IT Security News Roundup: 2026-10-29 Morning

IT Security News: Morning roundup, 2026-10-29

Summary

The morning was dominated by edge-device and browser exploitation: Cisco patched a second actively exploited firewall VPN zero-day since August, a researcher showed a zero-click Microsoft Edge chain, and Volt Typhoon was tied to several zero-days used against U.S. critical infrastructure. Alongside these ran the Brotli decompression flaw (HTTP2Shell), which reaches well beyond Node.js. Identity and trust were another thread, with Microsoft pushing admins off SMS authentication, fake Cloudflare checks spreading malware, and a huge leak of DHS staff records. For defenders, the common message is to inventory exposed components quickly, patch, and reduce reliance on weak authentication.

1. Microsoft will retire SMS and voice authentication in Entra ID starting February 1, 2027, covering Worldwide and GCC clouds. Admins should move users to passkeys now to cut phishing exposure and avoid sign-in disruption.
2. A fifth EMPACT Hackathon in Amsterdam, supported by Europol and Eurojust, brought together 40 experts from 20 countries. It identified 51 potential human trafficking victims and five suspects by focusing on the digital side of the crime.
3. A hacktivist group calling itself the Department of Peace leaked names, offices and assignments of over 41,000 DHS employees via DDoSecrets, exposing undercover ICE agents. The data allegedly came from an Okta single sign-on environment.
4. Microsoft's new public preview tool dotnetup aims to give .NET a rustup-style, single-command install across Windows, macOS and Linux. It works without elevated privileges, which also suits CI/CD runners and ephemeral build environments.
5. A network of 319 Chrome extensions, posing as PDF converters and safe-search helpers, hijacked searches for about 13.4 million users over a decade. Queries were routed through operator servers before reaching Yahoo or Bing to earn referral revenue.
6. The UK's ICO reprimanded Staffordshire Police over a serious personal-data breach connected to a domestic abuse case. The ruling underlines the heavy consequences when police mishandle sensitive victim information.
7. A new ClickFix campaign uses counterfeit Cloudflare "Verify you are human" pages to trick Windows and Mac users into running malicious commands themselves, which starts the infection chain.
8. A study found 42% of US county election websites still lack .gov domains, and also flagged weak email protection and third-party tracking. This leaves voters exposed to spoofing ahead of the November 3 election.
9. GitHub launched Copilot Fusion, which automatically picks the AI model for each coding task to balance quality, speed and cost. It is generally available in Visual Studio Code, Copilot CLI and other GitHub surfaces.
10. Thales Imperva API Security now surfaces six token-related risks, such as weak signing algorithms, overly long lifetimes and exposed credentials, directly in the API inventory. This helps teams prioritize and fix authentication weaknesses per endpoint.
11. Researcher Orange Tsai published a zero-click Microsoft Edge exploit chain combining five logic bugs and two Windows features. It escapes the sandbox and executes code on Windows without any memory corruption.
12. Cisco confirmed attackers are exploiting CVE-2026-76418 (CVSS 8.6) in the Remote Access SSL VPN of ASA and FTD software, the second such firewall zero-day since August. Unauthenticated attackers can force devices to reload.
13. A mysterious relay service supplies OpenAI Codex and Claude Code to mainland China and other unsupported regions, but with key security features such as sandboxes switched off. That leaves users running unprotected coding agents.
14. Cisco Talos spotted "NIK C2" in the wild, a new command-and-control framework with built-in AI integration. It shows attackers are starting to weave AI directly into their operational tooling.
15. This buyer's guide compares twelve SOAR platforms, from SIEM-bundled automation to no-code tools, judging which builder model teams can realistically sustain once the demo excitement fades.
16. NIST published guidance helping federal agencies prioritize post-quantum cryptography for their most sensitive systems. It is aimed at meeting the 2031 transition deadline.
17. Cisco released fixes for CVE-2026-76418 in the Remote Access SSL VPN of Secure Firewall ASA and FTD. The actively exploited flaw lets unauthenticated attackers cause device reloads and denial of service, so patching is urgent.
18. Amazon unveiled a range of gadgets showcasing its updated Alexa AI service while reportedly cutting up to 250 jobs in its devices unit.
19. This guide judges twelve SIEM platforms on pricing honesty, analyst workflow and ecosystem fit, noting 2026 consolidation around QRadar, Exabeam and Splunk under Cisco that buyers must factor in.
20. A cyber incident forced UNM Health to divert ambulances and pause outpatient care. It shows why hospital response plans must prioritize keeping patient services running.
21. Black Lotus Labs says Volt Typhoon exploited multiple unknown flaws in enterprise management platforms to hit strategic U.S. organizations. The research reveals "Silent Train," an access framework built on rapidly rotating chains of compromised devices.
22. The FBI seized virtualine.net, a hosting service accused of supporting criminal sites, ignoring abuse reports and helping launder proceeds. Despite the seizure, the allegedly abusive service itself reportedly remains online.
23. A sysadmin put profanity in a password to show off, a reminder that an unusual credential only helps if the rest of the security setup is also solid.
24. A former senior Merseyside Police officer secured Silicon Valley backing for an AI start-up valued at nearly $400m, building AI tools for law enforcement.
25. CVE-2026-111497, now called HTTP2Shell, is a Brotli decompression flaw that affects multiple runtimes and infrastructure components, not just Node.js. Defenders should find vulnerable decoders, check whether untrusted compressed data reaches them, then patch, redeploy and hunt.

