Here are today’s top cybersecurity stories for Wednesday, October 28, 2026.
Hackers Target Critical Oracle E-Business Suite Flaw Days After Patch
Defused Cyber reports attackers are probing CVE-2026-101767, a CVSS 9.8 unauthenticated SQL injection in the Thin Client Framework servlet of Oracle E-Business Suite. The flaw chains to remote code execution. Oracle fixed it in the October Critical Patch Update, and Horizon3.ai researchers reported it on July 24. The Hacker News
Volt Typhoon Hides Zero-Day Attacks Using Silent Train Framework
Black Lotus Labs, the research arm of Lumen, describes a Volt Typhoon framework built on rotating chains of compromised devices. The group used at least four zero-days in management platforms, including VeloCloud Orchestrator and Cisco Catalyst SD-WAN. Targets include telecommunications, utilities, defense contractors, and managed service providers. BleepingComputer
Critical 16-Year-Old UEFI Flaw Runs Code Before Secure Boot on Network-Booting Servers
TianoCore rated CVE-2026-97631 at 9.5 in its advisory. The flaw sits in the PXE network-boot driver of EDK II and dates to a November 2010 commit. No stable release carries the fix, and no exploitation is known. The Hacker News
Microsoft Urges Entra ID Admins to Migrate Users to Passkeys
Microsoft will retire its native SMS and voice authentication for Entra ID workforce tenants on February 1, 2027. Message Center update MC1528000 reminds administrators to move users to phishing-resistant methods. Microsoft cites phishing and SIM-swap attacks as the reason. BleepingComputer
Sony ISP Subsidiary Data Breach Exposes 2.5 Million Customer Records
Sony Network Communications says an unauthorized party reached its So-net member database on October 19. The 2,585,481 records include names, phone numbers, email addresses, and dates of birth. Sony reports no banking or payment card data was exposed. BleepingComputer
Adobe Fixes 8 Critical Campaign Classic Flaws
Adobe patched eight Campaign Classic flaws in version 7.4.4 build 9403. Four carry a CVSS score of 9.9 and allow code execution or security bypass. Adobe also fixed a CVSS 9.6 code injection flaw in Connect, and reports no exploitation in the wild. The Hacker News
HPE Patches Dozens of Critical Flaws in Networking Products
HPE released fixes for dozens of critical flaws in its networking products. Eight of the flaws carry maximum severity and allow remote code execution or authentication bypass. SecurityWeek
Vendor Key Leak Puts Data of 238,000 Denver Health Plan Members at Risk
A leaked SquareML access key allowed access to a database holding personal and health information for 238,000 Denver Health plan members. The exposure stems from a vendor credential leak. SecurityWeek
Nefilim and Hive Ransomware Affiliate Gets 70 Months in Prison
A Ukrainian national received a 70-month prison sentence for his role in ransomware attacks. The attacks hit hospitals, government entities, and high-revenue businesses worldwide between 2018 and 2021. BleepingComputer
Hackers Hijack Convertr Analytics Script to Steal Payment Card Data
A card-skimming group reportedly compromised a shared analytics script used by the Convertr e-commerce platform. The script stole shoppers’ payment data during checkout. BleepingComputer
Stay tuned for today’s in-depth analysis posts.
