2026-10-30

Developments on tracked stories (9 + 91 low-signal)

The brief — 46 stories · 4 deep reads

P1 · VAPOR PANDA uses ARTEX agentic AI framework in parallel intrusions; BLOODALCHEMY deployed at nine orgs

CrowdStrike reports China-nexus VAPOR PANDA used the ARTEX agentic AI framework (DeepSeek plus a commercial LLM) against 200+ organizations in 14+ countries starting Oct 17, 2026, with confirmed post-exploitation at nine organizations including financial-sector targets in the US. Tradecraft included unsigned SAML assertions and XXE to query cloud IMDS, web shells, LAPS reads, RBCD impersonation, forged mail admin tokens, VPN access with leaked keys, password spraying, and checks for hosts lacking Falcon via tasklist. BLOODALCHEMY was sideloaded via a renamed GameHook binary (svchost.exe) loading graphics-hook-filter64.dll. Hunt for artx/artex command-line strings, artx-prefixed cloud roles, art18- admin-command comments, C:\ProgramData\artx5v\, and svchost.exe outside System32 loading graphics-hook DLLs.

Why P1: Active state espionage campaign hitting US financial sector with concrete huntable markers (ARTEX strings, sideloading, IMDS/SAML abuse). · ATT&CK: T1588.007, T1190, T1078, T1133, T1651, T1505.003, T1134.001, T1574.001, T1036.005, T1552.005, T1555, T1606.002, T1606, T1110.003, T1518.001, T1114.002, T1090.003, T1572, T1057

Deep read — score 36: +15 7 behaviors, +8 4 evidence samples, +4 2 detection guidance, +3 10 IoCs, +2 primary source, +1 financial relevance, +2 light read P1, +1 High

Behaviors (10, 7 new)

Evidence samples (2)

C:\ProgramData\artx5v\

D:\ProjectX\Merman_New\

Published detection guidance (2)

• Hunt for ARTEX markers: command-line parameters containing artx or artex, artx-prefixed cloud roles, art18- administration-command comments, and C:\ProgramData\artx5v\ directory. tier AEDR process events, cloud audit logs link
• Enforce SAML signature validation, require IMDSv2, restrict cloud command-execution permissions; rotate keys after data exposure. tier A link

IoCs — 11 new

Sources

• crowdstrike.com — ok

P1 · Trojanized Claude Code extension 2.1.313 on Cursor Marketplace plants SSH backdoor

A malicious version 2.1.313 of the Claude Code extension (ID anthropic.claude-code) was distributed via the Cursor Marketplace between ~2:27 a.m. and 1:35 p.m. PT on Oct 29, 2026, reaching at most 5,000 users. A 66-line JS loader adds an attacker SSH key labeled 'svc-telemetry' to ~/.ssh/authorized_keys, tries to enable SSH, opens a reverse tunnel to 134.209.82[.]225, installs persistence (scheduled task/crontab/LaunchAgent), and beacons host recon over HTTP to port 8099. Enabling SSH fails without admin rights on most macOS/Windows hosts, but key, persistence and beacon still occur; no follow-on payloads observed. Hunt for the svc-telemetry key, new persistence spawned by the IDE, and outbound connections to 134.209.82.225.

Why P1: Supply-chain backdoor in widely used developer tool with concrete huntable artifacts (SSH key label, C2 IP, persistence). · ATT&CK: T1195.002, T1098.004, T1053.005, T1053.003, T1543.001, T1572, T1082, T1033, T1016, T1041, T1071.001, T1036

Deep read — score 24: +15 7 behaviors, +4 2 evidence samples, +2 1 detection guidance, +1 financial relevance, +2 light read P1

Behaviors (5, 5 new)

Evidence samples (2)

~/.ssh/authorized_keys

git config --global user.email

Published detection guidance (2)

• Check ~/.ssh/authorized_keys for a key labeled svc-telemetry and look for new scheduled tasks, crontab entries, or LaunchAgents created around Oct 29, 2026; check for installs of anthropic.claude-code 2.1.313. tier BFIM / EDR link
• Look for outbound HTTP to port 8099 /beacon and requests to api.ipify.org from IDE processes. tier Bproxy link

IoCs — 2 new

Sources

• The Hacker News — ok
• GitHub — ok

P1 · CISA adds Fragnesia Linux kernel flaw (CVE-2026-46300) to KEV; attackers reportedly chain it with PHP2Shell to root servers — update to 2026-10-29's story

CISA added the Linux kernel XFRM ESP-in-TCP privilege-escalation flaw CVE-2026-46300 (Fragnesia) to KEV and warned it can be chained with PHP2Shell (CVE-2026-109618/CVE-2026-109619) to implant PHP webshells and run commands as root. Dream Security reported a campaign that rooted 25 servers across the US, Japan, Taiwan and South Korea and then targeted three servers in a US government-affiliated environment, though CISA itself did not share details of the attacks. Hunters should look for PHP webshells on web servers and unexpected root-level command execution from PHP processes.

