Briefing · 2026-10-27 to 2026-11-01

Week in Review: Oct 27–Nov 1, 2026

The security desk reviews 24 reports published Oct 27–Nov 1, including KEV additions, vendor patches, incidents and disruption.

November 2, 2026

tldr.txt

CISA KEV coverage included PHP2Shell, Adobe Commerce and Brotli, VMware ESXi, GitLab and Ivanti Connect Secure.
Vendor patch coverage included FortiSandbox, Adobe Campaign Classic, Oracle EBS, Cisco ASA/FTD and Drupal Commerce Core.
The desk also covered ransomware disruption, breaches, and law enforcement action.

The desk published 24 reports from October 27 through November 1. This review follows their publication dates; each item links to the original report and the primary records cited there.

Oct 27

Fortinet Patches CVSS 9.8 Auth Bypass in FortiSandbox. CVE-2026-107656, a CVSS 9.8 authentication bypass in Fortinet FortiSandbox, affects three active branches. No active exploitation confirmed at publication. Sources: CVE-2026-107656, FortiGuard PSIRT advisory.
New Mexico Hospital Diverts Ambulances in Cyber Incident. UNM Health System diverted ambulances and closed 30 clinics Monday after a cybersecurity incident. The FBI is assisting; operations are resuming in phases.
Teams IT Support Scams Deploy Ransomware at Scale. Researchers document hundreds of cases where threat actors pose as IT support via Microsoft Teams external chat to deliver malware and ransomware into enterprise networks.
Apple Backports CoreGraphics Zero-Day Fix to Older iPhones. Apple extended patches for CVE-2026-86950, a CoreGraphics zero-day confirmed in targeted attacks, to older iPhone and iPad models that cannot run iOS 26. Sources: CVE-2026-86950.
PHP2Shell KEV Deadline: Federal Agencies Must Patch by Oct 29. CISA confirmed active exploitation of PHP2Shell and set an October 29 patch deadline for federal agencies. CVE-2026-109618 (CVSS 9.8) and CVE-2026-109619 (CVSS 8.1) hit PHP 8.3/8.4/8.5. Sources: CISA added both PHP2Shell CVEs to its Known Exploited Vulnerabilities catalog, CVE-2026-109618, CVE-2026-109619.
ENGIE Discloses Customer Data Breach via Partner Platform. French energy giant ENGIE confirmed attackers stole customer data after compromising a third-party marketing platform used by its business partners.
Tailscale SSH Flaws Exposed Before Patches Ready. Nearly a dozen Tailscale SSH vulnerabilities went public before fixes were available. Root privilege escalation and credential theft confirmed as possible impact. Sources: security advisories page.

Oct 28

GMO Group Orders Cloud Shutdown After Ransomware Threat. GMO Group told Onamae Desktop Cloud customers to disconnect and shut down PCs after a threat actor who breached the service threatened a ransomware deployment.
Oracle PeopleSoft CVE Was Three Chained Flaws, ZDI Shows. ZDI discloses CVE-2026-35273 chains an SSRF, a trust bypass, and two RCE paths. One CVE ID, two persistence mechanisms, and active exploitation since May. Sources: Oracle’s security alert for CVE-2026-35273, Known Exploited Vulnerabilities catalog.
Oracle EBS SQL Injection Probed 24 Hours After Patch. Threat actors began probing Oracle EBS CVE-2026-101767, a CVSS 9.8 unauthenticated SQL injection, one day after Oracle’s October 2026 CPU released the fix. Sources: CVE-2026-101767, October 2026 Critical Patch Update.
CISA Adds Adobe Commerce, Brotli to KEV After Active Attacks. CISA added CVE-2026-48356 and CVE-2026-111497 to its KEV catalog as PolyShell attacks breach hundreds of Adobe Commerce and Magento stores. Sources: Known Exploited Vulnerabilities catalog, NVD CVE-2026-48356, NVD CVE-2026-111497.
Adobe Patches 8 Critical Campaign Classic Flaws. Adobe patched eight critical flaws in Campaign Classic 7.4.4 build 9402, including a CVSS 10.0 SQL injection. Build 9403 is available now; no active exploitation reported. Sources: advisory APSB26-162.

Oct 29

Ukrainian Hive and Nefilim Affiliate Gets 70 Months. Artem Stryzhak, 35, sentenced to 70 months for Nefilim and Hive ransomware attacks on hospitals and corporations causing more than $100M in losses.
Cisco Patches ASA/FTD VPN Zero-Day, Active Attacks. CVE-2026-76418 lets unauthenticated attackers crash Cisco ASA and FTD firewalls via SSL VPN. Cisco confirmed active exploitation; patches released October 29.
Low-Severity ESXi Logging Flaw Hits CISA KEV. CISA added VMware ESXi CVE-2026-41709, a CVSS 2.7 logging flaw, to KEV after CrowdStrike tied it to Warp Panda zero-day use. Patch and review ESXi audit gaps. Sources: CVE-2026-41709, CISA KEV catalog.

Oct 30

GitLab CVE-2026-97229 Hit Alpine Linux, Now in KEV. CISA added GitLab’s CVSS 10.0 RCE to KEV after an attempted attack on Alpine Linux’s instance. Federal deadline is Nov 1. Patch, then check for crashes. Sources: Alpine’s incident report, CISA KEV catalog.
Drupal Commerce Core Bypass Exploited, Patch 3.3.13. Drupal says CVE-2026-118539, a highly critical Commerce Core access bypass, is exploited in the wild. Update to 3.3.13 or 8.x-2.41 and audit your orders.
Linux TCP Flaw Allows Remote Root on MPTCP Listeners. Anthropic demonstrated remote root execution through Linux CVE-2026-98432 on MPTCP listeners. Upstream fixes exist; distribution patch status varies. Sources: Linux CVE record, Red Hat’s October 30 bulletin, CVE page.
FBI Seizes Virtualine Bulletproof Hosting Domain. The FBI seized virtualine.net, a Russian-speaking bulletproof host tied to ransomware and StealC operators. A domain seizure alone does not prove it is offline.

Oct 31

Ivanti Connect Secure Chain Fixes Ship, KEV Due Nov 2. CISA added Ivanti Connect Secure CVE-2026-111357 and CVE-2026-118527 to KEV. Fixes for the full exploited chain are now out in 25.1.1.3 and 22.8R2.6. Source: CISA KEV catalog.

Nov 1

Chainalysis Confirms Breach by ‘Agentic’ Attacker. Chainalysis confirms an external actor reached internal tools and customer contact data using ‘offensive agentic techniques’. Entry point and dwell time unconfirmed.
Android ‘SMS of Death’ Crash Fix Exists, but Patch Coverage Is Unclear. Google’s Android source contains a fix for a remote telephony crash. The October bulletin does not identify the issue, so device patch coverage remains unconfirmed. Sources: Google source commit, October security bulletin.
Three Command Injection CVEs Affect WAVLINK WN553X1-B. Three published CVE records identify command injection flaws in WAVLINK WN553X1-B firmware. All carry a CNA CVSS 3.1 score of 9.9. Sources: CVE-2026-120238, CVE-2026-120239, CVE-2026-120240.
Prefab UI sandbox escape fixed in 0.21.0. CVE-2026-120338 affects Prefab UI’s optional Generative UI sandbox in versions 0.14.0 through 0.20.2. The 0.21.0 release contains the fix. Sources: published CVE-2026-120338 record, released that version on October 26, NVD entry.

Sources