Verified status
Checked by defend.network against the NIST National Vulnerability Database (NVD) and CISA’s Known Exploited Vulnerabilities catalog.
- CVE-2026-98432 in Linux Kernel: the source articles reported no exploitation. NVD rates it 9.8 (CRITICAL) on CVSS v3.1. (checked 2026-10-30)
- CVE-2026-109618 in PHP Group PHP is listed in CISA’s Known Exploited Vulnerabilities (KEV) catalog (added 2026-10-26; federal remediation due 2026-10-29). NVD rates it 9.8 (CRITICAL) on CVSS v3.1. NVD lists a vendor advisory. (checked 2026-10-29)
- CVE-2026-109619 in PHP Group PHP is listed in CISA’s Known Exploited Vulnerabilities (KEV) catalog (added 2026-10-26; federal remediation due 2026-10-29). NVD rates it 8.1 (HIGH) on CVSS v3.1. NVD lists a vendor advisory. (checked 2026-10-28)
- CVE-2026-97229 in GitLab Community Edition And Enterprise Edition is listed in CISA’s Known Exploited Vulnerabilities (KEV) catalog (added 2026-10-29; federal remediation due 2026-11-01). NVD rates it 10 (CRITICAL) on CVSS v3.1. NVD lists a vendor advisory. (checked 2026-10-30)
TL;DR
Linux kernel TCP flaw (CVE-2026-98432, CVSS 9.8) affects Ubuntu and Red Hat; PHP vulnerabilities (CVE-2026-109618, CVE-2026-109619) impact 70% of websites with active exploitation underway. Multiple critical firewall, GitLab, and virtualization flaws added to CISA KEV. Fake AI app campaigns abusing GitHub repos deliver crypto miners and RATs.
Executive Summary
- A Linux kernel TCP vulnerability rated 9.8 CVSS affects Ubuntu, Red Hat, and other distributions; Anthropic's Claude AI model has generated working exploits.
- PHP flaws CVE-2026-109618 and CVE-2026-109619 impact nearly 70% of websites; exploitation is underway with targeted campaigns against U.S. government-affiliated servers reported.
- CISA added five new vulnerabilities to its Known Exploited Vulnerabilities catalog, including Cisco firewall DoS, GitLab integer overflow, and VMware logging flaw, all with federal remediation deadlines.
- Threat actors are deploying fake ChatGPT and Claude desktop applications via hijacked GitHub projects to distribute crypto miners and remote access trojans.
- Binance is investigating a potential $5.8 billion cryptocurrency theft; Polymarket halted trading after JavaScript injection compromised $2.5 million in assets.
Top Threats Today
1. Linux Kernel TCP Vulnerability Exploitable via AI-Generated Payloads
Severity: HIGH Affected: Technology
A critical flaw in the Linux kernel's TCP code, tracked as CVE-2026-98432, affects Ubuntu, Red Hat Enterprise Linux, and other Linux distributions, with a CVSS score of 9.8 [1]. Anthropic disclosed on October 27 that its Claude AI model wrote an exploit that uses the vulnerability ⚠[1], indicating that weaponized payloads are available to threat actors with access to frontier AI capabilities.
Sources:[1] The Hacker News
Recommended Action
- Prioritize patching of Linux kernel TCP stack on all Ubuntu and Red Hat systems.
- Monitor systems for suspicious network activity or privilege escalation attempts targeting TCP processing.
- Consult vendor advisories for specific kernel version patches and upgrade timelines.
2. PHP RCE Flaws Actively Exploited Across 70% of Websites
Severity: HIGH Affected: Technology
Nearly 70% of websites depend on vulnerable PHP code, tracked as CVE-2026-109618 and CVE-2026-109619, which allow attackers to seize full control of affected servers [1]. Working exploits are confirmed in the wild [1], and one cyber firm identified targeted exploitation against U.S. government-affiliated servers, suspected to be carried out by a Chinese campaign [2]. These flaws enable remote code execution and potential implantation of PHP webshells . ⚠
Sources:[1] Krebs on Security[2] The Record[3] SecurityWeek
Recommended Action
- Issue immediate PHP security update across all production web servers.
- Scan web server logs for exploit payloads targeting PHP processing and unusual shell activity.
- Isolate affected servers if compromise is suspected; preserve logs for forensic investigation.
