Cybersecurity News: Research Digest

Date saved: 2026-10-27 03:01 (PDT)

Sources: The Hacker News, BleepingComputer, Cybersecurity Daily Standup, Traversy Media, CISA, NSA, Microsoft, Crunchatlas, Senthorus, The Week in Cyber

Key findings

PHP2Shell: critical RCE vulnerabilities in PHP under active exploitation

CISA / NSA (October 21-24, 2026): The U.S. Cybersecurity and Infrastructure Security Agency confirmed active exploitation of CVE-2026-109618 and CVE-2026-109619, two critical PHP vulnerabilities that allow unauthenticated remote code execution. Both are rated CVSS 9.2. CISA added them to its Known Exploited Vulnerabilities catalog, requiring FCEB agencies to apply fixes immediately. The NSA issued emergency guidance saying that if you cannot update, take the system offline. CVE-2026-109618 is an out-of-memory corruption vulnerability; CVE-2026-109619 is a stale internal request-state vulnerability. Fixed in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. One-time source patches exist for 7.4, 8.0, and 8.1. (Source)

Traversy Media (October 23, 2026): Two critical PHP vulnerabilities (PHP2Shell) let attackers take over a server with one request, and governments across Europe switched off their own websites. The vulnerabilities affect versions back to PHP 5.4. Amazon's honeypots recorded the first exploitation attempt on October 17. As of October 22, no confirmed break-ins had been reported. Found by Wiz Research, Calif, and OpenAI's security team. (Source)

Cybersecurity Daily Standup (October 24, 2026): Attackers fired millions of exploit attempts at PHP servers using PHP2Shell. Two critical unauthenticated remote code execution flaws rated CVSS 9.4 are being used to deploy Mirai botnet variants. The flaws hit configurations including Apache mod_php and PHP-FPM. Researchers report that turning these into working production exploits has been harder than expected, and there are no confirmed successful intrusions to date. (Source)

Crunchatlas / This Week in Cyber (October 15-21, 2026): CISA, the FBI, Secret Service, and international partners released a joint advisory on SafePay ransomware, which has affected at least 600 organizations across multiple critical infrastructure sectors since August 2024. The NSA issued emergency guidance on the two critical PHP vulnerabilities. (Source)

ConnectWise compromise and China-state actor Storm-0940

Microsoft / Huntress (October 21, 2026): Microsoft published a threat-intelligence report attributing the ConnectWise campaign to Storm-0940, a China-state-aligned actor. The group had been using the open-source ARTEX agentic penetration-testing framework since at least September to automate attacks against hundreds of organizations. Huntress identified unauthorized access to at least 162 Microsoft 365 tenants through credentials associated with ConnectWise Cloud Backup. ConnectWise suspended Cloud Backup and other services while investigating. (Source)

Capcom data breach: 11.7 million accounts exposed

BleepingComputer / Capcom (October 22, 2026): Capcom disclosed that unauthorized access to its CAPCOM ID service exposed information associated with 11,774,247 accounts. BleepingComputer independently reported the incident the same day. (Source)

AI-driven ransomware intrusions

The Hacker News / SOCRadar (October 23, 2026): Cybersecurity researchers discovered an AI-driven intrusion ecosystem run by affiliates of the INC and The Gentlemen ransomware groups. Central to the operation is an "Autonomous Red Team Kill Chain Framework" referred to as Phantom. The threat actor is assessed to be Russian-speaking and functions as both an intrusion and data-extortion operator. The operators exploited edge and remote-access systems at scale, including FortiClient EMS, SimpleHelp, cPanel, and VPN gateways, and used AI-managed knowledge bases to track victims, stolen credentials, and campaign progress. (Source)

Enterprise firewall and VPN credential breach

The Hacker News (October 23, 2026): A large-scale campaign targeted exposed network edge devices such as Fortinet FortiGate and Palo Alto Networks GlobalProtect firewalls, exposing over 70,000 credentials. Qilin and INC ransomware groups exploited a now-patched Palo Alto Networks authentication bypass flaw (CVE-2026-0257, CVSS 7.8) to bypass MFA and set up unauthorized VPN connections. The flaw was patched by Palo Alto Networks in May 2026 and added to CISA's KEV catalog on May 13, 2026. (Source)

Additional major incidents

BleepingComputer (October 21, 2026): CISA says the SafePay ransomware gang has breached over 600 critical infrastructure organizations worldwide since 2024. (Source)

Cybersecurity News (October 23-24, 2026): Palo Alto Networks confirmed that two critical PHP remote code execution vulnerabilities (CVE-2026-109618 and CVE-2026-109619) affect PAN-OS and previously impacted two cloud services. Oracle issued an emergency Java update for CVE-2026-91403, a critical vulnerability with a CVSS score of 9.1 affecting how Java applications trust digital certificates. The Everest ransomware group claims to have stolen 590.69 GB of data from PwC. (Source)

The Hacker News (October 27, 2026): The Computer Emergency Response Team of Ukraine (CERT-UA) issued an alert warning of unauthorized remote access to video surveillance systems manufactured by Dahua, with attackers hijacking Dahua IP cameras in Ukraine using P2P access and authentication weaknesses. (Source)

Not a hack: Bitcoin and AI speculation

Benzinga / Yahoo Finance (October 22, 2026): Billionaire investor Chamath Palihapitiya said on the Moonshots podcast that Bitcoin has a ceiling on its value and predicted a future AI-driven hack could eventually send it to zero. Palihapitiya argued that recursively self-improving AI models could eventually target Bitcoin's SHA-256 security. This is an opinion and financial speculation, not a cybersecurity incident, and no Bitcoin exploit has occurred. (Source)

The week of October 19-25 was one of the most intense stretches for enterprise security teams in recent memory. Two critical PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619, known as PHP2Shell) allowed unauthenticated remote code execution on affected web servers and triggered emergency patching across a technology stack that underpins an estimated 70% of websites. The NSA and CISA both issued emergency guidance: if you cannot update, take the system offline. Amazon's honeypots logged the first exploitation attempt on October 17, four days before the fix shipped. Cloudflare saw millions of attack attempts in a single day. As of October 24, no confirmed break-in had been publicly demonstrated, but the window between disclosure and universal patching is exactly where attackers operate, and PHP2Shell's CVSS score of 9.2 puts it in the category of flaws that get weaponized fast.

The second major story is the Microsoft attribution of the ConnectWise compromise to Storm-0940, a China-state-aligned actor that Microsoft says has been using the open-source ARTEX agentic penetration-testing framework since at least September to automate attacks against hundreds of organizations. The campaign exploited vulnerabilities in ConnectWise's software update infrastructure to compromise at least 162 Microsoft 365 tenants. This is not a routine vendor breach. It is a state-aligned actor using open-source AI tooling to scale intrusion operations, and the same week saw ransomware affiliates (the INC and The Gentlemen groups) running what researchers called an "Autonomous Red Team Kill Chain Framework" called Phantom to execute AI-driven intrusions at scale. The throughline is that the tools of autonomous attack are no longer theoretical. They are in active use by both criminal gangs and state-aligned groups, and the defense gap is widening.