Lumen's Black Lotus Labs published research on 28 October 2026 on what it calls Silent Train, a covert framework it attributes to the China state-sponsored group Volt Typhoon. Black Lotus Labs says it has tracked Silent Train for three years, first observing consistent activity in November 2023, shortly before the initial takedown of the KV-botnet, and that the work led to hundreds of victim notifications. It describes Silent Train as rapidly rotating chains of compromised SOHO, IoT and enterprise devices that are exploited on demand, used against selected targets, cleaned up after each operation and continuously refreshed: sessions began from virtual private servers outside the US and were daisy-chained through compromised non-US devices before pivoting within the US to reach targets. It observed more than 27 device classes used, from TP-Link routers and Netgear Orbi devices to Fortinet appliances and CyberPanel servers, with device types reserved for fixed roles (Intelbras modems only as overseas relays, Netgear Orbi devices as US-based hops that interacted with victims). By early 2025, compromised enterprise platforms were kept in the chains for one to three months, making Silent Train a hybrid framework. Black Lotus Labs says its monitoring helped uncover at least four confirmed and one likely zero-day campaigns against network and endpoint management systems, SD-WAN orchestrators and other control-plane infrastructure: Versa Director (which it documented in mid-2024), N-able N-central (a chain of then-undisclosed flaws assigned CVE-2025-8875 and CVE-2025-8876), Cisco Catalyst SD-WAN (CVE-2026-20127, exploited from late 2025 and continuing well after Cisco's February 2026 disclosure), VeloCloud Orchestrator (a zero-day later designated CVE-2026-16812) and, assessed with moderate confidence, Quest KACE (more than 30 victims; activity declined after Quest's October 2025 security updates). Post-incident analysis found in-memory webshells, credential harvesting, abuse of native platform features and, in several cases, erased or altered logs. Victims included telecommunications providers, government, defense contractors, satellite and mission-critical communications services, universities, MSPs, IT firms and critical infrastructure; Hawaii, California and Texas were the most targeted regions. Activity was concentrated on weekdays between 09:00 and 22:00 China Standard Time. BleepingComputer (28 Oct) also reported the research.
Lumen Black Lotus Labs — Silent Train: uncovering Volt Typhoon's operational framework for zero-day exploitation and strategic access (28 Oct 2026)
The US Treasury Department's Office of Foreign Assets Control (OFAC) said on 28 October 2026 that it had sanctioned 10 individuals and one entity for their roles in North Korean (DPRK) government-run IT worker schemes that defraud US businesses and generate revenue for North Korea's weapons of mass destruction and ballistic missile programs. Treasury says Russian national Vitold Viktorovich Obertas is an intermediary for illicit DPRK financial transactions, including for Amnokgang Technology Development Company (designated by OFAC on 12 March 2026), and has since January 2025 conducted nearly $2 million worth of cryptocurrency conversions and at least $1.25 million in other currency transactions for DPRK officials. Russian national Ilya Aleksandrovich Boykov has since 2024 supported Limited Liability Company Alis (designated in March 2024) by exchanging and converting an equivalent of $3.5 million in cryptocurrency transactions and providing logistical support. Kim Ki Hyok leads a Russia-based delegation of Alis IT workers and has transferred cryptocurrency for it valued at nearly $500,000 since 2024; Kim Hyo Dong leads a separate Russia-based Chinyong-subordinate delegation and has facilitated the transfer of over $100,000 in financial assets. The First Financial and Technical Development Center (FFTDC), a DPRK-controlled entity in Russia, was designated for exporting North Korean workers; Treasury says its IT workers use 'Super Intelligence (SI) tools' and complex cryptocurrency transfers, and that six Russia-based DPRK IT workers (Kim Kyong Ju, Ri Thae Chol, So Hyon Jin, Han Yu Song, Kim Sung Gwan and Hyon Se Il), also designated, collectively generated over $750,000 for it since 2025. Treasury says DPRK IT workers have also used their access to corporate networks to deploy malware, exfiltrate sensitive data and steal proprietary information, and that the United States is joined this month by Australia and the European Union in designating individuals and entities supporting the DPRK. The Record (28 Oct) also reported the action.
