October 29, 2026

The highest-priority items combine reported exploitation with enterprise network or application infrastructure, while the banking-agent report highlights how credential sharing can extend risk beyond a bank’s direct interface. [1][2][3]

What happened

Hackers exploited a critical Cisco Catalyst SD-WAN flaw, which had been fixed in February, to plant custom malware in systems controlling an organization’s SD-WAN network. [1]

Cisco Talos said on October 28 that the malware, called KeyDrift, is designed to copy keys used to encrypt traffic between sites and store them for later use. [1]

Why it matters

Compromise of systems directing site-to-site connectivity places cryptographic material and the network control plane within the same incident scope. [1]

What happened

Exploitation attempts have reportedly begun against CVE-2026-101767, a recently patched Oracle E-Business Suite vulnerability. [2]

Defused said its Oracle E-Business Suite decoys recorded exploratory exploits on October 27 against CVE-2026-101767, described as an unauthenticated SQL injection in the Thin Client Framework servlet that chains to remote code execution. [2]

Why it matters

The vulnerability is reported as having a CVSS score of 9.8. [2]

Reported exploratory activity makes this more than a patch disclosure: exposure to the affected enterprise application warrants immediate assessment. [2]

What happened

Black Lotus Labs reported that Volt Typhoon used a covert operation dubbed “Silent Train,” comprising rapidly rotated compromised SOHO routers, IoT devices and enterprise infrastructure, to maintain access and exploit additional vulnerabilities in network-edge devices. [4]

Researchers reported that Volt Typhoon could assemble a new infrastructure chain with different nodes in under two minutes; individual chains were dismantled daily, with sessions averaging roughly four hours and extensive cleanup. [4]

Why it matters

Black Lotus Labs notified hundreds of victims across telecommunications, government, defense, education, IT and other critical-infrastructure sectors, including water, energy, transportation, maritime, rail, aviation and emergency services. [4]

What happened

Axios reported that major US banks detected third-party AI agents operating inside customer accounts, often after customers provided usernames and passwords; this access can violate bank rules. [3]

JPMorgan CEO Jamie Dimon said the bank would not allow just any outside agent into its systems because doing so was too risky for clients and the bank. [3]

Why it matters

A vulnerability in a service handling banking credentials could expose those credentials or allow account misuse; Bank of America reportedly said customers are responsible for activity resulting from shared access. [3]

What happened

Google’s October 27 Chrome Stable update brings desktop Chrome to 156.0.8078.73/.74 on Windows and Mac and 156.0.8078.73 on Linux, with 52 security fixes, including four rated Critical. [5]

Critical browser fixes merit attention because the supplied memory-safety context includes potential code execution. [5]

What happened

Attackers accessed French ENGIE customers’ personal information through a sales tool used by some business partners to market electricity and natural-gas offers. [6]

The exposed details combine contact information with account-specific context that can support impersonation attempts. [6]