Daily Briefing — Thursday 29 October 2026

The day in cybersecurity, in plain English.

Volt Typhoon Used Covert Silent Train Network in Four Zero-Day Exploitation Campaigns

The China-linked espionage group Volt Typhoon has been linked to a covert access network called Silent Train, now disrupted, which was used for zero-day exploitation and long-term access. First identified in late 2023, the network used rotating chains of compromised devices to hide the group's activity.

Read the full story (The Hacker News)

Hackers Exploited Cisco SD-WAN Flaw to Plant Malware Built to Steal Encryption Keys

Attackers exploited a critical Cisco Catalyst SD-WAN flaw, fixed in February, to plant custom malware on the systems that control an organisation's SD-WAN network. The malware, called KeyDrift, is designed to copy the keys that encrypt traffic between sites and store them for later use.

Read the full story (The Hacker News)

Attacker Tried to Exploit Alpine Linux’s GitLab via CVSS 10.0 Flaw Its Ruby Left Open

An attacker tried to exploit a critical GitLab vulnerability, CVE-2026-97229 (10.0), on Alpine Linux's own GitLab server a week after GitLab released a fix. Alpine found no evidence the attack worked, but could not rule it out, so it rebuilt the server from scratch and reset every account password.

Read the full story (The Hacker News)

Sony ISP subsidiary data breach exposes 2.5 million customer records

Sony Network Communications has confirmed a data breach affecting about 2.5 million records. The records contain personal information belonging to current and former customers.

Read the full story (BleepingComputer)

PHP2Shell Attack Roots 25 Servers, Breaches U.S. Government-Affiliated Network

Researchers have disclosed an apparently AI-assisted attack by a suspected China-linked actor that used the PHP2Shell vulnerabilities to breach exposed systems. The activity, observed on 25 October, rooted 25 servers and reached a US government-affiliated network.

Read the full story (The Hacker News)

Hackers Target Critical Oracle E-Business Suite RCE Flaw Days After Security Patch

Threat actors have begun probing for a newly patched critical flaw in Oracle E-Business Suite, CVE-2026-101767 (9.8), an improper authentication issue. The probing began just days after the security patch was released.

Read the full story (The Hacker News)

China-Linked Hackers Exploited VMware ESX Zero-Day to Reduce Audit Trail Visibility

CISA has added a Broadcom VMware ESX flaw to its Known Exploited Vulnerabilities catalog after CrowdStrike revealed it was weaponised by the China-linked actor Warp Panda. The flaw was used to reduce the visibility of audit trails, making attacks harder to trace.

Read the full story (The Hacker News)

Telegram Android Flaw Lets Attackers Run Code When Users Answer Voice Calls

A flaw in Telegram for Android allowed an attacker to run code on a victim's phone via a voice call once the victim answered, according to security startup NebuSec. The attacker needed only an ordinary Telegram account, and Telegram fixed the flaw in version 12.10.4 of the app.

Read the full story (The Hacker News)