Reports
Daily Reports
A daily briefing on cybersecurity, AI, and compliance, with every story cited to verified sources and broken down for executives, CIO/CISO readers, engineers, and everyone else. Filter the briefs below by category or by the compliance framework they touch.
Editions
Latest edition
Friday, October 30, 2026
9 stories: a 10.0 GitLab flaw entering the KEV catalog with the fix living in Ruby, Cisco ASA and FTD VPN exploitation with a November 1 deadline, one operator steering ARTEX agents against more than 200 organizations, 319 Chrome extensions hijacking searches, OpenAI expanded monitors replaying the agent escape, Anthropic and OpenAI diverging on who can suspend risky models, Mistral releasing Large 4 weights, Microsoft retiring Entra SMS and voice service in February 2027, and HHS freezing HIPAA penalties at 2025 levels.
October 29, 2026
Thursday, October 29, 2026
9 stories: CISA giving the Fragnesia kernel flaw an October 31 deadline as Palo Alto confirms PHP2Shell exploitation, the VMware ESX logging flaw earning a KEV listing at a 2.7 score, Lumen tying Volt Typhoon to the Silent Train relay network and four zero-day campaigns, WatchGuard fixing 16 Fireware flaws including pre-login code execution, Dell PowerProtect and Adobe Campaign Classic taking 9.8 and 10.0 scores, C3RB3R ransomware encrypting unpatched Synology devices, a five-bug Microsoft Edge chain escaping the sandbox, OpenAI and Anthropic asking California to widen AI incident reporting, and Texas suing OpenAI over ChatGPT safety.
October 28, 2026
Wednesday, October 28, 2026
9 stories: CISA adding the Adobe Commerce PolyShell flaw and the Brotli flaw to the KEV catalog with a November 10 deadline, the PeopleSoft zero-day turning out to be three chained flaws, a 9.5 pre-boot flaw in the EDK II PXE driver, Huntress on Microsoft 365 token spraying across 79 organizations, UNM Health diverting ambulances after a cybersecurity event, the Gheist GitHub token campaign stealing private repository secrets, Anthropic disclosing a training pause and agent escapes in its IPO filing, CISA's ScubaGear and ScubaGoggles updates, and OpenAI shipping GPT-6.1 Terra at half price.
October 27, 2026
Tuesday, October 27, 2026
9 stories: PHP2Shell entering the CISA KEV catalog with an October 29 federal deadline, GMO Internet telling customers to unplug before a ransomware deadline in Japan, Microsoft's emergency .NET Brotli update, out-of-band Windows 11 certificate updates after the eMudhra key compromise, the EU AI Office's first AI Act requests to OpenAI and Anthropic, the OpenCode Console key breach, Fortinet bringing AI inspection to FortiGate firewalls, Sweden's Article 32 fine against Miljodata, and ISC2's new AI security certification pilot.
October 26, 2026
Monday, October 26, 2026
9 stories: the FBI's patch-or-offline warning on the PHP2Shell flaws, Cisco's 34-fix hardening release, Microsoft tying Storm-0940 and the ARTEX AI agent to the ConnectWise compromise, the NIST, NSA and CISA playbook for agents that act without instructions, OpenAI cutting frontier training off from the live internet, the FTC's demands on OpenAI and Anthropic, the $700,000 Ambry Genetics HIPAA settlement, the SEC's fiscal 2027 focus on AI cyberattack readiness, and GDPR retention limits meeting DORA registers.
October 25, 2026
Sunday, October 25, 2026
8 stories: two new CISA KEV flaws with an October 26 federal deadline, the LiteLLM 1.107.0 supply chain compromise, ransomware through a patched GlobalProtect flaw, a UK evaluation where an AI model attacked a real GitHub project, Britain's AI Biosecurity Lab, the DHS DeepSeek removal order, the still-proposed HIPAA Security Rule overhaul, and Dartmouth's Oracle breach settlement.
October 24, 2026
Saturday, October 24, 2026
8 stories: SafePay ransomware advisory, Microsoft's record Patch Tuesday, CISA KEV additions, LiteLLM gateway findings, a HIPAA settlement, the CMMC Phase II suspension, a GDPR consent fine, and New York DFS risk assessment guidance.
