About this episode
This week, trusted systems become attack paths from firmware and network controllers to cloud sessions, developer tools, browser components, and AI agents. Alex and Jordan connect the incidents, separate confirmed impact from broader claims, and identify the evidence defenders need before and after remediation.
This episode brings together the week’s most relevant cybersecurity stories and their operational context for defenders.
Play the episode, then review the stories and chapter list for the reporting and topics covered.
Stories covered this week
HPE patches eight critical RCE and auth bypass flaws in ArubaOS
Hewlett Packard Enterprise released updates fixing 72 vulnerabilities in ArubaOS, including eight max-severity issues involving remote code execution and authentication bypass. These flaws pose significant risks if exploited.
Source: BleepingComputer
Memory-Corruption Flaw in Brotli Decoder Impacts Node.js, Python, Bun
A memory-corruption vulnerability in Google's Brotli decoder affects multiple widely used software including Bun, Python Brotli packages, and Envoy proxies. Tracked as CVE-2026-111497, this flaw can corrupt memory by overwriting buffers with crafted compressed data.
Source: The Hacker News
Tailscale warns of SSH flaws enabling root privilege escalation
Tailscale is addressing nearly a dozen SSH-related vulnerabilities that allow attackers to steal credentials, cause server crashes, and escalate to root privileges. These flaws pose a significant risk to affected environments.
Source: BleepingComputer
Adobe Fixes 8 Critical Campaign Classic Flaws Allowing Code Execution
Adobe patches eight critical vulnerabilities in Campaign Classic, including code injection and privilege escalation flaws, that could allow attack execution and security bypass. These issues represent a high enterprise security risk.
Source: The Hacker News
Hackers Target Oracle E-Business Suite Critical RCE Flaw Post-Patch
Threat actors are actively probing a newly patched critical remote code execution vulnerability in Oracle E-Business Suite, tracked as CVE-2026-101767 with a CVSS score of 9.8. Oracle issued a patch last week addressing improper authentication in the Oracle Application Object Library.
Source: The Hacker News
Critical Linux Kernel TCP Flaw CVE-2026-98432 Hits Major Distros
A Linux kernel TCP vulnerability rated 9.8 CVSS impacts Ubuntu, Red Hat, and others. Anthropic demonstrated an AI-crafted remote exploit running root commands without credentials.
Source: The Hacker News
BlackX UEFI Bootkit Targets Central Asian Diplomats via Secure Boot Bypass
A new UEFI bootkit named BlackX is targeting diplomatic organizations in Tajikistan, Uzbekistan, and Turkmenistan by bypassing Secure Boot on patched Windows systems. The campaign is linked to the China-backed APT41 group, according to Kaspersky.
Source: The Hacker News
Gheist Campaign Steals GitHub Secrets via Stolen Tokens and Actions Logs
The Gheist group uses stolen GitHub tokens to deploy workflows that expose private repository secrets in GitHub Actions logs, then downloads and deletes the evidence. This attack affects private repositories and GitHub Enterprise environments, as analyzed by Wiz.
Source: The Hacker News
Lazarus Group Uses South Korean Security Software to Deploy Malware
The North Korea-linked Lazarus Group has launched Operation FlashHole, targeting South Korean firms across construction, software, and communication sectors using post-quantum encryption for malware deployment. The campaign has been active since July 2025, according to Kaspersky.
Source: The Hacker News
UAT-11473 APT Exploits Cisco SD-WAN to Deploy KeyDrift Malware
Talos uncovered UAT-11473, an advanced persistent threat group exploiting CVE-2026-20127, an authentication bypass in Cisco SD-WAN Catalyst Controllers, to deploy the KeyDrift malware. This unauthorized access highlights a critical risk for enterprise SD-WAN environments.
Source: Talos Intelligence
Volt Typhoon uses 'Silent Train' to mask zero-day attacks
Chinese state-sponsored group Volt Typhoon employs a novel 'Silent Train' framework using rotating chains of compromised devices to conduct zero-day attacks on high-value targets. This stealth technique complicates detection and mitigation efforts.
Source: BleepingComputer
Examining ESC1 & ESC8: Help Desk Impersonation to AD CS Abuse
New intrusion paths ESC1 and ESC8 reveal attackers leveraging help desk impersonation for remote access, runtime code execution, and Certificate Services abuse via authentication relay and Kerberos. These tactics highlight advanced techniques to escalate privileges in enterprise environments.
Source: Microsoft
319 Chrome Extensions with 13.4M Installs Hijack Searches for Ad Revenue
A large-scale campaign involving 319 Chrome extensions with 13.4 million installs has been found redirecting users' searches through tracking servers linked to Bing and Yahoo. The hijacking generates advertising revenue and poses privacy and security risks.
