CISA flags two actively exploited flaws in VMware ESX and the Linux kernel

CISA added two vulnerabilities to its Known Exploited Vulnerabilities Catalog on 28 October based on evidence of active exploitation. CISA lists a Broadcom VMware ESX insufficient logging vulnerability and a Linux kernel missing-initialization-of-a-variable vulnerability. CISA says Binding Operational Directive 26-04 requires Federal Civilian Executive Branch agencies to prioritise rapid remediation of these. If you run VMware ESX or Linux in your estate, match these against your inventory and apply vendor fixes on the KEV timeline.

The Hacker News reported that the China-nexus espionage group Volt Typhoon has been attributed to a now-disrupted covert access network called Silent Train, used for zero-day exploitation and strategic access. The Hacker News says the network, first identified in late 2023, uses rotating chains of compromised SOHO, IoT and enterprise devices.

The Register reported that attackers are probing another Oracle E-Business Suite bug, and that ShinyHunters' PeopleSoft zero-day turns out to involve three vulnerabilities. If you run EBS or PeopleSoft, treat these as live.

Google's advisory covers six high-severity Chrome flaws — CVE-2026-118359, CVE-2026-118358, CVE-2026-118357, CVE-2026-118356, CVE-2026-118354 and CVE-2026-118353 — each carrying CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base score 8.8. Google lists Chrome up to the fix in 156.0.8078.73 as affected. Follow Google's advisory for the fixed release (https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_0562499947.html).

On breaches: The Record reported Japan Airlines warned that hackers stole passport numbers, frequent flyer numbers, email addresses and phone numbers for about 2,000 customers. BleepingComputer reported Sony Network Communications confirmed a breach of approximately 2.5 million records containing current and former customers' personal information.

On enforcement: BleepingComputer reported U.S. law enforcement seized the primary domain of Virtualine, a bulletproof hosting service. SecurityWeek reported Artem Stryzhak was sentenced to 70 months in U.S. prison after pleading guilty to using Nefilim ransomware. The Record reported the U.S. Treasury sanctioned Russian and North Korean nationals it alleges laundered earnings of illicit IT workers for Pyongyang.

In policy, The Hacker News reported Google will allow approved third-party Android stores outside the U.S. to install apps with one tap, and Help Net Security reported GitHub launched an npm package firewall that checks packages against enterprise policy before they install.