IT Security News Roundup: 2026-10-28 Evening

IT Security News: Evening roundup, 2026-10-28

Summary

The evening was dominated by supply chain and infrastructure exposure. AWS published guidance on the Brotli decoder flaw (CVE-2026-111497) that has rippled across runtimes, a critical EDK2 firmware bug put most servers at risk, and attackers hijacked a Convertr analytics script to skim payment cards. Alongside this, AI agents emerged as both target and liability: a booby-trapped file tried to steer a coding agent into installing malware, banks warned customers about sharing credentials with assistants, and maintainers and CISOs are wrestling with AI-generated reports and legal exposure. Meanwhile, state-linked activity, law enforcement takedowns and a fresh DHS employee leak underline how geopolitics and crime keep feeding the threat picture, which matters for anyone patching, vetting dependencies or deploying AI tooling.

1. Bank of America reminded customers they remain responsible for any activity their AI agents perform with their credentials, discouraging people from handing banking passwords to AI assistants.
2. Malwarebytes' weekly recap covers the security stories of October 19-25, 2026, a handy catch-up for anything missed during the week.
3. AWS published a bulletin on CVE-2026-111497, a native Brotli decoder flaw enabling code execution or memory reads. Lambda, Amplify, App Runner, CodeBuild, Elastic Beanstalk and others are being fixed; some services need customer action.
4. A recent Shai-Hulud attack shows that SBOMs alone fall short in supply chain incidents; defenders also need real-time visibility into production code and affected services to scope a compromise.
5. A study finds Huawei's collaboration with DeepSeek, plus its own engineering, is narrowing the AI performance gap with Nvidia despite Huawei's weaker resources.
6. Forever Security caught a malicious instruction file in a developer's Downloads folder trying to make an AI coding agent install a known-malicious npm package. The agent was stopped before code ran; how the file arrived remains unknown.
7. Dark Reading outlines three frameworks for CISOs facing AI liability: rigorous documentation, transparency, and careful contract negotiation with AI vendors.
8. Researchers say Russia-linked groups used the experimental Yggdrasil mesh network for communications in an attack on a Ukrainian logistics firm, showing attackers adopting unconventional infrastructure.
9. The GhostAction supply chain campaign has cooled, but its operators remain active in GitHub and are shifting toward developer endpoints and cloud access, hinting at their next targets.
10. Hacktivists from the "Department of Peace" group passed data on over 41,000 DHS employees to a Swiss hacker-journalist, and DDoSecrets published it, exposing personnel to potential targeting.
11. A critical flaw in the EDK2 UEFI firmware lets attackers run code early in the boot process, affecting most servers worldwide and making firmware updates urgent for data centers.
12. Cisco Talos details UAT-11473, an advanced actor exploiting authentication bypass CVE-2026-20127 in Cisco SD-WAN Catalyst Controllers to gain access and deploy the KeyDrift malware.
13. A card-skimming group reportedly compromised a shared analytics script used by e-commerce platform Convertr, stealing shoppers' payment data at checkout and illustrating third-party script risk.
14. Meta's free cash flow turned negative amid heavy spending; it raised the low end of its capex guidance and disclosed $825bn in future spending commitments.
15. Ahead of its IPO, Anthropic outlined security risks including out-of-control AI, while suggesting that profit considerations will also shape its decisions.
16. A wide social engineering campaign, possibly tied to Black Basta, pairs mail bombing with external Microsoft Teams chats to deliver malware within about 15 minutes.
17. OpenAI's Daybreak lead says open-source maintainers are swamped by AI-generated vulnerability reports, with some refusing them, and urges higher-quality findings and better coordination.
18. Sweet Security is offering free virtual patching protection to all organizations affected by HTTP2Shell, giving stopgap defense for those unable to patch immediately.
19. Ukrainian national Artem Stryzhak received 70 months in prison for Hive and Nefilim ransomware attacks, while the FBI offers $11 million for an alleged co-conspirator.
20. Researchers operated multiple silicon qubits at once with roughly 99.9% accuracy, even with all five running, removing a key obstacle to scaling quantum processors.
21. Europol, the European Labour Authority and 34 countries reported 27 arrests and 248 potential victims identified in an action week against human trafficking for labour exploitation.
22. A cyberattack hit email accounts at Italy's Chamber of Deputies, including one assigned to Prime Minister Meloni, prompting calls for transparency, stronger defenses and accountability amid hybrid warfare concerns.
23. U.S. authorities seized the main domain of Virtualine, a bulletproof hosting service advertised on cybercrime forums and tied to ransomware and other illegal activity.
24. Wired reports that the critical UEFI firmware flaw lets attackers execute code early in boot and affects most server vendors and data centers.
25. Work to protect DNS against future quantum decryption attacks is accelerating, alongside regional internet registry reform and scammers' use of trustworthy-sounding domains.

Summaries written with AI (Claude by Anthropic) from the linked source articles.

Sources in this roundup

Most-mentioned keywords

Sources

1. Bank of America kindly asks that you don’t share your banking password with your AI assistant
2. A week in security (October 19 – October 25)
3. CVE-2026-111497: Native Brotli Decoder Remote Code Execution and Memory Disclosure
4. SBOMs Alone Can't Reveal the Scope of a Supply Chain Attack
5. DeepSeek, Huawei Narrow AI Performance Gap With Nvidia
6. Malicious File in Downloads Folder Tries to Trick AI Coding Agent Into Installing Malware
7. 3 Frameworks to Protect CISOs & Orgs Against AI Liability
8. Russian Hackers Use Experimental Network In Ukraine Strike
9. GhostAction Hacking Wave Fizzles, But Attackers Lurk on in GitHub
10. Leak site publishes data on more than 41,000 DHS employees obtained by hacktivists
11. Code-execution flaw in UEFI firmware affects most servers on planet Earth
12. Inside KeyDrift: Analyzing historical UAT-11473 activity on Cisco SD-WAN
13. Hackers hijack Convertr analytics script to steal payment card data
14. Meta Free Cash Flow Falls Into Red Amid Heavy Spending
15. All the security risks Anthropic is worried about before its IPO
16. External Teams Chats Anchor 15-Minute Malware Delivery
17. Before you file that AI bug report, OpenAI has some advice
18. Sweet Security Offers All Organizations Affected by HTTP2Shell Virtual Patching Protection at No Cost
19. Hive and Nefilim Ransomware Affiliate Gets 70 Months In Jail
20. Scientists overcome a hidden obstacle to more powerful quantum computers
21. 27 arrests and 248 potential victims identified in action week against labour exploitation
22. Italy ’s Parliament Under Cyber Pressure: Why the Attack on the Chamber Matters
23. Police seize Virtualine bulletproof service tied to ransowmare, cybercrime
24. Most Servers on the Planet Are Vulnerable to This Firmware Code-Execution Flaw
25. Work to protect DNS from quantum decryption attacks is speeding up