Good afternoon

Saturday 31 October · Today’s security news, in plain English

CRITICAL · VULNERABILITYCVE-2026-97229redteam/daily · 4 sources

Main story · 4 sources · 1dCISA adds maximum-severity GitLab flaw CVE-2026-97229 to exploited vulnerabilities catalogueCISA added CVE-2026-97229 to its Known Exploited Vulnerabilities catalogue on 29 October 2026, confirming active exploitation. The flaw affects GitLab Community Edition and Enterprise Edition, carries a CVSS score of 10.0, and allows unauthenticated remote code execution through a crafted regular expression in a CI/CD configuration. Administrators should update and not confuse this with the separate flaw CVE-2026-110264.

Your feed

The Register (Security)· 1dCritical

CISA adds maximum-severity GitLab flaw CVE-2026-97229 to exploited vulnerabilities catalogue

CISA added CVE-2026-97229 to its Known Exploited Vulnerabilities catalogue on 29 October 2026, confirming active exploitation. The flaw affects GitLab Community Edition and Enterprise Edition, carries a CVSS score of 10.0, and allows unauthenticated remote code execution through a crafted regular expression in a CI/CD configuration. Administrators should update and not confuse this with the separate flaw CVE-2026-110264.

4 sources Ask AI

Check Point Research· 1dCritical

GitLab CVSS 10.0 flaw targeted on Alpine Linux server; Ivanti, LiteLLM and UAT-6275 also reported

Alpine Linux said on 28 October that an attacker tried to exploit GitLab flaw CVE-2026-97229 (CVSS 10.0) on its GitLab server a week after the fix was released, with no evidence of success. Roundups also cover actively exploited Ivanti Connect Secure and Windows Shell bugs, LiteLLM gateway flaws fixed in version 1.83.9, and Talos and Recorded Future research on UAT-6275, a Kazakhstan-nexus group targeting CIS governments.

9 sources Ask AI

Cyber Security News· 1dCritical

Anthropic says its AI model built a working root exploit for critical Linux kernel flaw CVE-2026-98432

Anthropic says an unreleased Claude research model produced a zero-click exploit for CVE-2026-98432, a use-after-free race condition in the Linux kernel's IPv4 TCP handling that gives unauthenticated root command execution, with a claimed 9.8 CVSS score. Upstream fixes are available in stable branches such as 5.10.272, 5.15.223 and 6.6.159, but distribution fixes are uneven, with Ubuntu and Red Hat Enterprise Linux reportedly lacking patched kernels as of 30 October. Teams should prioritise internet-facing servers, apply vendor kernel updates, reboot, and check whether multipath TCP listeners are needed.

6 sources Ask AI

Krebs on Security· 2dCritical

Attackers probe critical Oracle E-Business Suite flaw CVE-2026-101767 after October patch

CVE-2026-101767 is an unauthenticated SQL injection in Oracle E-Business Suite's Thin Client Framework servlet that chains to remote code execution, with a CVSS score of 9.8. Oracle patched it in its October 2026 Critical Patch Update, and Defused Cyber decoys recorded exploratory exploitation on 27 October. The Canadian Centre for Cyber Security has updated its advisory to say open source reporting indicates exploitation in the wild.

7 sources Ask AI

Fortinet PSIRT Advisories· 2dCritical

Critical PHP flaws CVE-2026-109618 and CVE-2026-109619 now exploited in the wild

Two memory-corruption flaws in PHP, CVE-2026-109618 (out-of-memory handling) and CVE-2026-109619 (use-after-free in global state), allow unauthenticated remote code execution via crafted HTTP requests, with the risk greatest for Apache modphp. CISA added both to its Known Exploited Vulnerabilities catalogue on 26 October 2026, and AWS advises upgrading rather than relying on configuration changes alone.

