Cybersecurity News: Research Digest

Date saved: 2026-10-26 18:01 (PDT)

Sources: Reuters, KrebsOnSecurity, BleepingComputer, CERT, Senthorus, NetworkTigers, Palo Alto Networks Unit 42, Microsoft, AWS, CISA, Politico, Brandefense, Cybelangel, Wiz, The Big Newsletter, Yahoo News

Key findings

PHP2Shell: the vulnerabilities that threatened the web

CERT / Previdian (October 26, 2026): Over the weekend, PHP2Shell exploitation escalated sharply - Previdian's telemetry recorded hundreds of exploitation attempts against CVE-2026-109618 from dozens of unique IP addresses, with the first confirmed event on October 21 at 1:05pm; SOCRadar found a complete exploit toolkit on an attacker-controlled server, including a Python script labeled a "one-click" exploit for PHP 8.4.26 under Apache mod_php; Palo Alto Networks Unit 42 initially linked PHP2Shell exploitation to a breach at a European government agency where attackers accessed MFA secrets and password hashes, with signs pointing to agentic AI tooling used in post-exploitation; more than 34.4 million PHP services remained assessed as vulnerable as of October 23, and neither CVE had appeared on CISA's Known Exploited Vulnerabilities catalog despite confirmed exploitation. (Source)

BleepingComputer / Sergiu Gatlan (October 26, 2026): Two critical RCE vulnerabilities collectively tracked as PHP2Shell - CVE-2026-109618 and CVE-2026-109619 - have been successfully exploited in the wild; the PHP security team released emergency security patches on October 21; AWS Threat Intelligence says attackers began targeting the PHP2Shell flaws four days before security patches were released; the flaws affect all PHP installations serving web requests - PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, LiteSpeed - and are present in every PHP version since PHP 5. (Source)

Cybelangel (October 23, 2026): On October 21, 2026, the PHP security team shipped an emergency release covering CVE-2026-109618 and CVE-2026-109619, two critical unauthenticated remote code execution flaws in PHP core rated CVSS v4.0 9.2 each; the release landed 25 minutes ahead of schedule after a Hacker News leak broke the embargo the previous day; the flaws affect roughly 2.24 million internet-facing hosts; Cloudflare's CTO reported early attacks at 07:43 UTC on October 21, hours before the release; Sansec warned of mass exploitation within 15 minutes of the release; the flaws are present in every PHP version since PHP 5, affecting PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed. (Source)

Wiz / Calif / OpenAI (October 21, 2026): The two critical PHP flaws were discovered by AI-assisted research from teams at Wiz and Calif; OpenAI says its models "found these vulnerabilities before attackers did"; the vulnerabilities permit remote-code-execution scenarios against vulnerable PHP environments. (Source)

The AI-accelerated hack: one hacker, 100+ companies, AI agents

Reuters / Kansas City Star (October 19, 2026): A cybersecurity researcher watched as a Chinese-speaking hacker broke into websites belonging to more than 100 companies, including farm equipment maker Deere, home appliance company SharkNinja, and engine manufacturer Cummins; the cybercriminal outsourced the hacking spree almost entirely to artificial intelligence, tasking AI agents with spending hours autonomously probing and breaking into targeted sites; the researcher, Snorre Fagerland, principal threat researcher at NorForge, found about two dozen instances of Cairn - an open-source AI problem-solving platform popular with hackers - being used for malicious activity beginning around October 2; one of the hackers stole a trove of credit card data; as of late last week, their agents had attempted to break into more than 1,200 sites; Reuters could not ascertain the degree to which the breaches resulted in unauthorized extraction of data; Deere said it had taken "necessary remediation actions" and had "no indication that sensitive information was accessed"; SharkNinja said the hack hit a standalone site carrying only product support information and that the threat had been contained; Cummins said it was "investigating the report of a potential cyber-attack on a website operated by one of our third-party vendors." (Source)

Microsoft (October 21, 2026): A China-aligned group Microsoft calls Storm-0940 used the ARTEX AI framework to automate attacks against more than 2,250 Microsoft 365 organizations; some intrusions achieved privileged cloud access within three hours; a ConnectWise supply-chain compromise enabled unauthorized authentication to customer Microsoft 365 environments; Microsoft identified the group using the ARTEX AI framework to accelerate attack operations substantially. (Source)

Major data breaches: Capcom, Zeabur, Nikkei, Crime Stoppers, FBI

Capcom (October 22, 2026): Unauthorized access to Capcom's CAPCOM ID service exposed information associated with 11,774,247 accounts; the company disclosed the breach on October 22 and forced password resets for impacted accounts. (Source)

Zeabur (October 14-15, 2026): Development platform Zeabur disclosed its second significant security incident in roughly two months and subsequently announced that it would shut down; the October 14-15 intrusion ultimately gave the attacker access to the production database; approximately 321,810 accounts and more than 3.2 million environment-variable records were affected. (Source)

Nikkei (October 19, 2026): Japanese media organization Nikkei disclosed a further breach involving approximately 1.83 million personal-information records, marking its third publicly reported security incident in around a month. (Source)

CBC (October 2026): An exclusive CBC investigation revealed the extent of the Crime Stoppers data hack in Canada - more than 1.5 million tips submitted to Canadian Crime Stoppers programs over the last 25 years were exposed, along with tens of thousands of unredacted personal details; the information was stolen last March by hacktivist collective Internet Yiff Machine, who stated they wanted to disprove the company's claim that its platform was "anonymous" and "secure"; Navigate360 confirmed its database had been breached between November 2025 and March 2026, acknowledging this publicly seven months after the hack; Toronto, Halton, and Guelph are among the Ontario cities temporarily pausing Crime Stoppers tip programs. (Source)

