Palo Alto Networks confirmed PHP2Shell exploitation against internet-exposed PAN-OS management interfaces, and CISA added the chained Linux flaw Fragnesia to its exploited list with a 31 October deadline. Cisco patched an exploited ASA and FTD VPN crash flaw, Talos detailed KeyDrift key theft on SD-WAN controllers, and a 9.8-rated Linux TCP flaw still lacks Ubuntu and RHEL fixes. In Australia, the RMS Cloud booking scams have reached Tasmanian hotels.
Australia
- RMS Cloud booking scams reach Tasmanian hotels. Wrest Point, ALH and Discovery Parks guests targeted with emails quoting real bookings; RMS reissuing integration partner credentials. ABC News; Cyber Daily; The New Daily
Global threats
- PHP2Shell exploited against PAN-OS management interfaces. CVE-2026-109618 and CVE-2026-109619; some hotfixes due 29 to 30 October US time; restrict management access now. The Hacker News
- CISA KEV adds Fragnesia (CVE-2026-46300) and VMware ESX CVE-2026-41709. Due 31 October and 11 November. BleepingComputer; CISA KEV
- Cisco ASA and FTD VPN zero-day (CVE-2026-76418). Unauthenticated device reload where secondary authentication is configured. The Hacker News
- KeyDrift steals IPsec keys from Cisco SD-WAN controllers. UAT-11473 via CVE-2026-20127; Talos sees heavy infrastructure overlap with Silent Train, a shared device network Lumen links to Volt Typhoon, but no firm attribution. The Hacker News; BleepingComputer
- Warp Panda used VMware ESX zero-day to dodge audit logs. US legal sector targeted, per CrowdStrike. The Hacker News
- Linux TCP flaw CVE-2026-98432 still unpatched on Ubuntu and RHEL. Fixed in Debian, Oracle Linux and some SUSE and Amazon Linux kernels. The Hacker News
- Belgian finance ministry takes tax portals offline after attack. Filing deadline moved to 16 November. The Register
- Japan Airlines reservation data accessed via Amadeus. About 92,000 customers, passport numbers for about 2,000. JAL; The Record
- Telegram for Android voice call flaw disclosed. Fixed in 12.10.4; single-firm research. The Hacker News
AI security
- Yoba: fake ChatGPT and Claude desktop apps drop crypto miners. Signed executables used for DLL sideloading. The Hacker News
- 26,400 working cloud and AI credentials exposed on Gitee. Revocation unconfirmed. The Hacker News
- Google releases Gemini 4 Carbon. Vendor-reported cyber benchmark leads. The Hacker News
Industry
- GitHub previews an npm package firewall. The Hacker News
- Alpine Linux: GitLab update alone did not fix CVE-2026-97229. Self-built GitLab needs patched Ruby. The Hacker News
Late item
- CISA adds the Cisco ASA and FTD flaw and GitLab CVE-2026-97229 to its exploited list. Both due 1 November for US federal agencies; CISA asks for forensic triage on GitLab. CISA KEV
Outlook and patch priorities
- Critical: PAN-OS PHP2Shell fixes and management interfaces off the internet; Linux Fragnesia.
- High: Cisco ASA and FTD; GitLab and its Ruby (CVE-2026-97229); Cisco SD-WAN controllers (patch and check for implants); VMware ESX; distribution kernels for CVE-2026-98432; RMS customers rotate integration credentials.