Cybersecurity News — 2026-10-30

Generated: 2026-10-30 | Sources: Drupal, CISA, Dream Security, Perplexity, Microsoft, Cisco, Socket, Anthropic, Cursor, Sansec, Convertr, Amadeus, Japan Airlines, Sony Network Communications, Apple, Broadcom, The Hacker News, BleepingComputer, SecurityWeek

1. A Flaw Being Exploited in Drupal's Shop Module Needs Patching Today

Drupal Commerce Core is the module that turns a Drupal website into a shop. CVE-2026-118539 is a missing-authorisation flaw: the module does not sufficiently protect certain routes and entity fields, so someone with no account can reach data and actions meant to be restricted. Drupal rates it highly critical and says it is being actively exploited, though it has not described the attacks or how widespread they are. Everything up to Commerce Core 2.41 is affected on the older branch, and up to 3.3.13 on the current one; the fixes are those two versions.

Why it matters for your business: if your website is a Drupal shop, this is a patch-today job — ask your developer or host to confirm the Commerce Core version in writing. Because the flaw needs no login, an unpatched site is exposed to anyone who finds it. Once patched, look through recent orders and admin accounts for anything nobody can account for.

2. The PHP Flaws From Last Week Are Now Confirmed in Real Attacks, and Chained With a Second One

Last week the PHP2Shell flaws (CVE-2026-109618 and CVE-2026-109619) had drawn millions of exploit attempts but no confirmed break-in. That has changed. CISA has added them to its list of actively exploited flaws, and a honeypot run by a Perplexity engineer caught a genuine attack against PHP 8.4.26. Attackers are also chaining them with Fragnesia (CVE-2026-46300), a Linux kernel flaw that turns a foothold into full root control; it affects kernels built before 13 May 2026 and a public exploit exists. Dream Security reports the combination was used to take over 25 servers. Patches exist for both.

Why it matters for your business: if you asked your host about PHP two weeks ago and got a vague answer, ask again and insist on a version number — exploitation is no longer theoretical. The server's operating system needs patching too. A patched PHP on an unpatched kernel still hands an attacker root.

3. A Flaw in the Compression Nearly Every Website Uses Is Being Exploited

Brotli is a compression format used across the web to shrink data in transit. CVE-2026-111497, known as Node2Shell, is an out-of-bounds write in the Brotli decoder: an attacker with no account can send a specially compressed request that crashes the software, leaks memory from it, and on some systems runs code on the machine. It was first found in Node.js but affects any server or client using a vulnerable Brotli library — Microsoft shipped an emergency .NET update for it. CISA says exploitation has begun and gave US federal agencies until 10 November.

Why it matters for your business: few small businesses run this directly, but plenty of the web applications you pay for do. Ask your software suppliers whether they are affected and when they patched. If you host anything yourself, installing the patch is not enough on its own — affected processes must be restarted and containers rebuilt before the fix takes effect.

4. A Firewall Flaw Being Exploited Knocks Remote Workers Offline

Cisco ASA and Threat Defence firewalls sit at the edge of many business networks and provide staff VPN access. CVE-2026-76418 is a logic error in the remote-access SSL VPN service: an attacker with no account, and without any successful VPN login, can send traffic that forces the firewall to restart. Cisco learned in October that it was being exploited, has released fixes, and says there is no workaround. It affects tunnel groups using secondary authentication, and is the second exploited flaw of this kind since August. Note what it shares with the Drupal, PHP and Brotli flaws above: all four are reachable from the internet with no login.

Why it matters for your business: you probably do not manage this yourself. Ask whoever runs your network whether Cisco ASA or FTD is in use and whether it is on a fixed release. If your VPN has dropped unexpectedly in recent weeks, say so — a firewall rebooting under attack looks like a glitch rather than an intrusion.

5. Windows Has Now Stopped Trusting the Certificate Authority With Guessable Keys

Last week eMudhra's intermediate certificate keys were found to be guessable and browsers blocked them. The clean-up has now reached Windows itself. On 26 October Microsoft released out-of-band updates — KB5134133 for Windows 11 24H2, 25H2 and 26H2, and KB5134125 for Windows 10 21H2 and 22H2 — removing trust from seven certificates: six eMudhra G3 roots and one cross-signed AAA Certificate Services certificate. The same removals reached Edge on 27 October. Machines receiving Microsoft's automatic certificate-trust updates need no action; this update is for computers that are offline, cannot reach that service, or have those automatic updates switched off.

Why it matters for your business: if you keep any Windows machine off the internet — a till, or a PC running old line-of-business software — it will go on trusting certificates nobody else does until someone installs this update by hand. Separately, if any service you run uses an eMudhra certificate, replace it now: on updated computers it will simply stop working.

6. 319 Chrome Extensions With 13.4 Million Installs Were Quietly Redirecting Searches

Socket found 319 Chrome extensions, with roughly 13.4 million installs between them, that hijack the browser's default search engine and route searches through servers the operators control, earning referral payments. The operators can change where those searches end up at any time, so the same extensions could redirect users to phishing pages or malicious downloads. They posed as PDF converters, manual finders, safe-search and AI search tools, and were unlisted in the Chrome Web Store so they never showed up in store searches — they were promoted through adverts on low-quality websites. Most have now been removed, but new ones keep appearing.

Why it matters for your business: open Chrome's extensions page on every work computer and remove anything nobody can explain. A hijacked search engine is a quiet problem: results look normal while every query passes through someone else's server. If an extension arrived from an advert rather than a deliberate search, that alone is reason to delete it.

