{ "schema_version": 3, "report_contract_version": 5, "report_plan": { "control_implications": [ { "control_id": "vulnerability_management", "evidence_excerpt": "The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday added two vulnerabilities impacting Adobe Commerce and Magento, and Google's Brotli decoder library to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation. The vulnerabilities are listed below - CVE-2026-111497 (CVSS score: 9.2) - An unchecked return value vulnerability in…", "evidence_origin": "summary", "focus": "Adobe Commerce and Magento", "priority": "high", "source_ids": [ 4 ] }, { "control_id": "data_protection", "evidence_excerpt": "Sony Network Communications has confirmed a data breach that compromised approximately 2.5 million records containing current and former customers' personal information…", "evidence_origin": "summary", "focus": "personal information", "priority": "high", "source_ids": [ 6 ] }, { "control_id": "incident_response", "evidence_excerpt": "Cybersecurity researchers have disclosed details of what appears to be an artificial intelligence (AI)-assisted attack orchestrated by a suspected China-nexus threat actor that has leveraged the PHP2Shell vulnerabilities to breach exposed systems. The activity, which was observed on October 25, 2026, involved an attacker combining PHP2Shell with a kernel privilege escalation exploit to root…", "evidence_origin": "summary", "focus": "PHP2Shell vulnerabilities", "priority": "high", "source_ids": [ 8 ] }, { "control_id": "monitoring", "evidence_excerpt": "Chinese state-sponsored hacking group Volt Typhoon has been using a framework that relies on rotating chains of connected devices compromised on demand, including for zero-day attacks targeting high-value systems…", "evidence_origin": "summary", "focus": "Volt Typhoon", "priority": "high", "source_ids": [ 9 ] }, { "control_id": "access_management", "evidence_excerpt": "Microsoft again asked Entra ID administrators to migrate users to phishing-resistant methods to avoid sign-in disruptions before it retires SMS and voice authentication in February 2027…", "evidence_origin": "summary", "focus": "Entra ID administrators", "priority": "high", "source_ids": [ 10 ] }, { "control_id": "vulnerability_management", "evidence_excerpt": "Attackers are actively exploiting vulnerabilities across critical network infrastructure, and PHP flaws known as \"PHP2Shell\" put the web management interfaces of firewalls, VPNs, application delivery controllers, and other appliances at risk…", "evidence_origin": "summary", "focus": "critical network infrastructure", "priority": "high", "source_ids": [ 12 ] } ], "executive_brief": { "decision_frame": "separate", "source_ids": [ 4, 6, 8 ] }, "industry_impacts": [], "regulatory_changes": [] }, "generated_at": "2026-10-28T21:16:14.678571Z", "feed_url": "https://ricomanifesto.github.io/SentryDigest/feed.xml", "feed_home_url": "https://ricomanifesto.github.io/SentryDigest/", "digest_issue_date": "2026-10-28", "digest_issue_url": "https://ricomanifesto.github.io/SentryDigest/archive/2026-10-28/", "requested_model": "openrouter/nvidia/nemotron-3-ultra-550b-a55b:free", "resolved_model": "nvidia/nemotron-3-ultra-550b-a55b:free", "sources": [ { "title": "Hackers Target Critical Oracle E-Business Suite RCE Flaw Days After Security Patch", "url": "https://thehackernews.com/2026/10/hackers-target-critical-oracle-e.html", "digest_url": "https://ricomanifesto.github.io/SentryDigest/archive/2026-10-28/#reporting-f83598082f12", "cves": [ "CVE-2026-101767" ], "snippet": "Hackers Target Critical Oracle E-Business Suite RCE Flaw Days After Security Patch Threat actors are beginning to probe for a newly patched critical vulnerability in Oracle E-Business Suite (EBS), according to threat intelligence firm Defused Cyber. The vulnerability in question is CVE-2026-101767 (CVSS score: 9.8) in the Oracle Application Object Library of Oracle E-Business Suite. It was patched by Oracle last week as part of its Critical Patch Update. Security researchers… Threat actors are beginning to probe for a newly patched critical vulnerability in Oracle E-Business Suite (EBS), according to threat intelligence firm Defused Cyber. The vulnerability in question is CVE-2026-101767 (CV", "article_evidence": [ { "extraction_version": 1, "origin": "summary", "raw_text": "Threat actors are beginning to probe for a newly patched critical vulnerability in Oracle E-Business Suite (EBS), according to threat intelligence firm Defused Cyber. The vulnerability in question is CVE-2026-101767 (CVSS score: 9.8) in the Oracle Application Object Library of Oracle E-Business Suite. It was patched by Oracle last week as part of its Critical Patch Update. Security researchers…", "text": "Threat actors are beginning to probe for a newly patched critical vulnerability in Oracle E-Business Suite (EBS), according to threat intelligence firm Defused Cyber. The vulnerability in question is CVE-2026-101767 (CVSS score: 9.8) in the Oracle Application Object Library of Oracle E-Business Suite. It was patched by Oracle last week as part of its Critical Patch Update. Security researchers…" }, { "extraction_version": 1, "origin": "content", "raw_text": "Threat actors are beginning to probe for a newly patched critical vulnerability in Oracle E-Business Suite (EBS), according to threat intelligence firm Defused Cyber. The vulnerability in question is CVE-2026-101767 (CVSS score: 9.8) in the Oracle Application Object Library of Oracle E-Business Suite. It was patched by Oracle last week as part of its Critical Patch Update. Security researchers…", "text": "Threat actors are beginning to probe for a newly patched critical vulnerability in Oracle E-Business Suite (EBS), according to threat intelligence firm Defused Cyber. The vulnerability in question is CVE-2026-101767 (CVSS score: 9.8) in the Oracle Application Object Library of Oracle E-Business Suite. It was patched by Oracle last week as part of its Critical Patch Update. Security researchers…" } ], "effective_date_evidence": null }, { "title": "Adobe Fixes 8 Critical Campaign Classic Flaws Allowing Code Execution and Security Bypass", "url": "https://thehackernews.com/2026/10/adobe-fixes-8-critical-campaign-classic.html", "digest_url": "https://ricomanifesto.github.io/SentryDigest/archive/2026-10-28/#reporting-d4f5d5baa825", "cves": [ "CVE-2026-104351" ], "snippet": "Adobe Fixes 8 Critical Campaign Classic Flaws Allowing Code Execution and Security Bypass Adobe has released patches to address multiple critical security flaws in Campaign Classic that, if successfully exploited, could result in arbitrary code execution, security feature bypass, and privilege escalation. The list of eight vulnerabilities is as follows - CVE-2026-104351 (CVSS score: 9.9) - A code injection vulnerability that could lead to arbitrary code execution. Adobe has released patches to address multiple critical security flaws in Campaign Classic that, if successfully exploited, could result in arbitrary code execution, security feature bypass, and privilege escalation. The list of ei", "article_evidence": [ { "extraction_version": 1, "origin": "summary", "raw_text": "Adobe has released patches to address multiple critical security flaws in Campaign Classic that, if successfully exploited, could result in arbitrary code execution, security feature bypass, and privilege escalation. The list of eight vulnerabilities is as follows - CVE-2026-104351 (CVSS score: 9.9) - A code injection vulnerability that could lead to arbitrary code execution.", "text": "Adobe has released patches to address multiple critical security flaws in Campaign Classic that, if successfully exploited, could result in arbitrary code execution, security feature bypass, and privilege escalation. The list of eight vulnerabilities is as follows - CVE-2026-104351 (CVSS score: 9.9) - A code injection vulnerability that could lead to arbitrary code execution." }, { "extraction_version": 1, "origin": "content", "raw_text": "Adobe has released patches to address multiple critical security flaws in Campaign Classic that, if successfully exploited, could result in arbitrary code execution, security feature bypass, and privilege escalation. The list of eight vulnerabilities is as follows - CVE-2026-104351 (CVSS score: 9.9) - A code injection vulnerability that could lead to arbitrary code execution.", "text": "Adobe has released patches to address multiple critical security flaws in Campaign Classic that, if successfully exploited, could result in arbitrary code execution, security feature bypass, and privilege escalation. The list of eight vulnerabilities is as follows - CVE-2026-104351 (CVSS score: 9.9) - A code injection vulnerability that could lead to arbitrary code execution." } ], "effective_date_evidence": null }, { "title": "ShinyHunters-Exploited Oracle PeopleSoft Zero-Day Turns Out to Be Three