A suspected China-linked attacker used a custom PHP2Shell exploit, with signs of AI-assisted tooling, to root 25 firewalls and reach a US government-affiliated network, and Lumen's Black Lotus Labs exposed Volt Typhoon's Silent Train covert network behind four zero-day campaigns. In Australia, a breach at booking platform RMS Cloud is fuelling phishing of holiday park guests. We also cover Tailscale's Tailworm fixes, new CISA KEV entries, Oracle EBS probing and Anthropic's AI-built exploit chains.
Australia
- RMS Cloud breach fuels booking scams. Guest names, contact and booking details accessed (payment details not involved, says RMS); scam messages quoting real bookings hit guests of BIG4, Reflections, G'day Parks and others. RMS; ABC News; 7NEWS
Global threats
- PHP2Shell used to root 25 firewalls and reach a US government-affiliated network. Custom exploit plus Linux kernel flaw CVE-2026-46300 (Fragnesia); AI tooling found on attacker infrastructure; single-vendor analysis by Dream. The Hacker News
- Volt Typhoon's Silent Train covert network exposed. Short-lived chains of hijacked SOHO, IoT and enterprise devices behind zero-days in Versa Director, N-able N-central, Cisco Catalyst SD-WAN Controller and Arista VeloCloud Orchestrator. The Hacker News
- Tailscale 1.104.4 fixes Tailworm SSH forwarding flaws. Forwarding now runs as the logged-in user; set TS_SSH_DISABLE_FORWARDING=1 if you cannot update yet. The Hacker News
- Oracle E-Business Suite CVE-2026-101767 probed days after patch. Unauthenticated SQL injection chaining to command execution. The Hacker News
- CISA KEV adds Adobe Commerce PolyShell (CVE-2026-48356) and Brotli (CVE-2026-111497). Federal due date 10 November; Node.js fixed in 22.23.4, 24.22.1 and 26.12.1. The Hacker News
- ShinyHunters' PeopleSoft zero-day is three chained flaws. CVE-2026-35273, patched June; rotate credentials. The Hacker News
- 16-year-old EDK II UEFI flaw in network boot (CVE-2026-97631). No fixed stable release yet. The Hacker News
- Moldova examines foreign state role in government data theft. About 750,000 identity numbers affected. The Record
- GMO Internet Group offers US$1 million bounty after refusing extortion. The Hacker News
- FBI seizes bulletproof host Virtualine's domain. The Hacker News
- US sanctions launderers of North Korean IT worker earnings. The Record
AI security
- Anthropic says an unreleased model chained flaws into five working exploits. Chrome, Safari, Android, Windows and Linux; all patched; autonomy claims are self-reported. The Hacker News
- Credential scanner impersonates 32 AI bots. Cequence reports traffic at 48% of its customers on one day. Dark Reading
- noyb sues Scale AI over worker surveillance. The Record
Industry and policy
- UK to consult on software vendor liability for cyber breaches. The Record
Outlook and patch priorities
- Critical: PHP on servers and in appliance firmware; firewall management interfaces off the internet; Oracle EBS CVE-2026-101767.
- High: Tailscale 1.104.4; Node.js Brotli fixes; Adobe Commerce PolyShell; PeopleSoft credential rotation; RMS customers warn guests.