A honeypot operator reports exploratory attacks on CVE-2026-101767. There is no confirmed breach yet, but internet-facing EBS should be patched first.
This article is not yet available in your language; it is shown in English.
Threat-intelligence firm Defused reported on 27 October 2026 that its decoy systems received exploratory exploit attempts against CVE-2026-101767, a remote-code-execution flaw in Oracle E-Business Suite.
So far this is the only public report: it shows attackers are probing for the bug, not that organisations have been breached or that a wide campaign is under way. Oracle EBS has been a target of data-theft campaigns before, so early probing is worth taking seriously.
The two PHP core flaws fixed on 21 October are now in CISA's Known Exploited Vulnerabilities catalog, and JPCERT/CC reports public exploit code and attack traffic.
Ivanti has patched the last flaw in a zero-day chain used to get root on fully patched Connect Secure VPNs. The October fixes did not cover it; CISA listed it as exploited on 30 October.
Binance now puts the 29 October theft at about $6.3 billion and says a compromised DevOps engineer's laptop may have let the attacker reach a service container and submit withdrawals. About $3 billion is frozen; the full cause is not yet confirmed.