Lumen's Black Lotus Labs attributed Silent Train, a now-disrupted covert access network first identified in late 2023, to the China-nexus espionage group Volt Typhoon. Built from rotating chains of compromised SOHO, IoT and enterprise devices, it was used in four zero-day exploitation campaigns and for strategic access.
CISA added CVE-2026-41709, a Broadcom VMware ESX flaw, to its Known Exploited Vulnerabilities catalog after CrowdStrike revealed that the China-nexus actor Warp Panda exploited it as a zero-day against the U.S. legal sector to reduce audit trail visibility.
Researchers detailed an apparently AI-assisted attack by a suspected China-nexus actor on October 25, 2026 that combined the PHP2Shell vulnerabilities with a kernel privilege escalation exploit to root 25 servers and breach a U.S. government-affiliated network.
Cisco Talos said hackers exploited a critical Cisco Catalyst SD-WAN flaw, fixed in February, to plant KeyDrift, custom malware inside SD-WAN controllers designed to copy and store the keys that encrypt traffic between sites. Talos describes the attacks as historical.
A critical flaw in UEFI firmware used by most server vendors and data centers lets attackers execute code early in the boot process.
A massive leak exposed records on 41,000 U.S. Homeland Security workers, including undercover ICE agents. It includes the locations of ICE and CBP facilities, workers' cell phone numbers and members of groups tied to wiretap programs, Palantir software and xAI's Grok chatbot.
Cisco patched CVE-2026-76418 (CVSS 8.6), an actively exploited flaw in Secure Firewall ASA and FTD VPN software that lets an unauthenticated remote attacker crash the firewalls.
NebuSec disclosed a Telegram for Android flaw that, chained with two other bugs, gave an attacker with an ordinary account full control of a victim's phone once the victim answered a voice call. Telegram fixed it in version 12.10.4 in late September.
Japan's GMO Internet told customers to unplug their PCs in advance of a possible ransomware attack.
Alpine Linux said on October 28 that an attacker tried to exploit CVE-2026-97229 (CVSS 10.0) on its own GitLab server a week after GitLab released a fix. The flaw allows code execution through a crafted regular expression in a CI configuration; Alpine found no evidence the attack succeeded.