cyber.hendryadrian.com
← Cyber Reports

Cyber Threat Weekly Report

2026-W44
Reporting period
2026-10-26 – 2026-11-01 (UTC)
Publication date
Eligible Articles
76
Distinct Publishers
44

Highlighted News

The week's leading stories
Incident

Cisco SD-WAN flaw exploited to deploy KeyDrift

Cisco Talos observed UAT-11473 exploiting authentication-bypass flaw CVE-2026-20127 on Cisco Catalyst SD-WAN Controllers to deploy KeyDrift. Its PolyFlame component supports command execution and file transfer, while LittleFilch intercepts decrypted control-session messages. Cisco patched the flaw in February 2026.

Security Significance: Observed exploitation gives attackers privileged access to network management systems. KeyDrift can intercept control traffic and collect keying material; defenders should apply the available update.

Incident

VAPOR PANDA used ARTEX in intrusions targeting more than 200 organizations

CrowdStrike reports that VAPOR PANDA used ARTEX and large language models in parallel intrusion activity beginning October 17. It confirmed post-exploitation at nine organizations, including BLOODALCHEMY deployment at two ministries. Recovered transcripts showed a human operator steering activity at decision points.

Security Significance: The campaign demonstrates AI-assisted attack workflows at substantial scale, but targeting more than 200 organizations does not mean all were compromised. Confirmed post-exploitation affected nine.

Weekly News Digest

Additional developments
  1. Incident

    Attackers chained PHP2Shell flaws to root firewalls

    Dream reports that a China-nexus operation exploited 25 firewalls on October 23–24 by chaining PHP2Shell flaws CVE-2026-109618 and CVE-2026-109619 with Linux privilege-escalation flaw CVE-2026-46300. It reports root web shells on 24 devices and access to a management server containing firewall configurations and credentials.

    Security Significance: The reported exploitation reached privileged network infrastructure and exposed management credentials. Dream observed no further post-exploitation activity on 22 of the firewalls with web shells.

  2. Vulnerability

    Researchers detail exploited PeopleSoft SSRF-to-RCE chain

    ZDI describes three PeopleSoft flaws patched under CVE-2026-35273, including an SSRF in PSIGW that can reach PSEMHUB through its default loopback trust. Mandiant and Google Threat Intelligence Group attribute exploitation to ShinyHunters. ZDI is working with Oracle on separate CVE assignments.

    Security Significance: The chain permits unauthenticated remote code execution in affected PeopleTools versions. Patching addresses the flaw but may not remove attackers already present.

  3. Threat Research

    Coruna and DarkSword analysis reconstructs iOS exploit chains

    Zimperium analyzed version-selected iOS exploit chains delivered through hidden frames, including a route through a compromised npm art-template package. Its Coruna analysis covers a WebAssembly memory-access exploit, CVE-2022-48503, a pointer-authentication bypass and a native loader. Researchers confirmed Notes and app-inventory exfiltration from an iOS 18.6.2 test device.

    Security Significance: The research documents a delivery chain that does not require an app install and demonstrates sensitive-data exfiltration in testing; the test result alone does not establish victim impact.

  4. Threat Research

    Exposed Doorway workspaces reveal IoT and server exploitation engine

    CloudSEK analyzed two byte-identical exposed workspaces containing about 41 GB of material, including a Rust engine with 59 exploit modules targeting network devices and Java services. The engine fingerprints targets and probes them before attempting payload delivery; architecture-aware loaders can restrict retrieval with IP-bound HMAC signatures.

    Security Significance: The workspaces contained evidence of compromised devices and Java services. The final clients' capabilities and large-scale RouterOS reverse-shell deployment remain unconfirmed.

  5. Incident

    Cloudflare confirms cross-tenant exposure in Workers AI

    Cloudflare disclosed that 155 responses to exceptionally long GLM-5.3 requests contained data from other customers' requests between August 27 and September 9. A mismatch between the model context window and KV-pool capacity combined with an SGLang rejection-path bug allowed decoding to read stale cache pages. Fixes have been deployed.

    Security Significance: The issue caused confirmed cross-tenant data exposure. The supplied report does not establish deliberate exploitation.

  6. Vulnerability

    Brotli decoder flaw affects Node.js and other runtimes

    Datadog Security Labs reproduced CVE-2026-111497, an out-of-bounds write in the upstream Google Brotli decoder, on an official Node.js 24.22.0 image. The report also identifies affected runtimes and services including Python Brotli, Bun, .NET, Envoy and Istio. A crafted stream can cause an unchecked write or an indefinite CPU-consuming loop.

    Security Significance: The shared decoder creates exposure across multiple ecosystems. Datadog identifies patching as the only complete fix; the supplied evidence does not claim observed exploitation.

  7. Vulnerability

    BeyondTrust Remote Support flaw permits unauthenticated file upload and code execution

    An anonymous customer session can forge a reserved local router ID, bypass a local-origin check and reach the file-transfer service to upload and execute a PHP file as msfuser. Other affected releases and fixed builds remain undetermined in the supplied report.

    Security Significance: The demonstrated chain requires neither credentials nor user interaction from a network client. The report does not establish exploitation outside the demonstration.

  8. Threat Research

    Researchers link 319 Chrome extensions to search hijacking

    Socket identified 319 search-hijacking Chrome extensions with about 13.4 million installs over roughly a decade. The extensions change the default search provider and route queries through operator-controlled proxies, often without permissions or background scripts. The proxies can select destinations per request and may associate queries with a unique identifier.

