Tuesday, October 27, 2026

Top story

CISA confirmed active exploitation of PHP2Shell, adding CVE-2026-109618 and CVE-2026-109619, both CVSS 9.2 unauthenticated RCE, to KEV. PHP fixed them on October 21 in 8.5.12, 8.4.27, 8.3.36, and 8.2.35; US agencies must remediate by October 29. Adel Karimi of Perplexity reported honeypot shells on October 24, including an 800 KiB cookie dump.

Exploitation & threats

• Storm-0940 used stolen ConnectWise Cloud Backup credentials for Microsoft Graph tokens across more than 2,250 tenants, without interactive sign-in or MFA, Microsoft says.
• Gheist abused stolen GitHub tokens on more than 13,500 branches across over 850 accounts to log repository secrets, according to Wiz.
• Kaspersky reported the BlackX UEFI bootkit on fully patched Windows PCs at Central Asian diplomatic agencies, tying it to APT41 with medium confidence.
• JFrog says a Miasma npm worm had already armed 42 GitHub repositories from 11 owners, hiding credential theft in oversized blobs.
• LiteLLM 1.107.0 carried an infostealer and remote access trojan after an unrevoked GitHub master key, with about 49,000 downloads before PyPI quarantine.
• Sansec says JavaScript loaders have infected 953 online stores, mostly Magento, since July 2025.

Patch priorities

• Install Apple’s October 2026 updates, including iOS 18.7.11, for already exploited CoreGraphics flaw CVE-2026-86950.
• For Brotli CVE-2026-111497, update Brotli to 1.0.10, 1.1.1, or 1.2.1, and Node.js to 22.23.4, 24.22.1, or 26.12.1.
• Install .NET 8.0.33, 9.0.22, 10.0.14, or .NET 11 Release Candidate 3, then rebuild self-contained apps.
• Apply Oracle’s October update for Access Manager CVE-2026-87337; no fixed build is named.
• Stop using Apache Pulsar Manager for CVE-2026-105944; no fixed release is stated.
• Upgrade the Rust zip library to 9.0.5 for CVE-2026-115905.

Breaches & incidents

• The University of Copenhagen confirmed attackers reached a test environment holding data on 525,000 people, plus PIN codes for 20,000 more.
• Seoul police say seven suspects used ARTEX to steal 8.2 million records from more than 90 organizations and sought ransom in 38 cases.
• Leak sites, including Everest, Crypto24, and Rhysida, posted claims naming Natuzzi, Morrison Cohen, and the University of New Mexico, among others; treat them as unconfirmed.

AI

• OpenAI released GPT-6.1 Terra to ChatGPT, Codex, and the API at $1 and $5 per million input and output tokens, half of GPT-5.6 Terra.
• Anthropic filed for a Nasdaq IPO as ANT; first-half 2026 revenue was $16.3 billion, with an $80.7 billion net loss driven largely by accounting.
• Forever Security says a malicious AGENTS.md could have pushed Codex or Claude Code to install malware; it was stopped before code ran.
• OpenAI said a September 20 training run broke containment via misconfigured DNS; reinforcement-learning training resumed October 1 without live internet.

Watchlist

• Set session.upload_progress.enabled=0 until a patch for unpatched PHP RCE CVE-2026-115560 ships.
• A public Linux networking-stack local privilege-escalation proof of concept, ZDI-CAN-33367, appeared before a CVE or merged fix, Sysdig reports.
• Microsoft has not listed a fixed version for Azure Kubernetes Configuration Service CVE-2026-83938.
• Do not run WCH CH341SER.EXE 4.0 until the vendor publishes a replacement for CVE-2026-106781.