12 stories · 4 sources · 1 critical · 1 high · ~13 min read
Coverage: Last 24 hours
Today’s Highlights
Several critical application, cloud, and platform vulnerabilities demand immediate defender action this cycle, with active exploitation attempts observed against high-profile enterprise software and ongoing phishing campaigns targeting Microsoft authentication flows. AI-driven exploit development and persistent targeting of critical infrastructure highlight the need for continuous patching, exploitation monitoring, and rapid incident response planning across asset classes. Key stories today include exploitable flaws in Oracle E-Business Suite, an urgent ICS/OT patch for EPICS, and a large-scale phishing campaign abusing Microsoft cloud authentication.
Table of Contents
- Hackers Start Probing Fresh Oracle EBS Vulnerability
- Long-Hidden Flaws Patched in EPICS Research Facility Control Software
- Japan’s GMO Offers $1 Million Bounty to Catch Hackers Behind FX Trading Cloud Breach
- ICE Is Running One of the Largest Anti-Left Surveillance Operations in US History
- Studying Fraudulent North Korean IT Workers
- Anthropic’s Unreleased AI Model Chains Flaws Into Working Chrome, Safari, Windows and Linux Exploits
- CISA Warns of Node2Shell Exploitation as Honeypots Log Attack Attempts
Critical High Medium Low
Top Stories
Hackers Start Probing Fresh Oracle EBS Vulnerability
Source: SecurityWeek | Published: Oct 28 | Risk: CRITICAL | Impacted: Oracle E-Business Suite environments, ERP administrators, Enterprises with public-facing EBS | Topics: Threat Intel / Vulnerability
What happened: CVE-2026-101767 is an unauthenticated SQL injection that can be exploited for remote code execution. The post Hackers Start Probing Fresh Oracle EBS Vulnerability appeared first on SecurityWeek.
Why it matters: Unauthenticated SQL injection in enterprise resource planning systems exposes organizations to complete database compromise, potentially resulting in data theft, financial fraud, or business process disruption.
How it works: CVE-2026-101767 is an unauthenticated SQL injection flaw affecting Oracle E-Business Suite, widely used as an ERP solution. Attackers exploiting this can execute database commands remotely, potentially gaining control over integrated business processes and sensitive datasets.
Affected / Fix: Patch for CVE-2026-101767 is available from Oracle; affected versions not specified in the summary.
Practitioner Perspective
Oracle E-Business Suite deployments are prime targets due to the concentration of sensitive finance, HR, and operational data. Active probing for CVE-2026-101767 suggests exploitation is imminent, especially on internet-exposed portals. Many organizations run legacy versions with complex upgrade paths, which can delay remediation. Teams need to move beyond patch advisories and validate that compensating controls, such as WAF signatures and network segmentation, are functionally deployed before external exposure is reduced.
Recommended Actions
- Apply Oracle’s patch for CVE-2026-101767 to all E-Business Suite instances, prioritizing internet-facing servers
- Analyze web server and database logs for signs of SQL injection or suspicious error conditions on login flows
- Confirm that Web Application Firewall (WAF) rules are blocking known exploit payloads for CVE-2026-101767
- Restrict direct internet access to EBS interfaces until full validation and patching are completed
Long-Hidden Flaws Patched in EPICS Research Facility Control Software
Source: SecurityWeek | Published: Oct 28 | Risk: HIGH | Impacted: Research facilities, ICS/OT operators, Scientific campuses running EPICS | Topics: Threat Intel / Cloud
What happened: Four vulnerabilities in EPICS Base, a software toolkit used in research facilities, were discovered by Causal Security’s Cipher system. These flaws, affecting versions 7.0.10 and earlier, could lead to process crashes, memory corruption, and potential remote code execution. CISA recommends updating to version 7.0.11 to mitigate these risks.
Why it matters: Unpatched vulnerabilities in operational technology can allow attackers to disrupt research operations or potentially achieve persistence in environments that are difficult to triage and restore.