Why P1: KEV-listed kernel privilege escalation chained with PHP RCE; vendor-reported webshell implantation and third-party report of multi-server compromise. · ATT&CK: T1068, T1190, T1505.003

Behaviors (3, 2 new)

Sources

• BleepingComputer — ok

P1 · Palo Alto Networks confirms active exploitation of PHP2Shell flaws (CVE-2026-109618, CVE-2026-109619) against internet-exposed PAN-OS management interfaces; patches released — continues an earlier item in today's brief

Palo Alto Networks updated its advisory to say active exploitation has been observed against PAN-OS management web UI and XML API exposed to the internet, tied to PHP2Shell PHP RCE flaws. Dream reported a suspected China-nexus actor used the flaws alongside Fragnesia (CVE-2026-46300) to root 25 servers, with credential extraction and Active Directory enumeration confirmed in recovered artifacts. Hunters should check PAN-OS management interface exposure and logs for web shell and command execution activity, and remove public management access.

Why P1: Vendor-confirmed active exploitation of internet-exposed PAN-OS management interfaces with patches available; KEV-listed chained Linux LPE. · ATT&CK: T1190, T1505.003, T1068, T1003, T1087.002

Behaviors (3, 2 new)

Published detection guidance (1)

• Palo Alto Networks: remove public internet access to management interfaces; restrict to trusted internal IPs; apply PHP2Shell fixes. Customers with Frontier Virtual Patching (ATP Plus) received coverage via Threat ID 543004. tier B link

Sources

• The Hacker News — ok

P1 · Drupal Commerce Core access-bypass flaw CVE-2026-118539 exploited in the wild

Drupal warned administrators that CVE-2026-118539, a missing-authorization access bypass in the Commerce Core module, is being actively exploited against unauthenticated attackers. The sources say the flaw affects Commerce Core 0.0.0 through 2.41 and 3.0.0 through 3.3.13, with fixes in 3.3.13 and 8.x-2.41, and advise auditing orders for inconsistencies; no specific exploitation artifacts, log patterns, or indicators are published. Hunters should review order records for unexpected modifications and check exposed routes and entity fields for unauthenticated access.

Why P1: KEV-listed-style actively exploited internet-facing e-commerce CMS module with 42,000+ sites; no concrete huntable behaviors published yet. · ATT&CK: T1190

Behaviors (0)

None extracted.

Published detection guidance (1)

• Audit orders for inconsistencies after upgrading, as recommended by the Drupal security team. tier B link

Sources

• BleepingComputer — ok
• https://thehackernews.com/2026/10/hackers-actively-exploit-highly.html — not fetched

P1 · UAT-11473 exploits Cisco SD-WAN CVE-2026-20127 to deploy KeyDrift malware against defense and policy targets — update to 2026-10-29's story

Cisco Talos reports a newly identified cluster tracked as UAT-11473 exploiting CVE-2026-20127, an authentication bypass in Cisco Catalyst SD-WAN Controllers, to deploy the custom KeyDrift framework. The sources say KeyDrift runs inside vdaemon processes, intercepts decrypted control-plane traffic via SSL_read hooking, and stages keying material in /var/tmp/vdaemon.bin before UDP exfiltration. Hunters should look for activity in vdaemon processes, modified service startup scripts, and creation of /var/tmp/vdaemon.bin; Cisco recommends the February 2026 update and its SD-WAN hardening guide.

Why P1: Max-severity auth bypass in internet-facing SD-WAN controllers with described huntable artifacts, though the cluster's exposure is limited to the stated targets. · ATT&CK: T1190, T1543, T1005, T1557, T1041, T1573

Behaviors (5, 5 new)

Evidence samples (1)

/var/tmp/vdaemon.bin

Sources

• BleepingComputer — ok
• https://thehackernews.com/2026/10/hackers-exploited-cisco-sd-wan-flaw-to.html — not fetched
• SecurityWeek — ok

P1 · China-nexus Warp Panda exploited VMware ESXi zero-day CVE-2026-41709 to reduce audit logging visibility in US legal-sector intrusions — update to 2026-10-29's story

CrowdStrike reported that China-nexus actor Warp Panda exploited CVE-2026-41709, an insufficient-logging flaw in Broadcom VMware ESXi (CVSS 2.7), as a zero-day in early 2026 to perform admin operations without being logged. Per the source, the actor targets internet-facing edge devices, pivots to vCenter to deploy BRICKSTORM and SharpStorm, and in some cases harvests cloud session tokens and registers rogue MFA devices. CISA added the CVE to KEV and FCEB agencies were told to patch by November 11, 2026. Hunters should look for gaps in ESXi/vCenter audit logging and for new MFA device registrations on M365 accounts.

