Skip to content

Daily cyber recap, Oct 29: PHP2Shell, VMware, Japan

Watch the 2-minute recap

Attackers are rooting firewalls through PHP2Shell, and a VMware ESX flaw is now on CISA’s exploited list. Japan is dealing with several breaches at once, and a patched Oracle flaw is already being probed.

Today at a glance

  • PHP2Shell is being used against exposed Palo Alto management interfaces [The Hacker News]
  • CISA lists a VMware ESX flaw as exploited, tied to Warp Panda [The Hacker News]
  • Japan: GMO ransomware warning, Japan Airlines data loss, Sony records [The Record]
  • Volt Typhoon’s Silent Train covert network is disrupted [The Hacker News]
  • A Virtualine bulletproof hosting domain is seized [The Hacker News]
  • Moldova probes foreign involvement in a government cyberattack [The Record]
  • Operation Serengeti: 1,462 arrests, 105 million dollars recovered [Dark Reading]
  • Oracle E-Business Suite flaw (CVSS 9.8) is now being probed [The Hacker News]

PHP2Shell: Palo Alto management interfaces under attack

Palo Alto Networks says attackers are exploiting PHP2Shell against management interfaces that are exposed to the internet. SecurityWeek reports that a suspected China-linked actor hacked two servers of a US government-affiliated organization. BleepingComputer notes that exposed web management interfaces of firewalls and VPNs put networks at risk. If you run these devices, take the management interface off the public internet and apply the vendor fix. [The Hacker News, SecurityWeek, BleepingComputer]

A dark network operations room, a large firewall appliance glowing in the centre with its management port open to a
A dark network operations room, a large firewall appliance glowing in the centre with its management port open to a

VMware ESX zero-day exploited by Warp Panda

CISA added a flaw affecting Broadcom VMware ESX to its Known Exploited Vulnerabilities catalog. CrowdStrike tied attacks on the US legal sector to a China-nexus group known as Warp Panda that weaponized it. SecurityWeek’s headline says the actors quietly used a low-severity ESXi logging flaw as a zero-day. If you run ESX hosts, check the vendor advisory, patch, and restrict who can reach host management. [The Hacker News, SecurityWeek]

A dark data hall of virtualization servers, one rack in the centre opened with a glowing magenta ghost figure slipping
A dark data hall of virtualization servers, one rack in the centre opened with a glowing magenta ghost figure slipping

Japan faces a wave of breaches

Reports describe Japan grappling with several cyber incidents at once. Infosecurity Magazine says GMO Internet told customers to unplug their PCs in advance of a possible ransomware attack. The Record reports that hackers stole passport numbers and other data for about 2,000 Japan Airlines customers. BleepingComputer reports that a breach at a Sony internet unit compromised approximately 2.5 million records. If you are a customer, watch for phishing that uses your details. [Infosecurity Magazine, The Record, BleepingComputer]

A neon-lit Tokyo night skyline in the centre, cut by magenta glitch lines, a small passenger plane silhouette and a
A neon-lit Tokyo night skyline in the centre, cut by magenta glitch lines, a small passenger plane silhouette and a

Volt Typhoon’s Silent Train network disrupted

Researchers at Lumen Black Lotus Labs attribute zero-day exploitation to a now-disrupted covert access network dubbed Silent Train, tied to Volt Typhoon. The Hacker News says it used rotating chains of compromised small-office, IoT and enterprise infrastructure. Check edge routers and IoT devices for firmware updates, replace anything unsupported, and change default credentials. [The Hacker News, BleepingComputer]

A chain of glowing cyan nodes shaped like a night train winding through a dark digital landscape, small routers and
A chain of glowing cyan nodes shaped like a night train winding through a dark digital landscape, small routers and

US seizes a Virtualine domain

The US Justice Department announced the seizure of a domain associated with a bulletproof hosting provider named Virtualine. BleepingComputer says the service was advertised on cybercrime forums for facilitating illegal activities, and The Hacker News headline refers to criminal hosting and Bitcoin money laundering. Review any blocklists or alerts that reference the seized domain. [The Hacker News, BleepingComputer]

A dark police cyber unit desk, a glowing server tower in the centre wrapped in a magenta seizure barrier of light bars,
A dark police cyber unit desk, a glowing server tower in the centre wrapped in a magenta seizure barrier of light bars,

Moldova probes a major government cyberattack

Moldova is investigating possible foreign involvement in a major cyberattack on government systems. The Record reports that the prime minister says the attack may be part of a broader campaign targeting both citizens’ personal data and government digital infrastructure. Citizens and public-sector teams should expect follow-on phishing, so verify unexpected messages that mention official services and keep monitoring on government-facing systems. [The Record]

A dark government data centre corridor in Eastern Europe, a glowing cyan server cluster at the end under a cracked
A dark government data centre corridor in Eastern Europe, a glowing cyan server cluster at the end under a cracked