How it works: EPICS (Experimental Physics and Industrial Control System) Base is foundational middleware for monitoring and automating research and laboratory processes. These vulnerabilities can be exploited remotely to crash systems or potentially execute code through malformed network messages.
Affected / Fix: Affects EPICS Base 7.0.10 and earlier; update to 7.0.11 to mitigate.
Practitioner Perspective
EPICS is heavily used in research and scientific facilities, often running uninterrupted for years on under-managed assets. Attackers have begun targeting such environments for both espionage and as pivots into broader campus infrastructure. Given the potential for remote code execution, defenders must work with operations and facilities management to schedule downtimes for patching and ensure test environments are available for compatibility validation. Response playbooks should be updated given rising complexity in ICS/OT exploitation chains.
Recommended Actions
- Deploy EPICS Base version 7.0.11 across all production and test environments as recommended by CISA
- Run local network traffic analysis in research and control networks for signs of process crashes or exploit attempts
- Coordinate patch timing with OT/facilities leads to minimize downtime and maintain forensic readiness
- Update incident response procedures to account for new EPICS exploit scenarios
Emerging Signals
Japan’s GMO Offers $1 Million Bounty to Catch Hackers Behind FX Trading Cloud Breach
Source: The Hacker News | Published: Oct 28 | Risk: MEDIUM | Impacted: Cloud service providers, Windows FX trading platforms, Japan-based user accounts | Topics: Exploit / Cloud
What happened: Japan’s GMO Internet Group is offering up to $1 million in total for tips that help catch the attackers who breached its Onamae.com Desktop Cloud service, after refusing to pay an extortion demand. The reward program opened on October 28 and pays only if a tip helps lead to an arrest or an international wanted notice. The service hosts Windows desktops used for FX.
Why it matters: A proactive approach to apprehend threat actors after a significant cloud breach incentivizes community participation and signals unwillingness to negotiate with criminals. This may affect industry best practices and law enforcement cooperation in response to extortion events.
How it works: The company has publicized a reward program, paying out only for actionable tips leading to arrests or international warrants, in response to a cyber extortion demand following an attack on cloud-hosted trading environments.
Practitioner Perspective
Cloud desktop infrastructure, especially in the financial trading sector, is a high-value target for threat actors seeking financial gain or access to privileged data. Defensive postures must recognize the business and reputational stakes of breach extortion and weigh transparency-centric response actions. This bounty approach illustrates a preference for international cooperation over criminal negotiation and may shift community standards for post-breach behavior.
Recommended Actions
- Monitor impacted cloud services and user accounts for signs of follow-on fraud or credential abuse
- Review extortion response and law enforcement escalation playbooks to incorporate rewards programs where appropriate
ICE Is Running One of the Largest Anti-Left Surveillance Operations in US History
Source: WIRED Security | Published: Oct 28 | Risk: MEDIUM | Impacted: Privacy/compliance teams, Organizations with activist employees, US-based entities handling sensitive data | Topics: Policy / Privacy
What happened: ICE’s Homeland Security Investigations is engaged in far-reaching spying against left-wing activists that rivals the FBI and CIA crackdowns on the Civil Rights and anti-war movements.
Why it matters: Expanded domestic surveillance programs can expose politically active employees to state monitoring, potentially impacting organizational privacy compliance and whistleblower risk.
How it works: Surveillance activities may involve collection of electronic and in-person activity data, drawing on partnerships between US federal agencies and technology companies. Programs often leverage subpoena power and data aggregation to monitor targeted individuals and groups.
Practitioner Perspective
Security and privacy teams must monitor how government surveillance intersects with workforce safety, privacy policy, and regulatory reporting. Even if your organization is not directly targeted, users may engage in activities that result in external monitoring of private communications or travel. Evaluate data minimization practices and build trust with staff by ensuring robust response to lawful process and transparent disclosure practices. Privacy teams should be equipped to respond to employee inquiries around law enforcement data requests.
