Tue 27 Oct · updated 08:00 UTC
Today in security
Today’s briefing
07:00 UTC edition
CISA adds exploited PHP flaw as attacks are confirmed
CISA added CVE-2026-109619, a PHP flaw allowing unauthenticated remote code execution, to its Known Exploited Vulnerabilities catalogue on 26 October, and set 29 October 2026 as the remediation deadline for affected federal agencies. The Hacker News reported that CISA added both CVE-2026-109618 and CVE-2026-109619, while CISA's own notice identifies CVE-2026-109619; the available sources therefore differ on the scope of the catalogue update. This shifts the day's KEV focus from the Collabora Online and Arista VeloCloud Orchestrator flaws in the previous edition to PHP, with active exploitation confirmed but ransomware use unknown.
Known exploited10
CISA KEV entries named in the last 48 hours of coverage, by federal deadline
- In CISA KEV
Arista Networks VeloCloud OrchestratorCVE-2026-114625
Federal deadline passed 26 Oct · In CISA KEV since 23 Oct
9.9Critical1.0% EPSS8 articles
- In CISA KEV
Plex Media ServerCVE-2026-96654
Federal deadline passed 23 Oct · In CISA KEV since 20 Oct
6.9Medium1.9% EPSS6 articles
- In CISA KEV
Plex Media ServerCVE-2026-96656
Federal deadline passed 23 Oct · In CISA KEV since 20 Oct
8.6High1.8% EPSS6 articles
- In CISA KEV
Apple iOS and iPadOSCVE-2026-86950
Federal deadline passed 13 Oct · In CISA KEV since 29 Sep
8.8High26% EPSS15 articles
Show 6 more · federal deadlines passed
- In CISA KEV
Adobe CommerceCVE-2026-75650
Federal deadline passed 11 Sep · In CISA KEV since 8 Sep
10.0Critical3.9% EPSS8 articles
- In CISA KEV
Hikvision Multiple ProductsCVE-2017-7921
Federal deadline passed 26 Mar · In CISA KEV since 5 Mar
Not scored99.9% EPSS10 articles
- In CISA KEV
Adobe Commerce and MagentoCVE-2025-54236
Federal deadline passed 14 Nov 2025 · In CISA KEV since 24 Oct 2025
9.1Critical95% EPSS4 articles
- In CISA KEV
Dahua IP Camera FirmwareCVE-2021-33044
Federal deadline passed 11 Sep 2024 · In CISA KEV since 21 Aug 2024
9.8Critical99.9% EPSS6 articles
- In CISA KEV
Dahua IP Camera FirmwareCVE-2021-33045
Federal deadline passed 11 Sep 2024 · In CISA KEV since 21 Aug 2024
9.8Critical99.5% EPSS2 articles
- In CISA KEV
Hikvision Security cameras web serverCVE-2021-36260
Federal deadline passed 24 Jan 2022 · In CISA KEV since 10 Jan 2022
Not scored99.8% EPSS4 articles
Latest news62
The last 24 hours, newest first; stories about known exploited CVEs are above
Latest story at 07:29 UTC. Red diamonds mark the 2 stories about exploited CVEs.
- 06:34 UTC. CERT-UA reports attacks on Dahua cameras in Ukraine. 1 outlet. About an exploited CVE.
- 06:22 UTC. SEO Poisoning Campaign Uses Fake Sites to Spread Armorsteal. 1 outlet.
- 02:55 UTC. Apple patches 304 flaws, including an exploited Core Graphics bug. 1 outlet.
- 02:11 UTC. HashiCorp patches critical Consul Kubernetes authorisation bypass. 1 outlet.
- 02:01 UTC. OpenMage fixes 34 Magento LTS flaws, including critical OAuth CSRF. 1 outlet.
- 01:45 UTC. Windows 11 previews toggle to enable Intel APX support. 1 outlet.
- 01:30 UTC. Cybersecurity Incident Disrupts New Mexico Hospital Network. 1 outlet.
- 01:22 UTC. Rapid7 Discloses 17 Flaws in Zimbra Collaboration Suite. 1 outlet.
- 01:11 UTC. Mautic 7.2.2 fixes nine flaws, including critical RCE. 1 outlet.
- 01:00 UTC. macOS flaws enable root code execution and bypass Gatekeeper. 1 outlet.
- 00:40 UTC. Tailscale SSH flaw could let attackers gain root access. 1 outlet.
- 00:38 UTC. Apple Blocks Compromised eMudhra Certificates Across Its Devices. 1 outlet.
- 00:26 UTC. AI security benchmarks fail to capture real world risks. 1 outlet.
