Today’s vibe is “your dependencies have dependencies,” and attackers are happy to live there rent-free. The blast radius is no longer your org chart, it’s your vendors, your management planes, and the weird little features you enabled once.

Today's Top 5

1. 2,585,481 Sony ISP records exposed: Sony Network Communications says an unauthorized party accessed its So-net member database, exposing PII but not payment data. The Docomo phishing angle is already warming up, and the cleanup timeline is the part to study. Source
2. Volt Typhoon’s Silent Train relay chains: Lumen’s Black Lotus Labs tracking shows a framework that rotates compromised routers and devices on demand, then wipes itself. Add reported zero-days in edge management gear and you get stealthy access with very little “malware.” Source
3. Virtualine bulletproof hoster seized: Law enforcement yanked virtualine.net, a “bulletproof” host that allegedly supported ransomware and broader cybercrime infrastructure. If your threat intel doesn’t track hosting providers, you are missing the supply lines. Source
4. Node2Shell now exploited: CISA says attackers are exploiting the Brotli bug tracked as CVE-2026-111497. It is the classic pattern: wide dependency, lots of transitive reach, and plenty of internet-facing decompression paths you forgot you had. Source
5. Oracle EBS scanners wake up: Threat actors are already probing for CVE-2026-101767 after Oracle’s October CPU. It is a reminder that patch windows are measured in hours once a bug is named and a target list exists. Source

Why today matters: The same week keeps repeating: compromise does not start at “the perimeter,” it starts at a vendor, an admin plane, or a dependency you embedded years ago. Defenders who only count internet-facing assets miss the real story, attackers are chaining trust relationships faster than you can inventory them. If you run a mesh VPN, enterprise ERP, or any appliance with a web UI, you are the nervous system, not the edge.

XERJ Corpus Hub: Working the CVE-2026-111497 Node2Shell scramble? An AI agent loading exploit-pocs-2026 can quickly diff and cluster the latest PoCs, extract common request shapes, and draft a targeted WAF and log-hunt checklist for Brotli decode entry points in minutes. Then grab another corpus at hub.xerj.org.

Alright. Let’s get into what broke, what leaked, and what’s getting scanned right now.

Data Breaches

1. Sony ISP subsidiary data breach exposes 2.5 million customer records: Sony Network Communications says its So-net member database was accessed by an unauthorized party, exposing 2,585,481 records with PII such as names, phone numbers, emails, IDs, DOB, gender, and connection IDs. The company says no banking or card data was exposed, but noted a smaller set of email addresses and passwords were also exposed, prompting password changes. Source: BleepingComputer
2. ENGIE customer data stolen via partner marketing platform: ENGIE says attackers accessed a tool used by sales and marketing partners, and stole customer contact details plus contract-related fields (including customer ID and contract number). ENGIE says internal systems were not breached and no banking data was impacted, but the data is still prime phishing fuel. Source: BleepingComputer
3. Warp discloses breach exposing AI agent logs and telemetry: Warp says an attacker exploited a third-party vendor in its infrastructure, exposing agent decision logs and telemetry for roughly 1% of users, per the CEO. The missing detail is the scary detail: whether prompts, secrets, or code ever rode along in those traces. Source: BleepingComputer
4. Convertr checkout skimmer via hijacked analytics script: Researchers say a shared analytics script used by e-commerce platform Convertr was modified to skim card data entered at checkout, turning one compromised script into downstream payment exposure across multiple merchants. Even after server-side cleanup, browser caching can keep the malicious script alive long enough to complicate response. Source: Sansec

