOKEN/SECRET/PASS/AWS/GCP patterns. Clean version 2.1.314 on Open VSX and VS Code Marketplace. Remediation: isolate, remove SSH key, rotate all credentials. Source: The Hacker News

• Gheist Campaign (Wiz Research, Oct 25): Stolen GitHub tokens used to plant malicious Actions workflows across 13,500+ branches in 850+ compromised accounts. Secrets extracted from CI logs in base32, retrieved via API with runs deleted to cover tracks. Active since Sept 15; expanded to self-hosted runners Oct 19. ~2/3 of accounts removed by Oct 24. Source: Wiz Research / Start With Identity

• LiteLLM Supply Chain Attack (Oct 21): Malicious version 1.107.0 published to PyPI, Docker Hub, and GHCR via compromised Berri-AI/litellm GitHub repo (admin key committed to public repo May 2026, never rotated; GitHub OAuth token obtained Oct 10). Credential stealer and backdoor; AWS credentials tested by attacker within hours. Source: Wiz / Start With Identity

• OVHcloud CLI (GlassWorm Operation): Malicious release binaries published in versions 0.11.0-0.15.0 via contributor GitHub account hijacked in March 2026. Versions 0.10.0 and 0.16.0 reported clean. Advisory: GHSA-862f-55f5-vmvw. Source: The Hacker News

• eMudhra (emSign) PKI Trust Crisis: Private keys of 8 intermediate CAs exposed due to a script error. Chrome, Firefox, Apple, Microsoft, and Go have blocked emSign certificates; Mozilla removing emSign ECC root. No public end-entity certs reportedly issued from compromised CAs. Revocations started Oct 18. Source: Start With Identity

IDENTITY & AUTHENTICATION

• CVE-2026-80097 | Microsoft Authenticator Android | CVSS 8.6 | Exported component allows any installed app (zero permissions required) to steal work account OAuth tokens — enabling email read/send, file/SharePoint/Teams access, and persistent passkey implantation that survives app removal. Fixed: v6.2606.4246 (Google Play). MDM should enforce minimum version immediately. (Research: Enclave Security, 'AuthMask') Source: Help Net Security / Start With Identity

• CVE-2026-115547 | Okta Access Gateway | CVSS 9.1 | Admin command execution as service account. Fixed in release 2026.10.2. Source: Start With Identity

• MFA Bypass: Qilin and INC ransomware exploiting CVE-2026-0257 (PAN-OS GlobalProtect) to skip MFA. One confirmed case resulted in attackers dumping an entire domain controller virtual disk via vCenter (Unit 42 / Palo Alto Networks). Source: Start With Identity

• GhostAction Campaign: Phishing completing GitHub OAuth device flow to plant stealer in repos; expanded from 94 repos (Oct 19) to 1,900+ accounts and 30,000+ repos. AWS Secrets Manager enumeration observed. Also: k0t access broker breached FortiGate and GlobalProtect edges — 70,000+ credentials exposed (Group-IB, NyxLab). Source: GitGuardian / Start With Identity

• Fake IT Help Desk Social Engineering: Arctic Wolf documented 400+ intrusions using Microsoft Teams external chat + Quick Assist as entry vector. Some cases achieved code execution in under 15 minutes of initial contact. Source: Start With Identity / Arctic Wolf

• Passkey Adoption Milestone: Amazon reports 500M+ customers have enabled passkeys. FIDO Alliance Passkey Index 2026: 36% of sign-ins now use passkeys (up from 26%), with 93% success rate vs 78% for passwords; approximately 7 billion passkeys globally. Source: Start With Identity / FIDO Alliance

MOBILE SECURITY

• Microsoft Authenticator Android CVE-2026-80097 (CVSS 8.6): Any installed app can steal work account tokens with zero permissions required. Persistent attacker-added passkey survives app removal. Update to v6.2606.4246 via Google Play immediately. (Disclosed Oct 23; patched Sept 8.) Source: Help Net Security / CyberSecurity News

• Google Android October 2026 Security Update: 25 vulnerabilities patched including critical RCE flaws. MDM administrators should enforce update immediately across managed device fleets. Source: Secarma

• Malicious Firefox Extensions: Fake extensions impersonating Phantom, Jupiter, and Bitget cryptocurrency wallets deployed hidden loaders exfiltrating credentials and draining funds. Extensions removed from Firefox Add-on store. Source: CISA Cyberfeed / Unosecur