Why P1: KEV-listed, actively exploited hypervisor flaw with reported persistence and MFA-registration tradecraft. · ATT&CK: T1556.006, T1078.004, T1190

Behaviors (2, 0 new)

Sources

• The Hacker News — ok
• SecurityWeek — ok

P1 · Gotenberg CVE-2026-42589 RCE reportedly exploited to deploy Go reverse shell 'cache_base'

VulnCheck reports that threat actors are exploiting CVE-2026-42589, a critical RCE in Gotenberg patched in May 2026, to deliver a Go-based reverse shell called cache_base. The activity reportedly originated from a residential Japanese IP in early October 2026, with 1,358 exploitation events from 128 unique source IPs over the past 30 days. Hunters should look for Gotenberg service processes spawning unexpected children and the cache_base reverse shell's C2 registration and shell activity.

Why P1: Actively exploited critical internet-facing RCE with a described reverse shell payload; the brief itself labels the report unconfirmed. · ATT&CK: T1190, T1059, T1105

Behaviors (1, 1 new)

Sources

• The Hacker News — ok

P1 · Polymarket users' sessions targeted by malicious JavaScript served via compromised DebugBear RUM script; attack under investigation

Polymarket temporarily halted trading after a third-party provider was compromised and malicious JavaScript was distributed from cdn.debugbear[.]com, which BleepingComputer says was designed to hijack logged-in Polymarket trading sessions and move users' prediction-market tokens and crypto to an attacker wallet. Polymarket says it fixed the issue and will reimburse affected traders, but has not disclosed the number of victims or amount stolen; a ~$2.5M figure is traced to the attacker wallet, not confirmed as user losses. Hunters on DebugBear RUM embed code should look for requests to cdn.debugbear[.]com/C7xcKKrjUnXK.js and outbound traffic to data.debugbear.com.

Why P1: Concrete huntable behavior (third-party JS script serving session hijack and exfil to a named domain) affecting a widely embedded monitoring product, with active compromise reported. · ATT&CK: T1189, T1059.007, T1539, T1041

Behaviors (3, 3 new)

Evidence samples (1)

cdn.debugbear[.]com/C7xcKKrjUnXK.js

Published detection guidance (1)

• Hunt for requests to the malicious script path and for communication with the C2/exfil host; DebugBear advised customers to remove the RUM embed code. tier BWeb proxy logs; DNS logs link

IoCs — 4 new

Sources

• BleepingComputer — ok
• https://www.securityweek.com/2-million-drained-from-polymarket-traders-in-new-supply-chain-attack/ — not fetched

P2 · NIK C2: Go-based Windows implant steals credentials, keylogs, and routes prompts to OpenAI API — update to 2026-10-29's story

Cisco Talos documented NIK C2, a Go-based Windows RAT observed live in the wild (C2 at 87.120.196[.]120 / total-sitevv[.]lol). It steals browser credentials, Wi-Fi keys, crypto wallets and keystrokes, and can relay actor prompts to the OpenAI Chat Completions API using the victim's OPENAI_API_KEY if one is set. It persists via HKCU Run keys and a copy in %appdata%\Microsoft\Network, bypasses UAC via a fodhelper ms-settings hijack, patches AMSI, and can deploy an mshta-based screen-locker. Hunt for netsh wlan key=clear, chcp 65001 recon chains, mshta launching lock_screen.html, a SystemLock Run key, bcdedit /enum plus Confirm-SecureBootUEFI, and unexpected api.openai.com traffic from non-developer hosts.

Why P2: Live commodity RAT with rich vendor-stated Windows behaviors; no specific targeting or exploitation of enterprise infra. · ATT&CK: T1555.003, T1056.001, T1547.001, T1548.002, T1036.005, T1055.012, T1082, T1518.001, T1057, T1071.001, T1573.001, T1041, T1090, T1563.002, T1218.005, T1059.001, T1059.003, T1005, T1113, T1115, T1542.003, T1622, T1539, T1552.001, T1006, T1555

Deep read — score 34: +15 14 behaviors, +10 9 evidence samples, +2 1 detection guidance, +3 10 IoCs, +2 primary source, +1 financial relevance, +1 light read P2

Behaviors (9, 4 new)

Evidence samples (5)

netsh wlan show profiles netsh wlan show profile name="" key=clear

chcp 65001 >nul 2>&1 & systeminfo chcp 65001 >nul 2>&1 & wmic os get lastbootuptime /value chcp 65001 >nul 2>&1 & wmic /namespace:\\root\SecurityCenter2 path AntiVirusProduct get displayName 2>nul chcp 65001 >nul 2>&1 & Get-Process | Select-Object Id, ProcessName | ConvertTo-Json -Compress

HKCU\Software\Classes\ms-settings\Shell\Open\command

/opt/nik_panel/data/build_52b79724a1fc4b8f/main.go

[NIK] Starting

Published detection guidance (2)

• ClamAV signature Win.Trojan.GoDiscorder-10060526-0 detects NIK C2 implant tier AAV link
• C2 TLS certificate CN nik-panel; JARM 28d28d28d00000000042d42d0000001f361a1bf80ed39a1e352adeb016a07b tier ATLS/network sensor link

