Cuberk

I’ll keep this to a single-pass check of the six named sources, honoring the 24-hour cutoff and skipping anything without a verifiable fresh item.

The source checks are running in parallel with the UTC cutoff fixed at 2026-10-28 02:44:53 through 2026-10-29 02:44:53. I’ll include only timestamp-verifiable updates.

The Hacker News

• Volt Typhoon Used Covert Silent Train Network in Four Zero-Day Exploitation Campaigns - The China-nexus group used a rotating network of compromised SOHO, IoT, and enterprise devices to support zero-day exploitation and maintain strategic access.
• Researcher Reveals How Logic Bugs Alone Cracked Microsoft Edge in $175,000 Pwn2Own Win - A logic-flaw chain reportedly escaped the Edge sandbox and achieved code execution without memory corruption.
• PHP2Shell Attack Roots 25 Servers, Breaches U.S. Government-Affiliated Network - An apparent AI-assisted China-nexus operation chained PHP2Shell with a Linux kernel exploit to compromise 25 servers, including three in a U.S. government-affiliated environment.
• Hackers Target Critical Oracle E-Business Suite RCE Flaw Days After Security Patch - Threat actors began probing internet-facing systems for the recently patched CVE-2026-101767 Oracle EBS vulnerability.
• Critical 16-Year-Old UEFI Flaw Can Run Code Before Secure Boot on Network-Booting Servers - A long-standing EDK II flaw could permit code execution before Secure Boot during network boot under specific conditions.
• Adobe Fixes 8 Critical Campaign Classic Flaws Allowing Code Execution and Security Bypass - Adobe patched eight critical Campaign Classic vulnerabilities involving code injection, SQL injection, authorization, and privilege escalation.

BleepingComputer

• Police seize Virtualine bulletproof service tied to ransomware, cybercrime - U.S. law enforcement seized the primary domain of Virtualine, a bulletproof hosting service advertised for facilitating cybercrime.
• Sony ISP subsidiary data breach exposes 2.5 million customer records - Sony Network Communications confirmed a breach affecting about 2.5 million current and former customers.
• Volt Typhoon hides zero-day attacks using 'Silent Train' framework - The Chinese state-sponsored group used rotating chains of compromised devices to conceal attacks against high-value systems.
• InfraTrust report warns of exploited flaws in critical network infrastructure - Attackers are exploiting vulnerabilities in firewalls, VPNs, application delivery controllers, and other network appliances, including PHP2Shell flaws.
• Hackers now scanning systems for recently-patched Oracle flaw - Attackers began probing for unpatched systems vulnerable to the critical Oracle E-Business Suite flaw CVE-2026-101767.
• CISA warns of hackers now exploiting critical Node2Shell flaw - CISA confirmed exploitation of the critical Brotli vulnerability known as Node2Shell, Broccoli2Shell, or HTTP2Shell.
• Nefilim and Hive ransomware affiliate gets 70 months in prison - A Ukrainian national received a 70-month sentence for ransomware attacks against hospitals, government entities, and businesses.

SecurityWeek

• Ukrainian Hive and Nefilim Ransomware Affiliate Gets 70 Months in US Prison - Artem Stryzhak was sentenced after pleading guilty to using Nefilim ransomware in attacks.
• Chrome and Firefox Updates Patch Over 200 Vulnerabilities - Chrome 156 and Firefox 159 together addressed more than 200 security bugs.
• TLS Flaws Found in GoAhead Web Server Used in Hundreds of Millions of Devices - Three GoAhead TLS flaws can allow revoked certificates or expose some encrypted sessions to eavesdroppers.
• China-Linked Hackers Exploit PHP2Shell to Root Firewalls - China-linked attackers chained PHP2Shell and Fragnesia exploits to compromise two servers at a U.S. government-affiliated organization.
• Long-Hidden Flaws Patched in EPICS Research Facility Control Software - Four EPICS Base flaws could allow attackers to crash processes at particle accelerators and fusion laboratories.
• Hackers Start Probing Fresh Oracle EBS Vulnerability - Internet scanning began against CVE-2026-101767, an unauthenticated Oracle EBS SQL injection that can lead to remote code execution.
• CISA Warns of Node2Shell Exploitation as Honeypots Log Attack Attempts - CISA added the Brotli flaw to its KEV catalog after honeypots recorded exploitation attempts.

