Transcript
Kate: Good morning! It's Thursday, October twenty-ninth, and this is your daily update on security, AI and tech. Dade, we've got a busy one, haven't we?
Dade: Morning, Kate. We do. Let's start with security, because Oracle customers are not going to enjoy their coffee today.
Kate: Go on. What's happening with Oracle?
Dade: So, threat actors have started probing a critical flaw in Oracle E-Business Suite, tracked as CVE-2026-101767. It's an improper authentication bug, CVSS nine point eight, and it was only patched a few days ago. Threat intelligence firm Defused Cyber is already seeing scanning. And The Register adds that ShinyHunters' PeopleSoft zero-day turns out to involve three separate vulnerabilities, not one. If you run EBS or PeopleSoft, patch with priority. The window between patch and exploitation keeps shrinking.
Kate: And that's the pattern, right? Patch lands, and within days somebody's reverse engineering it.
Dade: Exactly. For a consultant, the advice to clients is simple. Don't wait for the monthly cycle for internet-facing business-critical systems. Also check logs back to before the patch date, because someone may already have been in.
Kate: Okay. CISA also added some things to its known exploited list?
Dade: Two entries. One is a Broadcom VMware ESX issue, CVE-2026-41709, described as insufficient logging. The other is a Linux kernel bug, CVE-2026-46300, a missing variable initialization. Both are confirmed as actively exploited. The ESX one is interesting because weak logging helps attackers stay hidden, and hypervisors are a favorite place to hide.
Kate: Now, a bigger story on the nation-state side. Volt Typhoon.
Dade: Yes. Researchers attribute a now-disrupted covert access network called Silent Train to the Chinese group Volt Typhoon. It was first identified in late twenty twenty-three, uses rotating chains of infrastructure, and was used in four zero-day campaigns plus strategic access. The takeaway is that this isn't just smash and grab. It's pre-positioning. For anyone under NIS2 in energy, transport or telecoms, this is exactly the threat model regulators have in mind. Related, there's a report of an apparently AI-assisted attack by a suspected China-nexus actor, called PHP2Shell, that rooted twenty-five servers and got into a US government-affiliated network.
Kate: And closer to home, Belgium had its own incident.
Dade: Right. The federal finance ministry, FOD Financiën, is dealing with a cyberattack. Several digital services are unavailable, and the deadline for certain tax filings has been pushed back. Details are thin so far, so I'd be careful about speculating on who or how. But it's a clear reminder of how a public-sector incident turns into a very public, very practical problem for citizens.
Kate: Plus a handful of data breaches today.
Dade: Yes. Japan Airlines says about two thousand customers had passport numbers, frequent flyer numbers and contact details stolen. In Germany, three hundred forty-five thousand email addresses from the AfD breach landed in Have I Been Pwned. In the US, more than forty-one thousand DHS employee records were taken. And Moldova is investigating a major government cyberattack, with possible foreign involvement. Every one of those is a GDPR notification story in Europe.
Kate: Before we leave security, some good news for developers?
Dade: A bit, yes. GitHub announced a package firewall for npm. It checks packages against your policy before they install, blocking known malware, critical vulnerabilities, and even brand-new versions. That last part is clever, because most malicious releases get caught within days. Meanwhile, Dark Reading says the GhostAction wave has fizzled, but the attackers are still lurking in GitHub, shifting towards developer endpoints and cloud access.
Kate: So the supply chain fight continues. Let's take a breath.
Kate: On to AI and tech. Dade, what stood out?
Dade: Money, mostly. Microsoft posted its first quarter of fiscal twenty-twenty-seven: ninety-two point three billion dollars in revenue, up nineteen percent, and Azure grew forty-eight percent. Alphabet says AI is driving more search queries, and Google Cloud revenue doubled. But advertising disappointed, and The Register reports Google is struggling to make AI Mode searches pay.
Kate: So the cloud is thriving, the old cash cow is wobbling.
Dade: That's the investor worry. If AI agents answer questions, who clicks on ads? Nobody knows yet. Google also announced Gemini 4 Carbon, but you can't use it. Ars calls it a slightly better version of Argon.
Kate: And on the developer side, GitHub is adding four million cores?
Dade: Yes, to cope with what The Register calls the AI slop-pocalypse, a flood of automated activity. And Amazon is telling developers to ease off tokenmaxxing and focus on useful software. Simon Willison, meanwhile, thinks vibe game development has hit an inflection point, like coding agents did last November.
Kate: And then there's Apple.
Dade: The first MacBook Pro with an OLED touchscreen. Fourteen-inch starts at twenty-eight ninety-nine dollars, the sixteen at thirty-three ninety-nine, and a fully loaded one costs fourteen thousand five hundred forty-nine. There's also an M6 MacBook Pro, an M6 iMac and an OLED iPad mini. Pre-orders are open, with delivery on Friday, November sixth.
Kate: One European angle?
Dade: Two. Europe plans a Pan-Arctic cable to Greenland, bypassing the US. And Combell, Delaware and Imec signed an intent to build a sovereign AI cloud. Digital sovereignty keeps moving from slogan to infrastructure.
Kate: Great, Dade. That's the briefing for today. Thanks for listening, everyone. Patch those Oracle systems, and have a really good day.
Dade: Take care, all. See you tomorrow.
No news overview was kept for this day.