12 sources Ask AI

Fortinet PSIRT Advisories· 2dCritical

Critical Brotli decoder flaw CVE-2026-111497 (Broccoli2Shell) exploited, added to CISA KEV

CVE-2026-111497, nicknamed Broccoli2Shell, is an out-of-bounds write in the Google Brotli decoder that can be exploited remotely without authentication. It can cause memory corruption, information disclosure, crashes or code execution. CISA added it to its Known Exploited Vulnerabilities catalogue on 27 October 2026. Software that bundles Brotli, including Node.js, .NET, PowerShell, Bun, Envoy Proxy, Istio and Python packages, may be affected.

5 sources Ask AI

Chrome Releases· 2dCritical

Google releases Chrome 156 stable security update fixing 52 flaws, including critical bugs

Chrome Stable 156.0.8078.73/.74 for Windows and Mac and 156.0.8078.73 for Linux addresses 52 security issues, several rated critical, including CVE-2026-118331 in FileAPI and CVE-2026-118306 in FileSystem. ChromeOS 16836.30.0 (Browser 156.0.8078.77) is rolling out to Stable devices with its own list of fixes, and Beta and Dev channels have also received ChromeOS 157 builds.

1 source Ask AI

Qualys Threat Research· 3dCritical

CISA adds Brotli and Adobe Commerce PolyShell flaws to Known Exploited Vulnerabilities catalogue

CISA added CVE-2026-111497 (Google Brotli, CVSS 9.2) and CVE-2026-48356 (Adobe Commerce and Magento, CVSS 9.3) to its KEV catalogue, with federal agencies told to fix them by October 29, 2026. Sansec reported the Magento flaw, dubbed PolyShell, had been used to infect at least 953 online stores, while exploit traffic for the Brotli flaw has also been observed. Node.js, PHP, Bun and Microsoft .NET have released fixes for Brotli.

9 sources Ask AI

BleepingComputer· 19hBreach

Binance investigates suspected breach involving up to $5.8 billion in crypto assets

Binance is investigating a potential security breach involving up to $5.8 billion in digital assets, which BleepingComputer says could become the largest cryptocurrency hack in history. HackRead reports that $3 billion in assets has been frozen, that investigators are tracing the funds, and that the exchange says user funds are safe. The articles describe the incident as suspected or potential, and neither gives details of how it happened.

2 sources Ask AI

Cyber Security News· 19hBreach

Polymarket international platform hit by wallet thefts after third-party provider compromise

Polymarket's international platform suspended trading on 29 October 2026 after a compromised third-party provider led to unauthorised withdrawals and closed positions. Reporting links the incident to DebugBear, a website performance monitoring service, though Polymarket's statement did not name the vendor. Outside estimates cited by CNBC put withdrawals at at least $2.7 million across 710 wallets, and the company has pledged to make users whole.

2 sources Ask AI

GBHackers· 19hMalware

Trojanized Claude Code extension on Open VSX installs persistent SSH backdoor on developer machines

Researchers found that anthropic.claude-code version 2.1.313, obtained from Open VSX, had 66 lines of malicious JavaScript added to the legitimate extension bundle. The loader runs before the extension's normal code and sets up persistent SSH access to infected hosts. The issue has been traced to a compromise of the Cursor Marketplace, and Cursor briefly took the service down to remove the malware.

2 sources Ask AI

TechCrunch (Security)· 19hBreach

Hacker leaks personal data of more than 40,000 US Homeland Security staff, including ICE and CBP agents

Reports say a hacker obtained personally identifiable information on more than 40,000 Homeland Security staff, with one outlet putting the figure at over 41,000. The data, which covers ICE and CBP agents among others, has been published online. The articles give no details of the intrusion method or the exact data fields exposed.

2 sources Ask AI

Help Net Security· 19hVulnerability

Embedded browsers in five AI coding assistants allow code execution, file theft and address spoofing

Forever Security reported flaws in the embedded browsers of Cursor, GitHub Copilot, OpenAI Codex, VS Code and Claude Desktop, grouped under the name EMBRACE. Impacts include code execution in Cursor, address-bar spoofing in Copilot, and local file reads in Codex, VS Code and Claude Desktop, including SSH keys, .env files and npm tokens. Cursor and Copilot have been fixed, while Codex and VS Code were unpatched at publication.