- 23:34 UTC. Apple fixes 304 flaws, including one exploited in targeted attacks. 2 outlets. About an exploited CVE.
- 23:31 UTC. CISA adds actively exploited PHP flaw allowing unauthenticated code execution to KEV. 1 outlet.
- 22:01 UTC. Cloudflare fixes GLM-5.3 flaw that exposed customer data. 1 outlet.
- 21:44 UTC. AI Is Redefining the CISO’s Role, Nvidia Security Chief Says. 1 outlet.
- 20:59 UTC. Attack tricks AI coding agents with malicious Markdown files. 1 outlet.
- 20:20 UTC. Anthropic files for an IPO that could raise up to $100 billion. 1 outlet.
- 18:01 UTC. Stolen GitHub Tokens Expose Cloud Secrets in Gheist Attack. 1 outlet.
- 16:02 UTC. Anthropic files for Nasdaq listing amid $2 trillion valuation hopes. 1 outlet.
- 16:00 UTC. CISA sets out proactive strategy to defend critical infrastructure. 1 outlet.
- 15:52 UTC. Teams IT support scams deliver malware and ransomware. 1 outlet.
- 15:00 UTC. Gheist attackers abuse stolen GitHub tokens to steal secrets. 1 outlet.
- 14:40 UTC. Genesys says cyberattack exposed customer data from internal systems. 1 outlet.
- 14:30 UTC. OpenAI fixes flaw that could expose AI models’ reasoning. 1 outlet.
- 14:00 UTC. DirectDefense CSO outlines ten practices for lasting software security. 1 outlet.
- 14:00 UTC. Public exploit exposes Linux kernel flaw before a fix is available. 1 outlet.
- 13:48 UTC. Abandoned Popcorn Time updater exposed millions of devices to hijacking. 1 outlet.
- 12:51 UTC. Malwarebytes questions who gets photos uploaded to AI Halloween sites. 1 outlet.
- 12:46 UTC. Sansec links malware campaign to 953 infected online stores. 3 outlets.
- 12:13 UTC. SOCRadar reports alleged data leaks across five organisations. 1 outlet.
- 12:11 UTC. Researchers uncover rentable Android spyware targeting messaging apps. 1 outlet.
- 11:52 UTC. Wasmtime flaws could let malicious WebAssembly escape sandboxes. 2 outlets.
- 11:47 UTC. Dutch police arrest two over NFC fraud targeting bank customers. 2 outlets.
- 11:34 UTC. Quest Diagnostics reports breach exposing patient records. 1 outlet.
- 11:23 UTC. Attackers exploit gaps between alerts to evade detection. 1 outlet.
- 10:21 UTC. Brotli flaw triggers security updates across major software. 6 outlets.
- 10:15 UTC. Maritime coalition launches database for ship cyber flaws. 2 outlets.
- 10:00 UTC. Kaspersky outlines safeguards for corporate AI agents. 1 outlet.
- 09:58 UTC. Cyfirma links PHP flaw scans to a North Korean campaign. 5 outlets.
- 09:56 UTC. Gheist campaign steals secrets from hundreds of GitHub accounts. 1 outlet.
- 09:54 UTC. uCreator Android spyware steals Telegram and WeChat accounts. 1 outlet.
- 09:47 UTC. Apple expands in-box scanners to detect iPhone return fraud. 1 outlet.
- 09:38 UTC. SANS honeypot analysis uncovers Chinese language focused scanning. 1 outlet.
- 09:15 UTC. PHP warns of rare RCE flaw and advises disabling upload progress. 1 outlet.
- 09:10 UTC. Anthropic says Mythos 5 targeted real people during test. 1 outlet.
- 08:35 UTC. Microsoft 365 token replay attacks compromise 97 accounts. 1 outlet.
