CISA adds VMware ESX zero-day used to blind audit trails
Themes & analysis
Attackers are targeting the layer below your monitoring
VMware ESX used to reduce audit visibility, Cisco SD-WAN keys stolen by KeyDrift, Palo Alto management interfaces under PHP2Shell attack, and Volt Typhoon hiding behind SOHO and IoT relays all point the same way. These systems often lack endpoint agents and sit upstream of the logs defenders trust. Reconsider whether hypervisor, network-controller and management-plane logs are stored somewhere an attacker on that layer cannot edit.
Patch age is no longer a reliable safety margin
Oracle EBS CVE-2026-101767 was probed days after its patch, and PHP2Shell is hitting recently patched bugs. Yet Cisco's KeyDrift exploited a flaw fixed in February. Both fast and slow exploitation are happening at once, so patch windows must be short and exposure of management interfaces must be removed regardless of patch state.
AI is now in the attack chain and the defense budget
123 Reg, South Korean banks and the 25-server PHP2Shell rooting involved AI-assisted attacks. OpenAI agents reportedly hacked Hugging Face in a test, and Cisco open sourced Project Quarry to detect agents on hacking sprees. Google limited Gemini 4 Carbon's cyber gains to defense partners. Speculation: labs may keep restricting the most cyber-capable models to vetted users, while open attackers use weaker, widely available ones.
AI demand is colliding with cost and capacity limits
Amazon is telling developers to ease off heavy AI tool use, Anthropic is shipping spend-visibility tools, and users are auditing Claude Code token use. GitHub is adding four million cores, Google struggles to monetize AI Mode after $51 billion in infrastructure spending, and Fujifilm is expanding tape capacity fivefold for AI data. Usage is outrunning both budgets and infrastructure, and cost attribution is becoming a product feature.
Watch list
CVE-2026-41709 (VMware ESX) and CVE-2026-46300 (Linux kernel) are now in KEV. Federal due dates will set the patch clock, and further Warp Panda victims may be disclosed.
Watch for CISA KEV due dates for CVE-2026-41709 and CVE-2026-46300
The EDK II UEFI flaw still lacks a CVE id, affected versions and patch status in the available coverage. Network-booting server fleets need OEM firmware guidance.
Watch for OEM or EDK2 advisory with a CVE id
Oracle E-Business Suite CVE-2026-101767 (CVSS 9.8) is being probed. Confirmed exploitation or a KEV listing would raise urgency for unpatched EBS installs.
Watch for CISA KEV listing or confirmed exploitation of CVE-2026-101767
Gemini 4 Carbon is limited to select defense partners. Whether access widens, and how OpenAI and Anthropic respond, will show if gated cyber models become a pattern.
The FCC is set to vote on letting prisons use cellphone signal jammers.
Watch for FCC vote, November 19
The touchscreen MacBook Pro ships November 6. Reviews should show whether the premium pricing and touch OLED hold up.
Watch for MacBook Pro shipping, November 6