Daily brief: Thursday 29 October 2026

Attackers are probing a freshly patched Oracle E-Business Suite flaw, a 16-year-old UEFI network-boot bug has no stable fix yet, Tailscale patches SSH forwarding flaws, and a device code phishing campaign targets Microsoft 365 accounts.

Cybersecurity

Attackers probe a critical Oracle E-Business Suite flaw days after the patch

Oracle fixed CVE-2026-101767 (CVSS 9.8) in its October 2026 Critical Patch Update. Horizon3.ai, which reported it, describes it as an unauthenticated SQL injection in the Thin Client Framework servlet that can be chained to remote code execution. Defused Cyber said its Oracle EBS decoys recorded exploratory attempts against the flaw on 27 October.

Why it matters for IT: If you look after Oracle EBS, apply the October patch now. If you can't, remove /OA_HTML/AppsTCFServer from the URL firewall allowlist and keep the EBS web tier off untrusted networks.

Source: The Hacker News

Microsoft

Device code phishing campaign steals Microsoft 365 tokens

ANY.RUN describes a campaign, which it calls Skyw4lker, that sends a password-protected 'contract' or 'proposal' document. The victim is taken to a Google Sites page and then into a real Microsoft device sign-in started by the attacker. Completing it hands the attacker Microsoft 365 tokens for the account. Targets are mainly US manufacturing, technology and healthcare firms.

Why it matters for IT: If your users don't need device code sign-in, block it with Conditional Access. Tell users never to enter a code on microsoft.com/devicelogin that they didn't ask for themselves.

Source: The Hacker News (ANY.RUN research)

Microsoft

Microsoft Authenticator for Android flaw let apps steal work tokens

Enclave published details of CVE-2026-80097 (CVSS 8.6), where a malicious Android app with no permissions could pretend to be a trusted Microsoft app and get work account tokens from Authenticator. In Enclave's tests the tokens could read and send mail and read and write files and calendars. Microsoft fixed it in Authenticator for Android 6.2606.4246 and says it was not exploited. Enclave and Microsoft disagree on how much user interaction is needed.

Why it matters for IT: Check that managed Android devices run Authenticator 6.2606.4246 or later, and set it as a minimum app version in Intune if you can.

Source: The Hacker News

Cybersecurity

16-year-old UEFI flaw lets network-booting servers run attacker code before Secure Boot

CVE-2026-97631, scored 9.5 by TianoCore, is a buffer overflow in the PXE network-boot code of EDK II, the firmware base used by many vendors. A fix reached the EDK II main branch on 15 October, but no stable EDK II release includes it yet, and Red Hat, SUSE and Debian list their edk2 packages as affected. There is no sign of exploitation.

Why it matters for IT: Servers will only be fixed when your hardware vendor ships new BIOS or UEFI firmware, so watch their advisories. Where you don't use PXE boot, turn it off in the firmware settings.

Source: The Hacker News

Networking

Tailscale patches SSH forwarding flaws that could give root on other servers

Tailscale bulletins TS-2026-014 to TS-2026-017 cover flaws where a device allowed to SSH to a server could reach root-only sockets, such as the Docker socket, or crash the Tailscale process. The fix is in Tailscale 1.104.4. Tailscale got the report about two hours before it was published, and neither side says the flaws have been used in attacks. The self-hosted headscale server is not fixed in version 0.29.5.

Why it matters for IT: Update Tailscale to 1.104.4 or later on Linux and macOS servers that use Tailscale SSH. If you can't yet, set TS_SSH_DISABLE_FORWARDING=1 for tailscaled and restart it, and tighten who is allowed to SSH in.

Source: The Hacker News

Networking

Report: attackers are exploiting flaws across network appliances

Eclypsium's October InfraTrust Pulse tracked 133 new advisories from 18 vendors between 18 September and 14 October, covering 2,813 vulnerabilities. Sixteen of the advisories included flaws on CISA's Known Exploited Vulnerabilities list. Because vendors build PHP into appliance firmware, many customers must wait for vendor updates for the PHP2Shell flaws.

Why it matters for IT: The report suggests patching Citrix NetScaler and Ivanti Connect Secure first, then Fortinet's 22 October updates. Keep any PHP-based management interface off the internet until the vendor patch is in.

Source: BleepingComputer

Claude

Anthropic says an unreleased model built working exploit chains for five platforms

Anthropic's Frontier Red Team says an unreleased internal model found flaws in Chrome, Safari, Android, Windows and Linux and chained them into proof-of-concept exploits in the lab. All the flaws were reported to vendors first and Anthropic says they are patched. The Chrome chain was fixed in Chrome 156 on 20 October. The Hacker News notes that some of Anthropic's claims can't be checked independently beyond the patches and vendor credits.

Why it matters for IT: AI is speeding up how fast flaws are found, so the time between a patch and a working exploit keeps shrinking. Keep browsers and operating systems on automatic updates.

Source: The Hacker News

Microsoft

Windows 11 October preview update KB5127936 is out

Microsoft released KB5127936 on 28 October for Windows 11 25H2 and 26H2 (builds 26200.9818 and 26300.9818). It is an optional preview update with a faster, customisable File Explorer context menu and grouped camera, microphone and location controls in Settings. Microsoft also repeats that Secure Boot certificates on most Windows devices began expiring in June 2026 and that new certificates keep arriving through Windows Update.

Why it matters for IT: Test it on a small pilot group before November's Patch Tuesday, when these changes arrive for everyone. Check your devices are getting the new Secure Boot certificates.

Source: Microsoft Support

Weather

Live forecast

Loading the forecast…

Fact of the day

All facts

← All daily briefs