Hackers exploited a critical Cisco Catalyst SD-WAN flaw, which had been fixed in February, to plant custom malware in systems controlling an organization’s SD-WAN network. Cisco Talos said on October 28 that the malware, called KeyDrift, is designed to copy keys used to encrypt traffic between sites and store them for later use.
Why it matters
Compromise of systems directing site-to-site connectivity places cryptographic material and the network control plane within the same incident scope.
Known limitation: This item is supported by one source record and has not been independently corroborated here.
Security Daily
Exploitation · Helpnetsecurity
What happened
Exploitation attempts have reportedly begun against CVE-2026-101767, a recently patched Oracle E-Business Suite vulnerability. Defused said its Oracle E-Business Suite decoys recorded exploratory exploits on October 27 against CVE-2026-101767, described as an unauthenticated SQL injection in the Thin Client Framework servlet that chains to remote code execution.
Why it matters
The vulnerability is reported as having a CVSS score of 9.8. Reported exploratory activity makes this more than a patch disclosure: exposure to the affected enterprise application warrants immediate assessment.
Known limitation: This item is supported by one source record and has not been independently corroborated here.
Security Daily
Identity · Cyberscoop
What happened
Black Lotus Labs reported that Volt Typhoon used a covert operation dubbed “Silent Train,” comprising rapidly rotated compromised SOHO routers, IoT devices and enterprise infrastructure, to maintain access and exploit additional vulnerabilities in network-edge devices. Researchers reported that Volt Typhoon could assemble a new infrastructure chain with different nodes in under two minutes; individual chains were dismantled daily, with sessions averaging roughly four hours and extensive cleanup.
Why it matters
Black Lotus Labs notified hundreds of victims across telecommunications, government, defense, education, IT and other critical-infrastructure sectors, including water, energy, transportation, maritime, rail, aviation and emergency services.
Known limitation: This item is supported by one source record and has not been independently corroborated here.
Evidence is visible. Uncertainty stays visible too.
Baitaphish separates source records from interpretations, labels AI-assisted enrichment, and avoids turning ingestion volume into unsupported claims about threats, prevalence, or risk.