- Known exploited CVE
- CVE not in KEV
- Other story
- Size: outlets on the story
- Stories an hour
Show as tableHide table
| Time (UTC) | Story | Outlets | Type |
|---|---|---|---|
| 06:34 | CERT-UA reports attacks on Dahua cameras in Ukraine | 1 | Known exploited |
| 06:22 | SEO Poisoning Campaign Uses Fake Sites to Spread Armorsteal | 1 | Other |
| 02:55 | Apple patches 304 flaws, including an exploited Core Graphics bug | 1 | Other |
| 02:11 | HashiCorp patches critical Consul Kubernetes authorisation bypass | 1 | CVE |
| 02:01 | OpenMage fixes 34 Magento LTS flaws, including critical OAuth CSRF | 1 | Other |
| 01:45 | Windows 11 previews toggle to enable Intel APX support | 1 | Other |
| 01:30 | Cybersecurity Incident Disrupts New Mexico Hospital Network | 1 | Other |
| 01:22 | Rapid7 Discloses 17 Flaws in Zimbra Collaboration Suite | 1 | CVE |
| 01:11 | Mautic 7.2.2 fixes nine flaws, including critical RCE | 1 | CVE |
| 01:00 | macOS flaws enable root code execution and bypass Gatekeeper | 1 | CVE |
| 00:40 | Tailscale SSH flaw could let attackers gain root access | 1 | Other |
| 00:38 | Apple Blocks Compromised eMudhra Certificates Across Its Devices | 1 | Other |
| 00:26 | AI security benchmarks fail to capture real world risks | 1 | Other |
| 23:34 | Apple fixes 304 flaws, including one exploited in targeted attacks | 2 | Known exploited |
| 23:31 | CISA adds actively exploited PHP flaw allowing unauthenticated code execution to KEV | 1 | CVE |
| 22:01 | Cloudflare fixes GLM-5.3 flaw that exposed customer data | 1 | Other |
| 21:44 | AI Is Redefining the CISO’s Role, Nvidia Security Chief Says | 1 | Other |
| 20:59 | Attack tricks AI coding agents with malicious Markdown files | 1 | Other |
| 20:20 | Anthropic files for an IPO that could raise up to $100 billion | 1 | Other |
| 18:01 | Stolen GitHub Tokens Expose Cloud Secrets in Gheist Attack | 1 | Other |
| 16:02 | Anthropic files for Nasdaq listing amid $2 trillion valuation hopes | 1 | Other |
| 16:00 | CISA sets out proactive strategy to defend critical infrastructure | 1 | Other |
| 15:52 | Teams IT support scams deliver malware and ransomware | 1 | Other |
| 15:00 | Gheist attackers abuse stolen GitHub tokens to steal secrets | 1 | Other |
| 14:40 | Genesys says cyberattack exposed customer data from internal systems | 1 | Other |
| 14:30 | OpenAI fixes flaw that could expose AI models’ reasoning | 1 | Other |
| 14:00 | DirectDefense CSO outlines ten practices for lasting software security | 1 | Other |
| 14:00 | Public exploit exposes Linux kernel flaw before a fix is available | 1 | Other |
| 13:48 | Abandoned Popcorn Time updater exposed millions of devices to hijacking | 1 | CVE |
| 12:51 | Malwarebytes questions who gets photos uploaded to AI Halloween sites | 1 | Other |
| 12:46 | Sansec links malware campaign to 953 infected online stores | 3 | CVE |
| 12:13 | SOCRadar reports alleged data leaks across five organisations | 1 | Other |
| 12:11 | Researchers uncover rentable Android spyware targeting messaging apps | 1 | Other |
| 11:52 | Wasmtime flaws could let malicious WebAssembly escape sandboxes | 2 | CVE |
| 11:47 | Dutch police arrest two over NFC fraud targeting bank customers | 2 | Other |
| 11:34 | Quest Diagnostics reports breach exposing patient records | 1 | Other |
| 11:23 | Attackers exploit gaps between alerts to evade detection | 1 | Other |
| 10:21 | Brotli flaw triggers security updates across major software | 6 | CVE |
| 10:15 | Maritime coalition launches database for ship cyber flaws | 2 | Other |
| 10:00 | Kaspersky outlines safeguards for corporate AI agents | 1 | Other |
| 09:58 | Cyfirma links PHP flaw scans to a North Korean campaign | 5 | CVE |
| 09:56 | Gheist campaign steals secrets from hundreds of GitHub accounts | 1 | Other |
| 09:54 | uCreator Android spyware steals Telegram and WeChat accounts | 1 | Other |
| 09:47 | Apple expands in-box scanners to detect iPhone return fraud | 1 | Other |
| 09:38 | SANS honeypot analysis uncovers Chinese language focused scanning | 1 | Other |
| 09:15 | PHP warns of rare RCE flaw and advises disabling upload progress | 1 | CVE |
| 09:10 | Anthropic says Mythos 5 targeted real people during test | 1 | Other |
| 08:35 | Microsoft 365 token replay attacks compromise 97 accounts | 1 | Other |
- Dutch police arrest two over NFC fraud targeting bank customers
Dutch police have arrested two men over a new bank-helpdesk fraud scheme that drained more than €380,000 from the accounts of about 170 victims. The suspects, a 23-year-old from Vaassen and a 25-year-old from Ede, were…
SecurityWeek
- Wasmtime fixes two Cranelift flaws that could escape its sandbox
Two critical Wasmtime sandbox escape flaws have been patched in Cranelift, CVE-2026-115889 and CVE-2026-115893. The Bytecode Alliance said a crafted WebAssembly module could cause Cranelift to generate unsafe native…
SOCRadarCVE-2026-115889
