WordPress.org released WordPress 7.1.4 on 28 October 2026 as a security release and recommends that sites update immediately; sites with automatic background updates will update automatically. The release post credits reporters for: a weakness in the WordPress upgrade process that can lead to remote code execution during the upgrade window (Umut Bayram); several stored cross-site scripting (XSS) bugs, including in specially crafted block markup, the Interactivity API, Customizer selective refresh, the Categories, Playlist, image and comments-pagination blocks, Privacy Data Removal Requests and specially crafted user logins (the last two reported by Anthropic); a stored denial-of-service issue in the Interactivity API; unpublished Customizer changesets that unauthenticated users can discover; and Notes that privileged users can read without access to edit the attached post. The release also updates the bundled root certificates because of the eMudhra revocation. WordPress says the security fixes are being backported to all branches eligible for security fixes (currently back to 4.7) and will ship as they become ready, and that WordPress 7.2 Beta 3 contains all applicable fixes. The post does not give CVE numbers or severity scores and does not say any of the flaws is being exploited. (source: WordPress.org) Correction (02 Nov 2026): removed The Hacker News as a source; removed details no other source gives. (source: WordPress.org)
WordPress.org News — WordPress 7.1.4 (28 Oct 2026)
The Independent reported on 28 October 2026 that US-based AI startup Cathedral, which The Independent says was founded this year by former staff of the US Department of Government Efficiency, claimed it breached Anthropic's internal network in less than 12 hours as part of a bug bounty program that encourages outsiders to look for security flaws. (source: The Independent) According to The Independent, Anthropic confirmed that Cathedral had reached a "limited set" of sales, HR and IT systems but did not access users' conversations with Claude, and the model's source code was not compromised. Anthropic said in a statement quoted by The Independent: "Our monitoring flagged some of Cathedral's activity before they reported it to us," and "We shut off their access the same day." (source: The Independent) An Anthropic spokesperson told The Independent that the activity "involved attempts over several days", pushing back on the 12-hour claim, and that Cathedral's actions went "substantially beyond" the company's bug bounty program by targeting third-party applications. (source: The Independent)
The Independent — Anthropic hacked by AI startup in less than 12 hours, report claims (28 Oct 2026)
Google announced Gemini 4 Carbon on 28 October 2026, calling it its strongest model, with state-of-the-art cybersecurity and long-horizon capabilities (Google blog, Koray Kavukcuoglu, SVP Google DeepMind and Chief AI Architect). Google says Carbon scores 88.2% on SEC-bench Pro for finding vulnerabilities, 54.8% on the ExploitGym exploitation benchmark and 71.0% on Collinear's CWE-bench for patching, evaluated without guardrails, and ranks first at 59 on v5.0 of the Artificial Analysis Intelligence Index. On internal benchmarks, Google says Carbon achieves more than 2x uplift in success rate for generating secure code over Gemini 4 Argon, and that the Chrome team reported Carbon performed more than 10X better than another lab's large frontier model when generating high quality patches. On safety, Google says Carbon builds on Argon's multi-layered safety and security stack, achieved a 0.0% attack success rate on Gray Swan's Indirect Prompt Injection benchmark (Argon: 0.7%), cut successful cheating on Terminal-Bench 4.0 to 0.0%, and saw high-severity misalignment alerts drop by almost 80% in live coding environments with internal teams. Google says it is taking a deliberate approach to rollout and is taking part in the U.S. government's voluntary process for checking models before release: starting this week, Carbon goes to a subset of cyber defenders, with access phased to additional trusted partners through its Fairwind Program before availability to developers, businesses and consumers. Google lists an introductory price of $2 per million input tokens and $10 per million output tokens, then $4 and $20. (source: Google) Correction (02 Nov 2026): removed The Hacker News as a source. (source: Google)
Google — Gemini 4 Carbon: our next frontier model (28 Oct 2026)
Belgium's Federal Public Service Finance (FOD Financiën / SPF Finances) says its digital services were hit by a cyberattack on Wednesday 28 October 2026 and that the attack was successfully stopped (FPS Finance notice in Dutch, dated 28 October and last updated 29 October; Cyberstack translation). As a precaution, MyMinfin and some other services were temporarily taken offline; FPS Finance says it is working on a restart, but that this takes time in order to rule out new risks. Because this affects tax deadlines in the near future, FPS Finance says the deadline for filing returns with specific income is postponed to 16 November 2026. FPS Finance says data protection is its priority and that it now knows no data has been leaked, and that a large part of its other applications remains available with full or partial functionality. The Register reports the deadline that moved was 31 October, for filings covering specific types of income such as sole traders and earnings from foreign companies, and The Record reports that Belgian authorities have not identified who was behind the attack or disclosed how the hackers may have gained access. (source: FPS Finance; The Register; The Record)