Interpol’s Operation Serengeti: 1,462 arrests

Dark Reading reports that the third Serengeti sweep led to 1,462 arrests across 20 African countries and the US, recovering 105 million dollars in stolen funds. For businesses and individuals, the lesson is simple: report fraud quickly, because faster reports help investigators trace and recover money. If a payment looks wrong, call your bank right away. [Dark Reading]

A dark police operation map table, a holographic abstract map of the African continent in the centre with many glowing
A dark police operation map table, a holographic abstract map of the African continent in the centre with many glowing

Story of the week: Oracle E-Business Suite flaw now probed

The Hacker News reports that attackers are beginning to probe for a newly patched critical vulnerability in Oracle E-Business Suite, citing threat intelligence firm Defused Cyber. The flaw is tracked as CVE-2026-101767, carries a CVSS score of 9.8, and is an improper authentication issue that Oracle patched last week.

BleepingComputer says attackers have begun probing the internet for systems that are not yet patched. Probing is not the same as confirmed breaches, but the window between a patch and mass scanning is short. If you run E-Business Suite, apply the Oracle patch now, check whether the system is reachable from the internet, and review logs for unexpected authentication activity. [The Hacker News, BleepingComputer]

A dark enterprise business-suite console, a large curved monitor in the centre with abstract tables and charts, a
A dark enterprise business-suite console, a large curved monitor in the centre with abstract tables and charts, a

What to do this week

  1. Take firewall, VPN and hypervisor management interfaces off the public internet, and apply vendor fixes.
  2. Patch Oracle E-Business Suite and VMware ESX first, then work through the rest of your list.
  3. Update or replace edge routers and IoT devices, and change default passwords.
  4. If a company you use reports a breach, watch for phishing that quotes your real details.

Sources

  1. The Hacker News: https://thehackernews.com/2026/10/attackers-exploit-php2shell-flaws-in.html (2026-10-29)
  2. SecurityWeek: https://www.securityweek.com/china-linked-hackers-exploit-php2shell-to-root-firewalls/ (2026-10-28)
  3. The Hacker News: https://thehackernews.com/2026/10/php2shell-attack-roots-25-servers.html (2026-10-28)
  4. BleepingComputer: https://www.bleepingcomputer.com/news/security/infratrust-report-warns-of-exploited-flaws-in-critical-network-infrastructure/ (2026-10-28)
  5. Daily cyber recap archive: https://edwinvonlabja.com/2026/10/28/daily-cyber-recap-20261028-2/ (2026-10-29)
  6. The Hacker News: https://thehackernews.com/2026/10/china-linked-hackers-exploited-vmware.html (2026-10-29)
  7. SecurityWeek: https://www.securityweek.com/chinese-hackers-quietly-used-low-severity-esxi-logging-flaw-as-zero-day/ (2026-10-29)
  8. Infosecurity Magazine: https://www.infosecurity-magazine.com/news/japan-gmo-internet-disconnect/ (2026-10-28)
  9. The Record: https://therecord.media/japan-airlines-warns-of-breach-country-grapples-with-incidents (2026-10-28)
  10. BleepingComputer: https://www.bleepingcomputer.com/news/security/sony-isp-subsidiary-data-breach-exposes-25-million-customer-records/ (2026-10-28)
  11. The Hacker News: https://thehackernews.com/2026/10/japans-gmo-offers-1-million-bounty-to.html (2026-10-28)
  12. The Hacker News: https://thehackernews.com/2026/10/volt-typhoon-used-covert-silent-train.html (2026-10-28)
  13. BleepingComputer: https://www.bleepingcomputer.com/news/security/volt-typhoon-hides-zero-day-attacks-using-silent-train-framework/ (2026-10-28)
  14. BleepingComputer: https://www.bleepingcomputer.com/news/security/police-seize-virtualine-bulletproof-service-tied-to-ransowmare-cybercrime/ (2026-10-28)
  15. The Hacker News: https://thehackernews.com/2026/10/fbi-seizes-virtualine-domain-over.html (2026-10-28)
  16. The Record: https://therecord.media/moldova-investigates-possible-foreign-involvement-cyberattacks (2026-10-28)
  17. Dark Reading: https://www.darkreading.com/cybersecurity-operations/third-serengeti-sweep-1400-arrests-investigations-mature (2026-10-28)
  18. The Hacker News: https://thehackernews.com/2026/10/hackers-target-critical-oracle-e.html (2026-10-28)
  19. BleepingComputer: https://www.bleepingcomputer.com/news/security/hackers-now-scanning-systems-for-recently-patched-oracle-flaw/ (2026-10-28)

Follow for the daily recap

Follow if you like this content and want to stay up to date. Find more at edwinvonlabja.com or watch on YouTube: https://www.youtube.com/watch?v=HepFLy__uJ8

Produced with an AI-assisted pipeline; every claim is checked against the linked sources.

Leave a Reply

Your email address will not be published. Required fields are marked *