Recommended Actions
- Review internal response protocol to government or law enforcement data requests for scope and privacy compliance
- Validate privacy notice language and legal process transparency for impacted employee or customer data
- Brief HR and legal teams on organizational exposure to state surveillance based on the latest reporting
- Reassess monitoring policies to ensure they reflect organizational values and current threat intelligence
Studying Fraudulent North Korean IT Workers
Source: Schneier on Security | Published: Oct 28 | Risk: MEDIUM | Impacted: Remote-first IT organizations, Companies using global contractors, Technology supply chains | Topics: Policy / Cryptography
What happened: An Arizona woman was sentenced to eight-and-a-half years in prison for aiding North Korean IT workers to infiltrate U.S. companies by hosting their computers in her home, making it appear they were U.S.-based. This scheme resulted in over $17 million in illicit revenue. (schneier.com)
Why it matters: Insider threats facilitated by supply chain manipulation can introduce sanctioned country actors into sensitive IT roles, increasing exposure to IP theft, financial fraud, or regulatory penalties.
How it works: North Korean actors exploited weaknesses in remote work verification by relaying network connections from US-located hosts, making fraudulent IT workers appear local. This technique bypasses basic IP geofencing and allows sanctioned organizations to earn revenue and potentially access sensitive business resources.
Practitioner Perspective
Firms leveraging remote IT labor, especially through indirect hiring, face a growing risk of sanctioned nation-state actors embedding themselves in development, operations, or support workflows. Attackers have demonstrated capability to remain undetected by proxying traffic from US networks to mask true origin. Enhanced due diligence on contractor identity and remote access monitoring is now critical. Prioritize identity verification for high-value IT functions and be aware that threat actors may leverage hosts and intermediaries for plausible deniability.
Recommended Actions
- Require identity verification for all remote IT hires, with recurring checks for privileged contractors
- Audit VPN and access logs for geolocation anomalies, flag traffic where endpoint locations are inconsistent with HR records
- Educate HR and hiring managers about risks of proxying activity from sanctioned actors, and strengthen procurement controls
Exploits & CVEs
Anthropic’s Unreleased AI Model Chains Flaws Into Working Chrome, Safari, Windows and Linux Exploits
Source: The Hacker News | Published: Oct 28 | Risk: MEDIUM | Impacted: Browser vendors, OS security teams, AI research communities | Topics: Exploit / Cloud
What happened: An unreleased Anthropic AI model found security flaws in Chrome, Safari, Android, Windows, and Linux and chained them into working proof-of-concept exploits, the company said in its latest report. The exploits were built in the lab after the model was prompted, not seen in any real attack, and Anthropic reported every flaw to the vendor first, so all of them.
Why it matters: Demonstrates the expanding capacity for AI to discover and weaponize chained vulnerabilities across platforms, accelerating offensive research and raising the bar for patch development and coordinated disclosure.
How it works: The Anthropic model used large language model reasoning to discover, chain, and exploit vulnerabilities in major browser and operating system targets. Exploits were generated in a research setting and disclosed responsibly to affected vendors, with fixes pending in normal product pipelines.
Practitioner Perspective
Defenders must anticipate new offensive techniques where AI-driven vulnerability discovery compresses zero-day timelines and broadens attack surface mapping. It is essential to work closely with vendors for timely patch application and to participate in information sharing around rapid vulnerability chains. Expect more complex exploit chains in future incidents due to AI-assisted chaining logic.
Recommended Actions
- Monitor browser and OS vendor advisories for any releases tied to Anthropic-coordinated disclosures
- Collaborate with threat intelligence partners for early warning of AI-discovered chained vulnerabilities
CISA Warns of Node2Shell Exploitation as Honeypots Log Attack Attempts
Source: SecurityWeek | Published: Oct 28 | Risk: MEDIUM | Impacted: Server admins, DevOps teams, Linux system operators | Topics: Exploit / Threat Intel
What happened: CISA added the Brotli flaw to its KEV catalog, and two honeypot operators logged attempts, including one that used a broken exploit. The post CISA Warns of Node2Shell Exploitation as Honeypots Log Attack Attempts appeared first on SecurityWeek.