Hacker News (yc)

• GitLab Security Incident: Attempted Exploitation of CVE-2026-97229 - A newly submitted report describes an attempted exploitation of CVE-2026-97229 in a GitLab security incident.

NIST NVD & CVE Mitre

• CVE-2026-103406 / CVE Record - Critical Juniper Session Smart Conductor OS-command-injection flaw enables remote unauthenticated command execution as root; CVSS 9.8, published 2026-10-28.
• CVE-2026-103409 / CVE Record - Critical Juniper Session Smart Router missing-authentication flaw can grant administrative privileges to an unauthenticated network attacker; CVSS 9.8, published 2026-10-28.
• CVE-2026-117574 / CVE Record - Critical Red Hat OpenShift AI authorization flaw can expose another tenant’s API keys and consume its LLM resources; CVSS 9.1, published 2026-10-28.
• CVE-2026-118690 / CVE Record - Critical Signal K Server missing-authentication flaw allows log-archive theft, JWT-secret recovery, token forgery, and persistent administrator creation; CVSS 9.8, published 2026-10-28.
• CVE-2026-118579 / CVE Record - Critical D-Link DIR-505 web-management backdoor flaw is remotely exploitable and has a public exploit; CVSS 9.8, published 2026-10-28.

PoC-in-GitHub (motikan2010.net)

• CVE-2026-109618/109619 PHP2Shell PoC - A PHP2Shell exploit toolkit was added with five exploit chains, JA3 stealth, mass scanning, and a safe webshell for authorized testing.
• CVE-2026-102785 YOOtheme Pro PoC - A PoC targets unauthenticated RCE in YOOtheme Pro through image-handler signature reuse, path traversal, and a PNG/PHP polyglot.
• CVE-2026-111497 Brotli PoC - A Brotli decoder out-of-bounds-write lab demonstrates possible memory disclosure, denial of service, or code execution through crafted compressed streams.
• CVE-2026-71195 OpenStack Manila detector - An offline detector was added for cross-tenant authorization failures affecting public-share operations in OpenStack Manila.
• CVE-2026-94300 BIND 9 detector - An offline detector was added for replayed GSS-TSIG messages that can trigger memory corruption and potentially remote code execution in BIND 9.
• CVE-2026-40281 Gotenberg PoC - A PoC targets unauthenticated ExifTool argument injection in Gotenberg, enabling arbitrary file overwrite and link creation inside the container.

GitHub Advisory Database

• Signal K Server before 2.33.0 - Critical missing authentication allows log-archive download, JWT-secret extraction, forged administrator tokens, and persistent admin accounts; CVE-2026-118690 was published 2026-10-29.
• Red Hat OpenShift AI ai-gateway-payload-processing - Critical cross-tenant authorization failure can expose another tenant’s API keys and consume its model quota; CVE-2026-117574 was published 2026-10-28.
• Juniper Session Smart Router missing authentication - Critical pre-onboarding authentication failure can provide administrative privileges through crafted URL parameters; CVE-2026-103409 was published 2026-10-28.
• Juniper Session Smart Conductor command injection - Critical OS-command-injection flaw allows remote command execution as root through a crafted Salt minion ID; CVE-2026-103406 was published 2026-10-28.
• Signal K Server advisory listing - The critical-advisory feed also listed newly published CVE-2026-118633 and multiple critical advisories dated 2026-10-28.

GitHub Search: CVE-2026 OR CVE-2025 created:today

• Scyrix-LLC/CVE-2026-109722 - Repository created 2026-10-29 at 02:33 UTC and updated shortly afterward.
• Try2Take/CVE-2026-97631-PoC - Educational EDK II/OVMF PXE-vulnerability lab with QEMU and Python PoC scripts for denial of service and memory-corruption research; created 2026-10-29.
• aulwardana/php2shell-check - Claude Skill for checking PHP exposure and detecting PHP2Shell CVE-2026-109618/CVE-2026-109619; created 2026-10-29.
• Again1996-bit/CVE-2026-98260-GhostKey - Android Shizuku/NDK privilege-escalation tool for CVE-2026-98260; created 2026-10-29.
• Lariinz/CVE-2026-117025 - CVE-2026-117025 repository created and updated on 2026-10-29.

The five source checks are running in parallel; I’ll use only verified items returned by those checks.