WaperCISA confirmed active exploitation affecting Brotli and Adobe Commerce, while a Sony subsidiary disclosed a breach involving approximately 2.5 million customer records.
Cybersecurity8 items
Other major developments include widespread public-service disruption in Moldova and new details of PHP2Shell attacks.
New7
CISA flags exploited Brotli and Adobe Commerce vulnerabilities
CISA added vulnerabilities affecting Google's Brotli decoder library and Adobe Commerce/Magento to its Known Exploited Vulnerabilities catalog. The reports describe Node2Shell exploitation and PolyShell attacks breaching hundreds of stores.
Why it matters: Organizations using affected components face confirmed exploitation, making exposure assessment and remediation urgent.
Sony ISP subsidiary confirms breach of approximately 2.5 million customer records
Sony Network Communications confirmed a data breach compromising approximately 2.5 million records containing personal information belonging to current and former customers.
Why it matters: The scale and inclusion of former customers broaden the population potentially exposed to misuse of personal information.
Moldova takes more than 80 public services offline after cyberattack
Moldova temporarily shut down 82 online public services after attackers stole personal and financial data on 750,000 citizens, roughly one third of its population. Attackers tried to regain access after being evicted, while the digital agency began restoring services.
Why it matters: The breach highlights how a large-scale data theft can disrupt public services and require continued defense against attackers during recovery.
Exploited Oracle PeopleSoft vulnerability comprises three chained flaws
Researchers said the PeopleSoft vulnerability exploited by ShinyHunters since May consists of three chained flaws. Oracle patched all three in June under CVE-2026-35273; the chain begins with server-side request forgery reaching an internal management interface.
Why it matters: The disclosure clarifies how attackers crossed internal trust boundaries and identifies the patch covering the full chain.
Volt Typhoon linked to Silent Train network supporting zero-day campaigns
Researchers linked Volt Typhoon to Silent Train, a now-disrupted covert access network used in four zero-day exploitation campaigns. It relied on rotating chains of compromised SOHO, IoT and enterprise devices.
Why it matters: The findings expose how compromised infrastructure can conceal espionage operations and support access to high-value targets.
Talos details KeyDrift deployment through Cisco SD-WAN authentication bypass
Cisco Talos identified UAT-11473 as an advanced threat actor exploiting CVE-2026-20127 in Cisco SD-WAN Catalyst Controller instances. The authentication bypass enabled unauthorized access and deployment of KeyDrift.
Why it matters: The research connects an exploited controller vulnerability to a specific attacker and payload, informing investigation of affected infrastructure.
Interpol's third Serengeti operation yields 1,462 arrests and $105 million recovered
Interpol's third annual Operation Serengeti led to 1,462 arrests across 20 African countries and the United States. Authorities recovered $105 million in stolen funds.
Why it matters: The operation represents a substantial cross-border enforcement effort and recovery of cybercrime proceeds.
Follow-ups1
PHP2Shell attack roots 25 servers and breaches US government-affiliated network
Researchers reported an October 25 attack combining PHP2Shell with a kernel privilege-escalation exploit to gain root access on 25 servers. The activity breached a US government-affiliated network and was attributed to a suspected China-nexus actor, with possible AI assistance.
Why it matters: The findings show concrete compromise and privilege escalation beyond previously reported exploitation of the PHP flaws.