Why it matters: Rapid weaponization and attempted exploitation following KEV listing reinforces the importance of promptly patching fast-moving public vulnerabilities before reliable exploit code emerges.
How it works: The Node2Shell vulnerability involves issues with Brotli compression libraries that can be exploited when attackers target unpatched Linux environments. While some observed attacks have used faulty exploits, persistence of probes indicates attackers are actively developing their methods.
Practitioner Perspective
Teams must accelerate patch cycles for KEV-listed vulnerabilities, treating even “proof-of-concept only” or low-sophistication scans as indicators that more robust attacks are forthcoming. Monitor for exploit attempts and ensure controls are tested for defensive efficacy as odds of opportunistic compromise rise rapidly once a CVE enters the public exploit ecosystem.
Recommended Actions
- Patch Brotli compression libraries promptly on all Linux servers per CISA KEV guidance
- Monitor log files for exploitation attempts and correlate with honeypot and threat intelligence feeds
Also Today
- Adobe Fixes 8 Critical Campaign Classic Flaws Allowing Code Execution and Security Bypass: Updates address code injection, SQL injection, and privilege escalation flaws in Campaign Classic for Windows and Linux versions through 7.4.4 build 9402.
- American Organizations Under Attack: Skyw4lker Device Code Phishing Campaign Exposed: The Skyw4lker phishing operation leverages business-themed lures and Google infrastructure to abuse Microsoft authentication in U.S. companies.
- FBI Seizes Virtualine Domain Over Alleged Criminal Hosting and Bitcoin Money Laundering: U.S. authorities have taken down the domain for a bulletproof host service facilitating illicit content and bitcoin laundering.
- Nobody Trusts the Security Questionnaire. We Rely on It Anyway.: Organizations depend on B2B security questionnaires despite widespread skepticism about their accuracy or utility.
- Secrets Management Firm Infisical Valued at $600 Million After $40 Million Raise: San Francisco-based Infisical received new funding to expand its secrets management platform, now serving over 1,300 organizations.
Defensive Actions
- Deploy EPICS Base version 7.0.11 across all research and ICS environments as prioritized by CISA guidance.
- Immediately apply Oracle’s patch for CVE-2026-101767 to all Oracle E-Business Suite instances, with special attention to publicly exposed portals.
- Search Azure Active Directory logs for suspicious device code grant and OAuth session activity related to the Skyw4lker phishing campaign.
- Patch Adobe Campaign Classic to version 7.4.4 build 9403 on all affected endpoints.
- Review contractor onboarding and access logs for signs of proxy-focused supply chain subversion, particularly in remote-first teams.
- Pair B2B security questionnaires with evidence-based technical audits for critical vendors.
- Review incident response and legal escalation protocols for cloud extortion and surveillance data requests.
- Patch Brotli and other KEV-listed vulnerabilities promptly in line with CISA and threat intelligence advisories.
What We’re Watching
- Potential surge in exploitation of Oracle EBS CVE-2026-101767 with observed active probing.
- Reports and vendor advisories following Anthropic’s AI-discovered, chained exploits in Chrome, Safari, Windows, and Linux ecosystems.
- Widespread phishing using Microsoft device code flows and Skyw4lker tactics targeting U.S. regulated sectors.
- Lateral movement or post-exploitation activity in EPICS-based research networks as patch adoption progresses.
- Retaliatory or opportunistic extortion attempts targeting cloud infrastructure in the wake of public bounty announcements.
Found this briefing useful? Follow the blog to get the next one as soon as it is published, and pass it along to a colleague who owns patching.
Categories: Cybersecurity Blog, Cybersecurity News
Leave a Reply