FOD Financiën — Cyberincident bij de FOD Financiën (28 Oct 2026; updated 29 Oct 2026; in Dutch)
Independent security researcher Ben Zimmermann, in a guest post developed with MongoDB's Kingfisher team and published on MongoDB's blog on 28 October 2026, says he scanned 7,256,531 public repositories on Gitee, which he describes as China's largest indigenous Git hosting platform, with both TruffleHog and Kingfisher and found 26,400 unique verified-live credentials. He says both scanners authenticate each candidate against its vendor's API at scan time and the figure is deduplicated by secret value; TruffleHog found 12,737, Kingfisher 14,664 and 1,001 were caught by both. Zimmermann says the findings included an active organization-admin credential for a major enterprise AI platform (not named) and thousands of live cloud provider access keys, that Alibaba Cloud AccessKey pairs were the most common type (roughly one in every 766 repositories), and that 2025 alone accounts for 12,242 of the credentials. He says he emailed the vendors with the highest exposure volume with the full list of their credentials, did not notify individual committers, and that at the time of writing revocation status had not been confirmed. He puts Gitee's rate at 3.64 verified-live credentials per 1,000 repositories, against 3.11 for GitLab and 2.39 for Bitbucket in earlier TruffleSecurity scans, noting those scans used TruffleHog alone. (source: Ben Zimmermann, MongoDB blog) Correction (02 Nov 2026): removed The Hacker News as a source. (source: MongoDB)
MongoDB blog (guest post by Ben Zimmermann) — Scanning 7.25 Million Public Repositories on China's Largest Git Platform for Secrets (28 Oct 2026)
Sophos published an advisory on 28 October 2026, rated Critical, for CVE-2026-118633, a path traversal vulnerability in Sophos UTM reported through its bug bounty program by external researcher Sam Pizzey. Sophos says the fix prevents an unauthenticated remote adversary from executing arbitrary commands with root privileges after winning a race condition by sustaining repeated attacks for a few minutes when the email proxy is used with scanning enabled. Sophos says all versions of Sophos UTM are affected, that UTM is end-of-life and the patch must be installed manually, and that urgent customer action is required: customers still using Email Protection features on UTM should apply the patch as soon as possible. Sophos lists no workaround and recommends upgrading to a supported version of Sophos Firewall. Sophos's CVE record scores the flaw 9.2 (CVSS 4.0, Critical) and 8.1 (CVSS 3.1, High) and lists SG UTM versions up to and including 9.724 as affected. The advisory does not mention exploitation. (source: Sophos)
Sophos — Resolved Pre-Auth RCE Vulnerability in Sophos UTM (CVE-2026-118633) (sophos-sa-20261028-utm-rce, 28 Oct 2026)
The transparency nonprofit Distributed Denial of Secrets (DDoSecrets) on Wednesday 28 October 2026 published an archive of US Department of Homeland Security records that, according to WIRED, exposes details of more than 41,000 employees or contractors of DHS and seven of its component agencies, including Immigration and Customs Enforcement and US Customs and Border Protection. WIRED reports that the records include email addresses, phone numbers and office addresses as well as references to internal systems and to undercover and surveillance programs, and were last updated on 19 August 2026; according to a WIRED analysis of the data, CBP staff account for more than half of the records and ICE for about 10,000. A Homeland Security spokesperson told WIRED: "DHS is aware of a potential breach and is actively working to address the situation swiftly and effectively." DDoSecrets says in a press release that the data is from DHS's Okta login system, according to WIRED; an Okta spokesperson told WIRED: "Okta is secure, and we have no evidence our data or systems were compromised." DDoSecrets told WIRED it obtained the data from a group calling itself the Department of Peace. (source: WIRED)
WIRED — Massive Leak Exposes 41,000 Homeland Security Workers—Including Undercover ICE Agents (28 Oct 2026; includes DHS and Okta statements)
