Daily Brief

Thursday, October 29, 2026

Added to KEV

2 additions

Broadcom VMware Cloud Foundation, VMware ESX, VMware Telco Cloud Platform and VMware vSphere Foundation

WARP PANDA exploited VMware ESX logging bypass as a zero-day, CrowdStrike says

Broadcom fixed the flaw in July, and CrowdStrike says the group used it in intrusions at US organizations as late as early 2026.

Further readingBroadcom advisory, further reading on WARP PANDA exploited VMware ESX logging bypass as a zero-day, CrowdStrike says CrowdStrike research, further reading on WARP PANDA exploited VMware ESX logging bypass as a zero-day, CrowdStrike says

Linux

Linux kernel flaw chained with PHP2Shell to root firewalls, Dream says

CISA added the flaw, known as Fragnesia, to KEV on Oct 28 and says it can be chained with the PHP2Shell flaws to run commands as root.

Further readingDream research, further reading on Linux kernel flaw chained with PHP2Shell to root firewalls, Dream says CVE record, further reading on Linux kernel flaw chained with PHP2Shell to root firewalls, Dream says

Source: CISA’s Known Exploited Vulnerabilities catalog, version 2026.10.28

Vulnerabilities and patches

3 items

Oracle E-Business Suite

Exploited

Oracle E-Business Suite flaw draws exploit attempts, Defused says

The flaw needs no login and affects EBS 12.2.3 through 12.2.15, Horizon3 says, and Oracle fixed it in its Oct 20 update.

Further readingDefused on X, further reading on Oracle E-Business Suite flaw draws exploit attempts, Defused says Horizon3 research, further reading on Oracle E-Business Suite flaw draws exploit attempts, Defused says Oracle advisory, further reading on Oracle E-Business Suite flaw draws exploit attempts, Defused says

PHP

Exploited

Palo Alto sees PHP2Shell attacks on PAN-OS, and all hotfixes are out

Palo Alto now scores the flaws 9.2 on internet-facing management interfaces, up from 8.7, with confidentiality and integrity at stake as well as availability.

Further readingPalo Alto Networks advisory, further reading on Palo Alto sees PHP2Shell attacks on PAN-OS, and all hotfixes are out

Juniper Networks Juniper Session Smart Conductor and Juniper Session Smart Router

Juniper fixes Session Smart Router and Conductor flaws that need no login

Both flaws are rated 9.8, and the one in the router can be exploited only before the router is onboarded to Mist or Conductor.

Further readingCanadian Centre for Cyber Security advisory, further reading on Juniper fixes Session Smart Router and Conductor flaws that need no login

Breaches and campaigns

3 items

Microsoft Microsoft 365 and Teams

Fake IT help desk calls target Canadian legal and financial firms

Callers push staff to fake passkey or MFA enrollment pages that relay sign-ins, then steal Microsoft 365 data and demand payment, the Cyber Centre says.

Further readingCanadian Centre for Cyber Security advisory, further reading on Fake IT help desk calls target Canadian legal and financial firms

Cisco Catalyst SD-WAN

Exploited

Attackers planted KeyDrift malware on Cisco SD-WAN controllers, Talos says

UAT-11473 got in through an authentication bypass Cisco disclosed in February, and its tools steal keys that protect SD-WAN traffic.

Further readingCisco Talos research, further reading on Attackers planted KeyDrift malware on Cisco SD-WAN controllers, Talos says Cisco advisory, further reading on Attackers planted KeyDrift malware on Cisco SD-WAN controllers, Talos says

Phishing lures enroll PCs in attackers’ MDM tenants, Huntress says

Huntress saw attackers use Hexnode and Rippling to install ScreenConnect, which in one case came back after the MSP removed it.

Further readingHuntress research, further reading on Phishing lures enroll PCs in attackers’ MDM tenants, Huntress says

Thursday, October 29, 2026

Added to KEV

Vulnerabilities and patches

Breaches and campaigns

Get the Daily Brief by email