Briefing · 2026-10-28

Oct 28: Desk Briefing

Oct 28 security desk briefing covering 5 published reports, with links to the underlying coverage and available primary records.

October 28, 2026

tldr.txt

GMO Group told Onamae Desktop Cloud customers to disconnect and shut down PCs after a threat actor who breached the service threatened a ransomware deployment.
ZDI discloses CVE-2026-35273 chains an SSRF, a trust bypass, and two RCE paths. One CVE ID, two persistence mechanisms, and active exploitation since May.
Threat actors began probing Oracle EBS CVE-2026-101767, a CVSS 9.8 unauthenticated SQL injection, one day after Oracle's October 2026 CPU released the fix.

Oct 28’s desk briefing covers 5 reports published that day. Follow each report for its sourcing and any later updates.

GMO Group Orders Cloud Shutdown After Ransomware Threat. GMO Group told Onamae Desktop Cloud customers to disconnect and shut down PCs after a threat actor who breached the service threatened a ransomware deployment.
Oracle PeopleSoft CVE Was Three Chained Flaws, ZDI Shows. ZDI discloses CVE-2026-35273 chains an SSRF, a trust bypass, and two RCE paths. One CVE ID, two persistence mechanisms, and active exploitation since May. Sources: Oracle’s security alert for CVE-2026-35273, Known Exploited Vulnerabilities catalog.
Oracle EBS SQL Injection Probed 24 Hours After Patch. Threat actors began probing Oracle EBS CVE-2026-101767, a CVSS 9.8 unauthenticated SQL injection, one day after Oracle’s October 2026 CPU released the fix. Sources: CVE-2026-101767, October 2026 Critical Patch Update.
CISA Adds Adobe Commerce, Brotli to KEV After Active Attacks. CISA added CVE-2026-48356 and CVE-2026-111497 to its KEV catalog as PolyShell attacks breach hundreds of Adobe Commerce and Magento stores. Sources: Known Exploited Vulnerabilities catalog, NVD CVE-2026-48356, NVD CVE-2026-111497.
Adobe Patches 8 Critical Campaign Classic Flaws. Adobe patched eight critical flaws in Campaign Classic 7.4.4 build 9402, including a CVSS 10.0 SQL injection. Build 9403 is available now; no active exploitation reported. Sources: advisory APSB26-162.

Sources