# Archive
Browse past daily curated stories
Thursday, October 29, 2026
-
1The Hacker News generalVolt Typhoon Used Covert Silent Train Network in Four Zero-Day Exploitation Campaigns
Lumen Technologies Black Lotus Labs has attributed a covert access network dubbed 'Silent Train' to China-nexus group Volt Typhoon, first identified in late 2023. The framework uses rotating chains of compromised SOHO, IoT, and enterprise devices to support four distinct zero-day exploitation campaigns against critical infrastructure. Security teams defending edge devices and network appliances should treat this as a high-priority threat-intel update given Volt Typhoon's persistent targeting of US critical infrastructure.
-
2The Hacker News generalResearcher Reveals How Logic Bugs Alone Cracked Microsoft Edge in $175,000 Pwn2Own Win
Orange Tsai of DEVCORE published the full technical details on October 28 of a logic-flaw-only exploit chain that bypassed Microsoft Edge's sandbox and achieved remote code execution — earning $175,000 at Pwn2Own Berlin in May. Notably, no memory corruption was required; the entire chain relied on logic bugs alone. Microsoft patched the Edge flaws the day after the contest, making this a valuable case study in non-memory-corruption browser exploitation.
-
3The Hacker News generalAdobe Commerce PolyShell Attacks Breach Hundreds of Stores as Brotli Exploit Traffic Emerges
CISA added three vulnerabilities to its KEV catalog: CVE-2026-111497 (CVSS 9.2) in Adobe Commerce/Magento via a PolyShell attack campaign breaching hundreds of e-commerce stores, and a critical flaw in Google's Brotli decoder library (the Node2Shell/HTTP2Shell vector) with confirmed active exploitation observed by honeypot operators. Organizations running Adobe Commerce or Magento storefronts and systems using the Brotli library face immediate patching urgency.
-
4The Hacker News generalShinyHunters-Exploited Oracle PeopleSoft Zero-Day Turns Out to Be Three Chained Flaws
Researchers revealed that the critical Oracle PeopleSoft vulnerability exploited by ShinyHunters since May 2026 is actually three chained flaws — a server-side request forgery (SSRF) reaching an internal management interface via PeopleSoft's trusted loopback address — all patched by Oracle under the single identifier CVE-2026-35273 in June. The ShinyHunters group's months-long exploitation window before patching underscores the risk of chained SSRF attacks on enterprise ERP systems.
-
5The Hacker News generalHackers Target Critical Oracle E-Business Suite RCE Flaw Days After Security Patch
Threat actors began probing for CVE-2026-101767 (CVSS 9.8), an unauthenticated SQL injection enabling remote code execution in Oracle E-Business Suite's Application Object Library, within days of Oracle's Critical Patch Update. Threat intelligence firm Defused Cyber confirmed active scanning is underway, making immediate patching critical for the large installed base of Oracle EBS deployments.
-
6The Hacker News generalCritical 16-Year-Old UEFI Flaw Can Run Code Before Secure Boot on Network-Booting Servers
A critical 16-year-old vulnerability in EDK II — the open-source UEFI firmware codebase used by most hardware manufacturers — allows pre-OS code execution on network-booting servers before Secure Boot activates. The flaw is exploitable only during PXE/network boot scenarios, but its presence in a widely-deployed firmware base across data center and enterprise hardware makes it a significant supply chain and infrastructure risk.
-
7The Hacker News generalPHP2Shell Attack Roots 25 Servers, Breaches U.S. Government-Affiliated Network
A suspected China-nexus threat actor exploited PHP2Shell vulnerabilities combined with a kernel privilege escalation exploit to root 25 servers, including systems within a US government-affiliated network, in an attack observed on October 25, 2026. Researchers noted AI-assisted elements in the attack orchestration, signaling an escalation in attacker tooling sophistication targeting web management interfaces of firewalls and VPNs.
-
8The Hacker News generalAdobe Fixes 8 Critical Campaign Classic Flaws Allowing Code Execution and Security Bypass
Adobe patched eight critical vulnerabilities in Campaign Classic, including CVE-2026-104351 (CVSS 9.9), a code injection flaw enabling arbitrary code execution, along with additional bugs enabling security feature bypass and privilege escalation. Organizations using Adobe Campaign Classic for marketing automation should treat this as an urgent patch given the near-maximum severity score and code execution impact.
-
9The Hacker News generalTailscale Patches SSH Flaws That Could Let Hacked Devices Gain Root Access on Other Servers
Tailscale released version 1.104.4 to address flaws in its built-in SSH server — dubbed 'Tailworm' — that could allow an attacker on a compromised node to pivot and gain root-level access to other servers in the Tailnet. The vulnerability stems from how Tailscale SSH forwards network connections using the root-privileged background process, and was disclosed publicly before patches were ready, forcing an emergency response from the Tailscale team.
-
10SecurityWeek generalChrome and Firefox Updates Patch Over 200 Vulnerabilities
Google released Chrome 156 with 52 security fixes, while Mozilla shipped Firefox 159 patching 167 vulnerabilities in a combined release cycle addressing over 200 flaws across both major browsers. Security teams managing enterprise browser fleets should prioritize deployment of both updates given the volume of addressed issues, which likely includes several high-severity memory safety bugs typical of these release cycles.