Cisco's security advisory for CVE-2026-20127 (cisco-sa-sdwan-rpa-EHchtZk; first published 25 February 2026; version 2.1, last updated 28 October 21:54 GMT, which is 29 October 05:54 Perth) says a vulnerability in the peering authentication of Cisco Catalyst SD-WAN Controller, Manager and Validator could allow an unauthenticated, remote attacker to bypass authentication and obtain administrative privileges; it says the Cisco PSIRT is aware of limited exploitation, lists no workarounds and now refers customers to a Talos post. (source: Cisco) Cisco Talos said on 28 October 2026 that it has identified UAT-11473, which it describes as a highly sophisticated advanced persistent threat actor, exploiting CVE-2026-20127, an authentication bypass vulnerability in Cisco Catalyst SD-WAN Controller instances, to gain unauthorized access and then install a custom malware framework it tracks as KeyDrift. Talos describes its post as an analysis of historical UAT-11473 activity and does not give dates for the intrusions. According to Talos, KeyDrift's primary component, PolyFlame, is a memory-resident module deployed through modified runit service paths and injected into legitimate vdaemon processes, where it can act as a TinyShell-style backdoor or as an intermediate command-and-control relay; another component, LittleFilch, hooks SSL_read inside vdaemon, extracts keying material for a list of predefined edge nodes (which Talos assesses as OMP-distributed AES-256 IPsec data-plane key material) and stages it RSA-encrypted in /var/tmp/vdaemon.bin for exfiltration. Talos says observed targeting spans space and satellite services, defense and aerospace technology, and policy research, and assesses with high confidence that UAT-11473's operating infrastructure overlaps considerably with Volt Typhoon's 'Silent Train' covert access network (see the Silent Train card). Talos published Snort rules 67387 through 67416 (Snort 2) and 7:44 through 7:73 (Snort 3) for the KeyDrift artifacts; SIDs 65938 and 65958 already cover the CVE itself. (source: Cisco Talos) CISA has listed CVE-2026-20127 in its Known Exploited Vulnerabilities catalog since 25 February 2026. (source: CISA KEV)
Cisco Security Advisory — Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability (cisco-sa-sdwan-rpa-EHchtZk; first published 25 Feb 2026, v2.1 updated 28 Oct 2026 GMT)
CISA added CVE-2026-41709, a Broadcom VMware ESX insufficient logging vulnerability, to its Known Exploited Vulnerabilities (KEV) catalog on 28 October 2026 based on evidence of active exploitation; the KEV entry gives US federal agencies a due date of 11 November and lists known ransomware campaign use as 'Unknown'. Broadcom's advisory VMSA-2026-0006 (issued 29 July 2026, updated 19 August) says VMware ESX contains an insufficient logging vulnerability that a malicious administrator could exploit to perform certain operations without them being logged; Broadcom rates it Low severity with a maximum CVSSv3 base score of 2.7 and credits Ian Barton of CrowdStrike for reporting it. Broadcom lists no workaround. The same advisory also covers the critical vCenter flaws CVE-2026-59309 and CVE-2026-59310 (see the CVE-2026-59310 card). CISA's alert does not say who exploited the flaw or how. UPDATE (29 Oct 2026, Perth; CrowdStrike): In a blog post dated 28 October on its 2026 Legal Threat Landscape Report, CrowdStrike says the China-nexus adversary it tracks as WARP PANDA deployed several forms of malware in victims' VMware vCenter environments in multiple intrusions at US-based entities, including targets in the legal sector, and that in several of these cases, and as late as early 2026, it exploited CVE-2026-41709, which CrowdStrike calls an ESXi command logging bypass vulnerability, as a zero-day. CISA's KEV entry does not name an actor. (source: CrowdStrike)
Japan Airlines (JAL) said one of its IT providers suffered a data breach that leaked the personal records of more than 90,000 customers, according to The Record (28 Oct 2026). The Record reports that JAL published a notice on Wednesday (28 October) saying Amadeus IT Group, the company that runs its flight reservation, ticketing and check-in systems, informed it last week that hackers accessed a 'portion of customer reservation data' for Japan Airlines and Japan Transocean Air flights; in total 92,000 customers were affected, with names, reservation codes and flight information accessed, and for about 2,000 customers passport numbers, frequent flyer numbers, email addresses and phone numbers were also taken. According to The Record, JAL said the breach never affected flight operations and credit card numbers were not compromised, and that it will contact affected customers individually, including reminders to watch for phishing emails, fraudulent phone calls and websites impersonating the JAL Group. ITmedia NEWS (28 Oct) reports that JAL and Japan Transocean Air (JTA) said Amadeus reported the unauthorised access to them on 23 October; that the traces of outside access cover part of the reservation records for JAL and JTA flights from 10 August 2023 to 23 September 2026; that for the about 2,000 customers the items accessed also include nationality, ticket number and seat number; that no leak of credit card numbers or passwords has been confirmed; that Amadeus has already completed the necessary security measures and, as of 28 October, no misuse of the information had been confirmed; and that a dedicated inquiry line opens on 29 October (our translation from Japanese). Correction (31 Oct 2026): removed the Cathay Pacific notice (Personal data security incident involving a third-party service provider) as a source, with the update and the title, product and advice wording that came only from it, because this desk could not read that page in full; every fact on this card now comes