U.S. Department of the Treasury — Treasury Sanctions Facilitators of DPRK IT Worker Fraud Targeting U.S. Businesses (28 Oct 2026)
The FBI seized the domain of Virtualine, a 'bulletproof' hosting provider accused of facilitating a range of cybercrimes including money laundering and the distribution of child sexual abuse material, The Record reported on 28 October 2026. According to The Record, the Justice Department said on Tuesday that a court authorised the seizure of virtualine.net, a service operating under names including Secury, Massgod, Spamhouse, Lanedo and Omegatech, and the site has been replaced by a seizure notice. Citing court records, The Record says Virtualine advertised on cybercrime forums, offering hosting for 'all illegal/black hat activities' including phishing, carding and spam. The Record reports that in January, about a month after Virtualine allegedly provided an IP address to a forum used to sell sexually explicit images of minors, the company received complaints from authorities in Germany, Canada and Australia, as well as the National Center for Missing and Exploited Children and a victim's attorney, and that instead of ending service it helped the forum's operators build another site, according to the Justice Department. The Record says the FBI's Washington Field Office led the investigation with help from authorities in Germany, the Netherlands and Britain and private-sector partners OverRIPE and Lumen, and that the Justice Department did not identify Virtualine's operators or announce criminal charges at the time of the seizure.
The Record — FBI seizes ‘bulletproof’ hosting site accused of facilitating child abuse, money laundering (28 Oct 2026)
UK domain registrar 123 Reg has emailed customers that their contact information, 'related customer relationship data', company VAT numbers and 'product information from an application programming interface (API)' were compromised in what it calls 'the first known AI-driven cyberattack against our company', according to The Register (28 October 2026). A company spokesperson told The Register this means names, phone numbers, countries, language and currency preferences, account creation dates, the products on the account and marketing preferences were affected; The Register dates the intrusion to 18 September. According to The Register, 123 Reg's email says the attacker's activity 'was limited to reading' customer data, while the spokesperson said 'it's possible they created copies of the information', which prompted the notification. The spokesperson told The Register that IP addresses 123 Reg assessed as the core attacker infrastructure were hosted in China and Singapore, 'indicating a strong Chinese nexus', and that ARTEX, an open-source agentic penetration-testing tool, was observed in the attack; this attribution is 123 Reg's own assessment and has not been independently verified. The Register says the GoDaddy-owned registrar reported the attack to law enforcement, brought in outside cybersecurity support, and notified the FTC and data protection authorities in the UK and EU.
The Register — 123 Reg discloses 'AI cyberattack' on customer data, suspects China nexus (28 Oct 2026)
Moldova's Electronic Governance Agency (Agenția de Guvernare Electronică, AGE) said on 27 October 2026 that preliminary investigation of the cyberattack on government information systems announced on 24 October shows that between 19 and 23 October about one million personal identification numbers (IDNPs) were queried in attempts to extract personal data without authorisation, and that data sets linked to about 750,000 IDNPs were extracted, according to preliminary estimates (desk translation from Romanian). AGE says the data may include names, dates and places of birth, first-degree family members, insurance status, family doctor, social benefits, pensions, disability, driving licence, photograph, vehicles and companies owned or managed, and financial information including IBAN, tax debts and MPay payment history, but not every affected person had all categories exposed. It says bank card data was not affected and investigators found no unauthorised changes to state registers. According to AGE, the attackers exploited vulnerabilities in services accessible without authentication and used the data obtained for further extraction; unauthorised extraction was stopped at 11:30 on 23 October, when 82 public services and more than 30 information systems and admin panels were disconnected as a precaution; a new forced-access attempt was blocked around 02:00 on 25 October and further extraction attempts around 07:00 on 27 October failed (AGE gives no time zone). The investigation involves the Cybersecurity Agency (ASC), the IT and Cyber Security Service (STISC), the Intelligence and Security Service (SIS), the national data protection centre and police. On 28 October Prime Minister Vasile Tofan said Moldova is 'the target of coordinated and large-scale cyberattacks' and that the relevant services are investigating the possible involvement of foreign state actors, according to state news agency Moldpres; he said that in about 750,000 cases at least one data element was extracted, which does not mean 750,000 accounts were hacked, and that the use of artificial intelligence allegedly helped the attackers find and exploit the vulnerabilities. The Record (28 Oct) reports that Moldova has not publicly attributed the attack to any country or group.