• Web-Based Spyware Delivery on Mobile: Researchers document threat actors weaponizing mobile web browsing as a spyware delivery vector, bypassing app store security controls entirely. Source: Axios (Oct 22)

ICS/OT/IoT

• CISA Advisory AA26-097A: Iranian-affiliated cyber actors exploiting PLCs across US critical infrastructure — targeting water, energy, and manufacturing sectors. Organizations must isolate ICS/OT from internet exposure and implement network segmentation. Source: CISA.gov

• PHP2Shell in OT/ICS (CVE-2026-109618/109619, CVSS 9.2): Actively chained in attacks against industrial HMIs and SCADA systems with embedded PHP. CISA confirmed mass exploitation. PHP2Shell also chained with Fragnesia to root network firewalls used in OT-adjacent environments. Patch PHP immediately in ALL environments including OT-adjacent. Source: OT Security Weekly / DEV Community / CISA

• PEERSTITCH: FortiOS in-memory implant (CVE-2025-61624, CISA KEV Oct 16) that tags VPN sessions to bypass authentication checks. VPN credentials stolen from 500+ firewalls. Threat actor using implant to maintain persistent access to OT-adjacent network segments. Source: CISA / Start With Identity

• Juniper Session Smart Router — 18 vulnerabilities; two CVSS 9.8 (unauthenticated RCE and privilege escalation). Widely deployed in carrier networks and OT-adjacent environments. Patch to 7.0.5, 7.1.7, or 7.2.3 immediately. Source: CISA / Cyberfeed

• CVE-2026-97631 | EDK II UEFI PXE Boot | Pre-boot RCE affecting network-booting devices. Most hardware vendors have not yet released patches. Impacts servers, OT devices, and embedded systems using EDK II firmware. Source: CISA Cyberfeed

• OT/ICS Threat Surge: Hacktivists and cybercriminals are expanding attacks on ICS, OT, and AI systems across critical infrastructure throughout 2026 (Industrial Cyber report). SC World documents a significant surge in OT-targeting and supply chain attacks. Source: Industrial Cyber / SC World

RESEARCH & TOOLS

• TeamViewer CVE-2026-111585 Technical Disclosure: Researcher Omri Dar (Remedio) published detailed writeup Oct 29 demonstrating Windows code execution via memory corruption, achieved by bypassing OS exploit mitigations. Demo requires controlled host; not yet fully network-based. Source: The Hacker News

• Anthropic Cyber Mission: Formally launched with disclosure that Claude AI discovered RCE vulnerability chains across Chrome, Safari, Android, Windows, and Linux — all patched via coordinated disclosure. Demonstrates AI-assisted defensive vulnerability research at scale. Source: Anthropic.com

• CrowdStrike ARTEX Disclosure: Released comprehensive analysis of Vapor Panda's AI pentesting framework, including attacker planning agent transcripts and technical exploitation chain details. Documents first confirmed nation-state use of LLM-coordinated agentic attack framework at this scale. Source: CrowdStrike / The Hacker News

• FIDO Alliance released Credential Manager Reference Architecture — standardizing passkey implementations across platforms and providing implementers with a common security baseline. Source: Start With Identity / FIDO Alliance

• NIST SP 800-63-4: Implementation hub released to help organizations implement updated digital identity guidelines, including new passkey and phishing-resistant authenticator requirements. Source: Start With Identity / NIST

• Infisical $40M Series B (Agent Vault): AI agent secrets management product specifically targeting over-privileged AI agents with persistent access to sensitive credentials. Led by Elad Gil at $600M valuation. Source: Start With Identity

• PoC Released for Critical Atlassian Flaw: Public proof-of-concept released for a critical Atlassian vulnerability enabling Jira admin access. Organizations running Jira should patch immediately before exploitation escalates. Source: CyberSecurity News

AI/SI SECURITY

• 'Black October' 2026: Threat researchers are calling October 2026 'Black October' — an unprecedented wave of AI-assisted cyberattacks hitting cloud systems, developer tooling, critical infrastructure, and financial platforms. AI is accelerating attacker reconnaissance, exploit development, and lateral movement at scale across all threat actor tiers. Source: Fox News / Exchange4Media / Avast / Unosecur