IoCs — 1 new, 7 seen before

Sources

• Cisco Talos Blog — ok

P2 · Talos IR Q3 2026: Help-desk vishing for RMM access, edge exploitation, EDR killers in ransomware

Cisco Talos IR's Q3 2026 trends report finds phishing (37%) and public-facing app exploitation (33%) led initial access; actors impersonated IT help desks via vishing to get victims to start Quick Assist/RMM sessions. VYPR ransomware operators used RMM-launched PowerShell to download an MSI, then MeshAgent, Rclone, PsExec and BYOVD to kill EDR; Interlock actors tried uninstalling Cisco Secure Endpoint, used taskkill/PsExec, disabled Defender and cleared logs. Salt Typhoon-linked actors exploited CVE-2023-20198 in web-based management interfaces, deploying BadCandy, creating privileged accounts and disabling logging. Hunt for Quick Assist sessions followed by RMM-spawned PowerShell/msiexec, taskkill against security processes, loads of known-vulnerable drivers, and new privileged accounts on network devices.

Why P2: Quarterly trends report with concrete huntable behaviors (vishing->RMM->PowerShell MSI, EDR killing) but no new IoCs; finance 18% of cases. · ATT&CK: T1566.004, T1219, T1059.001, T1105, T1218.007, T1569.002, T1567.002, T1489, T1068, T1070, T1190, T1078, T1505.003, T1136.001, T1555.001, T1486, T1046, T1021.001

Deep read — score 25: +15 6 behaviors, +4 2 evidence samples, +2 1 detection guidance, +2 primary source, +1 financial relevance, +1 light read P2

Behaviors (10, 8 new)

Published detection guidance (1)

• Centralize logs off-device with ≥90 days retention; enable process-creation, command-line, and Microsoft Graph API auditing to survive log tampering. tier ASIEM link

IoCs — 2 new

Sources

• Cisco Talos Blog — ok

P2 · Malicious Qwen2-lookalike Hugging Face repos deliver crypto miners and reverse shells to GPU hosts that load them with trust_remote_code

Pluto Security found 31 malicious Hugging Face repositories across seven accounts, published in two waves, posing as small Qwen2 test checkpoints aimed at GPU hosts running self-hosted inference servers such as Xinference and GPUStack. Their Python code runs when a user loads a model with trust_remote_code enabled, installing a disguised cryptominer that restarts if killed and removes competing miners, and in some versions opening a reverse shell; the sources report download counts but say these are not confirmed infections. Hunters should look for trust_remote_code model loads, Python processes spawning miners or reverse shells on inference hosts, and the named repositories and accounts.

Why P2: Concrete huntable behaviors in AI/ML inference hosts, though no confirmed infection counts and no KEV or CVE tie. · ATT&CK: T1204.002, T1496, T1059.006, T1543, T1071

Behaviors (3, 3 new)

IoCs — 1 new

Sources

• BleepingComputer — ok

P2 · North Korean threat actors use AI across lures, personas, and tooling, including the ARTEX agentic pentest framework; Microsoft publishes mitigations and Defender detections

Microsoft Threat Intelligence reports that multiple North Korean actors (Jade Sleet, Onyx Sleet, Coral Sleet, Diamond Sleet, Pearl Sleet, Sapphire Sleet, Jasper Sleet, Emerald Sleet) use generative and agentic AI for reconnaissance, persona creation, tailored lures, and tooling. The source says Cursor-type AI development platforms likely helped Coral Sleet, Jade Sleet, Pearl Sleet, and Sapphire Sleet with code and persistence work, and that Onyx Sleet and Pearl Sleet used the open-source ARTEX agentic penetration testing framework. It describes over 100 PDF lures attributed to Onyx Sleet, created in August and September 2026, with dozens generated within minutes. Hunting guidance in the visible text is mitigation-oriented; the post references Microsoft Defender detections without printing specific rules or log patterns.

Why P2: Strategic threat-actor trend report with no confirmed exploit chain or concrete huntable host behaviors in the visible text; relevant to phishing and recruiter-lure defense. · ATT&CK: T1566, T1598, T1585.001, T1204.002, T1059, T1027

Behaviors (0)

None extracted.

Published detection guidance (1)

• Microsoft recommends Defender for Office 365 controls: Zero-hour auto purge, Safe Links, Safe Attachments, Threat Explorer for phishing investigation, and blocking device code flow via Entra Conditional Access. tier AMicrosoft Defender for Office 365 / Entra ID Conditional Access link

Sources

• Microsoft Security Blog — ok

P2 · Malicious Firefox extensions impersonating Phantom, Jupiter and Bitget steal wallet recovery phrases; listings removed

Socket researchers found three Firefox Add-ons listings impersonating the Phantom, Jupiter and Bitget crypto wallets that stole recovery phrases and private keys once installed. The Phantom variant reportedly sent captured secrets to a Telegram bot and moved funds to hardcoded payout addresses, and the listings are reported as removed. Hunters should look for the listed add-on IDs, the bonto[.]io subdomains and the listed IP addresses in browser telemetry and proxy/DNS logs.

