All Articles

The week in one line: Attackers' claims ran ahead of what the organizations confirmed. The DHS leak, the UNM Health attack and Navigate360's late confirmation each left a gap between what was asserted and what was verified, while edge devices and suppliers carried the week's exploitation.

The week's most significant incidents

1. DHS personnel records published, with the Okta source claim unresolved

Distributed Denial of Secrets published records on more than 41,000 Department of Homeland Security employees and contractors on October 28, which it says a hacktivist group called the Department of Peace supplied. The group says the data came from an Okta single sign-on service used at DHS. Okta says it has no evidence its data or systems were compromised, DHS had not commented at publication, and no entry method has been shown. Reporting describes group names and organizational roles, and Cyber Security News adds more than 55,000 permission groups. DHS later said it is working to address the leak. A directory with role and group data is a map of who holds which access, which is why it matters beyond the headline. A vendor denial and an attacker claim are both inputs, and only your own tenant logs can tell you what happened in your environment.

Re-verified against CyberScoop, which matches the 41,000 figure, the publisher, the Okta claim and Okta's denial. CyberScoop did not mention the permission-group count, which comes from Cyber Security News, and it reports the searchable site was taken offline by Thursday morning and that current CISA employees appear in the data. See the October 28 and October 29 editions for the SSO checklist. Sources: CyberScoop, Cyber Security News, Help Net Security

2. Cisco ASA and FTD zero-day can force SSL VPN firewalls to reload

Cisco disclosed CVE-2026-76418 on October 28 and confirmed exploitation. A logic error in how Secure Firewall ASA and FTD handle secondary authentication on an SSL VPN tunnel group lets an unauthenticated attacker force a reload, which drops every VPN session on the device. Exposure depends on configuration: SSL VPN enabled on at least one interface plus secondary authentication on a tunnel group, including DefaultWEBVPNGroup. Cisco has no workaround that fixes it, and the stopgap is to disable secondary authentication on the affected groups. Cisco has shared no indicators or victim details. Shadowserver tracks more than 51,000 internet-exposed ASA SSL VPN devices, and how many use secondary authentication is not known. For a company with one VPN head-end, a repeatable reload is an outage risk, and repeated edge reloads can also mask other activity.

Re-verified against BleepingComputer (October 29), which matches the CVE ID, the trigger condition, confirmed exploitation and the mitigation. It does not list fixed release numbers, so use Cisco's advisory for your train. See the October 29 edition for the checklist. Sources: BleepingComputer, Cyber Security News

3. Volt Typhoon's Silent Train relay network, per Lumen

Lumen's Black Lotus Labs says Volt Typhoon rebuilt its covert infrastructure after the 2024 FBI disruption of the KV botnet, using a framework it calls Silent Train. Operators route through overseas servers and then chains of compromised home and small-office devices, with sessions that typically end within eight hours and tooling removed afterward. Lumen links the activity to zero-days in Cisco Catalyst SD-WAN, VeloCloud Orchestrator, N-able N-central and Versa Director, and says Quest KACE is suspected but not confirmed. Since early 2025 the framework has also held compromised enterprise systems for one to three months. Reported targets include telecoms, government, defense, utilities, managed service providers and IT firms, with California, Texas and Hawaii the most targeted states. Location-based controls will not catch access that arrives from ordinary U.S. residential addresses, so the defensive work is on management interfaces and logging.

Re-verified against BleepingComputer (October 28), which matches the framework, the relay design, the short sessions and the named zero-days. It adds the hybrid persistence detail and flags Quest KACE as suspected. A Nextgov report that Energy Department facilities were targeted rests on unnamed sources and is not confirmed. See the October 29 edition. Sources: BleepingComputer, Nextgov/FCW

4. UNM Health Sciences Center diverts ambulances after a cyberattack

The University of New Mexico Health Sciences Center reported a cybersecurity event on October 26. Containment began around 11 a.m., ambulances were diverted to other area systems between roughly 12:30 and 2:30 p.m., and appointments were cancelled for the rest of the day. Classes at four health sciences colleges were cancelled October 26 and 27, and critical systems were back online on October 27 with clinics resuming. UNM said its assessment, as of October 27, was that the event affected some end-user devices and did not penetrate core systems or servers. A group calling itself Byod claims about 36,000 machines and personal data, and those claims are unverified. The attack type has not been stated and the matter is under criminal investigation. The decision to isolate fast and divert patients is one your leadership should make in advance, with operational owners in the room.

Re-verified against UNM's own newsroom (October 28 update), which matches the dates, the two-hour diversion window and the restoration. The non-penetration finding is dated October 27 and is not repeated in the later update. See the October 27 edition for the tabletop checklist. Sources: UNM HSC Newsroom, BleepingComputer, Help Net Security

5. A planted instruction file can steer an AI coding agent

Forever Security found an AGENTS.md file in a customer's Downloads folder that told a coding agent to install an npm package named function-color, which The Hacker News ties to the MALFEX campaign. In a lab, the researchers reported that a planted file led OpenAI Codex to run a payload in about 90 percent of tests, using a harmless payload that opened the calculator. A planted CLAUDE.md redirected Claude Code's API traffic, exposed its OAuth token and led to code execution in roughly half of tests. How the file reached the customer is unknown, and real-world use of a download-based path is unconfirmed. The researchers say there is nothing for the vendors to patch, and the vendors recommend scoping agents to the project directory. The launch folder is a trust boundary most teams have never drawn.

