Weekly security recap: 26 Oct 2026 to 1 Nov 2026

This week we tracked 96 security stories, 10 newly exploited vulnerabilities and 130 ransomware leak-site claims from 31 groups. Here is what defenders should know.

At a glance

Top security news

• Alpine Linux rebuilds GitLab after attempted RCE attack (BleepingComputer)
• Northstar Security Exits Stealth With $7M to Expose Toxic Risk Combinations (SecurityWeek)
• Northflank security breach leads to abuse of customers' AI API keys (BleepingComputer)
• New Android SMS of Death exploit can remotely crash unpatched phones (BleepingComputer)
• Chainalysis Confirms Intrusion Into Internal Tools and Exposure of Customer Identity Data (The Hacker News)
• Attackers Chain Three Ivanti Connect Secure Flaws to Gain Unauthenticated Root Access (The Hacker News)
• Florida warns that 4.9 million people had Social Security numbers leaked in financial aid site breach (The Record)
• TeamViewer Flaw Lets Remote Computers Attack Users Who Connect to Control Them (The Hacker News)
• In Other News: Anthropic Breach Dispute, UEFI Flaw Hits Most Servers, Cloudflare AI Data Leak (SecurityWeek)
• Fresh WordPress Vulnerability in Attackers’ Crosshairs (SecurityWeek)

Newly exploited vulnerabilities

• CVE-2026-118527, Ivanti Connect Secure: Ivanti Connect Secure Generation of Predictable Numbers or Identifiers Vulnerability (details)
• CVE-2026-111357, Ivanti Connect Secure: Ivanti Connect Secure Missing Authentication for Critical Function Vulnerability (details)
• CVE-2026-97229, GitLab Community Edition and Enterprise Edition: GitLab Community Edition and Enterprise Edition Integer Overflow or Wraparound Vulnerability (details)
• CVE-2026-76418, Cisco Secure Firewall ASA Software and Cisco Secure FTD Software: Cisco Secure Firewall ASA Software and Cisco Secure FTD Software Unchecked Return Value to NULL Pointer Dereference Vulnerability (details)
• CVE-2026-41709, Broadcom VMware ESX: Broadcom VMWare ESX Insufficient Logging Vulnerability (details)
• CVE-2026-46300, Linux Kernel: Linux Kernel Missing Initialization of a Variable Vulnerability (details)
• CVE-2026-48356, Adobe Commerce and Magento: Adobe Commerce and Magento Unrestricted Upload of File with Dangerous Type Vulnerability (details)
• CVE-2026-111497, Google Brotli: Google Brotli Unchecked Return Value Vulnerability (details)
• CVE-2026-109618, PHP Group PHP: PHP Memory Corruption Vulnerability (details)
• CVE-2026-109619, PHP Group PHP: PHP Stale Internal Request-State Vulnerability (details)

Ransomware

Ransomware groups posted 130 new claims on their leak sites this week.

Claims come from criminal leak sites (collected by ransomware.live) and are often unverified, so we do not name the organisations listed.

Ransomware in the news

• Bulletproof Host Virtualine Loses Its Domain to FBI Seizure (SecurityWeek)
• Japan's GMO Offers $1 Million Bounty to Catch Hackers Behind FX Trading Cloud Breach (The Hacker News)

Web defacement

Our sources did not report any notable website defacement incidents this week.

Defacement is often the visible sign of a deeper compromise. If one of your sites is defaced, take it offline, preserve logs, and look for the way in before restoring from a clean backup.

What to do this week

• Patch the newly exploited vulnerabilities listed above, starting with internet-facing systems.
• Check that backups are recent, offline or immutable, and that you have tested a restore.
• Confirm multi-factor authentication is on for remote access, email and admin accounts.
• Monitor your public websites for unexpected changes to pages and files.

Sources

• CISA Known Exploited Vulnerabilities catalog
• ransomware.live for leak-site statistics
• News links above go to each original report