Timeline
What is happening across our reports over the last 30 days: new reports, what each update changed, and when CISA confirmed a covered vulnerability is being exploited. Report text is written by our AI newsroom; exploitation listings come from CISA.
Update
Volt Typhoon Used 'Silent Train' Network to Hide Zero-Day Attacks
Added Help Net Security's list of device types in the relay network; rewrote the report to credit Lumen and Cisco Talos directly.
6 outlets
New report
Eight eMudhra Certificate Authority Keys Compromised
Secret keys for eight certificates issued by the certificate provider eMudhra were found to be compromised, which could let attackers impersonate websites. Browser and security vendors are responding; most organizations need only confirm their systems receive trust updates.
3 outlets
Update
Brotli Decompression Flaw in Node.js and Other Software Under Attack
Added Datadog Security Labs' reproduction and detection guidance, credited original sources instead of outlets, and revised the timeline and Business Action.
Known exploited CVE-2026-111497· 7 outlets
Update
PHP2Shell: Two Critical PHP Flaws Under Active Attack
Rewrote the report to credit the original sources rather than outlets, added CrowdStrike's response guidance, and revised the timeline and Business Action.
Known exploited CVE-2026-109618, CVE-2026-109619· 16 outlets
New report
Microsoft Ties China-Linked Storm-0940 to ConnectWise-Related Attacks on Cloud Tenants
Microsoft says a China-aligned group used stolen ConnectWise credentials and an AI tool to break into customers' Microsoft 365 accounts. Companies whose IT provider uses ConnectWise should ask that provider whether they were affected.
3 outlets
New report
Cisco Patches Exploited Firewall VPN Flaw That Can Force Devices to Reload
Attackers are exploiting a flaw in the VPN feature of some Cisco firewalls to make the devices restart, and Cisco has released fixes. Organizations using these firewalls should check for and apply the fixes promptly.
Known exploited CVE-2026-76418· 3 outlets
Update
GitLab Patches Maximum-Severity Flaw; CISA Says It Is Exploited
CISA added the flaw to its Known Exploited Vulnerabilities catalogue on October 29, and the Canadian Centre for Cyber Security updated its advisory to say so.
Known exploited CVE-2026-97229· 5 outlets
Update
PHP2Shell: Two Critical PHP Flaws Under Active Attack
Added CISA's warning to federal agencies about a Linux kernel flaw, named Fragnesia by BleepingComputer's report, that attackers are chaining with the PHP2Shell flaws.
Known exploited CVE-2026-109618, CVE-2026-109619· 15 outlets
New report
Volt Typhoon Used 'Silent Train' Network to Hide Zero-Day Attacks
Researchers say a Chinese state-linked hacking group used a hidden network of hijacked routers and other devices to mask attacks that exploited flaws before fixes existed. No specific action is published for most organizations, but those with internet-facing network equipment should watch vendor advisories.
5 outlets
New report
GitLab Patches Maximum-Severity Flaw; CISA Says It Is Exploited
GitLab has fixed a serious flaw that could let an attacker take over servers running the GitLab code-hosting software. An attempted attack on one project's server has been reported, so organizations that run their own GitLab should check that they have updated.
Known exploited CVE-2026-97229· 3 outlets
New report
Low-Rated VMware ESX Logging Flaw Used as Zero-Day by China-Linked Group
Hackers linked to China exploited a flaw in VMware ESX, software that runs virtual servers, to carry out actions without leaving normal log records. Organizations running ESX should check Broadcom's guidance, as a US government deadline for federal agencies is set.
Known exploited CVE-2026-41709· 3 outlets
New report
Citrix NetScaler Zero-Day Flaws Exploited in Attacks on Gateways
Attackers have broken into Citrix NetScaler network gateway and load-balancing devices using two serious flaws that were exploited before fixes existed. Organizations running these devices should check with their IT provider that Citrix's fixes are installed.
Known exploited CVE-2026-88771, CVE-2026-88772· 5 outlets
New report
ShinyHunters Keeps Exploiting Oracle PeopleSoft Flaw, Now Shown to Be Three Chained Bugs
A serious flaw in Oracle PeopleSoft, business software widely used by universities and other organizations, is being exploited by a criminal group known as ShinyHunters. Organizations that run PeopleSoft should confirm the Oracle fix from June is installed.
Known exploited CVE-2026-35273· 3 outlets
New report
Attackers Probe Newly Patched Critical Oracle E-Business Suite Flaw
A serious flaw in Oracle's E-Business Suite, business software used to run finance and operations, can let an outsider take over a server without logging in. Oracle has released a fix, and organizations that run the software should apply it now because probing has begun.
4 outlets
Update
Brotli Decompression Flaw in Node.js and Other Software Under Attack
Corrected the scoring: the record now carries a CVSS score of 9.2, so the earlier statement that NVD had published none was removed.
Known exploited CVE-2026-111497· 6 outlets
New report
Brotli Decompression Flaw in Node.js and Other Software Under Attack
A flaw in a widely used data-decompression library can let attackers crash programs or run their own code, and it is now being exploited. Organizations that run Node.js or other software bundling the library should check for vendor updates now.
Known exploited CVE-2026-111497· 6 outlets
Update
PHP2Shell: Two Critical PHP Flaws Under Active Attack
Added Palo Alto Networks' warning of exploitation against internet-exposed management interfaces, the PHP guidance on the third issue, and corrected the CISA listing date to October 26.
Known exploited CVE-2026-109618, CVE-2026-109619· 15 outlets
New report
PHP2Shell: Two Critical PHP Flaws Under Active Attack
Two serious flaws in PHP, the programming language behind a large share of websites, let attackers run commands on a web server without logging in, and attacks are under way. Organizations running PHP should apply the emergency updates released on October 21 now.
Known exploited CVE-2026-109618, CVE-2026-109619· 13 outlets
CISA KEV
Cisco Patches Exploited Firewall VPN Flaw That Can Force Devices to Reload
CISA added CVE-2026-76418 to its Known Exploited Vulnerabilities catalog.
Exploitation confirmed: patch or mitigate affected systems now.
CISA KEV
GitLab Patches Maximum-Severity Flaw; CISA Says It Is Exploited
CISA added CVE-2026-97229 to its Known Exploited Vulnerabilities catalog.
Exploitation confirmed: patch or mitigate affected systems now.
CISA KEV
Low-Rated VMware ESX Logging Flaw Used as Zero-Day by China-Linked Group
CISA added CVE-2026-41709 to its Known Exploited Vulnerabilities catalog.
Exploitation confirmed: patch or mitigate affected systems now.
CISA KEV
Brotli Decompression Flaw in Node.js and Other Software Under Attack
CISA added CVE-2026-111497 to its Known Exploited Vulnerabilities catalog.
Exploitation confirmed: patch or mitigate affected systems now.
CISA KEV
PHP2Shell: Two Critical PHP Flaws Under Active Attack
CISA added CVE-2026-109618, CVE-2026-109619 to its Known Exploited Vulnerabilities catalog.
Exploitation confirmed: patch or mitigate affected systems now.