• ARTEX AI Pentesting Framework (Vapor Panda / China): Go-based agentic framework orchestrating DeepSeek LLM + commercial LLMs for automated attack planning, SAML/XXE exploitation, credential abuse, and lateral movement. One intrusion consumed 1.4 billion input tokens. Planner+worker agent coordination with human operator steering. First confirmed nation-state deployment of LLM-coordinated attack framework at scale. Source: CrowdStrike / The Hacker News

• LiteLLM Framework Supply Chain Attack (Oct 21): Malicious version 1.107.0 of LiteLLM (widely used multi-model AI routing library) injected with credential stealer and backdoor. Affects LangChain-adjacent and multi-model AI agent deployments broadly. AWS credentials tested by attacker within hours of publication. Source: Wiz / Start With Identity

• AI Provider API Key Theft — Multiple Platforms: OpenCode Console breach (Oct 16-17) exposed stored OpenAI, Anthropic, and Google API keys for ~1.4% of users. Railway breach (Oct 20-22) also specifically targeted AI provider API keys. Highlights systemic risk of storing AI credentials in third-party SaaS platforms. Source: Unosecur / Start With Identity

• Developer Toolchain Attack — Claude Code Extension Trojanized (Oct 29): Supply chain attack specifically targeting AI developers using Cursor IDE. Malicious extension version harvested env vars matching AI credential patterns and exfiltrated to attacker C2. Represents direct targeting of AI developer toolchain. Source: The Hacker News

• Warp AI Dev Environment Breach: Third-party infra provider incident exposed AI agent execution traces and telemetry for ~1% of users. Reports of 'AI agent swarm' involvement are preliminary but warrant investigation. CrowdStrike engaged. Source: Unosecur

• Microsoft Threat Intelligence: AI is giving attackers a head start — accelerating phishing, social engineering, and vulnerability research. Microsoft report (Oct 2) highlights AI-enabled attacks compressing dwell time and amplifying attack scale across all adversary tiers. Source: Help Net Security

• Defensive: Anthropic Cyber Mission — Claude AI autonomously discovered and responsibly disclosed RCE chains across Chrome, Safari, Android, Windows, and Linux. All vulnerabilities patched via coordinated disclosure. Demonstrates practical large-scale AI-assisted vulnerability research for defense. Agent Vault (Infisical) addresses over-privileged AI agent risk — a critical emerging security control as agentic AI becomes production-grade. Source: Anthropic / Infosecurity / Start With Identity

Sources

https://thehackernews.com/2026/10/cisa-adds-actively-exploited-gitlab-rce.html

https://thehackernews.com/2026/10/attackers-chain-three-ivanti-connect.html

https://thehackernews.com/2026/10/teamviewer-flaw-lets-remote-computers.html

https://thehackernews.com/2026/10/chinese-hackers-use-ai-powered-artex-to.html

https://thehackernews.com/2026/10/official-claude-code-vs-code-extension.html

https://www.bleepingcomputer.com/news/security/binance-links-63-billion-crypto-theft-to-compromised-devops-laptop/

https://www.helpnetsecurity.com/2026/10/27/microsoft-authenticator-vulnerability-patchedcve-2026-80097/

https://www.infosecurity-magazine.com/news/cisa-aggressive-strategy-critical/

https://www.unosecur.com/blog/october-2026-cybersecurity-incidents

https://www.cisa.gov/news-events/alerts/2026/10/28/cisa-adds-two-known-exploited-vulnerabilities-catalog

https://startwithidentity.com/news/archive/2026-10/

https://cloud.thecyberfeed.com/daily-summary/2026-10-29

https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-097a

https://industrialcyber.co/reports/hacktivists-and-cybercriminals-expand-attacks-on-ics-ot-and-ai-systems-across-critical-infrastructure/

https://www.foxnews.com/tech/ai-powered-cyberattacks-fuel-black-october-fears

https://www.anthropic.com/news/anthropic-cyber-mission

https://securityboulevard.com/2026/10/daily-ot-security-news-october-19-2026/

https://www.helpnetsecurity.com/2026/10/02/ai-cybersecurity-threats-microsoft-report/

https://secarma.com/07-10-2026-android-october-security-updates-25-vulnerabilities

https://cybersecuritynews.com/poc-exploit-released-for-atlassian-flaw/