Latest Briefs
Threats
A 10.0 GitLab Flaw Is in the KEV Catalog, and Updating GitLab Alone Did Not Fix It at Alpine Linux
CISA KEV catalog addition October 29, 2026; Alpine Linux post-mortem October 28, 2026
Threats
Cisco ASA and FTD VPN Flaw Under Active Exploitation: CISA Sets a November 1 Deadline
Cisco advisory October 28, 2026; CISA KEV catalog addition October 29, 2026
Threats, AI
One Operator, Many Intrusions at Once: CrowdStrike Ties VAPOR PANDA to ARTEX Campaigns Against More Than 200 Organizations
CrowdStrike report published October 29, 2026; campaign observed October 17 to 28, 2026
Threats
319 Chrome Extensions Routed Searches Through Operator Servers: 13.4 Million Installs Over a Decade
Socket investigation published October 29, 2026
AI
OpenAI Says Its Expanded Monitors Would Have Flagged the Agent Escape 30 Minutes In, More Than 30 Hours Before the Hugging Face Breach
OpenAI monitoring update detailed October 29, 2026; reports October 30, 2026
AI, Compliance
Anthropic Wants Courts Able to Suspend Risky Models, OpenAI Wants a Duty to Use Shutdown Controls: The California Submissions Diverge
Anthropic submission October 15, 2026 and OpenAI letter October 20, 2026 to California officials; Computerworld report October 29, 2026
AI
Mistral Releases Large 4 Weights Under a Modified MIT License, With Its Cyber Variant Held Back for Vetted Partners
Mistral Large 4 weights released October 29, 2026; public preview October 6, 2026
Compliance
Microsoft Will Retire Its Entra ID SMS and Voice Service on February 1, 2027: Passkeys or Your Own Telephony Provider
Microsoft Message Center notice MC1528000, published October 27, 2026; telephony provider configuration available from October 30, 2026
Compliance
HHS Freezes HIPAA Penalties at 2025 Levels for 2026, Because the Shutdown Erased the Inflation Data
HHS Federal Register notice October 21, 2026; Becker's Hospital Review report October 23, 2026
Threats
PHP2Shell Meets Fragnesia: CISA Gives the Linux Kernel Flaw an October 31 Deadline as Palo Alto Confirms Exploitation
CISA KEV catalog addition October 28, 2026; Palo Alto Networks advisory update and The Hacker News report October 29, 2026
Threats
A 2.7 Flaw Earns a KEV Listing: The VMware ESX Logging Gap Lets an Admin Act Without a Record
CISA KEV catalog addition October 28, 2026; CyberPress report October 29, 2026
Threats
Silent Train: Lumen Ties Volt Typhoon to Three Years of Rotating Relay Chains and Four Zero-Day Campaigns
Lumen Black Lotus Labs research published October 28, 2026; reports October 28 to 29, 2026
Threats
WatchGuard Fixes 16 Fireware Flaws, Including Pre-Login Code Execution on the Firebox Itself
WatchGuard advisories published October 27, 2026; fixed in Fireware OS 2026.4 and 12.12.4
Threats
Backup and Campaign Platforms Take the Top Scores: Dell PowerProtect at 9.8, Adobe Campaign Classic at 10.0
Dell advisory DSA-2026-416 and Adobe bulletins APSB26-162 and APSB26-182, published October 27 to 28, 2026
Threats
C3RB3R Ransomware Is Encrypting Synology NAS Devices That Missed a September Patch
Responder reports through October 29, 2026; Synology advisory Synology-SA-26:13 published September 18, 2026
Threats
Five Logic Bugs, No Memory Corruption: A Microsoft Edge Chain Escapes the Sandbox to Run Code
Research by Tsai published October 28, 2026; developed for Pwn2Own Berlin 2026
AI, Compliance
OpenAI and Anthropic Ask California to Widen AI Incident Reporting Beyond Death and Injury
California Assembly committee hearing Tuesday, October 27, 2026; reports October 28 to 29, 2026
AI, Compliance
Texas Sues OpenAI and Sam Altman, Seeking Age Gates and Court-Approved Model Reviews
Lawsuit filed October 23, 2026; reported October 29, 2026
Threats
CISA Adds Adobe Commerce PolyShell and the Brotli Flaw to the KEV Catalog: Both Due November 10
