360 Security Cloud Opens PHP2Shell Vulnerability Self-Check Platform for Enterprises and SMEs

Telegram Voice Call Flaw Enables Remote Code Execution on Android Devices

Security researchers disclosed on October 29, 2026 a vulnerability in Telegram for Android that allows arbitrary code execution on a victim's device simply by answering a voice call. The flaw resided in the handling of short MediaState messages exchanged during calls, where missing fields caused the application to read unauthorized memory. Telegram addressed the issue in version 12.10.4 released at the end of September 2026, covering versions from 8.6.2 through 12.10.3 issued between March 2022 and September 2026. The same underlying fix had been deployed earlier in the shared calling library on April 21, 2026, reaching iOS in May, desktop in July, and Android only in September. Researchers confirmed the impact exclusively on private calls running on ARM64 Android devices and found no evidence of exploitation on iOS, desktop, or group calls. Users are advised to check their Telegram version in settings and update immediately, while enterprise administrators should audit device fleets given the four-and-a-half-year span of affected releases.

Cisco Talos Details KeyDrift Malware Exploiting Critical CVE-2026-20127 Zero-Day in Catalyst SD-WAN

Cisco Talos published an analysis on October 28, 2026, of the KeyDrift malware set designed to reside inside Catalyst SD-WAN controllers and extract keys protecting inter-site traffic. The initial access vector was the critical CVE-2026-20127 authentication bypass, scored 10.0 on CVSS 3.1, affecting the peer authentication mechanism between the Catalyst SD-WAN Controller, Manager, and Validator. Attackers could obtain administrative privileges remotely without credentials by sending crafted requests. The Cisco patch was released in February 2026 and the CVE was added to the CISA catalog on February 25 with a two-day remediation deadline. KeyDrift consists of two core modules: the memory-resident PolyFlame backdoor injected into vdaemon processes and the LittleFilch component that intercepts decrypted session identifiers and 32-byte AES-256 IPsec keys distributed via the OMP protocol. Observed targets include space and satellite services, defense contractors, aerospace technology firms, and public policy research institutes. Talos assesses with high confidence that the UAT-11473 infrastructure overlaps significantly with the Silent Train access network linked to Volt Typhoon, though the groups are not confirmed to be identical.

Anthropic's Internal Claude Model Writes Exploit for Linux Kernel CVE-2026-98432 Enabling Remote Root Command Execution

An unreleased internal model from Anthropic generated a working exploit that achieves remote command execution with root privileges on a Linux server configured with multipath TCP (MPTCP). The exploit targets CVE-2026-98432, a use-after-free vulnerability in the Linux kernel network stack that occurs during parallel TCP request processing. Researchers first used the model to bypass KASLR address randomization, a process that took 48 minutes, followed by five additional minutes to seize control and execute arbitrary commands. The Linux kernel team rated the flaw 9.8 on CVSS while Red Hat assigned it 5.9, citing exploitation complexity. A patch has already been merged into the mainline kernel and supported stable branches, though users must verify availability through their distribution vendor. Anthropic emphasized that the experiment relied on a non-public model and cannot be reproduced with standard chat interfaces.