IT Security News Roundup: 2026-10-29 Afternoon

IT Security News: Afternoon roundup, 2026-10-29

Summary

Active exploitation and fresh patch advisories dominated this window: CISA added Linux kernel and Broadcom VMware ESX flaws to its Known Exploited Vulnerabilities catalog, attackers began scanning for a recently patched Oracle E-Business Suite bug, and Veeam disclosed a critical authorization bypass. AI security was the other strong thread, with flaws in popular AI coding tools, an OpenAI compaction weakness that exposed hidden reasoning, and Cisco open-sourcing a detection engine for agent behavior. Law enforcement and policy stories, including Australia's takedown of an Amadey backend and political pushback on ad-driven spyware, show defenders gaining ground. For readers, the practical message is to patch known-exploited bugs quickly and to treat AI agents and tooling as a new attack surface.

1. Veeam disclosed a critical authorization bypass in Backup & Replication on October 27, 2026. Attackers without credentials can circumvent access controls on the CDP Coordinator Service, which puts backup infrastructure at risk until patched.
2. Cisco Talos researcher Ryan Fetterman talks about what "blue collar" detection engineering looks like in practice. He also shares his approach to building a security career without burning out.
3. Banks are blocking AI agents from customer accounts and cite security risks. The article asks whether keeping these tools out also protects the banks' own profits.
4. Politicians in the U.S. and Europe are speaking out against advertising technology being used to infect targets with zero-click spyware. Citizen Lab reports that targeted ads are increasingly seen as a security risk.
5. Operation CANTABRIA, run jointly by European and Ecuadorian law enforcement, led to 20 arrests in a drug trafficking case. The EU's interior commissioner stressed that international cooperation is key against borderless criminal networks.
6. CISA added Linux kernel and Broadcom VMware ESX vulnerabilities to its Known Exploited Vulnerabilities catalog. Broadcom had released patches for the ESX issue in July, so unpatched systems should be prioritized.
7. The piece describes how industry, the UK's NCSC and the FCA worked together on a practical way for organisations to share information. The aim was to do so while protecting market integrity.
8. Some early buyers of Apple's first foldable iPhone, the iPhone Duo, report a defect that cracks the inner screen. The reports come amid strong initial demand for the device.
9. A buyer's guide on choosing a managed IT service provider for a business. It argues the choice can significantly influence a company's operations and security posture.
10. BAE Systems, a contractor for federal bankruptcy court systems, says no data was extracted during a cyber intrusion. A spokesperson made the statement to Recorded Future News while the company investigates.
11. A DHS data leak exposed records of more than 41,000 workers, including ICE agents. The coverage looks at what was leaked, the suspected access method and the resulting security risks.
12. Security firm Xint showed that OpenAI's compaction feature could be turned into a way to extract a model's hidden reasoning in plain text. Normally the reasoning is returned only as an encrypted item.
13. A Dark Reading piece outlines a four-question whiteboard exercise that CISOs can use to build a threat model. It promises useful results without a big spend.
14. The article looks at how AI can improve SOC workflows when combined with the open-source Wazuh platform. It frames AI as transforming both attacker and defender capabilities.
15. CyberMaterial's October 28 briefing highlights a Veeam backup bypass rated 9.1, the PHP2Shell campaign rooting firewalls, and a leak of 2.58 million records.
16. The Australian Signals Directorate gained access to an Amadey malware operator's backend and disconnected the controller from 180,000 infected computers worldwide. The operator can no longer access those machines or steal their data.
17. Manufacturing security looks very different from office-network security because of aging factory equipment. The article discusses the challenges of applying modern cybersecurity practices to those environments.
18. A critical 16-year-old flaw in EDK II, the open-source code behind much UEFI firmware, can let an attacker run code before the operating system loads. It is exploitable only while a machine boots over the network.
19. Anthropic's IPO filing discloses risks and its control structure. The company plans to list on Nasdaq under the ticker ANT, possibly as early as next month.
20. This post covers frontier AI-accelerated attacks and securing the agentic web and the MCP surface. The feed provided no text preview, so details are only available in the original article.
21. Attackers have begun probing the Internet for systems still unpatched against a recently disclosed critical Oracle E-Business Suite vulnerability. Organizations that haven't applied the fix are now being actively targeted.
22. The EMBRACE flaws affect Cursor, GitHub Copilot, Codex, VS Code and Claude Desktop. They enable code execution, file theft and browser address-bar spoofing, which makes AI coding tools a real attack surface.
23. Cisco open-sourced Project Quarry, a behavior detection engine for AI agents. It aims to prevent security incidents by analyzing complete action sequences rather than isolated events.
24. Rapid7 explains how its FedRAMP-authorized InsightGovCloud supports CISA's BOD 22-01. It offers automated vulnerability scanning, real-time alerts for known exploited vulnerabilities, and compliance reporting.
25. A major ransomware attack in New Zealand has delayed coronial investigations. One family has waited nine months for answers about their mother's death and calls the wait "incredibly stressful".

Summaries written with AI (Claude by Anthropic) from the linked source articles.

Sources in this roundup

Most-mentioned keywords

Sources

1. Veeam Patches Critical Authorization Bypass
2. From federal SOCs to Talos: Ryan Fetterman on practical security research
3. Banks are blocking AI agents from customer accounts
4. Politicians in U.S. and E.U. Say Targeted Ads Are a Security Risk
5. European and Ecuadorian cooperation leads to 20 arrests in major hit against drug trafficking
6. U.S. CISA adds Linux Kernel and Broadcom VMWare ESX  flaws to its Known Exploited Vulnerabilities catalog
7. From industry concern to practical action: the value of working with regulators
8. Some Early iPhone Duo Buyers Report Screen Defects
9. How to Choose the Best Managed IT Service Provider for Businesses
10. Federal bankruptcy courts contractor says no data stolen during cyber intrusion
11. DHS Data Leak Exposes 41,000 Workers, Including ICE Agents
12. OpenAI Compaction Flaw Let Researchers Bypass Hidden Reasoning Protections
13. Threat Modeling With 4 Simple Questions on a White Board
14. Wazuh and AI for Enhanced SOC Workflows
15. CYBER BRIEFING | October 28, 2026
16. Australia Gets Into Amadey Malware Backend, Cuts Off Access to 180,000 Infected Computers
17. What Happens When Old Factory Equipment Meets Modern Cybersecurity
18. Critical 16-Year-Old UEFI Flaw Can Run Code Before Secure Boot on Network-Booting Servers
19. Anthropic IPO Filing Discloses Risks, Control Structure
20. Frontier AI–Accelerated Attacks: Securing the Agentic Web and MCP Surface
21. Hackers now scanning systems for recently-patched Oracle flaw
22. EMBRACE Flaws in 5 AI Coding Tools Enable Code Execution and File Theft
23. Cisco open sources AI agent behavior detection tool
24. How Rapid7 InsightGovCloud Supports BOD 22-01 Compliance
25. NZ: Grieving families’ ‘incredibly stressful’ wait for answers after major NZ cyber attack