from The Record and ITmedia NEWS. (source: The Record) Updated (01 Nov 2026): Star Flyer, which uses the Amadeus passenger service system through All Nippon Airways (ANA), said on 30 October (first posted 29 October) that it received an updated report from ANA that an unauthorised third party accessed reservation information for Star Flyer-operated flights within the system, and that there are indications certain personal information of its customers may have been accessed. Star Flyer lists the information that shows signs of access as customer name, booking reference number, travel date, flight routing, cabin class, email address, phone number, frequent flyer number, airline, flight number, e-ticket number and seat number, among other related details, for certain customers who made reservations with Star Flyer from 28 July 2025 to 23 September 2026. Star Flyer said the incident did not involve credit card numbers or account passwords, that it has been informed the compromised authentication credentials have been revoked and monitoring substantially enhanced, and that it is still verifying the number of people affected and will contact customers directly once their details are verified. (source: Star Flyer)
The Record — Japan Airlines warns of data breach as country grapples with multiple cyber incidents (28 Oct 2026)
Coinbase said in a post on its Coinbase Support account on X at 10:49 am Perth time (AWST) on 28 October 2026 (02:49 UTC): 'Coinbase has not had a data breach. Amplitude, an analytics vendor, experienced a security incident which impacted a small subset of Coinbase customer contact data, among other Amplitude customers.' In the same post Coinbase said it had found no evidence of unauthorized access to Coinbase systems, that customer funds were not impacted, and that it is notifying impacted customers and regulatory agencies in accordance with its legal obligations. (source: Coinbase Support on X) Decrypt (28 Oct) reports that Coinbase did not say how many customers were affected, what kinds of contact data were exposed or when the incident took place, and did not name the other Amplitude customers affected. (source: Decrypt) Correction (29 Oct 2026): the post's time is now given in Perth time from the post's own timestamp, each statement is credited to the post or to Decrypt, and wording not in either source was removed. (source: Coinbase Support on X)
Coinbase Support on X — statement on Amplitude security incident (28 Oct 2026)
Lumen's Black Lotus Labs has published research, reported by BleepingComputer on 28 October 2026, on what it calls Silent Train, a covert framework it attributes to the China state-sponsored group Volt Typhoon. Black Lotus Labs says it has tracked Silent Train for three years, first observing consistent activity in November 2023, shortly before the initial takedown of the KV-botnet, and that the work led to hundreds of victim notifications. It describes Silent Train as rapidly rotating chains of compromised SOHO, IoT and enterprise devices that are exploited on demand, used against selected targets, cleaned up after each operation and continuously refreshed: sessions began from virtual private servers outside the US and were daisy-chained through compromised non-US devices before pivoting within the US to reach targets. It observed more than 27 device classes used, from TP-Link routers and Netgear Orbi devices to Fortinet appliances and CyberPanel servers, with device types reserved for fixed roles (Intelbras modems only as overseas relays, Netgear Orbi devices as US-based hops that interacted with victims). By early 2025, compromised enterprise platforms were kept in the chains for one to three months, making Silent Train a hybrid framework. Black Lotus Labs says its monitoring helped uncover at least four confirmed and one likely zero-day campaigns against network and endpoint management systems, SD-WAN orchestrators and other control-plane infrastructure: Versa Director (which it documented in mid-2024), N-able N-central (a chain of then-undisclosed flaws assigned CVE-2025-8875 and CVE-2025-8876), Cisco Catalyst SD-WAN (CVE-2026-20127, exploited from late 2025 and continuing well after Cisco's February 2026 disclosure), VeloCloud Orchestrator (a zero-day later designated CVE-2026-16812) and, assessed with moderate confidence, Quest KACE (more than 30 victims; activity declined after Quest's October 2025 security updates). Post-incident analysis found in-memory webshells, credential harvesting, abuse of native platform features and, in several cases, erased or altered logs. Victims included telecommunications providers, government, defense contractors, satellite and mission-critical communications services, universities, MSPs, IT firms and critical infrastructure; Hawaii, California and Texas were the most targeted regions. Activity was concentrated on weekdays between 09:00 and 22:00 China Standard Time. BleepingComputer (28 Oct) also reported the research. Correction (29 Oct 2026): the 28 October date is now credited to BleepingComputer's report. (source: BleepingComputer)
Lumen Black Lotus Labs — Silent Train: uncovering Volt Typhoon's operational framework for zero-day exploitation and strategic access
