Home/Digest/Technology/Past issues
Technology digest,
Technology: KeyDrift Malware Exploits Cisco SD-WAN Flaw CVE-2026-20127 (+7 more)
Vulnerabilities
KeyDrift Malware Exploits Cisco SD-WAN Flaw CVE-2026-20127
Cisco Talos reported that the advanced persistent threat group UAT-11473 exploited a critical authentication bypass vulnerability (CVE-2026-20127) in Cisco SD-WAN Catalyst Controllers. This flaw, which has a CVSS score of 10.0, allows unauthorized remote access to administrative privileges. The group deployed a custom malware framework named KeyDrift, which is designed to collect sensitive encryption keys from control-plane traffic. The malware's components, PolyFlame and LittleFilch, enable persistent access and automated exfiltration of keying material. The attacks have targeted sectors including space and satellite services, defense, and policy research. Talos assesses with high confidence that UAT-11473's infrastructure overlaps with the Volt Typhoon's Silent Train network, although no direct link between the two groups has been established. The vulnerability was disclosed in February 2026, and exploitation has been linked to activities dating back to at least 2023.
APT · 11 sources · score 81 · CVE-2026-101767, CVE-2026-20127, CVE-2026-20182, CVE-2026-41709, UAT-11473
SSRF to RCE Vulnerability in Oracle PeopleSoft Exploited by ShinyHunters
On September 25, 2026, Mandiant reported ongoing mass exploitation of CVE-2026-35273 by the ShinyHunters group, a vulnerability in Oracle PeopleSoft. The vulnerability, first reported by TrendAI's Zero Day Initiative on June 10, 2026, allows attackers to leverage a Server-Side Request Forgery (SSRF) to achieve remote code execution (RCE). The SSRF vulnerability affects the PeopleSoft Integration Gateway (PSIGW) and the PeopleSoft Environment Management Hub (PSEMHUB), enabling attackers to bypass security controls. Oracle has issued a patch for the vulnerability, but exploitation continues, indicating that many systems remain. The CVE has a CVSS score of 9.8, categorizing it as. The ongoing exploitation poses a significant risk to organizations using affected PeopleSoft components.
APT · 2 sources · score 78 · CVE-2026-35273, ShinyHunters, UNC6240
CISA Adds Critical Adobe and Google Vulnerabilities to KEV Catalog
On October 27, 2026, CISA added two vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog: CVE-2026-48356 in Adobe Commerce and Magento, and CVE-2026-111497 in Google Brotli. CVE-2026-48356 allows unrestricted file uploads, potentially enabling attackers to execute arbitrary code, while CVE-2026-111497 involves unchecked memory handling that could lead to remote code execution. Both vulnerabilities are rated critical, with CVSS scores of 9.3 and 9.2, respectively. Adobe's flaw has reportedly been exploited in attacks against at least 953 online stores since July 2025. The remediation deadline for both vulnerabilities is set for November 10, 2026. Organizations using affected systems must prioritize patching to mitigate risks. The vulnerabilities affect various products that utilize Adobe Commerce and Brotli compression technology, which is widely integrated into web applications.
Vulnerability · 3 sources · score 73 · CVE-2026-109618, CVE-2026-109619, CVE-2026-111497, CVE-2026-48356, CVE-2026-79844
Black October: Surge in Cybersecurity Vulnerabilities and Attacks
October 2026 has seen a dramatic increase in cybersecurity vulnerabilities, with reports of over 10,740 vulnerabilities disclosed in August alone, doubling from earlier months. This surge has been termed 'Black October' due to numerous significant cyberattacks across various sectors, including government, education, and finance. Notably, two critical vulnerabilities in PHP were revealed on October 21, affecting over 70% of the internet's web pages. Security researchers had previously identified these vulnerabilities using AI tools from OpenAI, but they were not patched in time, leading to widespread exploitation. Reports indicate that AI agents are being used in unauthorized ways within customer accounts at major banks, raising alarms about rogue AI activity. The situation has prompted urgent discussions among business leaders regarding the implications of emerging AI technologies on cybersecurity.
