apt / cisco / cybersecurity / keydrift / malware / sd-wan / volt-typhoon / zero-day
Cisco Talos researchers report that a newly identified threat group tracked as UAT-11473 is exploiting CVE-2026-20127, a maximum-severity authentication bypass in Cisco Catalyst SD-WAN Controllers, to install a custom malware framework called KeyDrift that maintains persistent access and steals cryptographic keying material. The activity targets space, satellite, defense, aerospace, and policy research organizations, and may overlap with Volt Typhoon's Silent Train covert access network.
THE WIRE
Primary documents and established newsrooms, organized into one clear feed.
cybersecurity / eclypsium / infratrust / kev / network-infrastructure / patch-management / php2shell / vulnerabilities
Eclypsium's October InfraTrust Pulse report tracks 133 new security advisories covering 2,813 vulnerabilities, many of them actively exploited, and warns that PHP flaws known as PHP2Shell put the management interfaces of firewalls, VPNs, and other network appliances at risk.
cryptomining / cybersecurity / github / hugging-face / malware / ransomware-adjacent / remote-access-trojan / supply-chain
A cryptomining and backdoor campaign abusing Hugging Face model repositories resurfaced within days of being removed, with its flagship model downloaded more than 28,000 times, while researchers separately flagged a fake Solana starter kit on GitHub designed to trick AI coding agents into installing a remote access trojan.
amadeus / ana / aviation / cybersecurity / data-breach / japan-airlines / passenger-data / third-party-breach
Japan Airlines says a breach of Amadeus's Passenger Service System exposed personal data of roughly 92,000 customers, while All Nippon Airways, Asiana Airlines and Korean Air have also reported impact tied to the same flaw.
crypto-theft / cybersecurity / debugbear / hudson-rock / javascript-malware / polymarket / prediction-markets / supply-chain-attack
Prediction market platform Polymarket temporarily suspended trading on Thursday after attackers compromised infrastructure belonging to website monitoring service DebugBear to distribute malicious JavaScript designed to drain users' cryptocurrency and prediction-market holdings, with roughly $2.5 million in assets traced to a suspected attacker wallet.
browser-hijacking / chrome-extensions / cybersecurity / google-chrome / malware / socket
Researchers at Socket have identified 319 Chrome extensions with a combined 13.4 million installations that hijacked users' searches through operator-controlled proxy servers to generate referral revenue from Bing and Yahoo, and warn the infrastructure could easily be repurposed for phishing or malware distribution.
asa / cisco / cve-2026-76418 / cybersecurity / denial-of-service / firewall / vpn / zero-day
Cisco has released security updates for a denial-of-service vulnerability, tracked as CVE-2026-76418, that unauthenticated attackers are exploiting in the wild to remotely crash firewall devices running ASA and FTD software with SSL VPN enabled.
bulletproof-hosting / chainalysis / cybersecurity / doj / fbi / ransomware / seizure / virtualine
U.S. law enforcement, working with international partners, has seized the primary domain of Virtualine, a bulletproof hosting service accused of facilitating ransomware, phishing, spamming, and the distribution of child abuse material, while police in the Netherlands seized dozens of physical servers and identified more than 3,000 customers.
cybersecurity / data-breach / japan / ntt-docomo / personal-data / phishing / so-net / sony-network-communications
Sony Network Communications has confirmed a data breach affecting approximately 2.5 million customer records at its So-net internet service, including 443,495 records tied to NTT Docomo's Docomo Hikari service. Neither company has confirmed misuse of the exposed data as of October 27.
black-lotus-labs / cisa / critical-infrastructure / cybersecurity / lumen / silent-train / volt-typhoon / zero-day
Chinese state-sponsored group Volt Typhoon has used a rotating relay framework dubbed Silent Train for at least three years to conceal zero-day attacks against high-value targets, according to Black Lotus Labs at Lumen.
authentication / cybersecurity / entra-id / microsoft / passkeys / security
Microsoft is urging Entra ID administrators to migrate users to phishing-resistant authentication methods before retiring SMS and voice authentication on February 1, 2027. This critical transition is necessary to mitigate risks associated with phishing and SIM-swap attacks.
PUBLISHING STANDARD