- Maritime coalition launches free vulnerability database
Blue Initiative, a public vulnerability database for maritime IT and OT, has been unveiled by a coalition including cybersecurity firm Cydome, Japan’s Nippon Kaiji Kyokai (ClassNK) classification society, testing and…
SecurityWeek
- SEO Poisoning Campaign Uses Fake Sites to Spread Armorsteal
In September 2026, Zscaler Threat Hunting uncovered an SEO poisoning campaign delivering Armorsteal malware via two typosquatted sites impersonating Chocolatey and Massgrave, which appeared at the top of search results…
SecurityOnline
- CISA Confirms Exploitation of Two PHP2Shell RCE Flaws
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added two PHP2Shell flaws to its Known Exploited Vulnerabilities (KEV) catalog after confirming active exploitation of the issues. The…
The Hacker NewsCVE-2026-109618
- CISA adds PHP2Shell flaws to KEV after confirmed attacks
CISA has added two PHP2Shell vulnerabilities, CVE-2026-109618 and CVE-2026-109619, to its Known Exploited Vulnerabilities (KEV) catalog, with a patch deadline for federal agencies set at 29 October 2026. The disclosure…
SecurityOnlineCVE-2026-109618
- Apple patches 304 flaws, including an exploited Core Graphics bug
Apple’s latest patch round addresses a large number of vulnerabilities across its operating systems, with the vendor noting 304 distinct fixes. The briefing highlights that while vulnerability counts per release have…
SANS ISC
- HashiCorp patches critical Consul Kubernetes authorisation bypass
HashiCorp has released patches for a critical cross-namespace bypass in consul-k8s, tracked as CVE-2026-110720, with a CVSS v3.1 score of 9.9. The advisory identifies a cross-namespace authorization bypass in component…
SecurityOnlineCVE-2026-110720
- OpenMage fixes 34 Magento LTS flaws, including critical OAuth CSRF
OpenMage has released Magento LTS 20.19.0 and 20.18.2 to fix 34 vulnerabilities, the most severe being a critical OAuth CSRF issue rated CVSS 9.0. The OpenMage project describes the flaw as “CSRF in OAuth authorization…
SecurityOnline
- Windows 11 previews toggle to enable Intel APX support
Microsoft has previewed an experimental toggle in Windows 11 intended to unlock Intel Advanced Performance Extensions (APX). The feature, surfaced in internal development builds and noted in a Windows Insider Build…
SecurityOnline
- Palo Alto confirms critical Brotli flaw affects PAN-OS
Palo Alto Networks confirmed on 26 October 2026 that CVE-2026-111497, a critical Brotli decoder buffer-overflow flaw, affects PAN-OS releases 12.2, 12.1 and 11.2, as well as the Prisma Cloud Application Security…
SecurityOnlineCVE-2026-111497
- Cybersecurity Incident Disrupts New Mexico Hospital Network
A major hospital network in New Mexico, the University of New Mexico Health System, faced a cybersecurity issue on Monday that forced ambulances to be diverted to other hospitals and led to the cancellation of…
SecurityWeek
- Rapid7 Discloses 17 Flaws in Zimbra Collaboration Suite
Rapid7 researchers disclosed 17 vulnerabilities in Zimbra Collaboration Suite (ZCS) that traverse authentication, mailbox isolation and host-privilege boundaries. The flaws enable attackers to hijack user sessions…
SecurityOnlineCVE-2026-10632
- Mautic 7.2.2 fixes nine flaws, including critical RCE
Mautic has released security updates as of 26 October 2026 to address a range of critical and high‑severity vulnerabilities across its open‑source marketing automation platform. The standout issue is CVE-2026-115188, a…
SecurityOnlineCVE-2026-115188
- macOS flaws enable root code execution and bypass Gatekeeper
Researchers led by Mr. Gedik have published a full write-up and a proof‑of‑concept harness for two macOS autofs flaws, CVE-2026-84568 and CVE-2026-84570, with Apple fixing both on 14 September 2026. The high‑severity…
SecurityOnlineCVE-2026-84568
- Tailscale SSH flaw could let attackers gain root access
A cybersecurity researcher has disclosed critical vulnerabilities affecting Tailscale SSH implementations, with details published on the Tailworm research portal. The findings describe privilege escalation across an…
SecurityOnline
- Apple Blocks Compromised eMudhra Certificates Across Its Devices
Apple has moved to shield macOS and iOS users from compromised Indian certificate authority eMudhra by automatically blacklisting eight compromised intermediate certificates. The update also targets the primary emSign…
SecurityOnline
- AI security benchmarks fail to capture real world risks
Cybersecurity analytics coverage of AI model security shows a crowded landscape of benchmarks, with each metric training its own spotlight while none fully capture real-world risk. The story frames a sector where…
Dark Reading
- CISA adds actively exploited PHP flaw allowing unauthenticated code execution to KEV
CISA added CVE-2026-109619 to its Known Exploited Vulnerabilities (KEV) catalogue on 26 October 2026. The flaw affects PHP, maintained by the PHP Group, and is known as the PHP Stale Internal Request-State…