Chained Flaws", "url": "https://thehackernews.com/2026/10/shinyhunters-exploited-oracle.html", "digest_url": "https://ricomanifesto.github.io/SentryDigest/archive/2026-10-28/#reporting-1417a62a4b37", "cves": [ "CVE-2026-35273" ], "snippet": "ShinyHunters-Exploited Oracle PeopleSoft Zero-Day Turns Out to Be Three Chained Flaws The critical Oracle PeopleSoft bug that ShinyHunters has exploited since May is not one flaw but three chained together, the researchers who reported it said this week. Oracle patched all three under a single identifier, CVE-2026-35273, in June. Its root is a server-side request forgery (SSRF) that reaches an internal management interface because PeopleSoft trusts its own loopback address… The critical Oracle PeopleSoft bug that ShinyHunters has exploited since May is not one flaw but three chained together, the researchers who reported it said this week. Oracle patched all three under a single identifier, ", "article_evidence": [ { "extraction_version": 1, "origin": "summary", "raw_text": "The critical Oracle PeopleSoft bug that ShinyHunters has exploited since May is not one flaw but three chained together, the researchers who reported it said this week. Oracle patched all three under a single identifier, CVE-2026-35273, in June. Its root is a server-side request forgery (SSRF) that reaches an internal management interface because PeopleSoft trusts its own loopback address…", "text": "The critical Oracle PeopleSoft bug that ShinyHunters has exploited since May is not one flaw but three chained together, the researchers who reported it said this week. Oracle patched all three under a single identifier, CVE-2026-35273, in June. Its root is a server-side request forgery (SSRF) that reaches an internal management interface because PeopleSoft trusts its own loopback address…" }, { "extraction_version": 1, "origin": "content", "raw_text": "The critical Oracle PeopleSoft bug that ShinyHunters has exploited since May is not one flaw but three chained together, the researchers who reported it said this week. Oracle patched all three under a single identifier, CVE-2026-35273, in June. Its root is a server-side request forgery (SSRF) that reaches an internal management interface because PeopleSoft trusts its own loopback address…", "text": "The critical Oracle PeopleSoft bug that ShinyHunters has exploited since May is not one flaw but three chained together, the researchers who reported it said this week. Oracle patched all three under a single identifier, CVE-2026-35273, in June. Its root is a server-side request forgery (SSRF) that reaches an internal management interface because PeopleSoft trusts its own loopback address…" } ], "effective_date_evidence": null }, { "title": "Adobe Commerce PolyShell Attacks Breach Hundreds of Stores as Brotli Exploit Traffic Emerges", "url": "https://thehackernews.com/2026/10/adobe-commerce-polyshell-attacks-breach.html", "digest_url": "https://ricomanifesto.github.io/SentryDigest/archive/2026-10-28/#reporting-5977b4ad9b07", "cves": [ "CVE-2026-111497" ], "snippet": "Adobe Commerce PolyShell Attacks Breach Hundreds of Stores as Brotli Exploit Traffic Emerges The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday added two vulnerabilities impacting Adobe Commerce and Magento, and Google's Brotli decoder library to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation. The vulnerabilities are listed below - CVE-2026-111497 (CVSS score: 9.2) - An unchecked return value vulnerability in… The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday added two vulnerabilities impacting Adobe Commerce and Magento, and Google's Brotli decoder library to its Known Exploited Vulnerabilities (KE", "article_evidence": [ { "extraction_version": 1, "origin": "summary", "raw_text": "The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday added two vulnerabilities impacting Adobe Commerce and Magento, and Google's Brotli decoder library to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation. The vulnerabilities are listed below - CVE-2026-111497 (CVSS score: 9.2) - An unchecked return value vulnerability in…", "text": "The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday added two vulnerabilities impacting Adobe Commerce and Magento, and Google's Brotli decoder library to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation. The vulnerabilities are listed below - CVE-2026-111497 (CVSS score: 9.2) - An unchecked return value