This is the security briefing for Friday the 30th of October 2026, drawn from the BlueTeamSec community on infosec.pub. A busy one, with eleven stories to get through.
CISA have added a critical Cisco vulnerability to the Known Exploited list. CVE-2026-76418 affects ASA and Firepower devices and lets unauthenticated attackers crash VPN-enabled kit with a single crafted request when secondary authentication is configured. This one's actively exploited in the wild against internet-facing VPN services, so patch immediately or disable secondary auth as a workaround.
Also from CISA, CVE-2026-97229 is an integer overflow in GitLab's CI pipeline regular expression compiler that allows remote code execution without authentication. It's been exploited in the wild, including a confirmed compromise of the Alpine Linux GitLab instance. This one follows the PHP2Shell activity we covered earlier in the week — organisations running GitLab need to patch to the fixed versions and review logs for signs of compromise.
Canada's Cyber Centre have documented an agentic AI framework called ARTEX, deployed by threat actor Storm-0940 to automate cyber operations at industrial scale. The framework chains multiple attack stages with minimal human oversight and can progress from target selection to privileged cloud access in under three hours, affecting hundreds of organisations across critical infrastructure. Significantly reduces the time defenders have to respond.
Norway's National Security Authority have raised the national cyber risk level to HIGH for the first time, citing a tripling of successful operations against Norwegian targets over six months. Defence sector, defence industry, space, and critical infrastructure are primary targets, with adversaries leveraging AI to accelerate network mapping, ransomware deployment, and denial-of-service attacks.
Australia's Signals Directorate have released their annual cyber threat report, documenting a significant escalation in state-sponsored espionage, ransomware, and cybercrime with increasingly blurred boundaries. They responded to over fifteen hundred incidents, up twenty percent, and issued forty-four hundred notifications, up eighty percent. The report emphasises that AI is enabling adversaries to identify and exploit vulnerabilities at greater speed and scale.
CISA have published their 2030 strategic plan, titled 'Defend, Harden, Prevail'. Three pillars: leading national cyber defence through collaboration, prioritising protection of high-impact infrastructure, and mobilising national resilience through enhanced communications and rapid response. Worth a read if you're involved in critical infrastructure protection or national-level risk planning.
NIST have released guidance on transitioning from quantum-vulnerable cryptographic algorithms to post-quantum standards. The report addresses proactive defence against future quantum computing threats, including store-now-decrypt-later attacks, and is mandatory for federal agencies under recent Executive Order and OMB memorandum. One for cryptography leads and those planning long-term infrastructure transitions.
Sansec have documented a Brazilian Magecart group exploiting outdated Plausible analytics software to compromise Convertr's server between the 24th and 27th of October. The attackers injected card-skimming malware that exfiltrated credit card data and Brazilian tax ID numbers from dozens of fashion brand checkouts using the platform. This group has appeared in our coverage before — we saw a similar Magecart campaign targeting Brazilian e-commerce back in September.
Researchers at Xint have discovered a vulnerability in the OpenAI API they're calling compaction smuggling. It allows attackers to extract raw reasoning traces from frontier AI models by exploiting the API's compaction feature through a three-stage process. This enables large-scale model distillation, letting adversaries train smaller models that replicate the performance of proprietary systems.
Wiz have written up the GHEIST campaign, an ongoing automated attack leveraging stolen GitHub personal access tokens to inject malicious workflows into repositories for large-scale secret exfiltration. Over eight hundred and fifty accounts compromised, thirteen and a half thousand malicious branches planted. The attack executes within GitHub Actions environments, bypassing traditional security controls, and can lead to self-hosted runner compromise and lateral movement.
And finally, S12 Cybersecurity have published a comprehensive reference documenting all kernel structures, routines, and machine-specific registers monitored by Windows PatchGuard. It details the protection mechanisms including integrity verification of critical modules, monitoring of system tables, and detection of rootkit techniques. Useful background if you're working on Windows kernel security or offensive research.
That's everything for today from BlueTeamSec. The articles are the work of their original authors — the analysis here was automated.