Ivanti KEV Alert, DHS Staff-Data Leak, and Volt Typhoon's Covert Relay Network

CISA adds actively exploited Ivanti Connect Secure flaws to KEV catalog

CISA added two new entries to its Known Exploited Vulnerabilities Catalog on October 30, 2026: CVE-2026-111357, a missing-authentication flaw in Ivanti Connect Secure, and CVE-2026-118527, a predictable-identifier bug in the same product, both based on evidence of active exploitation. Under Binding Operational Directive 26-04, federal civilian agencies must prioritize remediation of KEV-listed vulnerabilities on internet-facing assets that grant full control post-exploitation. CISA encourages all organizations, not just federal agencies, to adopt the same risk-based patching approach for these actively exploited Ivanti Connect Secure flaws. (CISA)

Volt Typhoon used a rotating relay network to hide intrusions into US infrastructure

Lumen's Black Lotus Labs disclosed that Chinese state-sponsored group Volt Typhoon has been routing its most sensitive intrusions through a constantly rotating relay network called Silent Train, built from compromised SOHO/IoT devices and enterprise appliances including Fortinet, Cisco, PRTG and CyberPanel systems. The group exploited zero-days in Versa Director, N-Able N-Central, Cisco Catalyst SD-WAN and VeloCloud Orchestrator to reach control-plane infrastructure with little lateral movement. Victims span US government entities, telecom providers, defense contractors, MSPs and critical-infrastructure organizations in water, energy and transportation sectors. (Help Net Security)

Chinese actors chained VMware ESX and Linux zero-days to root firewalls

CrowdStrike reported that China-nexus group Warp Panda exploited an insufficient-logging flaw in Broadcom's VMware ESX hypervisor, CVE-2026-41709, as a zero-day to reduce audit-trail visibility during intrusions into legal-sector targets; CISA added it to the KEV catalog on October 28 with a November 11 remediation deadline. Separately, researchers at Dream found a China-nexus actor chaining the Fragnesia Linux kernel flaw with PHP2Shell vulnerabilities to root 25 firewalls across the US, Japan, Taiwan and South Korea, while Cisco confirmed a separate firewall flaw, CVE-2026-76418, being exploited to crash devices. (Help Net Security)

Attackers probe patched Oracle E-Business Suite SQL injection flaw

Threat-intel firm Defused detected the first exploitation attempts against CVE-2026-101767, a CVSS 9.8 unauthenticated SQL injection in Oracle E-Business Suite's Thin Client Framework servlet that chains to remote code execution, beginning October 27. The flaw affects EBS Application Object Library versions 12.2.3 to 12.2.15 and was fixed in Oracle's October 20 patch release. Censys counted 2,246 internet-facing EBS web properties, and Horizon3.ai advises removing the vulnerable servlet from URL firewall allowlists until patches are applied. (Help Net Security)

Hacktivists leak 41,000 DHS staff records, exposing undercover agents

A hacktivist group calling itself Department of Peace leaked names, offices, contact details and assignments of more than 41,000 DHS employees, published via DDoSecrets on October 28 as the dataset "Icepick." The hacktivists say the records came from a DHS Okta single sign-on service; Okta told Reuters it found no evidence of compromise to its systems. DHS said it is "aware of a potential breach" and is working to address the situation. The leak exposes undercover ICE and HSI personnel and follows breaches at the FBI and Pentagon in the prior month. (Help Net Security)

345,000 email addresses exposed in breach at Germany's AfD party

Have I Been Pwned added a breach disclosing over 345,000 unique email addresses tied to Germany's AfD party, stemming from a September 2026 intrusion. Investigative reporting traced the attackers' entry to a poorly secured WordPress site, from which they reached the party's mail management system, changed officials' passwords and exfiltrated data in two separate break-ins on September 9 and 14. AfD confirmed the breach in an October 20 statement but has disputed the timeline given by researchers and the hackers themselves. (Help Net Security)

University of Utah names first Enterprise CIO, formalizes CISO role

The University of Utah named Donna Roach as its first Enterprise Chief Information Officer, effective November 1, a new role meant to align technology strategy, cybersecurity, data and AI investments across the university's academic, research and health-sciences enterprises. As part of the restructuring, Trevor Long was confirmed as CISO of the university's information security function after serving in an interim capacity, continuing responsibility for protecting the institution's technology and critical infrastructure. (University of Utah Communications)