The last 30 days of cyber threats for education and government (357 items).
AI-assisted summaries and fixes, sources cited.
Critical · Help Net Security ·
On 2026-10-29, China-linked Warp Panda exploited CVE-2026-41709 with PHP2Shell and Fragnesia, gaining root on VMware ESX and Cisco firewalls and hiding activity.
Critical · The Hacker News ·
CISA has added a pair of maximum-severity GitLab and Cisco vulnerabilities to its known-exploited list, citing evidence of active attacks and warning of remote code execution and denial-of-service risk.
Critical · CISA Advisories ·
Two newly cataloged vulnerabilities in VMware ESX and the Linux kernel are under active attack, prompting urgent remediation across federal networks and beyond.
Critical · SecurityWeek ·
Ivanti VPN and Connect Secure customers face active exploitation of CVE-2026-111357 and CVE-2026-118527, with CISA flagging both flaws for urgent patching.
Critical · Security Affairs ·
Attackers are exploiting two 2026 vulnerabilities in software from GitLab and Cisco, including CVE-2026-97229, enabling code execution and triggering a KEV catalog listing.
Critical · The Hacker News ·
Warp Panda, a China-nexus actor, weaponized CVE-2026-41709 in VMware ESX; CISA added it to KEV on Wednesday, and U.S. legal firms face reduced audit visibility.
Critical · The Hacker News ·
PolyShell attackers are actively exploiting CVE-2026-111497, a critical flaw tied to Adobe Commerce and Magento, prompting CISA to add it to the KEV catalog as hundreds of stores face compromise.
Critical · Security Affairs ·
In July, CISA added actively exploited Linux kernel and VMware ESX vulnerabilities to its must-patch list, with Broadcom and Linux maintainers issuing fixes.
Critical · BleepingComputer ·
CISA is alerting federal agencies that attackers are combining Linux kernel and PHP flaws into exploit chains that can elevate privileges in real-world attacks.
Critical · CISA Known Exploited Vulnerabilities ·
A remotely exploitable defect tracked as CVE-2026-76418 can force Cisco's Secure Firewall ASA and FTD appliances to reload, disrupting network defenses for any organization relying on them.
Critical · Security Affairs ·
CISA has placed security defects in Google Brotli and Adobe Commerce/Magento on its Known Exploited Vulnerabilities list, raising urgency for K-12 administrators.
High · The Hacker News ·
Unauthenticated attackers can crash Cisco Secure Firewall ASA and FTD devices via CVE-2026-76418, and exploitation is already underway despite released patches.
High · SecurityWeek ·
Cisco released fixes Wednesday for CVE-2026-76418, a remotely exploitable zero-day in Secure Firewall ASA and FTD SSL VPN services that can lead to device takeover.
High · Help Net Security ·
Attackers tracked as Defused and other unidentified parties made exploratory exploitation attempts against a patched Oracle E-Business Suite vulnerability, CVE-2026-101767, on October 27 and 29.
High · BleepingComputer ·
Attackers have exploited a Cisco SSL VPN issue to knock firewall appliances offline, and Cisco has released software fixes.
High · SecurityWeek ·
Chinese hackers used a VMware ESXi zero-day, CVE-2026-41709, to suppress audit records for privileged operations, raising detection risk despite a low base rating.
High · The Hacker News ·
ShinyHunters abused a zero-day and two linked flaws in Oracle PeopleSoft, using SSRF to reach internal interfaces before Oracle patched the issues in May and June.
High · SecurityWeek ·
A week-long PHP2Shell campaign achieved root-level compromise on Palo Alto firewalls while WordPress-focused exploitation failed, with 22.6 million instances exposed.
High · Patchstack ·
CVE-2026-111497 allows a remote unauthenticated POST to trigger a pingback fetch and a Brotli-compressed reply that can crash PHP workers on default WordPress sites.
High · Help Net Security ·
Attackers posing as service desk staff used phone, email, and Teams messages to persuade employees to start remote sessions, enabling intrusions and ransomware, according to Cisco Talos and Microsoft.
High · Help Net Security ·
Sophos ties the GOLD OGRE crew behind Aur0ra ransomware to an intrusion that ran through VPN and proxy access and leaned on Cursor's AI coding agents while stealing credentials and climbing to domain admin.
High · Unit 42 ·
Palo Alto Networks' Unit 42 published an Oct. 29 threat brief on CVE-2026-109618 and CVE-2026-109619, two critical PHP issues with worldwide exposure.
High · SecurityWeek ·
Cisco Talos and Lumen attribute Cisco SD-WAN intrusions to Volt Typhoon, citing stolen keys, zero-day abuse, and shared infrastructure with Silent Train.
High · Cisco Talos ·
Researchers at Cisco Talos have observed an artificial-intelligence-driven command-and-control tool tracked as NIK C2 being operated by unidentified actors in real-world activity, with no CVE to patch.