Wednesday, October 28, 2026

Top story

CISA added two critical PHP engine bugs, CVE-2026-109618 and CVE-2026-109619, called PHP2Shell, to the Known Exploited Vulnerabilities catalog. Unauthenticated HTTP requests can run code on PHP dating to 5.4; federal civilian agencies must remediate by October 29, 2026. Confirmed successful exploitation remains unproven after thousands of failed attempts; CISA’s rules still count attempts as active exploitation.

Exploitation & threats

• ELLIO saw public exploit traffic for CVE-2026-111497, an out-of-bounds write in Google’s Brotli decoder also bundled with Node.js.
• Mandiant reported continued mass exploitation of Oracle PeopleSoft CVE-2026-35273 by ShinyHunters.
• Apple fixed an exploited CoreGraphics zero-day, CVE-2026-86950, an out-of-bounds write triggered by a crafted file.
• Attackers exploited NetScaler before weekend patches covering unauthenticated flaws CVE-2026-88771 through CVE-2026-88778.
• The FBI says SafePay has breached at least 600 US and European organizations since August 2024.
• JFrog found malware in 42 GitHub repos that runs when Claude, Gemini, Cursor, or VS Code sessions start.

Patch priorities

• CVE-2026-109618 and CVE-2026-109619, PHP: upgrade to 8.5.12, 8.4.27, 8.3.36, or 8.2.35.
• CVE-2026-111497, Brotli and Node.js: move Brotli to 1.2.1, 1.1.1, or 1.0.10, and Node.js to 26.12.1, 24.22.1, or 22.23.4.
• CVE-2026-86950, older iPhones and iPads: install iOS 18.7.11 or iPadOS 18.7.11.
• CVE-2026-35273, Oracle PeopleSoft: apply Oracle’s patch.
• NetScaler ADC and Gateway: apply Citrix’s emergency patches, or disconnect internet-facing systems until patched.
• CVE-2026-48356, Adobe Commerce and Magento: see vendor advisory; CISA added the exploited upload flaw to KEV.

Breaches & incidents

• Conduent agreed to an $80 million settlement over a breach of about 62.2 million people; court approval is still required, and Conduent denies fault.
• Capcom said a third party took data from 11.7 million Capcom ID accounts and changed passwords on 196 accounts.
• Moldova shut 82 public services after hackers stole identity, health, and financial records on 750,000 people.
• UNM Health disclosed a cyberattack that diverted ambulances and suspended surgeries; Byod claims a theft, while UNM says core systems were not breached.
• The University of Copenhagen confirmed a test-environment intrusion exposed data on about 525,000 people, including national ID numbers.

AI

• OpenAI released GPT-6.1 Terra for agents and computer use, pricing the API at half of GPT-5.6 Terra and GPT-6.1 Sol, with cybersecurity rated Critical.
• Anthropic filed to list on Nasdaq as ANT, reporting $16.3 billion of first-half 2026 revenue and an 85% gross margin.
• Anthropic says an internal Claude model produced exploit chains in Chrome, Safari, and Android; Chrome issues are patched as of Chrome 156.
• DeepMind announced Genie 4, a world model that generates interactive simulations with ambient sound and dialogue for trusted testers first.

Watchlist

• Unpatched PHP bug CVE-2026-115560 still has no patch; apply the PHP team’s mitigation.
• CVE-2026-83938 and CVE-2026-97785 are CVSS 10 Microsoft cloud flaws with no fixed version stated.
• CVE-2026-114625, KEV SQL injection in on-prem Arista VeloCloud Orchestrator, still needs Arista’s mitigations.
• GitLab CVE-2026-110264 is unauthenticated RCE at CVSS 10.0 back to version 7.0, and the article says there is no workaround.