vulnerability in…" }, { "extraction_version": 1, "origin": "content", "raw_text": "The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday added two vulnerabilities impacting Adobe Commerce and Magento, and Google's Brotli decoder library to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation. The vulnerabilities are listed below - CVE-2026-111497 (CVSS score: 9.2) - An unchecked return value vulnerability in…", "text": "The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday added two vulnerabilities impacting Adobe Commerce and Magento, and Google's Brotli decoder library to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation. The vulnerabilities are listed below - CVE-2026-111497 (CVSS score: 9.2) - An unchecked return value vulnerability in…" } ], "effective_date_evidence": null }, { "title": "Google to Allow One-Tap Android App Installs From Approved Third-Party Stores Outside U.S.", "url": "https://thehackernews.com/2026/10/google-to-allow-one-tap-android-app.html", "digest_url": "https://ricomanifesto.github.io/SentryDigest/archive/2026-10-28/#reporting-346aefdaad09", "cves": [], "snippet": "Google to Allow One-Tap Android App Installs From Approved Third-Party Stores Outside U.S. Third-party Android app stores can now apply to Google for permission to install apps with one tap, without Android's usual confirmation screens, and to update them in the background. To qualify, a store must pass identity checks and send Google its full catalog, along with every new app and update, for ongoing malware scanning. Approved stores get the features from December 1, but only on… Third-party Android app stores can now apply to Google for permission to install apps with one tap, without Android's usual confirmation screens, and to update them in the background. To qualify, a store must pass i", "article_evidence": [ { "extraction_version": 1, "origin": "summary", "raw_text": "Third-party Android app stores can now apply to Google for permission to install apps with one tap, without Android's usual confirmation screens, and to update them in the background. To qualify, a store must pass identity checks and send Google its full catalog, along with every new app and update, for ongoing malware scanning. Approved stores get the features from December 1, but only on…", "text": "Third-party Android app stores can now apply to Google for permission to install apps with one tap, without Android's usual confirmation screens, and to update them in the background. To qualify, a store must pass identity checks and send Google its full catalog, along with every new app and update, for ongoing malware scanning. Approved stores get the features from December 1, but only on…" }, { "extraction_version": 1, "origin": "content", "raw_text": "Third-party Android app stores can now apply to Google for permission to install apps with one tap, without Android's usual confirmation screens, and to update them in the background. To qualify, a store must pass identity checks and send Google its full catalog, along with every new app and update, for ongoing malware scanning. Approved stores get the features from December 1, but only on…", "text": "Third-party Android app stores can now apply to Google for permission to install apps with one tap, without Android's usual confirmation screens, and to update them in the background. To qualify, a store must pass identity checks and send Google its full catalog, along with every new app and update, for ongoing malware scanning. Approved stores get the features from December 1, but only on…" } ], "effective_date_evidence": null }, { "title": "Sony ISP subsidiary data breach exposes 2.5 million customer records", "url": "https://www.bleepingcomputer.com/news/security/sony-isp-subsidiary-data-breach-exposes-25-million-customer-records/", "digest_url": "https://ricomanifesto.github.io/SentryDigest/archive/2026-10-28/#reporting-cfdef39189ea", "cves": [], "snippet": "Sony ISP subsidiary data breach exposes 2.5 million customer records Sony Network Communications has confirmed a data breach that compromised approximately 2.5 million records containing current and former customers' personal information… Sony Network Communications has confirmed a data breach that compromised approximately 2.5 million records containing current and former customers' personal information…", "article_evidence": [ { "extraction_version": 1, "origin": "summary", "raw_text": "Sony Network