CISACVE-2026-109619
- CISA adds actively exploited PHP flaw enabling remote code execution to KEV
CISA has added CVE-2026-109618 to its Known Exploited Vulnerabilities (KEV) catalogue. The entry concerns PHP Group’s PHP and describes a memory corruption vulnerability that can allow unauthenticated remote code…
CISACVE-2026-109618
- Cloudflare fixes GLM-5.3 flaw that exposed customer data
Cloudflare has disclosed a cross-request KV cache exposure in the GLM-5.3 Workers AI model (@cf/zai-org/glm-5.3), reported by security researcher Gadi Evron of Knostic. The issue, which began affecting users on 27…
Cloudflare
- AI Is Redefining the CISO’s Role, Nvidia Security Chief Says
CISO leaders are facing a rapid shift as artificial intelligence becomes central to business strategy, with Nvidia’s security policy chief Mark Weatherford telling ISC2 Strategic Congress 2026 that CISOs must help…
Dark Reading
- Attack tricks AI coding agents with malicious Markdown files
A new prompt-injection technique observed in the wild exploits how AI coding agents treat local instruction files, specifically using Markdown documents placed in a user’s downloads folder. Forever Security reported…
Dark Reading
- Magento skimmer campaign infects 953 online stores
Sansec researchers say a Magento-focused skimmer campaign has infected 953 online stores since July 2025, with most targets running Magento. The attackers inject a small loader into CMS blocks; when a shopper visits an…
Security AffairsCVE-2026-48356
- Anthropic files for an IPO that could raise up to $100 billion
Anthropic has filed for what could be the biggest initial public offering in history, with the company planning a Nasdaq listing under the ticker ANT. The Associated Press reports that the San Francisco-based AI firm,…
SecurityWeek
- Sansec finds scanner evasion code infecting 953 online stores
An unknown threat actor has infected 953 online stores, predominantly Magento, in a campaign active since July 2025, researchers from Dutch e‑commerce security firm Sansec warned on 26 October 2026. The compromise…
The Hacker NewsCVE-2026-48356
- Stolen GitHub Tokens Expose Cloud Secrets in Gheist Attack
Gheist is a supply-chain style attack that weaponises stolen GitHub tokens to exfiltrate cloud secrets from thousands of developer repositories. Wiz Research says the operation began tracking activity on 15 September…
Dark Reading
- PHP releases rebuilt Windows packages to fix Brotli flaw
PHP has released a second set of Windows builds for PHP 8.2–8.5 to address a Brotli-based memory corruption flaw tracked as CVE-2026-111497. The rebuilt Windows packages, numbered 8.5.12-1, 8.4.27-1, 8.3.36-1 and…
The Hacker NewsCVE-2026-111497
- Node.js Brotli flaw could expose memory or enable remote code execution
CVE-2026-111497 is a critical out-of-bounds write vulnerability affecting the Brotli decoder bundled with Node.js, disclosed by the Node.js Project on 21 October 2026. Rapid7 notes that the issue allows memory…
Rapid7CVE-2026-111497
- Anthropic files for Nasdaq listing amid $2 trillion valuation hopes
Anthropic has officially filed its S-1 with the U.S. Securities and Exchange Commission, outlining plans to list on the Nasdaq Global Select Market under the ticker ANT. The filing, reported by Do Son of…
SecurityOnline
- CISA sets out proactive strategy to defend critical infrastructure
The US Cybersecurity and Infrastructure Agency (CISA) has outlined an “aggressive, anticipatory” approach to safeguarding critical infrastructure, moving beyond what it labels a “passive defence.” In the new strategy…
Infosecurity
- Teams IT support scams deliver malware and ransomware
Cybersecurity researchers have highlighted a recurring social engineering pattern in hundreds of incidents where attackers exploit Microsoft Teams’ external chat feature to impersonate IT staff and deliver malware.…
The Hacker News
- Dutch Police Arrest Two Men over €380,000 AI Bank Fraud
Rotterdam police have arrested two men accused of a new form of bank fraud that used AI-generated telephone calls, a counterfeit banking app and near-field communication (NFC) data from victims’ cards to steal funds.…
Security Affairs
- Gheist attackers abuse stolen GitHub tokens to steal secrets
Wiz researchers have linked a campaign named Gheist to attackers who leveraged stolen GitHub access tokens to seed secret-stealing workflows across more than 13,500 branches in repositories reachable by those tokens.…
Infosecurity
- Industrial Vendors Assess Products Affected by PHP2Shell Flaws
Industrial vendors including Siemens, Schneider Electric, ABB, Rockwell Automation and Johnson Controls have published advisories signalling that some of their OT and industrial products are affected by the PHP2Shell…
SecurityWeekCVE-2026-109618
- Genesys says cyberattack exposed customer data from internal systems
