Episode 14: PHP2Shell reaches a US government network, Volt Typhoon's Silent Train exposed and Tailscale ships Tailworm fixes, 29 October 2026

A suspected China-linked attacker used a custom PHP2Shell exploit, with signs of AI-assisted tooling, to root 25 firewalls and reach a US government-affiliated network, and Lumen's Black Lotus Labs exposed Volt Typhoon's Silent Train covert network behind four zero-day campaigns. In Australia, a breach at booking platform RMS Cloud is fuelling phishing of holiday park guests. We also cover Tailscale's Tailworm fixes, new CISA KEV entries, Oracle EBS probing and Anthropic's AI-built exploit chains.

Australia

• RMS Cloud breach fuels booking scams. Guest names, contact and booking details accessed (payment details not involved, says RMS); scam messages quoting real bookings hit guests of BIG4, Reflections, G'day Parks and others. RMS; ABC News; 7NEWS

Global threats

• PHP2Shell used to root 25 firewalls and reach a US government-affiliated network. Custom exploit plus Linux kernel flaw CVE-2026-46300 (Fragnesia); AI tooling found on attacker infrastructure; single-vendor analysis by Dream. The Hacker News
• Volt Typhoon's Silent Train covert network exposed. Short-lived chains of hijacked SOHO, IoT and enterprise devices behind zero-days in Versa Director, N-able N-central, Cisco Catalyst SD-WAN Controller and Arista VeloCloud Orchestrator. The Hacker News
• Tailscale 1.104.4 fixes Tailworm SSH forwarding flaws. Forwarding now runs as the logged-in user; set TS_SSH_DISABLE_FORWARDING=1 if you cannot update yet. The Hacker News
• Oracle E-Business Suite CVE-2026-101767 probed days after patch. Unauthenticated SQL injection chaining to command execution. The Hacker News
• CISA KEV adds Adobe Commerce PolyShell (CVE-2026-48356) and Brotli (CVE-2026-111497). Federal due date 10 November; Node.js fixed in 22.23.4, 24.22.1 and 26.12.1. The Hacker News
• ShinyHunters' PeopleSoft zero-day is three chained flaws. CVE-2026-35273, patched June; rotate credentials. The Hacker News
• 16-year-old EDK II UEFI flaw in network boot (CVE-2026-97631). No fixed stable release yet. The Hacker News
• Moldova examines foreign state role in government data theft. About 750,000 identity numbers affected. The Record
• GMO Internet Group offers US$1 million bounty after refusing extortion. The Hacker News
• FBI seizes bulletproof host Virtualine's domain. The Hacker News
• US sanctions launderers of North Korean IT worker earnings. The Record

AI security

• Anthropic says an unreleased model chained flaws into five working exploits. Chrome, Safari, Android, Windows and Linux; all patched; autonomy claims are self-reported. The Hacker News
• Credential scanner impersonates 32 AI bots. Cequence reports traffic at 48% of its customers on one day. Dark Reading
• noyb sues Scale AI over worker surveillance. The Record

Industry and policy

• UK to consult on software vendor liability for cyber breaches. The Record

Outlook and patch priorities

• Critical: PHP on servers and in appliance firmware; firewall management interfaces off the internet; Oracle EBS CVE-2026-101767.
• High: Tailscale 1.104.4; Node.js Brotli fixes; Adobe Commerce PolyShell; PeopleSoft credential rotation; RMS customers warn guests.

Show notes page | Follow on X (@u51cyber)