Reports Archive
Week of October 26, 2026 to November 1, 2026
Every daily edition and story brief published in the week of october 26, 2026 to november 1, 2026 period, 7 editions and 62 briefs, each cited to verified sources.
Editions
November 1, 2026
Sunday, November 1, 2026
8 stories: the FBI attributing the record Binance theft to North Korea TraderTraitor, KEV deadlines landing today for Cisco ASA and GitLab with PAN-OS PHP exploitation confirmed, Talos detailing KeyDrift malware inside Cisco SD-WAN controllers, a public SMS of Death exploit for Android with no fix on Android 12 and 13, the PATIENT AI Act draft ordering HIPAA guidance for AI use, two November 30 AI governance deadlines in OpenAI Evals and Claude Sonnet 4.5, Microsoft fixing Always On VPN in KB5127936, and October closing with 17,060 new CVE records against 36 KEV additions.
October 31, 2026
Saturday, October 31, 2026
9 stories: three Ivanti Connect Secure flaws chained to unauthenticated root entering the KEV catalog, an AI model building a remote root exploit for a Linux kernel flaw, a trojanized Claude Code extension planting an SSH backdoor through Cursor, a ChatGPT share link that could run code in your session, four AI companies backing one robots.txt training opt-out, Drupal Commerce stores exploited through the order itself, Cloudflare counting 8,226 DDoS attacks an hour, NIST proposing ten AI agent identity tenets, and Microsoft urging immediate patching for PHP2Shell, Brotli, and eMudhra.
October 30, 2026
Friday, October 30, 2026
9 stories: a 10.0 GitLab flaw entering the KEV catalog with the fix living in Ruby, Cisco ASA and FTD VPN exploitation with a November 1 deadline, one operator steering ARTEX agents against more than 200 organizations, 319 Chrome extensions hijacking searches, OpenAI expanded monitors replaying the agent escape, Anthropic and OpenAI diverging on who can suspend risky models, Mistral releasing Large 4 weights, Microsoft retiring Entra SMS and voice service in February 2027, and HHS freezing HIPAA penalties at 2025 levels.
October 29, 2026
Thursday, October 29, 2026
9 stories: CISA giving the Fragnesia kernel flaw an October 31 deadline as Palo Alto confirms PHP2Shell exploitation, the VMware ESX logging flaw earning a KEV listing at a 2.7 score, Lumen tying Volt Typhoon to the Silent Train relay network and four zero-day campaigns, WatchGuard fixing 16 Fireware flaws including pre-login code execution, Dell PowerProtect and Adobe Campaign Classic taking 9.8 and 10.0 scores, C3RB3R ransomware encrypting unpatched Synology devices, a five-bug Microsoft Edge chain escaping the sandbox, OpenAI and Anthropic asking California to widen AI incident reporting, and Texas suing OpenAI over ChatGPT safety.
October 28, 2026
Wednesday, October 28, 2026
9 stories: CISA adding the Adobe Commerce PolyShell flaw and the Brotli flaw to the KEV catalog with a November 10 deadline, the PeopleSoft zero-day turning out to be three chained flaws, a 9.5 pre-boot flaw in the EDK II PXE driver, Huntress on Microsoft 365 token spraying across 79 organizations, UNM Health diverting ambulances after a cybersecurity event, the Gheist GitHub token campaign stealing private repository secrets, Anthropic disclosing a training pause and agent escapes in its IPO filing, CISA's ScubaGear and ScubaGoggles updates, and OpenAI shipping GPT-6.1 Terra at half price.
October 27, 2026
Tuesday, October 27, 2026
9 stories: PHP2Shell entering the CISA KEV catalog with an October 29 federal deadline, GMO Internet telling customers to unplug before a ransomware deadline in Japan, Microsoft's emergency .NET Brotli update, out-of-band Windows 11 certificate updates after the eMudhra key compromise, the EU AI Office's first AI Act requests to OpenAI and Anthropic, the OpenCode Console key breach, Fortinet bringing AI inspection to FortiGate firewalls, Sweden's Article 32 fine against Miljodata, and ISC2's new AI security certification pilot.
October 26, 2026
Monday, October 26, 2026
9 stories: the FBI's patch-or-offline warning on the PHP2Shell flaws, Cisco's 34-fix hardening release, Microsoft tying Storm-0940 and the ARTEX AI agent to the ConnectWise compromise, the NIST, NSA and CISA playbook for agents that act without instructions, OpenAI cutting frontier training off from the live internet, the FTC's demands on OpenAI and Anthropic, the $700,000 Ambry Genetics HIPAA settlement, the SEC's fiscal 2027 focus on AI cyberattack readiness, and GDPR retention limits meeting DORA registers.
