This briefing covers 20 cybersecurity and geopolitics stories published around Saturday, October 24, 2026, including activity involving APT28, APT41, PLA, China, Russia, and 2 disclosed vulnerabilities (CVE-2026-110447, CVE-2026-114625). Each entry links to the original reporting.
Russia's APT28 targeted NATO defense firms; separately, Tor exit relays were hijacked, PingCAP source code was stolen, and self-rebuilding macOS ransomware emerged. The NATO targeting signals continued Russian intelligence collection against Western defense industrial base ahead of any potential ceasefire negotiations.
China-linked APT41 deployed a UEFI bootkit called BlackX against diplomatic entities in Tajikistan, Uzbekistan, and Turkmenistan in early 2026, bypassing Secure Boot on patched Windows systems lacking revocation updates.
Microsoft Threat Intelligence found LiteLLM version 1.107.0 was backdoored using Python startup hooks to steal credentials and execute remotely loaded code. Targeting a widely used AI model-routing library signals adversaries are pivoting to AI-stack supply chains as a high-yield vector.
China and Pakistan held Karakoram 2026 joint military training exercises in Xinjiang amid a deteriorating regional security environment. The drills deepen PLA-Pakistani Army interoperability as both nations face compounding threats from Afghan instability and regional militant activity.
Xi Jinping has independent incentives to block a formal US-China-Russia trilateral summit, as it would force Beijing to publicly align or distance itself from Moscow on Ukraine. A formal trilateral risks exposing Chinese equities to European sanctions pressure and undercutting Beijing's cultivated ambiguity.
Analysis of Taiwan's formal diplomatic relationships in Africa and Latin America finds recognition decisions are primarily political, not driven by Taipei's financial assistance packages. The finding undermines the 'dollar diplomacy' framing Beijing uses to delegitimize Taiwan's remaining alliances.
Analysts argue Xi Jinping's sweeping PLA purges have paradoxically made US deterrence more urgent by creating unpredictable command dynamics inside China's military.
Britain's government proposes replacing the Submarine Telegraph Act 1885—capped at £1,000 fine and 5 years—with legislation carrying 14-year sentences for deliberate cable damage. The move reflects NATO-wide alarm over Russian and other state-linked sabotage of critical subsea infrastructure.
Analysis warns that a concluded South China Sea Code of Conduct lacking binding enforcement mechanisms will not constrain Chinese maritime assertiveness against ASEAN claimants. A toothless COC risks legitimizing the status quo while providing diplomatic cover for continued coercion.
Tencent launched TenPayGo to let foreign users access Chinese digital payments without domestic bank accounts, lowering friction without altering underlying data and regulatory architecture. The app extends China's digital ecosystem reach internationally while keeping foreign users inside surveilled infrastructure.
A South Korean official comment on the Ukraine-Russia conflict triggered a diplomatic spat, highlighting Seoul's precarious balancing act between Western alliance commitments and regional pressures. The episode exposes the limits of South Korea's strategic ambiguity as great-power competition intensifies.
China's climate engagement with Africa is pivoting from aid-based initiatives to investment-driven industrial partnerships, deepening economic integration under a green framing.
The FCC prohibited a wireless video transmitter and dashboard camera built on chips from Huawei subsidiary HiSilicon, which explicitly markets its products for surveillance applications. The ban extends the US hardware exclusion campaign beyond Huawei-branded gear to its chip-level supply chain.
Exposed infrastructure reveals Russian-speaking affiliates of INC and The Gentlemen ransomware groups running an AI-driven intrusion platform called Phantom, operating as a full autonomous red-team kill chain.
Threat actors are using AI voice tools to impersonate employees and socially engineer help-desk staff into granting access, bypassing technical controls entirely. The shift strips defenders of malware-based detection signals and exposes identity-verification gaps as the decisive attack surface.
An unauthorized threat actor accessed Quest Diagnostics' Quanum LSM platform, compromising patient medical records held by one of the largest US clinical lab networks. Healthcare data breaches carry compounding risk: records fuel identity fraud and can be leveraged for targeted extortion.
Chinese-linked threat actors deployed agentic AI tooling in a cloud supply chain attack, while PHP issued warnings on two critical remote code execution vulnerabilities. The supply chain vector combined with autonomous AI execution lowers the barrier for large-scale downstream compromise.
CISA added CVE-2026-114625, a SQL injection flaw in Arista VeloCloud Orchestrator on-premises deployments, to its Known Exploited Vulnerabilities catalog, allowing remote attackers full orchestrator compromise.
CISA flagged CVE-2026-110447, an OS command injection flaw in Collabora Online's built-in CODE server within NextCloud deployments, enabling remote code execution when the CODE server is offline.
CISA added CVE-2026-110447 (CVSS 9.2, Collabora Online Built-in CODE Server) and a critical Arista VeloCloud Orchestrator flaw to its KEV catalog amid confirmed in-the-wild exploitation. VeloCloud's role in enterprise SD-WAN makes it a high-value pivot point for network-layer intrusions.