Daily Summary of Cybersecurity · Final editionThursday 29 October 2026 · UTC
Cybersecurity News: 29 October 2026
DHS staff data leaked as Chinese hackers exploit VMware, Palo Alto and Cisco flaws
The fallout grew from a hacktivist leak exposing more than 41,000 US Department of Homeland Security employees, and DHS said it was working to address a potential breach. Researchers tied China-linked groups to exploitation of a VMware ESX logging flaw and a PHP2Shell and Linux kernel exploit chain, and Palo Alto Networks confirmed attacks on its firewall management interfaces.
Cisco confirmed that a new firewall VPN zero-day is being exploited, and Adobe, Veeam and Juniper patched critical bugs.
Security firm Dream says a China-nexus actor ran an AI-assisted campaign that paired the PHP2Shell flaws (CVE-2026-109618 and CVE-2026-109619) with the Fragnesia Linux kernel privilege escalation bug (CVE-2026-46300). Dream says the campaign rooted 25 servers in the US, Japan, Taiwan and South Korea, then took credentials from Active Directory domain controllers.
CISA added Fragnesia to its Known Exploited Vulnerabilities catalog and set an October 31 deadline for federal agencies. On Thursday, Palo Alto Networks updated its PHP2Shell advisory to say it has seen active exploitation against management interfaces exposed to the internet.
Cisco confirms new firewall SSL VPN zero-day is being used to crash devices
Cisco confirmed that CVE-2026-76418, which affects its classic and next-generation firewalls, is being exploited. The flaw comes from logic errors when secondary authentication is set up on a tunnel group. An unauthenticated remote attacker can send a crafted request to the SSL remote access VPN and force the device to reload.
Cisco says there are no workarounds and urges customers to upgrade, and SecurityWeek reports this is the second exploited Cisco firewall VPN zero-day since August.
Chinese spies used low-severity VMware ESX logging flaw as zero-day, CISA orders fix
CrowdStrike says the China-nexus group Warp Panda exploited CVE-2026-41709, an insufficient-logging flaw in Broadcom's VMware ESX hypervisor, as a zero-day to cut audit trail visibility. The group targets US entities, including law firms. Broadcom fixed the bug in July and rated it CVSS 2.7, since exploiting it requires administrator privileges.
CISA added it to the Known Exploited Vulnerabilities catalog on October 28 and gave federal civilian agencies until November 11 to fix it.
Hacktivist leak exposes work details of more than 41,000 DHS employees
A group calling itself the Department of Peace published data on 41,191 people across nine DHS agencies, among them about 21,000 CBP and 6,600 ICE staff. The data is reportedly from an Okta single sign-on service used by DHS and was released through Distributed Denial of Secrets and a searchable tool called Icepick. It includes names, job titles, managers, work addresses, phone numbers and links to undercover operations.
DHS said it is aware of a potential breach and is working to address it.
Cisco SD-WAN zero-day attacks linked to Volt Typhoon's 'Silent Train' relay network
Cisco Talos reports that a cluster it tracks as UAT-11473 exploited the critical Cisco Catalyst SD-WAN flaw CVE-2026-20127 to plant KeyDrift, malware that steals SD-WAN encryption keys. Talos assesses with high confidence that the actor's infrastructure overlaps with Silent Train, but it stops short of naming Volt Typhoon. Lumen's Black Lotus Labs separately attributes Silent Train to Volt Typhoon.
Lumen says the network supported at least four confirmed zero-day campaigns, against Versa Director, N-able N-central, Cisco Catalyst SD-WAN and VeloCloud Orchestrator.
Adobe, Veeam and Juniper patch critical code execution and bypass flaws
Adobe fixed 12 vulnerabilities in Campaign Classic, Connect, Creative Cloud and Substance 3D Painter, eight of them critical bugs in Campaign Classic. Veeam patched a critical authorization bypass in Backup & Replication (CVE-2026-108142, CVSS 9.1) that lets an attacker without credentials get past access checks on the CDP Coordinator Service.
Juniper Networks fixed 18 flaws in Session Smart Router and Session Smart Conductor, two of them critical. None of the vendors report active exploitation.
Illustration 