3. Cisco Firewall DoS and GitLab Integer Overflow Added to CISA KEV
Severity: HIGH Affected: Government
CISA added CVE-2026-97229 (GitLab Community and Enterprise Edition integer overflow) and CVE-2026-76418 (Cisco Secure Firewall ASA and FTD NULL pointer dereference) to its Known Exploited Vulnerabilities catalog on October 29 [1][2]. The GitLab vulnerability allows unauthenticated users to execute arbitrary code via specially crafted CI/CD regular expressions [1], with federal remediation due November 1, 2026 [1]. The Cisco flaw enables unauthenticated remote denial-of-service attacks [2], also due November 1 [2]. Federal agencies must remediate both immediately.
Sources:[1] CISA KEV[2] CISA KEV
Recommended Action
- Verify GitLab version and apply patches to Community and Enterprise instances immediately.
- Update Cisco ASA and FTD appliances to patched firmware versions; coordinate with network operations for maintenance windows.
- Document remediation completion and submit proof to federal oversight bodies by November 1 deadline.
4. Fake AI Application Campaign Hijacks GitHub to Deploy Crypto Miners and RATs
Severity: HIGH Affected: Technology
Threat actors are delivering malicious loaders and cryptocurrency miners masquerading as desktop applications for ChatGPT and Anthropic Claude, dubbed the “Yoba” campaign [1]. Attackers created fake GitHub projects claiming to be legitimate desktop clients, distributing signed executables that install crypto mining malware [1]. A separate malicious Solana starter kit on GitHub is designed to trick AI coding agents into installing NetSupport RAT ⚠[2]. One GPU-hijacking model on Hugging Face was downloaded over 28,000 times before takedown, and the campaign has already resurged [2].
Sources:[1] The Hacker News[2] BleepingComputer
Recommended Action
- Educate developers and end-users to verify GitHub project authenticity via official vendor links only, not search results.
- Deploy endpoint detection and response (EDR) to flag unsigned or suspicious executable downloads and execution.
- Monitor GitHub organizational activity for unauthorized account takeovers or malicious repository creation.
5. Binance Investigates $5.8 Billion Cryptocurrency Breach; Polymarket Halts After $2.5M Theft
Severity: HIGH Affected: Finance
Cryptocurrency exchange Binance is investigating a potential security breach involving up to $5.8 billion in digital assets, which could become the largest cryptocurrency hack in history [1]. Separately, prediction market platform Polymarket temporarily suspended trading after hackers compromised a third-party service to distribute cryptocurrency-draining JavaScript, with approximately $2.5 million in assets traced to a suspected attacker wallet [2]. Both incidents underscore the continued targeting of cryptocurrency platforms and the risk posed by third-party service integrations.
Sources:[1] BleepingComputer[2] BleepingComputer
Recommended Action
- If holding assets on Binance or Polymarket, monitor account activity closely and enable multi-factor authentication.
- Cryptocurrency platforms should audit third-party integrations and JavaScript dependencies for unauthorized modifications.
- Review blockchain transaction logs to identify and potentially recover stolen assets before they are laundered.
Ongoing Coverage
- Microsoft Patches 1,400+ Flaws: Microsoft released updates for more than 1,400 security vulnerabilities in Windows and other products, including CVE-2026-108398 and CVE-2026-96951 [14]. This represents a ten-fold increase over normal monthly patch volume and reflects sustained pressure on the vendor’s security posture. See earlier coverage for additional context.
- ShinyHunters Investigation Intensifies: Federal investigators have identified ransomware negotiation firm executives with unusually close relations to the ShinyHunters extortion group, which recently stole sensitive FBI data [12]. The FBI has arrested the co-founder of a Canadian cybersecurity firm in connection with the investigation [15].
- Japan Airlines Third-Party Breach: Japan Airlines confirmed a data breach at Amadeus’s Passenger Service System exposing approximately 92,000 customer records [9].
- VMware ESX and Adobe Commerce Vulnerabilities: CISA added CVE-2026-41709 (VMware ESX insufficient logging) and CVE-2026-48356 (Adobe Commerce unrestricted file upload) to its KEV catalog, enabling admin impersonation and arbitrary code execution, respectively [33, 35].
Today’s Action Checklist
- ☐ URGENT: Patch Linux kernel TCP stack (CVE-2026-98432) on all Ubuntu and Red Hat systems; coordinate testing before production deployment.
- ☐ URGENT: Apply PHP security updates (CVE-2026-109618, CVE-2026-109619) to all web servers; scan logs for exploitation attempts.
- ☐ URGENT: Update Cisco ASA/FTD and GitLab instances to latest patched versions; confirm remediation by November 1 federal deadline.
- ☐ Audit GitHub and Hugging Face integrations within development pipelines for malicious packages or compromised repositories.
- ☐ Review third-party JavaScript and dependency management controls across financial technology and e-commerce platforms.
- ☐ Monitor threat intelligence feeds for Yoba campaign indicators of compromise and implement EDR detection signatures.