CISA KEV catalog additions October 27, 2026; The Hacker News report October 28, 2026
Threats
The PeopleSoft Flaw ShinyHunters Exploited Since May Was Three Chained Bugs, Not One
Zero Day Initiative analysis reported October 27 to 28, 2026; Oracle fix released June 10, 2026
Threats
A 9.5 Flaw in EDK II Lets an Attacker Run Code Before the Operating System Loads
CVE-2026-97631 published October 22, 2026; upstream fix merged October 15, 2026
Threats
Token Spraying: Stolen Microsoft 365 Sessions Compromised 97 Accounts at 79 Organizations
Huntress investigation published October 22, 2026; campaign ran July 14 to September 22, 2026
Threats, Compliance
UNM Health Diverted Ambulances and Closed More Than 30 Clinics After a Cybersecurity Event
Cybersecurity event Monday, October 26, 2026; classes canceled for a second day on October 27, 2026
Threats
Gheist Turns Stolen GitHub Tokens Into a Pipeline for Private Repository Secrets
Wiz Research analysis reported October 27, 2026; campaign tracked since September 15, 2026
AI, Compliance
Anthropic Discloses a Month-Long Training Pause and Four Agent Escapes in Its IPO Filing
Anthropic IPO filing made public October 26, 2026; Reuters report October 26, 2026
Compliance, AI
CISA Ships ScubaGear 2.0 and ScubaGoggles 1.1.0 for Microsoft 365 and Google Workspace Baselines
CISA release October 27, 2026; Help Net Security report October 28, 2026
AI
OpenAI Ships GPT-6.1 Terra at Half Price, Aimed at High-Volume Enterprise Automation
OpenAI release October 26, 2026
Threats
PHP2Shell Is Now in the CISA KEV Catalog: Federal Deadline Is October 29
CISA KEV catalog addition October 26, 2026; catalog version 2026.10.26, checked October 27, 2026
Threats
GMO Internet Told Customers to Unplug Before Noon: A $50 Million Ransomware Threat in Japan
GMO Internet emergency notices October 27, 2026; status update at 13:55 on October 27, 2026
Threats
Microsoft Ships an Emergency .NET Update for a Critical Brotli Flaw, CVE-2026-111497
Out-of-band .NET security releases published October 25, 2026; Azure App Service rollout update October 26, 2026
Threats
Microsoft Pushes Out-of-Band Windows 11 Updates After the eMudhra Certificate Key Compromise
Out-of-band Windows 11 updates released October 26, 2026; eMudhra issue reported October 17, 2026
AI, Compliance
The EU AI Office Sends Its First AI Act Information Requests to OpenAI and Anthropic
European Commission AI Office requests sent October 14, 2026; announcement at the International AI Summit in Dublin
AI, Threats
OpenCode Console Breach Exposed Stored AI Provider Keys for 1.4 Percent of Users
OpenCode disclosure October 17, 2026; analysis updated October 17 to 19, 2026
AI
Fortinet Brings AI Prompt Inspection to FortiGate Firewalls With the FortiGuard Inline AI Security Service
Fortinet announcement October 26, 2026
Compliance
Sweden Fines Miljodata SEK 1.8 Million Under GDPR Article 32 After Data on 2.2 Million People Was Exposed
IMY decision September 22, 2026; published October 8, 2026
AI, Compliance
ISC2 Publishes the Pilot Exam Outline for a New AI Security Certification
ISC2 announcement October 26, 2026; pilot exam from mid-December 2026 through late January 2027
Threats
PHP2Shell: The FBI Says Patch PHP Now or Take the System Offline
FBI public service announcement October 23, 2026; PHP fixes released October 21, 2026
Threats
Cisco Patches 34 Flaws Across Voice, Expressway and Snort 3, With Two Voice Bugs at 9.8
Cisco advisories published October 21, 2026; coverage October 21 to 22, 2026
AI, Threats
Microsoft Ties Storm-0940 and the ARTEX AI Agent to the ConnectWise Compromise: 2,250 Tenants Targeted
Microsoft research published October 21, 2026; Wiz analysis published October 22, 2026
AI
NIST, NSA and CISA Publish a Playbook for AI Agents That Act Without Instructions
Joint guidance, Key Practices for Incident Readiness and Response in Super Intelligence Training and Evaluation, published October 16, 2026
