US Cybersecurity Briefing – Thursday, Oct 29, 2026

SAISD told KSAT that its vendor Frontline (Frontline Education, K-12 HR and administrative software) had a breach that involved district data for some employees. The district says no student records were involved. Staff were first told on Oct 6, and Frontline began mailing individual notices Oct 26. Per KXAN's coverage of Austin ISD, which was hit by the same incident, the breach came from a vulnerability in a third-party product Frontline used to build, test and manage software, and it exposed names, Social Security numbers, email addresses and home addresses. Unconfirmed: the number of SAISD staff affected, the threat actor, and the vulnerable product.

Action: Texas districts that use Frontline should confirm with the vendor whether their staff are included and alert payroll/HR to watch for direct-deposit change fraud.

KSAT →    KXAN →

A tracker of the Texas AG's breach portal lists 22 filings dated Oct 28. They include STP Nuclear Operating Company, which runs the South Texas Project nuclear plant near Bay City; CenterPoint Energy of Houston, which filed again after disclosing a breach of more than 1 million Texans earlier in October; and Frontline Education. AG filings cover breaches of personal information. The tracker shows no counts or data types, and the AG portal did not load for verification, so the STP filing's size, cause and data types are unconfirmed. Nothing found so far links it to plant operations. No news coverage of the STP filing was found.

DataBreachRecords →    KPRC Click2Houston →

A hacker calling themselves “Department of Peace” gave DHS personnel records to maia arson crimew, who passed them to DDoSecrets for publication. The records cover about 21,000 CBP staff, about 10,000 at ICE/HSI, just under 1,000 at CISA, and thousands more at HQ and other components. Fields include names, titles, work emails, phone numbers and office locations. The Okta records also show app access and Active Directory group memberships. Some reports say undercover ICE agents are exposed. The hacker claims the data came from DHS's Okta SSO. That is unverified, and Okta says it has no evidence its systems were compromised. TechCrunch says the data appears to have been taken around mid-August and verified part of it.

Action: Expect targeted phishing aimed at DHS/CISA contacts. Treat unexpected messages that cite DHS staff names with caution.

TechCrunch →    Help Net Security →

Israeli firm Dream reports that a suspected China-nexus actor used a custom PHP2Shell exploit for unauthenticated RCE, then the Fragnesia Linux kernel LPE, to get root on 25 firewall servers in the US, Japan, Taiwan and South Korea on Oct 23–24. The firewalls run a “large vendor's” software with PHP 8.0.30. Neither the vendor nor the victims are named; three compromised servers sat in a US government-affiliated environment. The attackers planted web shells and opened reverse SSH tunnels. They also tried to decrypt an LDAP service-account password, ran password spraying, and tried to create backdoor AD accounts; Dream did not confirm whether those attempts worked. Dream also found AI-assisted tooling on the attacker infrastructure.

Action: Inventory appliances and web servers that run PHP. Upgrade to PHP 8.2.35 / 8.3.36 / 8.4.27 or the vendor's fixed firmware, and patch kernels (see below).

The Hacker News →    OffSeq (SecurityWeek summary) →

This attack started before the window; the Oct 28 update is new. UNM Health says it has made no concessions to the hackers, and the FBI is running a forensic investigation. Some staff are still told not to power on their computers. The new group BYOD claims it compromised 36,000 machines, two Oracle databases and two AD forests and stole SSNs, payroll and patient data. UNM says the attack hit some end-user devices but did not penetrate core systems or servers. Impact so far: outpatient surgeries and appointments canceled, ambulances diverted for about two hours, and HSC classes canceled. Whether data was stolen is still unconfirmed.

Albuquerque Journal →    The Register →

After spotting unusual activity, the district shut off internet connectivity as a precaution at 10:20 a.m. Oct 28 and brought in outside forensic specialists. Schools stayed open. Cause, attacker and any data impact are not disclosed.

WDTV →

The FBI Washington Field Office seized virtualine.net, with help from German, Dutch and UK police and from private partners. Virtualine also operated as Secury, Massgod, Spamhouse, Lanedo and Omegatech. It allegedly sold hosting to criminals, laundered customer money, and hosted a CSAM forum.

Help Net Security →

The Ukrainian national was sentenced in a case brought by the Middle District of Florida. The State Department is offering up to $11 million for co-conspirator Tymoshchuk. Victims were hospitals, governments, law firms and an oil-and-gas transportation company; none are named, including any in Texas.

Help Net Security →    The Record →

The flaw lets an ESX administrator run commands that never reach the logs; it gives no access on its own. CrowdStrike reports that the China-nexus group WARP PANDA used it as a zero-day as late as early 2026 to hide activity in vCenter/ESXi environments at US entities, including legal-sector firms. Victims are not named. Fixed in ESXi80U3j-25429389, ESXi-9.0.2.0100-25595025 and ESXi-9.1.0.0-25370933 (VMSA-2026-0006).

Action: Patch ESXi, and don't rely on ESXi shell logs alone when hunting for intrusions on unpatched hosts.

HOL Guard →    GBHackers →

A bug in the XFRM ESP-in-TCP path lets an unprivileged user modify page-cache copies of read-only files, such as /usr/bin/su, to get root. It has been exploited in the wild as the second stage after PHP2Shell (see the firewall item above), and a Metasploit module exists. Ubuntu, RHEL, Debian, openSUSE and CentOS Stream were affected as of Tenable's FAQ; Amazon Linux is not affected. The earlier Dirty Frag kernel patches do NOT fix it.

Action: Apply your distro's kernel update. As a stopgap, blacklist the esp4, esp6 and rxrpc modules.

SecurityOnline →    Tenable →

1. KSAT – San Antonio ISD warns staff of vendor data breach
2. KXAN – Austin ISD staff data compromised after software breach
3. DataBreachRecords – Texas AG breach filings
4. KPRC Click2Houston – CenterPoint breach affects 1M+ Texans
5. TechCrunch – Hacker stole DHS personnel data
6. Help Net Security – DHS staff records leak
7. The Hacker News – PHP2Shell attack roots 25 servers
8. OffSeq – China-linked hackers exploit PHP2Shell to root firewalls
9. Albuquerque Journal – UNM Health has not made concessions
10. The Register – UNM Health Sciences Center attack
11. WDTV – Barbour County Schools potential incident
12. Help Net Security – FBI seizes Virtualine
13. Help Net Security – Ukrainian ransomware hacker sentenced
14. The Record – Nefilim/Hive operator sentenced
15. HOL Guard – CVE-2026-41709 ESXi logging bypass
16. GBHackers – CISA adds ESXi logging flaw to KEV
17. SecurityOnline – CISA adds Linux kernel and ESX flaws to KEV
18. Tenable – Fragnesia CVE-2026-46300 FAQ