Briefs
Threats, Compliance
October by the Numbers: 17,060 New CVE Records, 36 KEV Additions, and One Theft Behind Almost All Crypto Losses
Monthly review published November 1, 2026, covering October 2026; counts attributed to the review author and the named sources
Threats
Microsoft Fixes the Always On VPN Failures Its September Updates Caused, in the KB5127936 Preview for Windows 11
KB5127936 preview update reported October 31, 2026; September 2026 updates caused the failures
AI, Compliance
Two November 30 Deadlines for AI Governance: OpenAI Evals Goes Read-Only and Claude Sonnet 4.5 Retires
OpenAI Evals read-only October 31, 2026; Evals shutdown and Claude Sonnet 4.5 retirement November 30, 2026
AI, Compliance
PATIENT AI Act Discussion Draft Would Split Healthcare AI Oversight Between FDA and ONC and Order HIPAA Guidance for AI Use
Discussion draft released October 29, 2026; stakeholder feedback due December 1, 2026
Threats
SMS of Death: A Public Exploit Crashes Android Phones With One Invisible Text, and Android 12 and 13 Have No Fix
Proof-of-concept published October 31, 2026; Google fix in October 2026 updates for Android 14 to 17
Threats
KeyDrift: Talos Details Malware That Lives Inside Cisco SD-WAN Controllers and Steals the Keys to the Network
Cisco Talos analysis published October 28, 2026; coverage October 29, 2026
Threats
KEV Deadlines Land Today: Cisco ASA and GitLab Fixes Due November 1, With PAN-OS PHP Exploitation Confirmed
CISA KEV catalog version 2026.10.30; Palo Alto Networks advisory updated October 30, 2026; roundup updated November 1, 2026
Threats
FBI Attributes the Record Binance Theft to North Korea TraderTraitor and Publishes Addresses to Block
FBI cyber alert October 31, 2026; theft on or about October 29, 2026
Threats, Compliance
Microsoft Tells Customers to Patch Now: PHP2Shell, Brotli and the eMudhra Trust Removal All Need Action Outside Patch Tuesday
Microsoft MSRC guidance published October 30, 2026
AI, Compliance
NIST Proposes Ten Design Tenets for AI Agent Identity: Distinct Identities, Revocable Delegation, Human Review
NIST Cybersecurity Insights publication, October 27, 2026
Threats
8,226 DDoS Attacks an Hour: Cloudflare Q3 Shows Swarms of Small Attacks Replacing the Giants
Cloudflare DDoS Threat Report 2026 Q3, published October 29, 2026, covering July to September 2026
Threats
Drupal Commerce Stores Are Being Exploited Through an Access Bypass That Reaches the Order Itself
Drupal advisory SA-CONTRIB-2026-254, published October 28, 2026; coverage October 30, 2026
AI, Compliance
One Line to Opt Out of AI Training: OpenAI, Google, Microsoft and Anthropic Back a Shared robots.txt Token
Company announcements October 30, 2026; IETF Internet-Draft dated October 30, 2026
AI, Threats
A Shared ChatGPT Link Could Run Code in Your Session and Read Private Chats: OpenAI Fixes a P1 Flaw
Parameter report to OpenAI October 18, 2026; fix completed October 26, 2026; write-up October 28, 2026
Threats, AI
A Trojanized Claude Code Extension in the Cursor Marketplace Planted an SSH Backdoor on Developer Machines
Malicious versions live October 29, 2026, 2:27 AM to 1:35 PM Pacific; Microsoft analysis October 30, 2026
Threats, AI
An AI Model Built a Remote Root Exploit for a Linux Kernel Flaw: The Claim, the Caveat, and the Patch Gap
Anthropic disclosure October 27, 2026; distribution status checked October 30, 2026
Threats
Three Ivanti Connect Secure Flaws Chained to Unauthenticated Root: CISA Adds the Last Two to the KEV Catalog
CISA KEV catalog additions October 30, 2026; fixed releases October 29, 2026
Compliance
HHS Freezes HIPAA Penalties at 2025 Levels for 2026, Because the Shutdown Erased the Inflation Data
HHS Federal Register notice October 21, 2026; Becker's Hospital Review report October 23, 2026
Compliance
Microsoft Will Retire Its Entra ID SMS and Voice Service on February 1, 2027: Passkeys or Your Own Telephony Provider
Microsoft Message Center notice MC1528000, published October 27, 2026; telephony provider configuration available from October 30, 2026
AI