Communications has confirmed a data breach that compromised approximately 2.5 million records containing current and former customers' personal information…", "text": "Sony Network Communications has confirmed a data breach that compromised approximately 2.5 million records containing current and former customers' personal information…" }, { "extraction_version": 1, "origin": "content", "raw_text": "Sony Network Communications has confirmed a data breach that compromised approximately 2.5 million records containing current and former customers' personal information…", "text": "Sony Network Communications has confirmed a data breach that compromised approximately 2.5 million records containing current and former customers' personal information…" } ], "effective_date_evidence": null }, { "title": "Researcher Reveals How Logic Bugs Alone Cracked Microsoft Edge in $175,000 Pwn2Own Win", "url": "https://thehackernews.com/2026/10/researcher-reveals-how-logic-bugs-alone.html", "digest_url": "https://ricomanifesto.github.io/SentryDigest/archive/2026-10-28/#reporting-4abc2dcf4334", "cves": [], "snippet": "Researcher Reveals How Logic Bugs Alone Cracked Microsoft Edge in $175,000 Pwn2Own Win A chain of logic flaws, with no memory corruption, can turn a malicious web page into code running on a Windows computer outside Microsoft Edge's sandbox, a security researcher has shown. Orange Tsai of DEVCORE published the full method on October 28, five months after the chain won $175,000 at the Pwn2Own Berlin contest in May. Microsoft fixed the Edge bugs the day after the contest… A chain of logic flaws, with no memory corruption, can turn a malicious web page into code running on a Windows computer outside Microsoft Edge's sandbox, a security researcher has shown. Orange Tsai of DEVCORE published the ", "article_evidence": [ { "extraction_version": 1, "origin": "summary", "raw_text": "A chain of logic flaws, with no memory corruption, can turn a malicious web page into code running on a Windows computer outside Microsoft Edge's sandbox, a security researcher has shown. Orange Tsai of DEVCORE published the full method on October 28, five months after the chain won $175,000 at the Pwn2Own Berlin contest in May. Microsoft fixed the Edge bugs the day after the contest…", "text": "A chain of logic flaws, with no memory corruption, can turn a malicious web page into code running on a Windows computer outside Microsoft Edge's sandbox, a security researcher has shown. Orange Tsai of DEVCORE published the full method on October 28, five months after the chain won $175,000 at the Pwn2Own Berlin contest in May. Microsoft fixed the Edge bugs the day after the contest…" }, { "extraction_version": 1, "origin": "content", "raw_text": "A chain of logic flaws, with no memory corruption, can turn a malicious web page into code running on a Windows computer outside Microsoft Edge's sandbox, a security researcher has shown. Orange Tsai of DEVCORE published the full method on October 28, five months after the chain won $175,000 at the Pwn2Own Berlin contest in May. Microsoft fixed the Edge bugs the day after the contest…", "text": "A chain of logic flaws, with no memory corruption, can turn a malicious web page into code running on a Windows computer outside Microsoft Edge's sandbox, a security researcher has shown. Orange Tsai of DEVCORE published the full method on October 28, five months after the chain won $175,000 at the Pwn2Own Berlin contest in May. Microsoft fixed the Edge bugs the day after the contest…" } ], "effective_date_evidence": null }, { "title": "PHP2Shell Attack Roots 25 Servers, Breaches U.S. Government-Affiliated Network", "url": "https://thehackernews.com/2026/10/php2shell-attack-roots-25-servers.html", "digest_url": "https://ricomanifesto.github.io/SentryDigest/archive/2026-10-28/#reporting-257599f0048e", "cves": [], "snippet": "PHP2Shell Attack Roots 25 Servers, Breaches U.S. Government-Affiliated Network Cybersecurity researchers have disclosed details of what appears to be an artificial intelligence (AI)-assisted attack orchestrated by a suspected China-nexus threat actor that has leveraged the PHP2Shell vulnerabilities to breach exposed systems. The activity, which was observed on October 25, 2026, involved an attacker combining PHP2Shell with a kernel privilege escalation exploit to root… Cybersecurity researchers have disclosed details of what appears to be an artificial intelligence (AI)-assisted