Daily brief · Security Now #1102
Thursday, 29 October 2026
A leak exposes 41,000 DHS staff including undercover ICE agents, a UEFI flaw puts most servers at risk, and Talos details an APT abusing Cisco SD-WAN.
Top stories
- Leak exposes 41,000 Homeland Security workers
#breach— Leaked records include ICE and CBP facility locations, staff phone numbers and members of groups tied to wiretap programs, Palantir and xAI’s Grok; Bluesky is blocking links to the archive. Why it matters: it puts undercover agents at physical risk and shows how much sensitive data sits in internal directories. Wired · Wired — Bluesky - Critical UEFI firmware flaw affects most servers
#vulnCRITICAL— The bug in UEFI firmware used by most server vendors lets attackers run code early in the boot process. Why it matters: code that runs before the OS survives reinstalls and is invisible to EDR, and firmware patching is slow. Wired - KeyDrift: APT UAT-11473 exploited Cisco SD-WAN
#threat— Talos attributes exploitation of CVE-2026-20127, an auth bypass in Cisco SD-WAN Catalyst Controller, to a sophisticated APT deploying the KeyDrift implant. Why it matters: network edge controllers keep being the entry point of choice for state actors. Cisco Talos
Vulnerabilities & patches
- CVE-2026-46300 — Linux kernel
HIGHEXPLOITEDKEV— Missing initialisation of a variable, added to KEV on 28 Oct with a 31 Oct federal due date. CISA alert - CVE-2026-41709 — VMware ESX
EXPLOITEDKEV— Insufficient logging weakness in ESX now in KEV; useful to attackers who want to hide activity on hypervisors. CISA alert
Threat intel & red team
- Attacker poses as AI crawlers to hunt for credentials
#threat#ai— A threat actor hid behind user agents impersonating OpenAI, Anthropic, Meta and other bots while scanning for exposed secrets. Bot UA strings are not an allow-list. Dark Reading - GhostAction wave fizzles, but the actors stay in GitHub
#threat#supply-chain— The supply-chain campaign is shifting toward developer endpoints and cloud access. Dark Reading - Retail peak-season threats
#threat— Unit 42’s outlook on what hits retailers ahead of the holiday season. Unit 42
Blue team & defense
- Deploy a local Ghidra server for your malware lab
#defense— SANS ISC walks through a shared Ghidra server for collaborative reversing in a snapshot-based lab. SANS ISC
Worth reading
- Studying fraudulent North Korean IT workers
#learning— Researchers created a fake start-up to observe DPRK IT-worker fraud up close. Schneier on Security
Security Now cross-check
SN #1102 — “A Strategic Plug Pull” (27 Oct)
The whole episode was a debrief of last week’s PHP2Shell disclosure, which happened before this site started. What we hadn’t covered:
- How PHP2Shell was found
#vuln#ai— Calif (using an OpenAI model in its “Patch the Planet” effort) and Google’s Wiz independently found the bugs; the vulnerable code path had been exploitable in PHP’s default configuration for about 14 years. Recorded Future · Transcript - The embargo collapsed — and Chainguard shipped early
#industry— CVE IDs leaked two days before the planned release, a PoC video was published by mistake, and the PHP Foundation says Chainguard published fixed images 6+ hours before coordinated release. A case study in why coordinated disclosure struggles at internet scale. Socket · InfoWorld · Transcript - Exploited before disclosure?
#threat— Amazon reported a PHP2Shell attempt in its honeypots dated 17 Oct, days before any leak. CSA research note - No fix for a huge share of hosts
#vuln— Scans show a large fraction of internet-facing PHP runs end-of-life branches that get no official patch; distro backports may keep the old version number, so check package changelogs rather thanphp -v. Technology Checker · Recorded Future - Quest Diagnostics breach
#breach— Unauthorized access to Quest’s Quanum LSM ordering/results system, discovered 21 Oct; scope of patient records still under investigation. BleepingComputer - Steve’s “strategic plug pull”
#learning— His argument that temporarily disconnecting critical systems from the internet may be the right move during the next internet-scale bug. Transcript
Already covered: PHP2Shell added to CISA KEV (28 Oct).