2 sources Ask AI

Cyber Security News· 19hHigh

Trezor warns of suspected hardware implant in Safe 5 wallet sold via CryptoBilis

Trezor has issued a security notice about a suspected hardware implant in a Safe 5 bought through CryptoBilis, a reseller it removed from its authorised network on 9 October. A customer in Indonesia reported an extra board with a cellular module and antenna between the main board and screen, allegedly capturing the recovery phrase shown on the display and sending it over a mobile network. The device is going to Trezor's security lab, so the implant is unconfirmed, but all Trezor devices bought from CryptoBilis from March 2026 onward are covered as a precaution. No fund losses have been reported by CryptoBilis buyers.

2 sources Ask AI

Help Net Security· 19hMalware

Tampered Claude Code extension spread SSH backdoor via Open VSX and Cursor marketplaces

Phorion researchers found that Claude Code extension version 2.1.313 was tampered with and published on Open VSX, the Eclipse Foundation's open-source marketplace for VS Code-compatible editors. BleepingComputer reports it was distributed through Cursor's extension marketplace for about 11 hours on October 29, exposing up to 5,000 developers to malware that installs persistent SSH backdoors. Microsoft's Visual Studio Marketplace never carried the compromised build.

3 sources Ask AI

The Record· 19hMalware

NetamLoader malware targets custom Windows 10 build used by Asian government bodies

Kaspersky's GReAT team reported NetamLoader, a .NET and XAML-based loader found in a CAB archive in the Windows update download folder, built for a custom Windows 10 build used only by Asian government bodies. It abuses Microsoft-signed components, patches AMSI, cleans up logs and contacts its C2 server slowly to evade sandboxes and EDR. Kaspersky saw one victim, could not say how the archive was delivered and found no sign that Patch My PC was compromised.

2 sources Ask AI

The Hacker News· 19hHigh

Trezor warns of suspected hardware implant in Safe 5 wallets sold by reseller CryptoBilis

Trezor has received credible reports of a suspected hardware implant in a Trezor Safe 5 sold by its reseller CryptoBilis, which BleepingComputer says operates in Southeast Asia. One customer reported an extra circuit board that transmits the recovery phrase over a mobile network. Trezor has not yet examined the device and advises everyone who bought from CryptoBilis since March 2026 to move funds to a new wallet with a new recovery phrase.

2 sources Ask AI

AWS Security Bulletins· 21hVulnerability

FreeRTOS-Kernel queue-set flaw lets unprivileged tasks trigger privileged out-of-bounds write (CVE-2026-119086)

AWS has disclosed CVE-2026-119086, a missing type validation issue in xQueueSelectFromSet in FreeRTOS-Kernel. On MPU-enabled builds with queue sets enabled, an unprivileged task can make the kernel write beyond the intended destination while running in a privileged context, affecting the integrity of privileged execution. Builds without queue sets are not affected.

1 source Ask AI

Cloudflare Blog (Security)· 21hVulnerability

Cloudflare tracks exploitation and patching of eMudhra's weak intermediate CA keys

Cloudflare reports that eMudhra's eight intermediate private keys, one of which was simply the number 4, can be recovered from the public certificates, letting anyone forge certificates that unpatched clients not enforcing Certificate Transparency would accept. Cloudflare patched high-priority systems, including Pingora origin-facing proxies, within hours and logged about 22,000 handshakes using the weak keys, all refused where verification was enabled. About 160 handshakes carried forged certificates, one dated less than an hour after Mozilla's bug report went public, but they appeared to be servers' own default certificates rather than interception attempts.

1 source Ask AI

The Record· 22hBreach

Florida Department of Education warns 4.9 million people had Social Security numbers leaked in financial aid site breach

The Florida Department of Education (FLDOE) said on Thursday that it became aware of a data breach affecting the Florida Student Financial Aid website on 19 October. The department says Social Security numbers belonging to 4.9 million people were leaked. The article excerpt gives no further detail on the cause or the attacker.

1 source Ask AI

Top stories

Most covered

Your feed