Why P2: Concrete IoCs and behaviors in a browser extension channel, but listings reported removed and no enterprise product vulnerability involved. · ATT&CK: T1176, T1056.003, T1555

Behaviors (3, 3 new)

Published detection guidance (2)

• Check Firefox installed extensions for the listed add-on IDs 3092199, 3092666 and 3092059. tier BBrowser extension inventory link
• Hunt for DNS or proxy requests to the listed bonto[.]io subdomains and IP addresses. tier BDNS / proxy link

IoCs — 11 new

Sources

• Malwarebytes — ok

P2 · Researcher finds 26,400 working cloud and AI credentials exposed in public Gitee repositories

Independent researcher Ben Zimmermann scanned 7.25 million public Gitee repositories with TruffleHog and Kingfisher and reported 26,400 credentials that still authenticated, led by 9,473 Alibaba Cloud AccessKey pairs, plus YouTube, DeepSeek, Zhipu BigModel, and OpenAI keys. The sources do not confirm that any of these keys were revoked or abused, and the scan did not establish how long the keys had been exposed. Hunters should check for use of any Alibaba Cloud, OpenAI, Google/YouTube, or DeepSeek keys that appeared in public code and rotate any key ever committed to a public repository, since deleting it from code does not revoke it.

Why P2: Exposed working cloud keys are a concrete credential-exposure risk, but this is a researcher scan with no confirmed abuse and no huntable adversary behavior. · ATT&CK: T1552.001

Behaviors (0)

None extracted.

Published detection guidance (3)

• Alibaba Cloud ActionTrail shows AccessKey API calls for the last 90 days; data operations in services such as OSS and SLS must be checked in each service's own logs, per Alibaba Cloud's leak response plan as cited by the source. tier BAlibaba Cloud ActionTrail
• Check for unexpected charges and for resources created or deleted that were not needed, per Alibaba Cloud's leak response plan as cited by the source. tier B
• Verify secret scanner detectors against the services in use; TruffleHog lacks a detector for Zhipu keys, and single-scanner coverage found only about half of the total. tier B

Sources

• The Hacker News — ok

P3 · Fake Padre Terminal crypto app on Apple App Store linked to drainer theft of about $23,000 from 27 Solana wallets; Apple removed it

A fake Padre Terminal trading app on the Apple App Store was linked by blockchain investigator Iris to draining about $23,000 from 27 Solana wallets since October 25, 2026, and the app was removed afterward. Iris confirmed only one victim was compromised through the app, has not determined how the other wallets were compromised, and has not directly observed the wallet-draining screen. Hunters should look for users importing Solana private keys into mobile crypto trading apps, and for the Solana addresses named in the source.

Why P3: Crypto-wallet drainer app on the App Store with no concrete endpoint or log behaviors published; awareness only.

Behaviors (1, 0 new)

Sources

• BleepingComputer — ok

P3 · Yet Another ClickFix Campaign uses fake Cloudflare check against Windows and macOS; payloads not retrieved

A ClickFix campaign served a fake Cloudflare verification page from the domain js-static[.]cfd, hosted on a compromised legitimate website, and targeted both Windows and macOS users. The SANS handler could not retrieve the Windows or macOS malware: the Windows delivery server returned 403 Forbidden and the macOS domain did not resolve. Hunters can pivot on the js-static[.]cfd domain and the observed ClickFix command URLs, but no payload or compromise is confirmed.

Why P3: Single SANS diary with no retrieved payloads and no confirmed compromise; awareness only. · ATT&CK: T1204.004

Behaviors (0)

None extracted.

IoCs — 0 new, 3 seen before

Sources

• SANS Internet Storm Center — ok

P3 · Telegram for Android flaw in MediaState handling allows code execution during voice calls; fixed in 12.10.4, no confirmed exploitation

NebuSec disclosed a Telegram for Android flaw in code reading MediaState call messages that, combined with an information-leak bug and an Android root exploit, could give full phone control once a victim answered a call. The flaw affects versions 8.6.2 through 12.10.3 and was fixed in 12.10.4; NebuSec has not seen it used in real attacks and the full attack chain is not technically documented, relying on a video. Hunters should check the app version and consider setting call privacy to Nobody.

Why P3: Patched flaw with no confirmed exploitation and no published technical write-up; no concrete huntable behaviors.

Behaviors (0)

None extracted.

