Cybersecurity briefing, 2026-10-29

Cisco SD-WAN controllers were breached in an espionage operation attributed by Talos to UAT-11473.

• PHP2Shell attacks give exposed PAN-OS consoles code execution
• Cisco SD-WAN controller breach exposes decrypted traffic
• CISA confirms active exploitation of Brotli decoder flaw
• Virtualine’s shell-company plan shadows wider FBI seizure
• DHS leak maps staff tied to sensitive work
• Oracle EBS probes sharpen PeopleSoft’s patching problem
• AI agent finds four EPICS flaws, one may enable code execution
• Chrome extensions hijack searches for referral payments
• Tailscale SSH flaw lets authorized devices reach root
• EDK II flaw exposes shared firmware to boot-time code execution
• GhostWriter attack brings destructive cyber operations to Ukrainian industry
• Engie partner breach exposes identifiers that aid impersonation
• Gheist’s Base32 trick exposes GitHub Actions secrets
• Stryzhak sentence leaves ransomware networks unresolved
• Fake ChatGPT and Claude downloads deliver Yoba malware
• GMO desktop breach puts trading account integrity in question
• Adobe fixes nine critical flaws across Campaign Classic and Connect
• Unsloth flaw lets model configs run Python past safety setting

Recent editions

• Wednesday, October 28, 2026: Cisco SD-WAN controller breach exposes decrypted traffic · 19 stories
• Tuesday, October 27, 2026: Apple extends exploited CoreGraphics fix to iOS 18 · 15 stories
• Monday, October 26, 2026: Downloads files can persist in Codex and expose Claude tokens · 17 stories
• Sunday, October 25, 2026: Collabora backdoors target credential stores as VCO flaws recur · 7 stories
• Saturday, October 24, 2026: EvilTokens uses AI to turn inbox access toward payment fraud · 16 stories
• Friday, October 23, 2026: Ruby regex bugs expose applications beyond GitLab · 19 stories
• Thursday, October 22, 2026: PHP2Shell moves from probes to confirmed shell execution · 18 stories