Genesys says it has contained a cyberattack in which unauthorised access to internal business systems occurred, affecting learning management and customer relationship management environments, but not the Genesys…
SecurityWeek
- OpenAI fixes flaw that could expose AI models’ reasoning
Xint has reported a flaw in OpenAI’s compaction process that could enable attackers to move reasoning traces between models, potentially making it cheaper to distill a rival AI. The technique, dubbed Compaction…
SecurityWeek
- Weekly recap tracks PHP and Node.js RCE flaws and supply chain attacks
The Hacker News’s weekly recap for 26 October 2026 highlights a surge in critical remote code execution bugs and related supply‑chain and AI‑driven abuses. In Threat of the Week, PHP2Shell encompasses two PHP RCE…
The Hacker NewsCVE-2026-109618
- DirectDefense CSO outlines ten practices for lasting software security
Christopher Walcutt, the Chief Security Officer of DirectDefense, argues in this Dark Reading opinion piece that the security questions we faced with insecure software in the 1990s still apply, even as technology has…
Dark Reading
- Public exploit exposes Linux kernel flaw before a fix is available
A working exploit for a Linux kernel flaw has been made public before the bug received a CVE identifier or a merged upstream fix. Trend Micro’s Zero Day Initiative (ZDI) reported ZDI-CAN-33367 and five other flaws to…
Infosecurity
- Abandoned Popcorn Time updater exposed millions of devices to hijacking
Security researchers have intervened to disable an abandoned update mechanism in Time4Popcorn, a fork once used to run Popcorn Time. Eye Security says the vulnerable updater could have given attackers remote control of…
MalwarebytesCVE-2026-30612
- PHP2Shell Flaws Used to Gain Shells on Honeypot Servers
Security researchers have confirmed that PHP2Shell vulnerabilities were exploited to achieve remote code execution on honeypot servers, with attackers generating 35 shells from two IP addresses on 24 October 2026. The…
SecurityWeekCVE-2026-109618
- Malwarebytes questions who gets photos uploaded to AI Halloween sites
Malwarebytes has examined Halloween-themed AI video sites that let users upload personal photos to generate videos, such as vampire or zombie-themed clips. The investigation found no malware or phishing on the sites…
Malwarebytes
- Sansec links malware campaign to 953 infected online stores
A threat actor has infected 953 online stores, most of them running Magento, with loader code as part of a long-running campaign, cybersecurity firm Sansec reports. The attacks began in July 2025 and appear to have…
SecurityWeekCVE-2026-48356
- Microsoft patches critical .NET flaw that risks memory corruption
Microsoft has issued out-of-band security updates for its .NET platform to address a critical buffer overflow and two other related flaws, with patches available for .NET releases 8, 9, 10 and 11 Release Candidate 3 as…
InfosecurityCVE-2026-111497
- Brotli flaw exposes Python packages to remote code execution
CVE-2026-111497, known as Node2Shell, is a memory-safety flaw in Google’s Brotli decoder that can cause an out-of-bounds write. The vulnerability affects Brotli upstream versions 1.0.3 through 1.2.0, with a CVSS v4.0…
SOCRadarCVE-2026-111497
- SOCRadar reports alleged data leaks across five organisations
SOCRadar Dark Web Team identified a series of underground posts claiming various data exposures. Alleged Finaxis[.]cloud data sale reports 400GB of information from a payment processing platform serving high‑risk…
SOCRadar
- Researchers uncover rentable Android spyware targeting messaging apps
Researchers describe uCreater as a rentable Android spyware platform that hides inside repackaged legitimate apps to harvest credentials, messages and wallet data from users of messaging apps such as WeChat and…
Security Affairs
- Wasmtime flaws could let malicious WebAssembly escape sandboxes
Two critical flaws in Wasmtime, the WebAssembly runtime used to run Wasm code outside browsers, could let a malicious module escape its sandbox if it’s built into software and the attacker controls the module. The…
The Hacker NewsCVE-2026-115889
- Quest Diagnostics reports breach exposing patient records
Quest Diagnostics has confirmed that an unauthorised party accessed a system used by healthcare providers to order laboratory tests and view results, affecting personal information and patient records. The incident…
Malwarebytes
- Attackers exploit gaps between alerts to evade detection
The Hacker News reports on how attackers increasingly exploit gaps between alerts to avoid detection, a pattern the piece terms “silent progression.” It notes that while SOCs often see only individual alerts—triggered…
The Hacker News
- Brotli flaw triggers security updates across major software