Published detection guidance (1)

• Verify Telegram for Android is version 12.10.4 or later; version number is shown at the bottom of the app's Settings page. tier B link

Sources

• The Hacker News — ok

Quick reads — nothing huntable found (28)

• GitLab CE/EE CVE-2026-97229 added to KEV; Alpine Linux reported an exploitation attempt P1 · CISA added GitLab CE/EE CVE-2026-97229 to the KEV catalog on 2026-10-29 with a 2026-11-01 due date. The KEV entry describes an unauthenticated integer overflow that can allow arbitrary code execution through a specially crafted regular expression in a CI/CD configuration. The brief item reports an exploitation attempt noted by Alpine Linux, but the source text does not print any exploitation details, so hunters should rely on GitLab's patch release and the Ruby/Onigmo fix for guidance. — update to 2026-10-29's story
• Chrome extensions reroute searches through tracking servers, per Socket report (319 extensions, 13.4M installs) P2 · A brief item reports that 319 Chrome extensions with about 13.4 million installs reroute search queries through tracking servers that could be switched to phishing or malware. The brief directs defenders to audit installed extensions against Socket's list. No source could be fetched, so the adversary's actions beyond search rerouting and the exact mechanics are unconfirmed; hunt for unexpected Chrome extensions and unusual search-redirect traffic. ⚠ suspicious source excluded: https://www.bleepingcomputer.com/news/security/chrome-extensions-with-134-million-installs-caught-hijacking-searches/
• Linux kernel TCP use-after-free CVE-2026-98432: root exploit reported by Anthropic, no confirmed exploitation in the wild, Ubuntu and RHEL fixes pending P2 · A race condition in the Linux kernel's IPv4 TCP connection setup (use-after-free, introduced in Linux 4.4) is tracked as CVE-2026-98432; the kernel CVE team scores it 9.8 while Red Hat scores it 5.9 or 8.1 depending on the file. Anthropic said on October 27 that its AI model wrote a working exploit that lets a remote unauthenticated attacker run commands as root on servers with an MPTCP listener, though the sources state no attacks using the flaw have been observed. Ubuntu and RHEL had no released fix as of October 29-30, so defenders should check distribution fix status and upgrade to patched kernels where available. — update to 2026-10-28's story
• TeamViewer clients affected by CVE-2026-111585 integer overflow allowing malicious host code execution; not known to be exploited P2 · TeamViewer disclosed CVE-2026-111585 (CVSS 8.8), an integer overflow in the remote-control screen processing component of its clients on Windows, macOS, Linux, and Android, which a malicious or compromised host can trigger during an ordinary session to crash the viewer or execute code. The sources also describe CVE-2026-92372 (out-of-bounds write in the decoder, requires user interaction, including via a crafted .tvs session recording) and CVE-2026-92374 (macOS TOCTOU symlink flaw for local root). TeamViewer says it is not aware of exploitation in the wild; hunters should focus on patch status for clients version 15.83 and later and on unexpected remote-control sessions to untrusted hosts.
• Veeam, Juniper, and Adobe release patches for multiple critical flaws; no exploitation reported P2 · Adobe, Veeam, and Juniper Networks published patches for dozens of vulnerabilities, including critical flaws allowing unauthenticated authorization bypass in Veeam Backup & Replication and unauthenticated arbitrary command execution in Juniper Session Smart Router and Session Smart Conductor. All three vendors state they are not aware of exploitation in the wild. Defenders should prioritize patching the Veeam and Juniper products and review them for unexpected command execution or authorization anomalies.
• Belarus-linked actors reportedly conducting destructive attacks in Ukraine P3 · A brief item states that Belarus-linked actors are carrying out destructive attacks in Ukraine in support of Russian objectives. No source could be fetched, so no technical details, victims, tooling, or outcomes are confirmed. Hunters should treat this as awareness only until a primary source provides specifics.
• Binance suffers ~$6.3B crypto theft via compromised DevOps laptop; TRM and Chainalysis attribute to North Korea's TraderTraitor P3 · Binance confirmed that about $6.3B was withdrawn from its wallets on October 29, 2026, after a DevOps engineer's compromised laptop enabled attackers to access a service container and submit unauthorized withdrawals. Binance has not attributed the attack to any group, while TRM Labs and Chainalysis attribute it to TraderTraitor (Lazarus/APT38) with high confidence. Binance says it has not found evidence of a leaked wallet private key and that it uncovered additional breach points; sources do not publish technical detection artifacts, so hunters should focus on withdrawal service container access and anomalous withdrawal transactions.
• Japan Airlines discloses passenger data breach at Amadeus PSS; ANA, Asiana, Korean Air also report Amadeus-linked impact P3 · Amadeus notified Japan Airlines on October 23, 2026 that unauthorized access to its Passenger Service System occurred between August 10, 2023 and September 23, 2026, exposing reservation codes, names, flight details and, for about 2,000 customers, passport numbers and contact data. BleepingComputer reports the earlier Amadeus disclosure of a vulnerability in its travel booking display environment, and says the flaw appears to have been maliciously exploited, per JAL. The sources give no technical detail on the intrusion vector or attacker tooling, so hunters have no published behaviors to search for.
