US Cybersecurity Briefing – Friday, Oct 30, 2026

Nothing new to report.

FLDOE says staff found unauthorized access on Oct 19, and it believes the incident was limited to FloridaStudentFinancialAidSG.org. About 4.9 million people are potentially affected. Exposed data may include SSNs, names, dates of birth, home addresses, phone numbers, email addresses and gender codes, and the specific data varies by person. Florida Digital Service and FDLE are investigating it as a criminal case. The threat actor and the intrusion vector have not been disclosed.

FLDOE →    ClickOrlando →

An actor calling itself “Department of Peace” claimed the theft, and DDoSecrets published the data as “Icepick.” It reportedly covers about 21,000 CBP records, about 10,000 from ICE (including HSI), just under 1,000 from CISA, and thousands more from DHS HQ, USCIS and FPS. Fields include names, titles, work emails, cell numbers, office locations, and SSO access and group records (Microsoft 365, Penlink, Mobile Fortify). The hacker claims the data came from DHS's Okta SSO, and Okta says it has no evidence its systems were compromised. DHS says it is aware of a “potential breach” but has not confirmed it. TechCrunch verified some records, which suggest the data was copied around mid-August.

Security Affairs →

The attack disrupted the clerk's website and phone systems in Sanford, FL. The office cut off outside internet access and closed public services until further notice. Injunctions and probate stayed open, and deadlines and payment due dates are being extended without penalty. The clerk says it found no ransomware and no compromised information. No threat actor has been named, and the restoration timeline is unknown.

ClickOrlando →

Honda confirmed a “cybersecurity incident” and took the iN portal offline on Oct 27. For about two days, Honda and Acura dealers and Honda powersports could not submit credit applications, check recalls, order parts or get support for complex repairs. Dealers reported access was restored Thursday morning. Honda says it has found no evidence of customer-data access, and its investigation is still open. No threat actor has been named.

DysruptionHub →

Reuters, citing four officials, reports that the Pentagon is investigating August freezer failures at on-base commissaries as a suspected hack. The confirmed stores are Fort Irwin, F.E. Warren, Naval Station Newport, Columbus and Travis, and Fort Huachuca reported its freezer went into defrost mode. A Cyber Command unit and Army CID's Cyber Field Office are working with French police on a similar October attack on French supermarket freezers. Unconfirmed: the cause, the attacker, the freezer brand, and claims of up to 14 sites in 11 states. No Texas bases have been named.

Security Affairs →

BAE runs the Bankruptcy Noticing Center for the Administrative Office of the US Courts. It says no other systems were affected and no data or PII was extracted in the attack that took bnc.uscourts.gov, notices.uscourts.gov and the National Creditor Registration Service offline. A 90-day “Bankruptcy Rules emergency” remains in effect, and backlogged paper notices are going out in waves. Services began resuming Oct 26. No group has claimed it.

The Record →

A crafted regex in a CI configuration can lead to code execution on the server. The named target is Alpine Linux: an attacker registered an account and sent crafted CI configs to its GitLab on Oct 20–21, crashing workers eight times. Alpine rebuilt the server and rotated secrets, and it found no evidence of code execution but cannot rule it out. CISA has not named attackers or other victims. The federal deadline is listed as Nov 1 (per CybersecurityNews; CISA's page was unreachable for this briefing).

Action: Upgrade to the latest release on your branch (Oct 21 releases: 19.5.1, 19.4.3, 19.3.6, 19.2.9). Self-compiled or custom-Ruby installs must also move to Ruby 3.3.13, 3.4.12 or 4.0.9+, because upgrading GitLab alone does not fix them. If compromise is suspected, rotate gitlab-secrets.json, CI variables and runner and access tokens.

The Hacker News →    CybersecurityNews →

A crafted request to the Remote Access SSL VPN service makes the device reload, and no successful login is needed. It is exposed when secondary authentication is configured on a tunnel group, including DefaultWEBVPNGroup. Cisco confirmed exploitation in October 2026 but has not named attackers or victims. This is the second exploited ASA VPN zero-day since August.

Action: Move to the fixed ASA (e.g. 9.20.4.50, 9.22.3.200, 9.24.1.27) and FTD (e.g. 7.4.9, 7.6.7, 10.0.3) releases.

The Hacker News →    KEV tracker (GitHub) →

This low-severity flaw (CVSS 2.7) lets an admin-level attacker perform operations without them being logged. CrowdStrike reports that China-nexus Warp Panda (aka UNC5221/Clay Typhoon) used it as a zero-day in early 2026 against US entities, with the legal sector explicitly targeted. The group got in through edge devices, moved to vCenter, and deployed BRICKSTORM and SharpStorm. Individual victims are not named. The federal deadline is Nov 11.

Action: Apply Broadcom's July fixes (e.g. ESXi80U3j-25429389 or later) and hunt vCenter/ESX for BRICKSTORM.

The Hacker News →    GBHackers →

Cisco Talos says UAT-11473 exploits this CVSS 10.0 bug on SD-WAN Controllers, Managers and Validators to plant KeyDrift (PolyFlame backdoor, LittleFilch key harvester). The malware copies inter-site AES key material. Talos links the infrastructure to Lumen's “Silent Train” network used by Volt Typhoon but stops short of calling them the same group. Targets include space/satellite, defense/aerospace and policy research, and no victims are named. It is not known whether keys were exfiltrated.

Action: Confirm SD-WAN components are patched. Restricting ports 22/830 does not remove existing implants.

The Hacker News →

1. FLDOE – Data breach notice
2. ClickOrlando – Hackers breach Florida Department of Education systems
3. Security Affairs – Hacker leaks data on 40,000+ DHS employees
4. ClickOrlando – Seminole County courthouse, Florida financial aid site report breaches
5. DysruptionHub – Honda dealers face delays after cyber incident
6. Security Affairs – US probes suspected hack behind military base freezer failures
7. The Record – Bankruptcy courts contractor says no data stolen
8. The Hacker News – Attacker tried to exploit Alpine Linux's GitLab
9. CybersecurityNews – CISA warns of exploited GitLab flaw
10. The Hacker News – Cisco patches actively exploited ASA/FTD VPN flaw
11. GitHub KEV tracker – Oct 29 KEV additions
12. The Hacker News – China-linked hackers exploited VMware ESX zero-day
13. GBHackers – CISA adds VMware ESXi logging flaw to KEV
14. The Hacker News – Cisco SD-WAN flaw exploited to plant key-stealing malware