Agenția de Guvernare Electronică (Moldova) — Aproximativ un milion de IDNP-uri vizate în tentative de extragere a datelor cu caracter personal (27 Oct 2026, Romanian)
Australian travellers are being warned their personal information may have been exposed following a cybersecurity breach involving Australian booking management software provider RMS Cloud, ABC News reported on 27 October 2026. According to the ABC, RMS said it is investigating reports of phishing messages sent by WhatsApp, SMS and email that "reference genuine booking information" and request payment details; its website said: "Our teams are actively investigating the activity and taking steps to contain it, protect customer information and support affected customers and integration partners" and "No payment card information has been exposed from RMS." The ABC says major holiday park operators including Reflections, BIG4 and G'day Parks are understood to have been affected, and that RMS provides cloud-based property management and booking systems to more than 6,000 hotels, holiday parks and serviced apartments worldwide, according to its website. A BIG4 spokeswoman told the ABC that a breach of a third-party platform used by some parks in its network, as well as other accommodation providers and groups, had resulted in some guests receiving fraudulent messages asking for credit card or payment details. On its own booking-safety page, BIG4 says RMS, a booking system used by a third of BIG4 holiday parks, has experienced a security incident involving unauthorised access to guest contact and booking information, that the incident is not specific to BIG4 and has also affected holiday park and hotel accommodation providers outside its network, and that credit card and payment details were not accessed through this incident. Reflections Holidays (NSW) texted guests that RMS had made it aware of phishing emails claiming booking payments had failed, and Summerstar Tourist Parks, which runs caravan parks across Western Australia, warned guests on social media, according to the ABC.
ABC News — Major holiday park operators warn guests about fraudulent emails, messages seeking credit card details (27 Oct 2026)
The Luanti project says an attacker gained unauthorised access to ContentDB's servers and data, including emails, hashed passwords and uploads, in a notice titled 'URGENT: ContentDB security incident: 22–26 October 2026' on the Luanti blog (web address dated 27 October 2026). Luanti says the attacker broke in by exploiting two vulnerabilities, one in a third-party component that it has reported to the maintainer. In UTC: from 22 October 13:00 the attacker had access to ContentDB's internal configuration and used it to sign into a staff account (the configuration also allowed modifying uploads and sending emails, but Luanti has no evidence this took place); a patch for one of the vulnerabilities was coincidentally deployed on 22 October at 17:35; from 24 October 23:00 the attacker probed for remote code execution; from 26 October 00:15 the attacker had full access to run commands on the server inside a docker container; and on 26 October at 09:00 Luanti discovered the break-in, took ContentDB offline and revoked all secrets, including sessions, API tokens and GitHub OAuth tokens. Luanti says the attacker had full access to the secrets, database, redis and uploads: usernames, emails and passwords stored as salted bcrypt hashes; IP addresses, not linked to any account, of people who downloaded or viewed packages in-game in the two weeks before 26 October; and uploaded packages and release files. With the secret key the attacker could act on behalf of any account. Luanti says it checked every upload against backups and found no changes, but has not ruled out that ContentDB served malicious uploads during the vulnerable period. ContentDB will stay offline for security updates, likely for a week or more.
Luanti Blog — URGENT: ContentDB security incident: 22–26 October 2026
In a research post published 27 October 2026, Anthropic says that over the past few months it used an unreleased, internal research model to find critical vulnerabilities in widely used software and shares details of five attack chains (an exploit chain links several flaws into one attack; a proof of concept is a working demonstration exploit). Anthropic says it reported each vulnerability to the affected vendor under its coordinated vulnerability disclosure policy, which gives developers 90 days to patch and a further 45 days before it discusses details beyond a public advisory. Per Anthropic: in Chrome, after initial prompting, Claude wrote a full chain (a V8 heap corruption bug, a V8 sandbox escape, a CacheStorage race condition and a use-after-free in FedCM) that runs arbitrary code outside the browser sandbox, with a proof of concept that launches Calculator on stock Chrome for macOS within seconds of a page loading, without further user interaction; Anthropic says 62 CVEs reported to Google have been assigned and patched as of Chrome 156, all rated critical or high, including 13 sandbox escapes. In Safari, a data-only chain (a JavaScriptCore use-after-free, a Gigacage bypass and a WebContent sandbox IPC flaw) let any website bypass the same-origin policy and read Safari history, cookies and other data; Anthropic says Apple acknowledged the report the same day and its fix is available. On Android, an exploit chaining three flaws let an attacker extract photos and other personal data from a locked, stolen phone, tested on a Google Pixel 9. On Windows, an out-of-bounds read in the kernel's QUIC implementation let an attacker remotely crash machines that respond to HTTP/3 requests; Anthropic says Microsoft resolved it as CVE-2026-33096. On Linux, a race-condition use-after-free in the kernel networking stack lets a remote attacker run commands as root on servers with a multipath TCP listener; Anthropic says this flaw, CVE-2026-98432, was patched upstream and backported to all maintained stable kernel branches, and its proof of concept took 48 minutes to leak a kernel pointer and five more minutes to reach command execution. Anthropic says frontier models can now do this with little human involvement. The Hacker News (28 October) notes that Anthropic does not break down what a person did at each step, and that the public CVE-2026-33096 record names HTTP.sys and credits no finder.