KrebsOnSecurity (October 19, 2026): U.S. federal investigators pursuing the ShinyHunters hacking group identified executives at two different ransomware negotiation firms who maintained unusually close relations with the extortion group; one of the executives in the United States even helped ShinyHunters operate a website that pressured victims into paying a ransom; ShinyHunters hacked the FBI recruitment website fbijobs.gov and taunted the agency by threatening to publish the stolen files, which reportedly included medical and psychological records, Social Security numbers, home addresses, and information about each employee's unit and specialization; the FBI removed a contractor at Accenture over their failure to patch the FBI recruitment website; the FBI arrested a 54-year-old Canadian cybersecurity executive named Edward Dubrovsky in connection with the ShinyHunters investigation; ShinyHunters has extorted more than $70 million from victims so far this year. (Source)

SafePay ransomware and the supply-chain compromises

NetworkTigers (October 26, 2026): U.S. and international agencies warned that SafePay ransomware has affected at least 600 organizations since 2024; attackers exploit vulnerable VPNs, compromised credentials, and exposed systems to steal data and disrupt backups; SafePay pairs file encryption with data-theft pressure to force payouts and has been tied to attacks leveraging multiple vulnerabilities including CVE-2023-20269, CVE-2020-3259, CVE-2023-27532, CVE-2024-40711, and CVE-2024-40766. (Source)

LiteLLM compromise (October 2026): Attackers compromised LiteLLM's release pipeline and distributed malicious Python packages and Docker images containing an information stealer; version 1.107.0 exposed cloud credentials, API keys, and environment variables, requiring affected organizations to isolate systems, rebuild compromised environments, and rotate secrets. (Source)

Arista VeloCloud (October 2026): Attackers are exploiting CVE-2026-114625, a critical SQL injection vulnerability affecting VeloCloud Orchestrator with a CVSS 9.9 rating; authenticated users can escalate to superuser privileges, potentially compromising SD-WAN management infrastructure; Arista released patches for affected on-premises deployments and confirmed hosted systems were already updated. (Source)

Other critical vulnerabilities: GitLab, Collabora, Plex, Node.js, Brotli

GitLab (October 2026): GitLab issued security updates for CVE-2026-110264, carrying a CVSS 10.0 rating and potentially allowing unauthenticated remote code execution against self-managed GitLab environments under affected conditions; the flaw affects self-managed Community and Enterprise installations. (Source)

Collabora Online (October 23, 2026): CISA added CVE-2026-110447 (CVSS 9.2) to its Known Exploited Vulnerabilities catalog - an operating-system command-injection vulnerability affecting the Collabora Online Built-in CODE Server used with Nextcloud that can provide remote code execution through proxy.php under affected conditions. (Source)

Plex Media Server (October 17, 2026): Attackers began exploiting Plex2Shell, a chain of four Plex Media Server vulnerabilities tracked as CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656, achieving unauthenticated remote code execution against exposed Plex servers; the chain combines four vulnerabilities to achieve full compromise. (Source)

Google Brotli (October 2026): CVE-2026-111497 affects Google's Brotli decoder and can produce memory corruption when applications process malicious compressed content; the vulnerability affects Node.js and other software, with fixes delayed into October releases. (Source)

Oracle / Cisco (October 2026): Oracle's October Critical Patch Update addresses 1,209 unique vulnerabilities, including 95 critical flaws; Fusion Middleware received 206 fixes, including 134 vulnerabilities that could be exploited remotely without authentication; Cisco released fixes for 34 vulnerabilities affecting Expressway, IOS XR, Snort 3, and Unified Communications products, with critical flaws that could enable root-level command execution and authentication bypass. (Source)

Onamae Desktop Cloud (October 2026): Attackers compromised Onamae Desktop Cloud infrastructure and installed malware on customer servers, potentially affecting 26,739 systems; the provider suspended services while investigating possible data exposure. (Source)

October 2026 will be remembered as "Black October" in cybersecurity circles - a week in which two critical PHP vulnerabilities, discovered with AI assistance, threatened roughly 70 percent of the web, and attackers were already exploiting them before patches shipped. The PHP2Shell flaws - CVE-2026-109618 and CVE-2026-109619 - are unauthenticated remote code execution vulnerabilities rated CVSS v4.0 9.2 each, affecting PHP versions from 5.4 through 8.5. They permit remote-code-execution scenarios against vulnerable PHP environments, with researchers demonstrating significant consequences for PHP-backed applications including sites running WordPress, Drupal, and Joomla. AWS detected exploitation attempts four days before the patches were disclosed. Cloudflare logged millions of exploitation attempts within hours of the public announcement. More than 34.4 million PHP services remained assessed as vulnerable as of October 23, and neither CVE had appeared on CISA's Known Exploited Vulnerabilities catalog despite confirmed in-the-wild exploitation.

This was not a routine vulnerability disclosure. The PHP project accelerated its security-release schedule after details leaked before coordinated disclosure. The official release landed 25 minutes ahead of schedule after a Hacker News leak broke the embargo. Researchers named the flaws "PHP2Shell" because they effectively turn vulnerable PHP installations into shells. The vulnerabilities were found by AI-assisted research - teams at Wiz and Calif independently discovered them using AI, and OpenAI says its models "found these vulnerabilities before attackers did." The same AI techniques are now being used by attackers: Reuters documented a Chinese-speaking hacker who broke into websites belonging to more than 100 companies - including John Deere, SharkNinja, and Cummins - by outsourcing almost the entire hacking spree to AI agents. Microsoft says a China-aligned group it calls Storm-0940 used the ARTEX AI framework to automate attacks against more than 2,250 Microsoft 365 organizations, with some intrusions achieving privileged cloud access within three hours.