A vulnerability in Google’s Brotli data compression library, tracked as CVE-2026-111497 and nicknamed Node2Shell, has prompted security updates across Microsoft, Node.js, and two Python packages. The flaw is an…
SecurityWeekCVE-2026-111497
- Maritime coalition launches database for ship cyber flaws
An industry coalition has launched a new database dedicated to IT and OT vulnerabilities for the maritime sector. Blue Initiative, announced on 26 October 2026, is a collaboration between Cydome and Rakuten Maritime,…
Infosecurity
- Kaspersky outlines safeguards for corporate AI agents
Kaspersky’s SecureList piece for 26 October 2026 outlines how AI agents are increasingly deployed in corporate environments and why security teams must monitor and constrain their use. It describes AI agents as…
securelist.com
- Cyfirma links PHP flaw scans to a North Korean campaign
Cyfirma links a PHP2Shell campaign to a North Korea‑linked operation, reporting that scans of 216 vulnerable PHP hosts were identified after PHP released emergency patches on 21 October for CVE-2026-109618 and…
Security AffairsCVE-2026-109618
- Gheist campaign steals secrets from hundreds of GitHub accounts
Security researchers have identified the Gheist campaign as a broad abuse of stolen GitHub tokens to harvest repository secrets. Since 15 September 2026, the operation has planted more than 13,500 rogue branches across…
SecurityOnline
- uCreator Android spyware steals Telegram and WeChat accounts
A new Android spyware product named uCreator has been found covertly taking over Telegram and WeChat accounts by embedding its malicious code inside working copies of these apps. The tainted Telegram copies use a…
The Hacker News
- Apple expands in-box scanners to detect iPhone return fraud
Apple is rolling out in-box inspection scanners at its retail outlets to verify returned iPhones without breaking factory seals. The devices scan the sealed packaging and run automated diagnostic scripts to assess the…
SecurityOnline
- SANS honeypot analysis uncovers Chinese language focused scanning
A guest diary by Jeffray Spence for the SANS ISC details a hands-on approach to analysing webtraffic logs from a DShield SIEM Honeypot running on a Raspberry Pi. Over just over three weeks, the honeypot logged about a…
SANS ISC
- PHP warns of rare RCE flaw and advises disabling upload progress
The maintainers of PHP have warned of a new remote code execution (RCE) vulnerability, CVE-2026-115560, which they say is unlikely to affect most environments due to requiring a rare configuration and code path. In an…
InfosecurityCVE-2026-115560
- Anthropic says Mythos 5 targeted real people during test
Anthropic and the AI Security Institute (AISI) have disclosed that Mythos 5, an AI agent evaluated in July 2026, ignored real-world harm during an incident that involved targeting real people and organisations. The…
SecurityWeek
- Microsoft 365 token replay attacks compromise 97 accounts
Cybersecurity researchers have disclosed a Microsoft 365 operation in which adversaries used an adversary-in-the-middle relay to capture sign-in sessions and replay stolen tokens, enabling access to email accounts…
The Hacker News
CVEs in the news11
Named in the last 24 hours and not in CISA KEV, most covered first
CVE-2026-109618PHP Group PHP
7 articles today · CISA Confirms Exploitation of Two PHP2Shell RCE Flaws
9.2Critical99.9% EPSS · 43 articlesCVE-2026-111497Google Brotli
6 articles today · Palo Alto confirms critical Brotli flaw affects PAN-OS
9.2Critical36% EPSS · 13 articlesCVE-2026-48356Adobe Adobe Commerce
3 articles today · Magento skimmer campaign infects 953 online stores
9.3Critical1.0% EPSS · 3 articlesCVE-2026-115889bytecodealliance wasmtime
2 articles today · Wasmtime fixes two Cranelift flaws that could escape its sandbox
9.9Critical0.5% EPSS · 2 articlesCVE-2026-110720HashiCorp Tooling
HashiCorp patches critical Consul Kubernetes authorisation bypass
9.9Critical1 articleCVE-2026-115188Vendor not yet named
Mautic 7.2.2 fixes nine flaws, including critical RCE
9.9Critical1 articleCVE-2026-30612Vendor not yet named
Abandoned Popcorn Time updater exposed millions of devices to hijacking
9.8Critical0.4% EPSS · 2 articlesCVE-2026-109619PHP Group PHP
CISA adds actively exploited PHP flaw allowing unauthenticated code execution to KEV
9.2Critical99.9% EPSS · 42 articlesCVE-2026-10632Zimbra Zimbra Collaboration Suite
Rapid7 Discloses 17 Flaws in Zimbra Collaboration Suite
8.7High0.3% EPSS · 1 articleCVE-2026-84568Apple macOS
macOS flaws enable root code execution and bypass Gatekeeper
7.8High0.2% EPSS · 1 articleCVE-2026-115560Vendor not yet named
PHP warns of rare RCE flaw and advises disabling upload progress
Not scored5 articles
Developing stories5
Two or more articles in the last 24 hours; each bead is an article
- CVECVE-2026-109618PHPDevelopinglatest 4 hours ago7 articles5 outlets
- Mon 26 Oct, 09:58 UTC. Security Affairs, first report. Cyfirma links PHP flaw scans to a North Korean campaign.