Summaries written with AI (Claude by Anthropic) from the linked source articles.

Sources in this roundup

Most-mentioned keywords

Sources

1. Microsoft Urges Entra ID Admins to Migrate from SMS and Voice Authentication to Passkeys
2. 5th EMPACT Hackathon leads to the detection of 51 potential victims
3. Hacktivists leak 41,000 DHS staff records, revealing undercover ICE agents
4. Simplifying .NET toolchain installs with dotnetup
5. 319 Chrome Extensions Found Hijacking Searches, Affecting 13.4 Million Users
6. ICO Reprimands Staffordshire Police After Domestic Abuse Breach
7. Hackers Use Fake Cloudflare Verification Pages to Target Windows and Mac Users
8. Election Website Security: 42% of US County Sites Still Lack .gov Domains
9. GitHub Launches Copilot Fusion for Smarter and Cheaper AI Coding
10. From Token Risk to Remediation: Thales Imperva API Security Brings Authentication Risks Into API Inventory
11. Microsoft Edge 0-Click Exploit Chains Five Flaws to Execute Code and Escape Sandbox
12. Attackers Exploit Second Cisco Firewall VPN Zero-Day Since August
13. Shadowy AI Relay Disables OpenAI Codex, Claude Code Sandboxes
14. NIK C2: The new AI-enabled command-and-control framework
15. 12 SOAR Tools: The 2026 Buyer’s Verdict Guide
16. NIST Publishes Guidance to Meet Federal Post-Quantum Deadlines
17. Cisco Patches Actively Exploited SSL VPN Vulnerability Affecting ASA and FTD Firewalls
18. Amazon Launches Alexa Gadgets, Cuts Jobs In Devices Unit
19. 12 SIEM Tools: The 2026 Buyer’s Verdict Guide
20. UNM Health Cyber Incident Diverts Ambulances, Disrupts Patient Care
21. Volt Typhoon Hackers Exploit Multiple Zero-Days to Breach U.S. Critical Infrastructure Networks
22. Virtualine Domain Seized, but Allegedly Abusive Website Remains Online
23. Admin dropped the F-bomb in a password to show hackers who was really 1337
24. Ex-Merseyside Police Officer Founds $400m AI Start-Up
25. HTTP2Shell: The Brotli Vulnerability That Extends Beyond Node.js