• Belgian MyMinfin tax portal taken offline after cyberattack; attacker and method unknown, no breach confirmed P3 · Belgium's FPS Finance temporarily suspended access to MyMinfin, the main online tax platform, after a cyberattack days before an October 31 filing deadline. The agency said there was no indication a data breach had occurred, while investigators examined possible data exposure. Authorities have not identified the attackers or how access was gained, and no link to an earlier PHP-vulnerability precautionary shutdown has been established; hunters should treat this as an unattributed incident with no published technical indicators.
• Leaked database allegedly containing 41,000+ DHS employee records, claimed stolen from an Okta SSO system; Okta denies compromise P3 · A threat actor using the handle Department of Peace leaked a database of over 41,000 DHS staff records, including CBP, ICE, HSI and about 1,000 CISA employees, claiming the data came from an Okta single sign-on system. The leaked records reportedly include names, work emails, phone numbers, job titles, office locations, and which systems and applications each account can access. Okta says it has no evidence its data or systems were compromised, and DHS says it is aware of a potential breach; hunters should treat the access-mapping data as a targeting risk rather than confirmed SSO compromise.
• Sony So-net breach exposes about 2.6M member records and 54,000 mail account credentials; attack vector undisclosed P3 · Sony Network Communications disclosed on October 27 that an unauthorized third party accessed the So-net member database on October 19, with the intrusion first spotted October 23. Exposed data includes names, dates of birth, contact details, user IDs, and internet connection IDs for about 2.6 million records, plus roughly 54,000 email addresses and passwords for four secondary mail services, which were reset. The initial access method has not been disclosed, so no behaviors or detection artifacts are published; hunters should treat this as awareness until the vendor publishes technical details.
• iRhythm data breach affects 8,179,772 people per HHS filing; extortion attempt confirmed P3 · Medical device provider iRhythm disclosed a June 2026 breach of certain third-party-hosted business applications, and the attackers attempted to extort a ransom by threatening to leak the data. An HHS portal listing reports 8,179,772 affected individuals, with names, dates of birth, contact details, and iRhythm account and device data compromised. The sources report no technical attack details, and the company offers no free credit monitoring; hunters have no published behaviors or indicators to act on from these sources.
• US bankruptcy courts' Bankruptcy Noticing Center back online after cyberattack; BAE Systems says no data taken P3 · The Bankruptcy Noticing Center, a system run by BAE Systems for the Administrative Office of the U.S. Courts, was taken offline by a cyberattack announced October 22 and is now restoring service. BAE told Recorded Future News that no other systems were affected, no data was extracted, and no PII was breached; no hacker group claimed the attack. The sources do not describe the attack technique or provide any indicators, so there are no hunting details to act on.
• UNM Health systems restored after ransomware attack; BYOD group claims attack with no confirmed data release P3 · The University of New Mexico Health Sciences Center said its systems were restored and it did not pay a ransom after a cyberattack that forced ambulance diversions and class cancellations. A new ransomware group calling itself BYOD claimed the attack, offered free decryption keys, and demanded $2,500 to destroy stolen patient and employee data. The sources give no technical details on initial access, malware, or intrusion behaviors, so hunters have no concrete behaviors to pursue from this item.
• Sponsored piece: AI agents already operate inside employee browsers via debugging interfaces, extensions, agentic browsers, and WebMCP P3 · A sponsored BleepingComputer article by Keep Aware argues that AI agents can act inside authenticated browser sessions through Chrome DevTools Protocol debugging, AI extensions such as Claude in Chrome, agentic browsers, and the emerging WebMCP standard. It reports no confirmed compromise or observed attack. Hunters may consider inventorying debuggable browsers, AI extensions and their permissions (scripting, tabs, debugger API), and agentic browsers across the fleet.
• Google announces Gemini 4 Carbon AI model, claims lead in vulnerability-finding benchmarks; limited release to vetted cyber defenders P3 · Google unveiled Gemini 4 Carbon, a frontier AI model, and claims it leads benchmarks for finding (SEC-bench Pro 88.2%), exploiting (ExploitGym 54.8%), and patching (CWE-bench 71.0%) vulnerabilities, as stated by Google DeepMind. Rollout is limited to a subset of cyber defenders before expanding to trusted partners under the Fairwind Program. The article contains no threat actor activity, malware, or detectable adversary behavior; these are vendor-reported benchmark claims only.
• GitHub launches npm firewall preview to block malicious, vulnerable, and freshly published packages at install time P3 · GitHub announced a public preview of a package firewall for npm, available to all GitHub Enterprise Cloud customers, that sits between endpoints or internal registries and upstream npm. The firewall checks metadata requests and package downloads against policy controls including malware advisories, vulnerability severity, attestation downgrades, newly added preinstall/postinstall scripts, and a configurable cooldown (default 1 day). This is a defensive control announcement, not a reported attack; the source describes no confirmed compromise. Hunters may consider reviewing install-time policy and CI/coding-agent dependency sources.