    Security Significance: The proxy architecture exposes search queries to operators and could enable selective malicious redirects. The install figure is cumulative, not a count of currently affected users.

  9. Threat Research

    Volt Typhoon linked to Silent Train relay network used in zero-day campaigns

    Lumen's Black Lotus Labs attributes Silent Train to Volt Typhoon. The network uses rotating, multi-hop chains of compromised SOHO, IoT and enterprise devices to relay traffic. Researchers say it supported four confirmed zero-day campaigns, including exploitation of Versa Director CVE-2024-39717 to deploy the VersaMem web shell.

    Security Significance: Compromised edge devices can conceal the origin of operations exploiting high-impact vulnerabilities. The attribution and campaign connections are Black Lotus Labs' assessments.

  10. Incident

    Stolen AI credentials used for millions of Bedrock calls

    Wiz analyzed nine AI developer-platform incidents and linked two enterprise credentials to one vendor breach. It documented about 2.5 million Bedrock calls and says resale operators accessed the keys. Their connection to the original attacks or the high-volume abuse was not established.

    Security Significance: The findings show how stolen AI-service credentials can enable substantial unauthorized usage. The supplied evidence does not support attributing all the activity to the resale operators.

  11. Threat Research

    Teams external chat abused in more than 400 social-engineering incidents

    Arctic Wolf analyzed more than 400 incidents involving Microsoft Teams external chat for impersonation and initial access. Attackers posed as IT support, sometimes after email bombing, and commonly sought access through Quick Assist or other remote-management tools. Some activity progressed from user engagement to payload execution in under 15 minutes.

    Security Significance: The incidents abuse a legitimate collaboration feature rather than a known Teams vulnerability. Restricting external access and monitoring chat and endpoint activity can reduce exposure.

Weekly Threat Intelligence

Six Top 7 rankings

Ranked by distinct supporting articles. Open Related Evidence for saved source contexts and CVE details.

Top 7 CVEs

  1. 1CVE-2026-109618
  2. 2CVE-2026-109619
  3. 3CVE-2026-20127 · Cisco Catalyst SD-WAN Manager
  4. 4CVE-2024-39717 · Versa-networks Versa director
  5. 5CVE-2026-46300 · Linux Linux
  6. 6CVE-2019-19006 · Sangoma Freepbx
  7. 7CVE-2022-48503 · Apple iOS and iPadOS

Top 7 MITRE ATT&CK Techniques

  1. 1T1105 · Ingress Tool Transfer
  2. 2T1027 · Obfuscated Files or Information
  3. 3T1190 · Exploit Public-Facing Application
  4. 4T1059.001 · PowerShell
  5. 5T1071.001 · Web Protocols
  6. 6T1041 · Exfiltration Over C2 Channel
  7. 7T1059.004 · Unix Shell

Top 7 Malware

  1. 1GoGRPC
  2. 2Golden Gh0st RAT
  3. 3KeyDrift
  4. 4LittleFilch
  5. 5PolinRider
  6. 6PolyFlame
  7. 7XMRig

Top 7 Threat Actors

  1. 1Volt Typhoon
  2. 2Storm-0940
  3. 3APT-Q-27
  4. 4GoldenEyeDog
  5. 5Qilin
  6. 6ShinyHunters
  7. 7The Gentlemen

Top 7 Mentioned Countries

  1. 1United States
  2. 2China
  3. 3Russia
  4. 4South Korea
  5. 5Brazil
  6. 6India
  7. 7Japan

Top 7 Mentioned Industries

  1. 1Government
  2. 2Cryptocurrency
  3. 3Defense
  4. 4Telecommunications
  5. 5Education
  6. 6Energy
  7. 7Healthcare
Other Articles (63)
METHODOLOGY AND LIMITATIONS

Reporting period and eligibility

Article selection uses the original publisher publication date within the saved reporting period. Articles without that date are excluded; discovery dates and Cyber publication dates do not substitute for it. Counts include articles meeting public eligibility rules after the saved Weekly Report SCOPE exclusions were applied.

Ranked lists and evidence

Ranked lists show up to seven saved, validated canonical entities per category, ordered by the number of distinct supporting articles. Each article counts once per entity. These are article references, not unique incident counts; multiple articles and publishers may cover the same event.

Related Evidence displays saved entity-specific contexts with publisher identity, publication dates and article links. Missing context is identified explicitly and does not mean a supporting article is missing: the article remains linked and counted. Article summaries are not substituted for unavailable entity context.

Entity mentions do not confirm attribution, infection, exploitation, attacker origin, victim location, targeting or industry compromise. Country and industry contexts retain the original research wording.

Saved CVE details

CVSS, severity, EPSS and CISA KEV details are available inside each CVE's Related Evidence, using saved snapshot enrichment only; unavailable values are Unknown. EPSS estimates exploitation probability, not vulnerability severity or confirmed exploitation. Absence from KEV does not establish absence of exploitation. CVE rankings depend on supporting articles, not scores or KEV status.

Historical and AI limitations

This report uses a saved historical evidence snapshot. Source edits, later enrichment and subsequent reporting do not automatically update it. AI analysis uses bounded editorial selections of summaries, key points and validated relationships; it cannot establish complete coverage of global threat activity. Historical completeness: Unknown.

Ransomware operator claims and leak-site listings are unverified allegations, not confirmed attacks. Repetition by another publisher does not independently verify compromise, data theft or actor involvement.

Evidence panels provide ten articles per page, with every saved reference accessible. Without JavaScript, all references are displayed. Related entity metadata does not increase the supporting article count. Links use saved identities; their availability may change.

ALL CYBER REPORTS