Security Research

1. Volt Typhoon “Silent Train” framework details: Lumen Black Lotus Labs tracking describes a rotating relay chain using compromised devices as hops, cleaned up after each operation, with reported exploitation of multiple zero-days in edge and management infrastructure. The takeaway for CISOs is operational: log retention and admin interface exposure decide whether you ever see this. Source: BleepingComputer
2. Node2Shell exploitation confirmed by CISA: The Brotli out-of-bounds write issue tracked as CVE-2026-111497 is now listed as exploited. Any product path that decompresses attacker-controlled Brotli becomes the “new input,” and you likely have more of those than you think. Source: SecurityWeek
3. Oracle E-Business Suite CVE-2026-101767 scanning: Defused reported its decoys recorded exploratory exploit activity targeting CVE-2026-101767, described as an unauthenticated SQL injection in EBS’s Thin Client Framework servlet chaining to RCE. Treat “scanning” as the last warning before compromises show up in IR tickets. Source: BleepingComputer
4. InfraTrust Pulse: exploited flaws across network infrastructure: A monthly patch-priority report highlights continued exploitation across infrastructure appliances and calls out that PHP2Shell-style runtime bugs matter because PHP is embedded in management UIs across firewalls, VPNs, ADCs, and more. This is your reminder to inventory appliance web stacks, not just CVEs. Source: BleepingComputer
5. Tailscale “Tailworm” fixes shipped: After the Tailworm report on Tailscale SSH and headscale, the upstream response notes that fixes landed and a patched Tailscale release shipped as v1.104.4. If you use Tailscale SSH forwarding, treat this as “assume one node pops, then assume lateral root.” Source: tailworm.com
6. LiteLLM Enterprise proxy unauth file read: A GitHub advisory says an unauthenticated request to LiteLLM proxy routes (Enterprise license) could read a local file and exfiltrate it to an attacker-chosen URL, risking master key and provider credential exposure. This is exactly the wrong place to have “just one more proxy.” Source: GitHub

Top CVEs

1. CVE-2026-111497: Critical Brotli out-of-bounds write linked to Node2Shell and now listed as exploited. If you decompress attacker-controlled Brotli in any service path, prioritize patches and add exploit-attempt telemetry to your edge logs. Source
2. CVE-2026-101767: Oracle E-Business Suite flaw described as unauthenticated SQL injection chaining to RCE, with scanning observed shortly after Oracle’s October CPU. Internet exposure plus slow patching is the whole risk story here. Source
3. CVE-2026-48356: Adobe Commerce and Magento unrestricted file upload added to CISA KEV on Oct 27, indicating exploitation in the wild. If you run Commerce, verify the specific branch patch level, not just “we are on 2.4.x.” Source
4. CVE-2026-97631: Pre-boot RCE in the EDK II PXE driver, where an unauthenticated attacker delivering ICMP error messages during PXE boot can corrupt memory and execute code before the OS loads. It is niche but catastrophic for environments that PXE boot servers. Source
5. CVE-2026-93616: Check Point Security Management issues referenced in infrastructure patch-priority reporting as exploited, with the usual appliance reality: exposed management ports turn “internal tool” into “internet incident.” If you run it, validate exposure, version, and compensating controls. Source

Podcasts & Talks

1. SANS Stormcast (Oct 29, 2026): ClickFix campaign targeting macOS and Windows, EDK II PXE pre-boot RCE (CVE-2026-97631), Qwen model exfil behavior in testing, and a LiteLLM master-key exposure bug. This is a great “what should I brief my ops team on today” episode. Listen: SANS ISC

Final Words

The pattern underneath today’s headlines is not “more CVEs.” It is trust compression. One compromised analytics script hits many merchants. One compromised tailnet node can become many roots. One “partner tool” becomes the breach boundary for an energy giant. The uncomfortable implication is that your controls are only as strong as the least-governed plane where data and authority meet, and that plane is usually owned by someone else.

This week, do three things:

• Run an emergency inventory for Brotli decompression paths and patch or mitigate CVE-2026-111497 across Node.js services, gateways, and anything that can ingest attacker-controlled Brotli.
• If you use Tailscale SSH, upgrade to the fixed release noted by the Tailworm upstream response and immediately disable SSH forwarding where it is not explicitly required.
• Audit third-party “marketing, telemetry, analytics, checkout” scripts and partner platforms that touch customer workflows, then enforce ownership for patching and integrity monitoring for each script origin.

Your turn: If a regulator asked you tomorrow to prove who could have accessed the 2,585,481 Sony ISP records equivalent in your org, could you produce a clean, timestamped answer from logs you actually retain? Hit reply with your take, or drop a comment on the web version. I read every reply.

Know someone who still treats “partner platforms” as out of scope? Forward them this issue, the ENGIE partner-tool breach is exactly how that mindset becomes a customer notification. For everyone else: subscribe free at secretciso.org.

Stay vigilant, stay informed, and see you in the next edition of Secret CISO!