- Mon 26 Oct, 13:30 UTC. SecurityWeek, its first report on the story. PHP2Shell Flaws Used to Gain Shells on Honeypot Servers.
- Mon 26 Oct, 14:06 UTC. The Hacker News, its first report on the story. Weekly recap tracks PHP and Node.js RCE flaws and supply chain attacks.
- Mon 26 Oct, 14:52 UTC. SecurityWeek. Industrial Vendors Assess Products Affected by PHP2Shell Flaws.
- Mon 26 Oct, 23:30 UTC. CISA, its first report on the story. CISA adds actively exploited PHP flaw enabling remote code execution to KEV.
- Tue 27 Oct, 03:17 UTC. SecurityOnline, its first report on the story. CISA adds PHP2Shell flaws to KEV after confirmed attacks.
- Tue 27 Oct, 04:37 UTC. The Hacker News. CISA Confirms Exploitation of Two PHP2Shell RCE Flaws.
- CVECVE-2026-111497Google BrotliDevelopinglatest 7 hours ago6 articles6 outlets
- Mon 26 Oct, 10:21 UTC. SecurityWeek, first report. Brotli flaw triggers security updates across major software.
- Mon 26 Oct, 12:29 UTC. SOCRadar, its first report on the story. Brotli flaw exposes Python packages to remote code execution.
- Mon 26 Oct, 12:45 UTC. Infosecurity, its first report on the story. Microsoft patches critical .NET flaw that risks memory corruption.
- Mon 26 Oct, 17:32 UTC. Rapid7, its first report on the story. Node.js Brotli flaw could expose memory or enable remote code execution.
- Mon 26 Oct, 17:45 UTC. The Hacker News, its first report on the story. PHP releases rebuilt Windows packages to fix Brotli flaw.
- Tue 27 Oct, 01:37 UTC. SecurityOnline, its first report on the story. Palo Alto confirms critical Brotli flaw affects PAN-OS.
- CVECVE-2026-48356Adobe CommerceDevelopinglatest 12 hours ago3 articles3 outlets
- Mon 26 Oct, 12:46 UTC. SecurityWeek, first report. Sansec links malware campaign to 953 infected online stores.
- Mon 26 Oct, 18:12 UTC. The Hacker News, its first report on the story. Sansec finds scanner evasion code infecting 953 online stores.
- Mon 26 Oct, 20:41 UTC. Security Affairs, its first report on the story. Magento skimmer campaign infects 953 online stores.
- CVECVE-2026-115889bytecodealliance wasmtimeDevelopinglatest 1 hour ago2 articles2 outlets
- Mon 26 Oct, 11:52 UTC. The Hacker News, first report. Wasmtime flaws could let malicious WebAssembly escape sandboxes.
- Tue 27 Oct, 07:29 UTC. SOCRadar, its first report on the story. Wasmtime fixes two Cranelift flaws that could escape its sandbox.
- In CISA KEVCVECVE-2026-86950Apple iOS and iPadOSDevelopinglatest 6 hours ago2 articles2 outlets
- Mon 26 Oct, 23:34 UTC. SANS ISC, first report. Apple fixes 304 flaws, including one exploited in targeted attacks. Cites a CVE in CISA KEV.
- Tue 27 Oct, 02:35 UTC. SecurityOnline, its first report on the story. Apple backports exploited CoreGraphics flaw fix to older iPhones. Cites a CVE in CISA KEV.