Here are today’s top cybersecurity stories for Thursday, October 29, 2026.
Linux Kernel TCP Flaw With 9.8 CVSS Score Affects Ubuntu, Red Hat and Other Distributions
The kernel CVE team rates CVE-2026-98432 at 9.8, while Red Hat, Amazon, Oracle, and SUSE score it between 5.9 and 8.1. The race condition in IPv4 TCP connection setup causes a use-after-free. Anthropic says its AI model wrote a root exploit for servers with a multipath TCP listener, and Ubuntu and RHEL had no fixed kernel as of October 29. The Hacker News
Cisco Patches Actively Exploited ASA and FTD VPN Flaw Behind Firewall Crashes
CVE-2026-76418, rated CVSS 8.6, is a logic error in the Remote Access SSL VPN service when secondary authentication is set on a tunnel group. An unauthenticated attacker forces affected ASA and FTD devices to reload. Cisco says attackers are exploiting the flaw and has released patches. The Hacker News
Attackers Exploit PHP2Shell Flaws in Internet-Exposed Palo Alto Networks Management Interfaces
Palo Alto Networks reports active exploitation of CVE-2026-109618 and CVE-2026-109619, both CVSS 9.2, against PAN-OS management interfaces exposed to the internet. The PHP flaws allow unauthenticated remote code execution and were patched upstream on October 21. Dream separately reports a suspected China-nexus actor combined them with the Linux kernel flaw Fragnesia, CVE-2026-46300, and rooted 25 servers. The Hacker News
Hackers Exploited Cisco SD-WAN Flaw to Plant Malware Built to Steal Encryption Keys
Cisco Talos reports attackers exploited CVE-2026-20127, a CVSS 10.0 authentication bypass in Cisco Catalyst SD-WAN, to install KeyDrift malware. KeyDrift copies the AES key material protecting traffic between sites. Talos tracks the group as UAT-11473 and notes infrastructure overlap with the Silent Train network linked to Volt Typhoon. The Hacker News
Telegram Android Flaw Lets Attackers Run Code When Users Answer Voice Calls
NebuSec disclosed a flaw allowing an attacker with an ordinary Telegram account to run code on an Android phone once the victim answers a voice call. Versions 8.6.2 through 12.10.3 are affected and version 12.10.4 fixes the bug. The flaw has no CVE identifier, and it is unclear whether attackers have used it. The Hacker News
Fake ChatGPT and Claude Apps Abuse Signed Executables to Deploy Crypto Miners
Check Point Research analyzed the Yoba campaign, which uses fake GitHub projects posing as AI desktop apps such as GPT-5.6 Sol and Claude Opus. The YobaLoader malware sits beside signed OpenAI and Anthropic executables and loads through DLL sideloading. SEO poisoning is suspected as the delivery route. The Hacker News
26,400 Valid Cloud and AI Credentials Found Exposed in Public Gitee Repositories
Researcher Ben Zimmermann scanned 7.25 million public Gitee repositories and found 26,400 working credentials, including 9,473 Alibaba Cloud AccessKey pairs. He reported the findings to vendors on October 28 and has not confirmed the keys were revoked. The Hacker News
Attacker Tried to Exploit Alpine Linux’s GitLab via CVSS 10.0 Flaw Its Ruby Left Open
An attacker tried to exploit CVE-2026-97229 on Alpine Linux’s GitLab server a week after the fix was released. Alpine found no sign of success, rebuilt the server, and reset all passwords. Upgrading GitLab alone does not fix self-built or custom-container setups, which also need patched Ruby versions. The Hacker News
China-Linked Hackers Exploited VMware ESX Zero-Day to Reduce Audit Trail Visibility
CISA added CVE-2026-41709, a CVSS 2.7 logging flaw in Broadcom VMware ESX, to its Known Exploited Vulnerabilities catalog. CrowdStrike says the China-nexus group Warp Panda exploited it against US legal-sector targets to perform administrative actions without leaving logs. The Hacker News
Chrome and Firefox Updates Patch Over 200 Vulnerabilities
The Chrome 156 update fixes 52 bugs. Firefox 159 ships with 167 security patches. Together the two releases address more than 200 vulnerabilities. SecurityWeek
Long-Hidden Flaws Patched in EPICS Research Facility Control Software
An autonomous system found four flaws in EPICS Base. The flaws allow attackers to crash processes at particle accelerators and fusion labs. Patches are available. SecurityWeek
GitHub Launches npm Firewall to Block Malicious Packages Before Installation
GitHub’s npm firewall is in public preview for GitHub Enterprise Cloud customers. It inspects metadata requests and package downloads to block malicious npm packages during installation, guarding against AI agents and CI runners installing dependencies automatically. The Hacker News
Stay tuned for today’s in-depth analysis posts.