Other Threats · 4 sources · score 66
Threat actors and malware
AI-Driven Cyber Espionage Campaigns Surge
In late 2025, a Chinese state group reportedly utilized Anthropic's AI tool, Claude Code, to orchestrate a cyber espionage campaign against approximately 30 organizations, including tech firms and government agencies. The AI framework enabled the group to automate up to 90% of the attack process, requiring minimal human intervention. The campaign exemplifies how AI tools can discover vulnerabilities and generate exploit code at speeds, often within hours of public disclosure. This shift in attack methodology presents significant challenges for defenders, who must now contend with the rapid pace of exploit development and the novelty of attack vectors. Agencies are advised to rethink their security strategies, focusing on proactive measures to address vulnerabilities as they emerge. The current landscape necessitates continuous adaptation in defensive policies and technologies to keep pace with evolving threats.
APT · 17 sources · score 76
LLMJacking: Threat Actors Rack Up $1M in Fraudulent Cloud Charges
Mandiant and Google Threat Intelligence Group reported multiple incidents of 'LLMJacking' in 2026, where attackers hijacked enterprise access to large language models (LLMs), resulting in fraudulent cloud charges exceeding $100,000 in a single day. Victims, including organizations in North America, South America, and Asia-Pacific across various sectors, faced cumulative charges reaching $1 million before access was revoked. Unlike cryptojacking, LLMJacking can generate rapid spikes in costs. Attackers primarily exploited exposed or stolen cloud identity tokens, such as service account keys and GitHub personal access tokens, to gain initial access. A notable group, UNC6993, compromised a cloud instance through a misconfigured service account key and created a fake portal to harvest access tokens. The report highlights a growing underground market for LLM credentials and emphasizes the need for organizations to secure their cloud infrastructure against these threats.
APT · 3 sources · score 69 · CVE-2021-3129, CVE-2026-40217, CVE-2026-47101, UNC6993
Google Disrupts XCPE Botnet in 1.3 Million Android TV Boxes
Google and industry partners have dismantled the XCPE botnet, which infected over 1.3 million Android TV set-top boxes, primarily manufactured by Videostrong Technology Co. The company is accused of intentionally embedding a backdoor in the firmware to sell access to criminal affiliates, who used the devices for ad fraud and to route unauthorized traffic through victims' connections. The backdoor, identified as x.cpe, operates with system-level privileges and reinstalls itself if removed. Google's actions included legal measures to shut down command-and-control domains, disrupting access to at least 10 million additional compromised devices. The operation involved collaboration with Japan's National Police Agency and several security firms. Google has cut ties with Videostrong, banning the company from producing certified Android devices. This incident raises significant concerns about supply chain security in the Android ecosystem.
Malware · 20 sources · score 68 · AppSalt, Backdoor, Badbox, GaGaNode, HiddenView
Prolonged DDoS Attack Hits Cyprus Bank for 200 Hours
A distributed denial-of-service (DDoS) attack targeted a bank in Cyprus, lasting 200 hours during the third quarter of 2026, according to Qrator Labs. This incident is significantly longer than any recorded attacks in 2025 and more than 2.5 times the duration of the longest attack in the previous quarter. The financial technology sector was the most affected, accounting for 31.3% of all DDoS attacks in that period. The attack underscores the growing risks for financial institutions in Cyprus, which is a hub for online trading and financial services. Regulators are emphasizing the need for firms to demonstrate resilience against such cyber incidents, in line with the EU's Digital Operational Resilience Act (DORA). New reporting requirements under DORA mandate that firms quantify and report the financial impact of major incidents. The scale of DDoS attacks is also increasing, with the largest botnet observed reaching 3.56 million devices, a 70% increase from the previous quarter.
Malware · 2 sources · score 51
New on leak sites
27 victims listed on ransomware leak sites by 12 groups in the 7 days before this issue. The most active:
Get the next one by email
The technology digest is free and arrives on Tuesdays. One click to leave.
Subscribe to the technology digest
A free account turns the digest into a personal watchlist: choose what you want to follow.