7. A Developer Tool's Official Release Was Replaced With a Backdoored Copy for Eleven Hours

On 29 October the official Claude Code extension for Visual Studio Code, used by developers, was published in a trojanised version — 2.1.313 — to both the Microsoft and Open VSX marketplaces. A 66-line loader inserted ahead of the real code wrote an attacker's SSH key into the user's authorized_keys file, tried to switch SSH on, opened a tunnel to an external server, and reinstalled itself through a scheduled task, crontab or LaunchAgent. It also sent out the machine's hostname, username and the names of up to 40 secret-looking environment variables. Anyone whose editor auto-updated inside that window received it. Version 2.1.314 is clean; how the compromise happened is not known.

Why it matters for your business: if anyone writing software for you uses this extension, updating is not the fix. The SSH key and the persistence survive an update, so they have to be removed by hand and every credential on that machine rotated. Cursor advises following the removal steps even where enabling SSH would have failed.

8. One Analytics Script Turned Every Shop on a Platform Into a Card Skimmer

Sansec found that attackers had modified a shared analytics script hosted by Convertr, a Brazilian e-commerce platform, so that it skimmed card details from the checkout pages of every merchant using it. The stolen fields were the card number, expiry date, CVV, cardholder name and Brazilian taxpayer ID. Sansec believes the attackers got in through an out-of-date self-hosted install of Plausible analytics (CVE-2026-8467), though that is unconfirmed. Convertr has removed the skimmer and patched Plausible. Browser caching can keep the old script running for up to 24 hours after clean-up.

Why it matters for your business: the lesson travels well beyond Brazil — a single third-party script on your checkout page can read everything a customer types into it. List every script that loads on your checkout, confirm each one still needs to be there, and ask who patches the ones you host yourself. Analytics is the most common and least examined.

9. An Airline's Breach Happened at Its Supplier, and Went Unnoticed for Three Years

Japan Airlines said customer data was exposed by a breach at Amadeus, the supplier running its passenger service system. Amadeus told JAL on 23 October that its systems had been accessed between August 2023 and September 2026. Around 90,000 customers had booking references, names, flight dates and routes taken; about 2,000 also had email addresses, phone numbers, passport numbers and frequent-flyer details exposed. JAL says no card numbers or passwords were involved. ANA, Asiana and Korean Air have confirmed impact from the same supplier. With the Convertr skimmer above, that is two of this week's breaches that began at a supplier rather than the victim.

Why it matters for your business: you cannot patch a supplier, but you can ask two things before signing: will you tell us within 72 hours of discovering a breach, and exactly what of ours do you hold? A three-year undetected intrusion is also a prompt to keep your own list of which suppliers hold your customer data.

10. 2.6 Million Customer Records Taken From Sony's Japanese Internet Provider

Sony Network Communications disclosed that about 2.6 million customer records were stolen from So-net and Plala, its Japanese internet providers. Attackers entered the member database on 19 October; Sony detected them on 23 October, took the server offline, and confirmed the theft a day later. The exposed data includes names, dates of birth, phone numbers, email addresses and account IDs, plus around 54,000 email addresses together with their passwords, and 16 bank account records. No card details were held. Sony has forced password resets on the affected mail accounts and reported the incident to Japan's data protection regulator. How the attackers got in has not been disclosed.

Why it matters for your business: four days between break-in and detection is faster than most. The real risk here is the mailbox passwords: stolen credentials get tried against other services within hours. Use a different password for every account, and if you only turn multi-factor authentication on in one place, make it email.

11. Older iPhones and iPads Finally Get the Fix for a Flaw Already Used in Attacks

Apple has backported the fix for CVE-2026-86950, an out-of-bounds write in CoreGraphics that lets a maliciously crafted file run code on a device, to hardware too old for the current iOS. Apple says the flaw may have been used in an extremely sophisticated attack against specific targeted individuals, and CISA added it to its actively exploited list in late September. The original patch shipped in September for iOS 26.7.1 and current macOS; the backport, released 26 October, covers the iPhone XS, XS Max and XR, the 7th-generation iPad, iPad Air 4th generation and later, iPad 9th generation and later, and iPad mini 6th generation and later.

Why it matters for your business: older phones kept as spares or handed down to staff are exactly the ones that miss updates. Check every work device for a pending update and install it — these models sat exposed to a known exploited flaw about a month longer than newer ones. Any device too old to receive updates at all should be retired.

12. A Router Wi-Fi Flaw With No Fix Lets Anyone Nearby Take Control

Researcher Quentin Kaiser showed that Broadcom's implementation of Wi-Fi Protected Setup — the pairing feature on routers — mishandles fragmented setup messages, letting anyone within radio range corrupt the router's memory and run their own code on it with full privileges. No password or pairing is required. Broadcom's WPS code is embedded in routers and access points from dozens of vendors, which Kaiser estimates at millions of devices. No fix has been shipped: Broadcom released an incomplete one in 2018 and advised customers to use different software, and on older eCos-based chips there is no usable fix at all. No real-world attacks have been reported and no CVE has been assigned.

Why it matters for your business: an attacker has to be physically close, so this matters most for an office, shop or café router within range of the street or the neighbours. Ask your internet provider or router maker whether a firmware update is planned, naming the model. Where the answer is no, replacing the router is the only fix.

Sources

New editions publish Every Friday. Summaries are compiled from public threat-intelligence feeds and security news sources. This digest is for awareness purposes only and does not constitute professional security advice.

Cybersecurity News