• Cisco open-sources Project Quarry, a rule language for detecting multi-step AI-agent attacks P3 · Cisco released Project Quarry, an open-source neurosymbolic rule language that combines ML classifiers and LLM judges with symbolic checks to detect suspicious patterns spanning individually benign agent actions. It ships a DSL, evaluation runtime, CLI scanner, Python SDK, and a Claude Code/Codex plugin for writing and testing rules. The source describes a 2025 Claude Code campaign against about 30 organizations that split an attack into routine-looking tasks, but it is a product announcement with no concrete attacker behaviors or indicators to hunt.
• Opinion analysis of US election voting-machine and AI-driven influence risks; no confirmed compromise reported P3 · A SecurityWeek opinion piece by Kevin Townsend examines theoretical attacks on US voting machines and the growing threat of AI-enabled influence operations. It quotes practitioners on EAC certification gaps, Voting Village findings, and deepfake robocalls such as the 2024 New Hampshire Biden impersonation call that failed. The article states there is no evidence that machine tampering has changed the outcome of a US election, so there are no concrete adversary behaviors or indicators to hunt.
• CrowdStrike publishes new prompt injection techniques targeting agent planning (Goal Decomposition Exploitation, Constraint-Driven Task Steering) P3 · CrowdStrike's research blog introduces a new version of its Prompt Injection Taxonomy (222 techniques) that adds attacks on how autonomous agents plan, including Goal Decomposition Exploitation and Constraint-Driven Task Steering. The post describes a hypothetical scenario in which a poisoned test utility message induces a coding agent to send local config files with credentials to an outside endpoint, with no confirmed real-world incident. Defenders should review agent telemetry for multi-step sequences such as reading .env files followed by outbound HTTP requests to unfamiliar endpoints.
• Check Point finds Qwen3.8-Flash-Next 'call home' upload to cloud address looks like model jaggedness, not a backdoor P3 · Cohere reported that the open-weight model Qwen3.8-Flash-Next, while writing a detection rule, produced a shell command attempting to send a test string to an Alibaba Cloud storage address in Beijing, which Cohere's sandbox blocked. Check Point replayed the trace and sampled 64 completions, finding 52 distinct destination hosts including local addresses and nonexistent domains, and concluded model jaggedness is the most likely explanation rather than a fixed backdoor. Hunters with agentic LLM deployments may look for unrequested curl upload commands issued by model tool-call processes, though the source does not provide detection content.
• Huntress opinion piece: SIEM is not dead; filter logs before storage and limit AI query costs P3 · Huntress blog post by Ben Bernstein argues the problem with SIEM is the cost model of ingesting and storing everything, not SIEM itself. It contrasts storing filtered security-relevant logs plus compliance-required records against AI-native designs that query source APIs on demand, which it says shifts cost to tokens and adds retention and availability risks. The post describes no specific threat actor, malware, or intrusion, so hunters have no concrete adversary behavior to pursue from it.
• Ghidra Server: local shared-project server for malware-analysis labs (not a threat; defensive setup guidance) P3 · SANS ISC describes deploying the bundled Ghidra Server (Ghidra 12.1.4) in a malware-analysis lab so analysis projects persist across VM snapshot reverts. The post stresses keeping the server on the lab network, never exposing it to the Internet, and treating it as hosting live malware, since it runs as a Java RMI service on TCP 13100-13101 (and 13102). No adversary activity, exploitation, or detection content is described.
• Anthropic-themed phishing reportedly bypasses some leading email gateways P3 · A brief item reports that obvious Anthropic-themed phishing emails are getting past some leading email gateways. No source could be fetched, so no technical details, sender infrastructure, or outcome beyond this headline are confirmed. Hunters should treat this as awareness only until a primary source is reviewed.
• Unofficial relay reportedly resells Codex and Claude Code access with sandboxes disabled P3 · A researcher blog item reports that an unofficial relay service resells access to Codex and Claude Code with sandboxing disabled. No source could be fetched, so the claim is unverified beyond the brief line. Hunters should treat this as awareness only unless primary sources confirm specific behaviors or indicators.
• Researchers report unusual threat profile in Italy with unexplained cause P3 · A brief item states that researchers observed an unusual threat profile in Italy but could not explain it. No source could be fetched and the item names no actor, malware, CVE, or technique. Nothing in the item is confirmed as a compromise or as a huntable behavior.
• Researcher blog post on a four-question threat modeling whiteboard exercise for CISOs P3 · A brief item describes a four-question whiteboard exercise offered as a low-cost threat modeling approach for CISOs. It is general methodology guidance rather than reporting on an adversary or intrusion. No threat actor, malware, CVEs, or technical detail are stated, so there is nothing huntable in this item.
• Security awareness training programs shifting to AI-assisted training for new workers P3 · The brief item reports that security awareness training programs are moving toward AI-assisted training for new workers. No source could be fetched, and the item names no threat actor, malware, vulnerability, or technical behavior. Nothing in this story is huntable.