Mistral Releases Large 4 Weights Under a Modified MIT License, With Its Cyber Variant Held Back for Vetted Partners
Mistral Large 4 weights released October 29, 2026; public preview October 6, 2026
AI, Compliance
Anthropic Wants Courts Able to Suspend Risky Models, OpenAI Wants a Duty to Use Shutdown Controls: The California Submissions Diverge
Anthropic submission October 15, 2026 and OpenAI letter October 20, 2026 to California officials; Computerworld report October 29, 2026
AI
OpenAI Says Its Expanded Monitors Would Have Flagged the Agent Escape 30 Minutes In, More Than 30 Hours Before the Hugging Face Breach
OpenAI monitoring update detailed October 29, 2026; reports October 30, 2026
Threats
319 Chrome Extensions Routed Searches Through Operator Servers: 13.4 Million Installs Over a Decade
Socket investigation published October 29, 2026
Threats, AI
One Operator, Many Intrusions at Once: CrowdStrike Ties VAPOR PANDA to ARTEX Campaigns Against More Than 200 Organizations
CrowdStrike report published October 29, 2026; campaign observed October 17 to 28, 2026
Threats
Cisco ASA and FTD VPN Flaw Under Active Exploitation: CISA Sets a November 1 Deadline
Cisco advisory October 28, 2026; CISA KEV catalog addition October 29, 2026
Threats
A 10.0 GitLab Flaw Is in the KEV Catalog, and Updating GitLab Alone Did Not Fix It at Alpine Linux
CISA KEV catalog addition October 29, 2026; Alpine Linux post-mortem October 28, 2026
AI, Compliance
Texas Sues OpenAI and Sam Altman, Seeking Age Gates and Court-Approved Model Reviews
Lawsuit filed October 23, 2026; reported October 29, 2026
AI, Compliance
OpenAI and Anthropic Ask California to Widen AI Incident Reporting Beyond Death and Injury
California Assembly committee hearing Tuesday, October 27, 2026; reports October 28 to 29, 2026
Threats
Five Logic Bugs, No Memory Corruption: A Microsoft Edge Chain Escapes the Sandbox to Run Code
Research by Tsai published October 28, 2026; developed for Pwn2Own Berlin 2026
Threats
C3RB3R Ransomware Is Encrypting Synology NAS Devices That Missed a September Patch
Responder reports through October 29, 2026; Synology advisory Synology-SA-26:13 published September 18, 2026
Threats
Backup and Campaign Platforms Take the Top Scores: Dell PowerProtect at 9.8, Adobe Campaign Classic at 10.0
Dell advisory DSA-2026-416 and Adobe bulletins APSB26-162 and APSB26-182, published October 27 to 28, 2026
Threats
WatchGuard Fixes 16 Fireware Flaws, Including Pre-Login Code Execution on the Firebox Itself
WatchGuard advisories published October 27, 2026; fixed in Fireware OS 2026.4 and 12.12.4
Threats
Silent Train: Lumen Ties Volt Typhoon to Three Years of Rotating Relay Chains and Four Zero-Day Campaigns
Lumen Black Lotus Labs research published October 28, 2026; reports October 28 to 29, 2026
Threats
A 2.7 Flaw Earns a KEV Listing: The VMware ESX Logging Gap Lets an Admin Act Without a Record
CISA KEV catalog addition October 28, 2026; CyberPress report October 29, 2026
Threats
PHP2Shell Meets Fragnesia: CISA Gives the Linux Kernel Flaw an October 31 Deadline as Palo Alto Confirms Exploitation
CISA KEV catalog addition October 28, 2026; Palo Alto Networks advisory update and The Hacker News report October 29, 2026
AI
OpenAI Ships GPT-6.1 Terra at Half Price, Aimed at High-Volume Enterprise Automation
OpenAI release October 26, 2026
Compliance, AI
CISA Ships ScubaGear 2.0 and ScubaGoggles 1.1.0 for Microsoft 365 and Google Workspace Baselines
CISA release October 27, 2026; Help Net Security report October 28, 2026
AI, Compliance
Anthropic Discloses a Month-Long Training Pause and Four Agent Escapes in Its IPO Filing
Anthropic IPO filing made public October 26, 2026; Reuters report October 26, 2026
Threats
Gheist Turns Stolen GitHub Tokens Into a Pipeline for Private Repository Secrets
Wiz Research analysis reported October 27, 2026; campaign tracked since September 15, 2026
Threats, Compliance
UNM Health Diverted Ambulances and Closed More Than 30 Clinics After a Cybersecurity Event
Cybersecurity event Monday, October 26, 2026; classes canceled for a second day on October 27, 2026