Anthropic — Discovering and exploiting vulnerabilities in critical, real-world software with Claude (27 Oct 2026)
Sony Network Communications said in a notice dated 27 October 2026 (in Japanese) that the member database of its So-net internet service was accessed without authorisation from outside on 19 October; it confirmed the access on 23 October, stopped the affected server and cut off communications from the source, and on 24 October established that personal information had leaked. The company lists 2,141,986 So-net member records (1,869,771 current members and 272,215 former members who left in March 2026 or later) and 443,495 plala (S Course) member records (422,365 current and 21,130 former), covering name, phone number, email address, user ID, date of birth, gender and internet connection ID, and says no passwords were leaked from these records. Separately, it confirmed the leak of 54,401 email addresses together with their mailbox passwords across four mail services (Mail Service (G) 24,655, A-Box 17,672, So-net VAIO Mail 7,005 and PostPet mail account service 5,069), which it reset on 27 October, as well as 16 bank account records (it says it holds no account PINs) and 7 password-reset notice records. The company says none of the leaked data includes credit card information, that it has not confirmed any leak from NURO or its other services, and that people who left by the end of February 2026 are not affected. It gives the cause as unauthorised access by a third party (under investigation), says it has reported the incident to Japan's Personal Information Protection Commission, and says that, as far as it knew on 27 October, no secondary damage had been confirmed. Help Net Security reported the notice on 28 October.
So-net (Sony Network Communications) — So-net会員データベースへの不正アクセスに伴う情報漏洩に関するお詫びとお知らせ (27 Oct 2026, Japanese)
Adobe's security bulletin APSB26-162, published 27 October 2026, says Adobe has released a priority 2 security update for Adobe Campaign Classic that addresses vulnerabilities rated critical that could result in arbitrary code execution, security feature bypass and privilege escalation. The bulletin lists ACC v7 7.4.4 build 9402 and earlier on Windows and Linux as affected, and ACC v7 7.4.4 build 9403 as the updated version. All eight CVEs are rated Critical by Adobe: CVE-2026-104351 (code injection, CVSS 9.9), CVE-2026-104353 (OS command injection, 9.9) and CVE-2026-105780 (incorrect authorization, 9.9), each with arbitrary code execution as the impact; CVE-2026-105489 (SQL injection, 9.9), CVE-2026-105781 (SQL injection, 9.8, with a vector that requires no privileges), CVE-2026-104354 (SQL injection, 9.1) and CVE-2026-105779 (SQL injection, 9.1), each with security feature bypass as the impact; and CVE-2026-104350 (reflected cross-site scripting, 9.3) with privilege escalation as the impact. Adobe says it is not aware of any exploits in the wild for any of the issues addressed in this update. The Hacker News reported the update on 28 October.
Adobe Security Bulletin — Security update available for Adobe Campaign Classic | APSB26-162 (27 Oct 2026)
Google's Chrome Releases blog says the Stable channel was updated on 27 October 2026 to 156.0.8078.73/.74 for Windows and Mac and 156.0.8078.73 for Linux, rolling out over the coming days and weeks, with 52 security fixes: four Critical, 46 High and two Medium. The Critical bugs are CVE-2026-118306 (memory corruption in FileSystem) and CVE-2026-118331 (improper input validation in FileAPI), both reported by Xinyang Ge (Anthropic), assisted by Claude, and CVE-2026-118348 (improper input validation in Skia) and CVE-2026-118344 (use-after-free in Layout), both reported by Xinyang Ge. High-rated fixes include use-after-free and memory-corruption bugs in V8, Turbolev, ANGLE, Skia, PDFium, SVG, Media and FileSystem; Google is credited with 19 of the 52 bugs, and four High bugs are credited to OpenAI Codex Security. Google does not say any of the flaws is exploited and does not publish CVSS scores; bug details stay restricted until most users have updated. Chrome 156.0.8078.73 for Android, released the same day, carries the same security fixes as desktop. This follows the Chrome 156 Stable release (156.0.8078.47/.48, 20 October), which is a separate card. Primary: Chrome Releases (27 Oct 2026).
Chrome Releases — Stable Channel Update for Desktop, Chrome 156.0.8078.73/.74 (27 Oct 2026)
Google Brotli Unchecked Return Value Vulnerability. Google Brotli contains an unchecked return value vulnerability that allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream. Apply vendor mitigations. Check the NVD record and the vendor advisory for affected versions and the patch.
