Daily Briefing

CISA flags two actively exploited flaws in VMware ESX and the Linux kernel

By The IT Security Desk

Good morning. CISA added two vulnerabilities to its Known Exploited Vulnerabilities Catalog on 28 October based on evidence of active exploitation. CISA lists a Broadcom VMware ESX insufficient logging vulnerability and a Linux kernel missing-initialization-of-a-variable vulnerability. CISA says Binding Operational Directive 26-04 requires Federal Civilian Executive Branch agencies to prioritise rapid remediation of these. If you run VMware ESX or Linux in your estate, match these against your inventory and apply vendor fixes on the KEV timeline.

The Hacker News reported that the China-nexus espionage group Volt Typhoon has been attributed to a now-disrupted covert access network called Silent Train, used for zero-day exploitation and strategic access. The Hacker News says the network, first identified in late 2023, uses rotating chains of compromised SOHO, IoT and enterprise devices.

The Register reported that attackers are probing another Oracle E-Business Suite bug, and that ShinyHunters' PeopleSoft zero-day turns out to involve three vulnerabilities. If you run EBS or PeopleSoft, treat these as live.

Read the full briefing →

Zoom out: The Register reports the Oracle disclosures landed as Cybersecurity Awareness Month closed.

Vulnerability in focus

CVE-2026-118359 — Google. CVSS 8.8

Affected: chrome.

What to do: Follow the vendor advisory for the fixed release and any interim mitigation.

Elsewhere

The Hacker News: Attackers Exploit PHP2Shell Flaws in Internet-Exposed Palo Alto Networks Management Interfaces Read it
The Hacker News: China-Linked Hackers Exploited VMware ESX Zero-Day to Reduce Audit Trail Visibility Read it
Help Net Security: Qualys CISO on what security teams can do as exploit campaigns grow Read it
Help Net Security: IT bosses are confident they’ve found the certificates they don’t know about Read it
Help Net Security: Shame and sleepless nights haunt scam victims long after the money is gone Read it
Help Net Security: Stolen staff logins are spreading attacks between K-12 school districts Read it
The Record: Court strikes down West Virginia law barring disclosure of public officials’ personal data Read it
BleepingComputer: Police seize Virtualine bulletproof service tied to ransowmare, cybercrime Read it
CISA: CISA Adds Two Known Exploited Vulnerabilities to Catalog Read it
The Register: Oracle celebrates end of Cybersecurity Awareness Month with quadruple trouble Read it
The Hacker News: Volt Typhoon Used Covert Silent Train Network in Four Zero-Day Exploitation Campaigns Read it
The Record: European digital rights nonprofit noyb sues Scale AI for ‘invasive’ worker surveillance Read it

Sources

Court strikes down West Virginia law barring disclosure of public officials’ personal data The Record
Police seize Virtualine bulletproof service tied to ransowmare, cybercrime BleepingComputer
Oracle celebrates end of Cybersecurity Awareness Month with quadruple trouble The Register
Volt Typhoon Used Covert Silent Train Network in Four Zero-Day Exploitation Campaigns The Hacker News
GitHub’s npm package firewall can block brand-new versions before they install Help Net Security
Ukrainian Hive and Nefilim Ransomware Affiliate Gets 70 Months in US Prison SecurityWeek
CISA Adds Two Known Exploited Vulnerabilities to Catalog CISA
Studying Fraudulent North Korean IT Workers Schneier on Security
Japan Airlines warns of data breach as country grapples with multiple cyber incidents The Record
European digital rights nonprofit noyb sues Scale AI for ‘invasive’ worker surveillance The Record
US sanctions Russians, North Koreans for laundering IT worker earnings The Record
Google to Allow One-Tap Android App Installs From Approved Third-Party Stores Outside U.S. The Hacker News
Sony ISP subsidiary data breach exposes 2.5 million customer records BleepingComputer
Moldova investigates possible foreign involvement in major government cyberattack The Record

Share this issue

Facebook · X · Reddit · LinkedIn · WhatsApp · Email · Bluesky

Every briefing is on the site, with the advisory record behind it. All briefings