attack orchestrated by a suspected China-nexus threat actor that has leveraged the PHP2Shell vulnerabilities to br", "article_evidence": [ { "extraction_version": 1, "origin": "summary", "raw_text": "Cybersecurity researchers have disclosed details of what appears to be an artificial intelligence (AI)-assisted attack orchestrated by a suspected China-nexus threat actor that has leveraged the PHP2Shell vulnerabilities to breach exposed systems. The activity, which was observed on October 25, 2026, involved an attacker combining PHP2Shell with a kernel privilege escalation exploit to root…", "text": "Cybersecurity researchers have disclosed details of what appears to be an artificial intelligence (AI)-assisted attack orchestrated by a suspected China-nexus threat actor that has leveraged the PHP2Shell vulnerabilities to breach exposed systems. The activity, which was observed on October 25, 2026, involved an attacker combining PHP2Shell with a kernel privilege escalation exploit to root…" }, { "extraction_version": 1, "origin": "content", "raw_text": "Cybersecurity researchers have disclosed details of what appears to be an artificial intelligence (AI)-assisted attack orchestrated by a suspected China-nexus threat actor that has leveraged the PHP2Shell vulnerabilities to breach exposed systems. The activity, which was observed on October 25, 2026, involved an attacker combining PHP2Shell with a kernel privilege escalation exploit to root…", "text": "Cybersecurity researchers have disclosed details of what appears to be an artificial intelligence (AI)-assisted attack orchestrated by a suspected China-nexus threat actor that has leveraged the PHP2Shell vulnerabilities to breach exposed systems. The activity, which was observed on October 25, 2026, involved an attacker combining PHP2Shell with a kernel privilege escalation exploit to root…" } ], "effective_date_evidence": null }, { "title": "Volt Typhoon hides zero-day attacks using 'Silent Train' framework", "url": "https://www.bleepingcomputer.com/news/security/volt-typhoon-hides-zero-day-attacks-using-silent-train-framework/", "digest_url": "https://ricomanifesto.github.io/SentryDigest/archive/2026-10-28/#reporting-0b33a76a486a", "cves": [], "snippet": "Volt Typhoon hides zero-day attacks using 'Silent Train' framework Chinese state-sponsored hacking group Volt Typhoon has been using a framework that relies on rotating chains of connected devices compromised on demand, including for zero-day attacks targeting high-value systems… Chinese state-sponsored hacking group Volt Typhoon has been using a framework that relies on rotating chains of connected devices compromised on demand, including for zero-day attacks targeting high-value systems…", "article_evidence": [ { "extraction_version": 1, "origin": "summary", "raw_text": "Chinese state-sponsored hacking group Volt Typhoon has been using a framework that relies on rotating chains of connected devices compromised on demand, including for zero-day attacks targeting high-value systems…", "text": "Chinese state-sponsored hacking group Volt Typhoon has been using a framework that relies on rotating chains of connected devices compromised on demand, including for zero-day attacks targeting high-value systems…" }, { "extraction_version": 1, "origin": "content", "raw_text": "Chinese state-sponsored hacking group Volt Typhoon has been using a framework that relies on rotating chains of connected devices compromised on demand, including for zero-day attacks targeting high-value systems…", "text": "Chinese state-sponsored hacking group Volt Typhoon has been using a framework that relies on rotating chains of connected devices compromised on demand, including for zero-day attacks targeting high-value systems…" } ], "effective_date_evidence": null }, { "title": "Microsoft urges Entra ID admins to migrate users to passkeys", "url": "https://www.bleepingcomputer.com/news/microsoft/microsoft-reminds-entra-id-admins-to-migrate-users-to-passkeys/", "digest_url": "https://ricomanifesto.github.io/SentryDigest/archive/2026-10-28/#reporting-a7b8cf39a163", "cves": [], "snippet": "Microsoft urges Entra ID admins to migrate users to passkeys Microsoft again asked Entra ID administrators to migrate users to phishing-resistant methods to avoid sign-in disruptions before it retires SMS and voice authentication in February 2027… Microsoft again asked Entra ID administrators to migrate users to phishing-resistant