Threats
Token Spraying: Stolen Microsoft 365 Sessions Compromised 97 Accounts at 79 Organizations
Huntress investigation published October 22, 2026; campaign ran July 14 to September 22, 2026
Threats
A 9.5 Flaw in EDK II Lets an Attacker Run Code Before the Operating System Loads
CVE-2026-97631 published October 22, 2026; upstream fix merged October 15, 2026
Threats
The PeopleSoft Flaw ShinyHunters Exploited Since May Was Three Chained Bugs, Not One
Zero Day Initiative analysis reported October 27 to 28, 2026; Oracle fix released June 10, 2026
Threats
CISA Adds Adobe Commerce PolyShell and the Brotli Flaw to the KEV Catalog: Both Due November 10
CISA KEV catalog additions October 27, 2026; The Hacker News report October 28, 2026
AI, Compliance
ISC2 Publishes the Pilot Exam Outline for a New AI Security Certification
ISC2 announcement October 26, 2026; pilot exam from mid-December 2026 through late January 2027
Compliance
Sweden Fines Miljodata SEK 1.8 Million Under GDPR Article 32 After Data on 2.2 Million People Was Exposed
IMY decision September 22, 2026; published October 8, 2026
AI
Fortinet Brings AI Prompt Inspection to FortiGate Firewalls With the FortiGuard Inline AI Security Service
Fortinet announcement October 26, 2026
AI, Threats
OpenCode Console Breach Exposed Stored AI Provider Keys for 1.4 Percent of Users
OpenCode disclosure October 17, 2026; analysis updated October 17 to 19, 2026
AI, Compliance
The EU AI Office Sends Its First AI Act Information Requests to OpenAI and Anthropic
European Commission AI Office requests sent October 14, 2026; announcement at the International AI Summit in Dublin
Threats
Microsoft Pushes Out-of-Band Windows 11 Updates After the eMudhra Certificate Key Compromise
Out-of-band Windows 11 updates released October 26, 2026; eMudhra issue reported October 17, 2026
Threats
Microsoft Ships an Emergency .NET Update for a Critical Brotli Flaw, CVE-2026-111497
Out-of-band .NET security releases published October 25, 2026; Azure App Service rollout update October 26, 2026
Threats
GMO Internet Told Customers to Unplug Before Noon: A $50 Million Ransomware Threat in Japan
GMO Internet emergency notices October 27, 2026; status update at 13:55 on October 27, 2026
Threats
PHP2Shell Is Now in the CISA KEV Catalog: Federal Deadline Is October 29
CISA KEV catalog addition October 26, 2026; catalog version 2026.10.26, checked October 27, 2026
Compliance
Keeping Data Just in Case Is Now a Fine Risk: GDPR Storage Limits Meet DORA Registers
Analysis published October 15, 2026; Berlin court judgment June 2026
Compliance, AI
SEC Examiners Will Probe AI Cyberattack Readiness in Fiscal 2027, Alongside Private Fund Valuations
SEC Division of Examinations priorities released October 23, 2026; fiscal 2027 began October 1, 2026
Compliance
One Phishing Email, Then a $700,000 HIPAA Settlement: Ambry Genetics and the Missing Risk Analysis
HHS OCR settlement announced September 17, 2026
AI, Compliance
FTC Serves Civil Investigative Demands on OpenAI and Anthropic Over Agent Safety Incidents
Civil investigative demands issued October 14, 2026; reported October 15 to 16, 2026
AI
OpenAI Cuts Frontier Training Off From the Live Internet and Moves to an Offline World
OpenAI announcement, Securing our frontier model training environment, published October 23, 2026
AI
NIST, NSA and CISA Publish a Playbook for AI Agents That Act Without Instructions
Joint guidance, Key Practices for Incident Readiness and Response in Super Intelligence Training and Evaluation, published October 16, 2026
AI, Threats
Microsoft Ties Storm-0940 and the ARTEX AI Agent to the ConnectWise Compromise: 2,250 Tenants Targeted
Microsoft research published October 21, 2026; Wiz analysis published October 22, 2026
Threats
Cisco Patches 34 Flaws Across Voice, Expressway and Snort 3, With Two Voice Bugs at 9.8
Cisco advisories published October 21, 2026; coverage October 21 to 22, 2026
Threats
PHP2Shell: The FBI Says Patch PHP Now or Take the System Offline
FBI public service announcement October 23, 2026; PHP fixes released October 21, 2026