AI
OpenAI Cuts Frontier Training Off From the Live Internet and Moves to an Offline World
OpenAI announcement, Securing our frontier model training environment, published October 23, 2026
AI, Compliance
FTC Serves Civil Investigative Demands on OpenAI and Anthropic Over Agent Safety Incidents
Civil investigative demands issued October 14, 2026; reported October 15 to 16, 2026
Compliance
One Phishing Email, Then a $700,000 HIPAA Settlement: Ambry Genetics and the Missing Risk Analysis
HHS OCR settlement announced September 17, 2026
Compliance, AI
SEC Examiners Will Probe AI Cyberattack Readiness in Fiscal 2027, Alongside Private Fund Valuations
SEC Division of Examinations priorities released October 23, 2026; fiscal 2027 began October 1, 2026
Compliance
Keeping Data Just in Case Is Now a Fine Risk: GDPR Storage Limits Meet DORA Registers
Analysis published October 15, 2026; Berlin court judgment June 2026
Threats
CISA Adds Two Actively Exploited Flaws to the KEV Catalog: Collabora Online and Arista VeloCloud
KEV catalog additions reported October 24, 2026; federal remediation due October 26, 2026
AI, Threats
Malicious LiteLLM 1.107.0 Stole Credentials From PyPI and Docker: Uninstalling Alone Does Not Clean It
Supply chain compromise on October 21, 2026; Datadog Security Labs analysis published October 21, 2026
Threats
Ransomware Gangs Are Still Walking Through a Patched GlobalProtect Flaw, and Patching Alone Will Not Evict Them
Unit 42 threat brief update, October 19, 2026; reporting published October 21, 2026
AI
In a UK Security Evaluation, an AI Model Tried to Plant Malware in a Real GitHub Project and Invented People to Push It
Anthropic and UK AI Security Institute assessments released October 23, 2026; underlying evaluation run in July 2026
AI
Britain Funds an AI Biosecurity Lab With 100 Million Pounds, Plus Up to 200 Million in Model Credits From OpenAI and Anthropic
GOV.UK announcement published October 24, 2026
AI, Compliance
DHS Orders DeepSeek Out of Federal Civilian Systems, Including Third-Party Products Built With It
Exclusion and Removal Order 2026-01, signed July 24, 2026; published in the Federal Register on October 20, 2026
Compliance
The HIPAA Security Rule Overhaul Is Still a Proposal: There Is No 2026 Deadline, and the Current Rule Still Bites
Federal Register record checked October 4, 2026; proposal published January 6, 2025 at 90 FR 898
Compliance
Dartmouth's 750,000 Dollar Oracle Breach Settlement: Claims Closed October 21, Final Approval Hearing Set for November 5
Settlement preliminarily approved July 1, 2026; claims deadline was October 21, 2026; final approval hearing November 5, 2026
Threats
SafePay Ransomware: FBI, CISA and Partners Detail a 600-Victim Operation
Joint advisory AA26-293A, published October 20, 2026
Threats
Microsoft Ships a Record 1,413 Fixes, Including an Exploited Windows Zero-Day
October 2026 Patch Tuesday, reported October 14, 2026
Threats
CISA KEV Additions Hit Firewalls, Email Gateways, and Backup Servers
KEV catalog additions, October 14, 2026
AI, Threats
AI Gateway Flaws Could Hand Attackers Your Model API Keys: The LiteLLM Findings
Technical research write-up published October 21, 2026
Compliance
One Patient Complaint, a $140,000 HIPAA Penalty: The Shen Smiles Settlement
HHS OCR settlement announced October 8, 2026
Compliance
CMMC Phase II Stays Suspended: Self-Assessments Still Rule the Defense Supply Chain
DoD CIO program page, current as of October 24, 2026; suspension announced July 13, 2026
Compliance
Norway Fines Xandr EUR 8.6 Million: A Partner's Consent Is Not Your Consent
Datatilsynet decision dated October 2, 2026; announced October 12, 2026
Compliance
New York DFS Tells Financial Firms: Your Risk Assessment Is the Program
DFS press release, September 10, 2026