methods to avoid sign-in disruptions before it retires SMS and voice authentication in February 2027…", "article_evidence": [ { "extraction_version": 1, "origin": "summary", "raw_text": "Microsoft again asked Entra ID administrators to migrate users to phishing-resistant methods to avoid sign-in disruptions before it retires SMS and voice authentication in February 2027…", "text": "Microsoft again asked Entra ID administrators to migrate users to phishing-resistant methods to avoid sign-in disruptions before it retires SMS and voice authentication in February 2027…" }, { "extraction_version": 1, "origin": "content", "raw_text": "Microsoft again asked Entra ID administrators to migrate users to phishing-resistant methods to avoid sign-in disruptions before it retires SMS and voice authentication in February 2027…", "text": "Microsoft again asked Entra ID administrators to migrate users to phishing-resistant methods to avoid sign-in disruptions before it retires SMS and voice authentication in February 2027…" } ], "effective_date_evidence": null }, { "title": "Attacker Relentlessly Scans for Credentials by Impersonating AI Bots", "url": "https://www.darkreading.com/cyber-risk/attacker-impersonates-ai-bots-scans-credentials", "digest_url": "https://ricomanifesto.github.io/SentryDigest/archive/2026-10-28/#reporting-9c52e80bed55", "cves": [], "snippet": "Attacker Relentlessly Scans for Credentials by Impersonating AI Bots The threat actor lurked behind bots posing as agents from OpenAI, Anthropic, Meta, and others to find exposed data. The threat actor lurked behind bots posing as agents from OpenAI, Anthropic, Meta, and others to find exposed data.", "article_evidence": [ { "extraction_version": 1, "origin": "summary", "raw_text": "The threat actor lurked behind bots posing as agents from OpenAI, Anthropic, Meta, and others to find exposed data.", "text": "The threat actor lurked behind bots posing as agents from OpenAI, Anthropic, Meta, and others to find exposed data." }, { "extraction_version": 1, "origin": "content", "raw_text": "The threat actor lurked behind bots posing as agents from OpenAI, Anthropic, Meta, and others to find exposed data.", "text": "The threat actor lurked behind bots posing as agents from OpenAI, Anthropic, Meta, and others to find exposed data." } ], "effective_date_evidence": null }, { "title": "InfraTrust report warns of exploited flaws in critical network infrastructure", "url": "https://www.bleepingcomputer.com/news/security/infratrust-report-warns-of-exploited-flaws-in-critical-network-infrastructure/", "digest_url": "https://ricomanifesto.github.io/SentryDigest/archive/2026-10-28/#reporting-f2c961bbdd37", "cves": [], "snippet": "InfraTrust report warns of exploited flaws in critical network infrastructure Attackers are actively exploiting vulnerabilities across critical network infrastructure, and PHP flaws known as \"PHP2Shell\" put the web management interfaces of firewalls, VPNs, application delivery controllers, and other appliances at risk… Attackers are actively exploiting vulnerabilities across critical network infrastructure, and PHP flaws known as \"PHP2Shell\" put the web management interfaces of firewalls, VPNs, application delivery controllers, and other appliances at risk…", "article_evidence": [ { "extraction_version": 1, "origin": "summary", "raw_text": "Attackers are actively exploiting vulnerabilities across critical network infrastructure, and PHP flaws known as \"PHP2Shell\" put the web management interfaces of firewalls, VPNs, application delivery controllers, and other appliances at risk…", "text": "Attackers are actively exploiting vulnerabilities across critical network infrastructure, and PHP flaws known as \"PHP2Shell\" put the web management interfaces of firewalls, VPNs, application delivery controllers, and other appliances at risk…" }, { "extraction_version": 1, "origin": "content", "raw_text": "Attackers are actively exploiting vulnerabilities across critical network infrastructure, and PHP flaws known as \"PHP2Shell\" put the web management interfaces of firewalls, VPNs, application delivery controllers, and other appliances at risk…", "text": "Attackers are actively exploiting vulnerabilities across critical network infrastructure, and PHP flaws known as \"PHP2Shell\" put the web management interfaces of firewalls, VPNs, application delivery controllers, and other appliances at risk…" } ], "effective_date_evidence": null } ] }