UEFI flaw CVE-2026-97631 exposes servers worldwide to ring-0 code execution

16-year-old UEFI PXE bug rated 9.5 threatens servers across vendors

A memory-corruption flaw in the TianoCore EDK II open-source codebase, tracked as CVE-2026-97631 and rated 9.5 for severity, affects UEFI firmware used by most of the world’s server vendors and data centers. The 16-year-old buffer overflow sits in the PXE Base Code driver, which copies ICMP error messages into a fixed 504-byte field without correct bounds handling in both IPv4 and IPv6 paths. A malicious error sent by simple unicast during PXE boot can hang the boot sequence or, with knowledge of the firmware build, execute code at ring 0. Exploits bypass attestation and can break disk encryption. Patch code is now public, making exploit development trivial for advanced hackers, while patching millions of devices remains slow. Home users booting only from disk are unaffected.

Code-execution flaw in UEFI firmware affects most servers on planet Earth - Ars Technica →

Topics: Zero-day vulnerabilities

UAT-11473 exploits Cisco SD-WAN flaw to deploy KeyDrift malware

An advanced persistent threat group tracked as UAT-11473 exploited CVE-2026-20127, a maximum-severity authentication-bypass flaw in Cisco Catalyst SD-WAN Controllers patched in February 2026, to deploy a custom framework called KeyDrift. Cisco Talos reported the activity and assessed that UAT-11473 appears to overlap with Volt Typhoon’s Silent Train covert access network, without making definitive links. Targets included space and satellite services, defense and aerospace technology, and policy research organizations. KeyDrift runs inside SD-WAN control-plane processes and can intercept decrypted control traffic, extract control-session metadata and data-plane keying material, and exfiltrate it in encrypted records. Its PolyFlame and LittleFilch components show ongoing development, including anti-debugging mechanisms and process impersonation. Cisco urges administrators to apply available updates and follow its hardening guide.

Hackers exploit Cisco SD-WAN flaw to deploy custom KeyDrift malware →

Topics: State-sponsored hacking

GRU-directed hackers caused water main bursts and factory fires for two years

A two-year campaign directed by Russia’s GRU used weak or default credentials on internet-facing industrial control systems to cause physical damage across Western infrastructure. The Cyber Army of Russia Reborn and its Z-Pentest offshoot connect to devices running VNC on default port 5900 and alter physical settings. In Tureby, Denmark, in December 2024, attackers zeroed pressure settings on a water pump, then surged pressure until pipes burst, cutting water to 450 homes; the password was 1234. In the U.S., refrigeration was shut down at a meatpacking facility near Los Angeles, spoiling over 2,000 pounds of meat and triggering an ammonia leak. A December 2025 DOJ indictment states CARR was founded, funded and directed by the GRU. CISA joint advisory AA25-343A names CARR, Z-Pentest, NoName057(16) and Sector16.

GRU-Backed Hackers Burst Water Mains and Sparked Factory Fires From Denmark to California →

Topics: State-sponsored hacking

Microsoft Authenticator for Android flaw let any app obtain work account tokens

A high-severity design flaw in Microsoft Authenticator for Android allowed any installed app to impersonate trusted Microsoft apps such as Teams and obtain access tokens for work accounts. Microsoft assigned CVE-2026-80097, a CVSS 8.6 Important rating, on September 8, 2026. Enclave’s October 23 writeup describes a confused-deputy flaw in the exported AccountChooserActivity, reachable without special permissions. Authenticator checked the requesting app’s declared metadata against the impersonated app’s publicly readable metadata but never used the real package and UID identity supplied by Android. Tokens obtained by impersonating Teams included Microsoft Graph permissions Mail.ReadWrite, Mail.Send, Files.ReadWrite.All and Calendars.ReadWrite. By impersonating Authenticator itself, a malicious app could add attacker-controlled passkeys that survived removal or updating. Microsoft released the fix in version 6.2606.4246 and says the flaw was not exploited in known attacks; iOS is unaffected.

Microsoft Authenticator for Android: The 'Confused Deputy' That Handed Corporate Tokens to Any App | DeafNews →

Topics: MicrosoftPassword security

Keystone to destroy 18,835 hardware wallets after authentication key theft

Keystone will destroy 18,835 unsold hardware wallets after a hacker stole the WebAuth authentication key used to verify device authenticity. The breach also exposed personal information in 25,964 customer records, including names, contact details, shipping addresses and order information. Keystone detected unauthorized access to its website on October 20, 2026; the attacker exploited a vulnerability in a third-party monitoring tool. The stolen key could let someone build a counterfeit device that passes the same authenticity check and steals a recovery phrase. The key is permanently written into each device and cannot be replaced, so affected wallets cannot be updated. Newly manufactured devices will use a replacement key. No confirmed counterfeit devices or stolen bitcoin have been reported. Keystone cut its data retention period from 180 to 90 days and warned about replacement scams.

Keystone to Destroy 18,835 Hardware Wallets After Authentication Key Theft →

Topics: Crypto security