Source: BleepingComputer
Fake ChatGPT and Claude Apps Deploy Crypto Miners via Signed Executables
Threat actors are distributing cryptocurrency miners and malicious loaders disguised as AI desktop apps mimicking ChatGPT and Claude through fake GitHub projects. This campaign, known as Yoba, leverages signed executables to evade detection and infect systems.
Source: The Hacker News
Malicious Claude Code Extension on Cursor Delivered SSH Backdoors
A malicious version of Anthropic's Claude Code VS Code extension was distributed via Cursor's marketplace for 11 hours, potentially exposing 5,000 developers to malware installing persistent SSH backdoors. The incident highlights supply chain risks in popular developer tool ecosystems.
Source: BleepingComputer
Microsoft 365 Token-Replay Attacks Hit 79 Organizations
Researchers have uncovered a token-replay campaign targeting Microsoft 365 accounts at 79 organizations, exploiting adversary-in-the-middle relays to hijack session tokens. Huntress detected nearly 500 successful sign-ins between July and September 2026 using this method.
Source: The Hacker News
Hackers exploit Convertr analytics script to steal payment card data
Attackers compromised a shared analytics script used by Convertr's e-commerce platform to skim credit card data during the checkout process. This form of supply chain attack targets multiple retailers relying on the same third-party script.
Source: BleepingComputer
Sony ISP Subsidiary Breach Exposes 2.5 Million Customer Records
Sony Network Communications confirmed a data breach compromising 2.5 million records including personal information of current and former customers. The incident raises concerns over data protection in ISP subsidiaries.
Source: BleepingComputer
Binance Security Breach Impacts $6.3B in Assets, Nearly $3B Frozen
Cryptocurrency exchange Binance reported a security breach affecting $6.3 billion in assets, with almost $3 billion frozen on-chain. Tether and Circle have frozen over $2.3 billion in USDT and USDC tokens linked to the incident.
Source: The Hacker News
Microsoft Teams to Get AI-Powered Phishing Detection
Microsoft plans to introduce AI-powered, context-aware phishing detection in Teams messages starting November 2026, enhancing protection against phishing attacks. This upgrade aims to improve security for enterprise communication by integrating advanced AI detection capabilities.
Source: BleepingComputer
AI Coding Agents Hijacked via Malicious AGENTS.md File
Researchers discovered a malicious AGENTS.md file placed in a Downloads folder tricking AI coding agents into installing rogue npm packages. This vulnerability demonstrates how AI-driven development tools can be manipulated for supply chain attacks.
Source: BleepingComputer
NIST, CISA, NSA Guide Treats Runaway AI Agents as Security Incidents
A new joint guide from NIST, CISA, and NSA frames runaway AI agents as security incidents requiring rehearsed response plans. The key challenge is establishing authority and identity records before incidents occur.
Source: BleepingComputer
AI-Generated Fake Login Pages Heighten Risk of Account Takeovers
Generative AI enables attackers to create more convincing fake login pages that can steal passwords, MFA codes, and hijack sessions. This advancement increases the sophistication and effectiveness of phishing attacks targeting organizations.
Source: The Hacker News
Chapters
- Opening
- BlackX UEFI Bootkit Targets Central Asian Diplomats via Secure Boot Bypass
- HPE patches eight critical RCE and auth bypass flaws in ArubaOS
- UAT-11473 APT Exploits Cisco SD-WAN to Deploy KeyDrift Malware
- Volt Typhoon uses 'Silent Train' to mask zero-day attacks
- Tailscale warns of SSH flaws enabling root privilege escalation
- Critical Linux Kernel TCP Flaw CVE-2026-98432 Hits Major Distros
- Hackers Target Oracle E-Business Suite Critical RCE Flaw Post-Patch
- Adobe Fixes 8 Critical Campaign Classic Flaws Allowing Code Execution
- Memory-Corruption Flaw in Brotli Decoder Impacts Node.js, Python, Bun
- Microsoft 365 Token-Replay Attacks Hit 79 Organizations
- AI-Generated Fake Login Pages Heighten Risk of Account Takeovers
- Examining ESC1 & ESC8: Help Desk Impersonation to AD CS Abuse
- Gheist Campaign Steals GitHub Secrets via Stolen Tokens and Actions Logs
- AI Coding Agents Hijacked via Malicious AGENTS.md File
- Malicious Claude Code Extension on Cursor Delivered SSH Backdoors
- Fake ChatGPT and Claude Apps Deploy Crypto Miners via Signed Executables
- NIST, CISA, NSA Guide Treats Runaway AI Agents as Security Incidents
- Hackers exploit Convertr analytics script to steal payment card data
- 319 Chrome Extensions with 13.4M Installs Hijack Searches for Ad Revenue
- Microsoft Teams to Get AI-Powered Phishing Detection
- Lazarus Group Uses South Korean Security Software to Deploy Malware
- Sony ISP Subsidiary Breach Exposes 2.5 Million Customer Records
- Binance Security Breach Impacts $6.3B in Assets, Nearly $3B Frozen
- Closing