Re-verified against BleepingComputer (October 25), which matches the finding and the discovery story. The Codex result used a harmless payload and the figure is 90 percent, and the Claude Code result involved the OAuth token and code execution, so those details are stated as the source gives them. See the October 25 edition for the checklist. Sources: BleepingComputer, The Hacker News

6. Follow-up: PHP2Shell, what changed since last week

PHP2Shell (CVE-2026-109618 and CVE-2026-109619) was covered in last week's weekly as a critical flaw under active probing. Three things changed this week. CISA added both flaws to its Known Exploited Vulnerabilities catalog on October 26 with an October 29 federal deadline, and said systems that cannot be patched, including PHP 8.1 and older, should come offline. Researchers at Dream then reported 25 servers rooted across the United States, Japan, Taiwan and South Korea, three of them in a U.S. government-affiliated environment. Earlier in the week Mandiant had seen no evidence of widescale successful exploitation, so the evidence moved from attempts to confirmed intrusions in about seven days. If your inventory and patching are done, the remaining work is hunting for footholds placed before the fix.

Re-verified against The Hacker News (October 28), which matches the 25 servers, the four countries and the three government-affiliated systems. Its timeline places compromises on October 23 and 24 while the lede cites October 25 activity, and the KEV dates come from CISA's October 26 alert as cited in the daily edition. See last week's October 17-23 weekly for the original coverage, and the October 26 and October 28 editions. Sources: The Hacker News, CISA

Also across the week

• Navigate360: confirmed on October 23 that an intruder copied several months of data, including Social Security numbers, seven months after a hacker's public claim about its P3 Global Intel unit. Officials in Nevada and Canada said the company shared only partial information, and Ontario police suspended use of the service.
• University of Copenhagen: disclosed a breach affecting about 525,000 people through a test environment, then reported a second attack on October 26.
• GMO Internet and Sony Network Communications: GMO says it will not pay a reported 8 billion yen demand after the Onamae Desktop Cloud intrusion, which could affect up to 26,739 servers. Sony disclosed 2,585,481 So-net and plala records, including passwords for 54,401 email addresses, and says main membership passwords and card data were not involved.
• Coinbase and Amplitude: Coinbase says customer contact data was exposed through an incident at analytics vendor Amplitude and that its own systems and funds were not affected. No count is confirmed.
• Tailscale SSH: a researcher published 11 unpatched findings in Tailscale SSH and headscale. They are lab results that need an existing foothold, and Tailscale has not confirmed them.
• CISA KEV additions: Collabora Online and Arista VeloCloud Orchestrator on October 23, then VMware ESX CVE-2026-41709 (tied by CrowdStrike to the China-nexus group Warp Panda, federal due date November 11), plus GitLab CVE-2026-97229 and a Linux kernel flaw nicknamed Fragnesia. The CISA catalog could not always be fetched, so several entries rest on agreeing secondary sources.
• Microsoft 365 token replay and LiteLLM: one report cites token replay against 97 accounts at 79 organizations, and, as a follow-up to last week's poisoned release, the LiteLLM project reported a release pipeline compromise. Both rest on a single source in our review.
• Quest Diagnostics and Oracle: Quest Diagnostics confirmed a Quanum data breach reported October 23, and Oracle's October Critical Patch Update carries 1,209 vulnerabilities, 95 of them critical.
• Ohio Auditor of State and AB InBev: the Ohio Auditor's office said an overseas cyberattack hit its web server and that it was not ransomware, and an Emperador group claim against AB InBev remains unconfirmed and single-sourced.
• BlackX, Brotli and a sentencing: the BlackX UEFI bootkit abuses the Baton Drop flaw to bypass Secure Boot, a Brotli decoder flaw (CVE-2026-111497) sits behind a Node.js code execution issue, and a court sentenced Stryzhak.

What to watch next week

FAQ

What was the biggest breach story of the week?
The DHS Icepick leak. Records on more than 41,000 DHS employees and contractors were published, the leakers named Okta as the source, and Okta says it has no evidence of compromise. The entry point is still unconfirmed.

Was Okta breached in the DHS leak?
Not confirmed. The group behind the leak says the data came from an Okta single sign-on service used at DHS, and Okta says it has no evidence its data or systems were compromised. No entry method has been shown.

Which products need action first?
Any PHP runtime that is not on 8.5.12, 8.4.27, 8.3.36 or 8.2.35 or a vendor backport, and Cisco ASA and FTD devices with SSL VPN and secondary authentication on a tunnel group. Both flaws are confirmed exploited.

Do planted AGENTS.md files mean AI coding agents are unsafe?
The researchers describe agents behaving as designed, with the risk coming from where they are launched. Keep agents out of Downloads and home folders, keep approval prompts on, and scope them to the project directory.

What should a CISO do first on Monday?
Review SSO administrator and directory export logs, write a one-page protocol for responding to attacker claims you cannot yet verify, check Cisco tunnel group settings, and hunt for PHP2Shell footholds placed before your patch.

More from the community: the CISO Platform Breach Intelligence hub, and peer resources on third-party risk, vulnerability management, and ransomware.

Corrections and takedown requests: CISO Platform is committed to accuracy and fairness. If any detail in this briefing is inaccurate, or if you represent an affected organization and would like a correction or removal, please contact us at pritha.aash@cisoplatform.com and we will review your request promptly.