PHP exploitation attempts keep climbing, a leaked LiteLLM master key turned into a poisoned package release, a ten week token replay campaign slipped past MFA at 79 organisations, and Capcom confirmed 11.7 million exposed accounts.
🟠 HIGH (7)
PHP2Shell attempts hit millions of servers as CISA adds a detection rule and CrowdStrike urges caution Under investigation
Attackers are mass scanning and attempting to exploit CVE-2026-109618 and CVE-2026-109619, the critical unauthenticated remote code execution flaws in PHP fixed in emergency releases this week. CISA updated its alert on 23 October with a SIGMA detection rule and mitigation guidance, researchers have tied some attempts to a Mirai variant called Potassium, and an ASLR bypass has been demonstrated. CrowdStrike says no successful exploitation has been confirmed yet and that weaponising the flaws is proving harder than the scan volume suggests, so patch every PHP deployment and hunt for signs of intrusion rather than assuming compromise.
Sources CISA|The Hacker News|SecurityWeek|CrowdStrike
Leaked LiteLLM master key led to poisoned PyPI and Docker releases Confirmed
LiteLLM says a configuration file committed to a public repository on 27 May exposed the master key for one of its deployments, which let an attacker reach GitHub tokens and push an unauthorised version of the widely used Python package. SecurityWeek reports the actor used stolen GitHub CLI OAuth tokens to publish and approve malicious packages on PyPI and Docker. Teams running LiteLLM in AI gateways should audit installed versions, revoke GitHub and registry credentials used by the project pipeline, and check release history for artefacts they did not build.
Sources The Hacker News|SecurityWeek
Brotli decoder flaw CVE-2026-111497 exposes Node.js, Bun, Python and Envoy to code execution Confirmed
A memory corruption bug in Google’s Brotli decoder lets crafted compressed data overwrite past the end of a buffer, and Imperva has demonstrated a working exploit, named Node2Shell, against an official Node.js 24.22.0 Linux arm64 build with no debugger or custom compilation. The same flaw affects Bun, the Python brotli and brotlicffi packages, and Envoy proxies configured to decompress Brotli. Update the runtimes and libraries that unpack untrusted Brotli data, and treat any service that decompresses user supplied content as exposed.
Token replay campaign bypassed MFA at 79 Microsoft 365 organisations Confirmed
Huntress tracked 497 successful Microsoft 365 sign-ins across 79 organisations between 14 July and 22 September, against more than 200,000 failed attempts, all replayed from addresses at German hosting provider 1337 Services GmbH. The attacker captured session tokens through adversary-in-the-middle sign-in pages and device code phishing, then replayed them without a password or a fresh MFA prompt, and added hidden inbox rules so victims would not see replies from colleagues and customers. Review Entra ID sign-in logs for token replay patterns, remove unknown inbox rules and devices, and revoke sessions on affected accounts.
Sources Huntress|Help Net Security
Capcom confirms 11.7 million CAPCOM ID accounts exposed Confirmed
Capcom says intruders reached its CAPCOM ID service and took 11,774,247 email addresses plus account metadata such as creation date, last login time and last login IP address. For 43 customers the exposed data included dates of birth, gender, country and nickname, and the attackers changed the passwords of 196 accounts, which Capcom has reset. No account passwords were stolen. Users should expect credential stuffing and targeted phishing at the leaked addresses, and turn on MFA wherever CAPCOM services support it.
Sources SecurityWeek|BleepingComputer
Microsoft links Storm-0940 to the ConnectWise supply chain attack and an AI-assisted intrusion tool Confirmed
Microsoft has attributed the ConnectWise supply chain attack to the China-linked actor Storm-0940, which used an AI-enabled penetration testing tool to automate and accelerate its campaign against more than 2,200 tenants. The case illustrates how automation shrinks the effort needed to exploit a managed service provider platform at scale. ConnectWise partners should assume tenant data was reachable, rotate credentials and API keys held in the platform, and hunt for abuse of remote monitoring and management tooling.
Sources DarkReading
Railway tells developers to rotate every secret after suspected breach of environment variables Under investigation
Cloud platform Railway warned that an unauthorised third party may have accessed its store of customer environment variables and obtained the decrypted contents of some of them, and paused all deployments while it investigated. The company links the incident to a run of attacks on platform providers aimed at AI inference credentials, and has asked the providers involved to revoke keys. Customers should rotate API keys, database passwords and private registry credentials held in Railway, then check logs for use of the old values.
Sources BleepingComputer|SecurityWeek
🟡 MEDIUM (4)
333 Tor exit relays were rewritten to harvest SSH passwords and spread Ebury Confirmed
A researcher whose own SSH session was intercepted while using Tor found that 333 exit relays, roughly a tenth of all exits, were redirecting SSH connections to a dozen attacker-run servers that logged passwords and then tried to infect the destination servers with the Ebury backdoor. The relays ran on hosts already compromised by Ebury and had their exit policies edited to block encrypted mail ports. The Tor Project removed the relays within three days. Anyone who ignored the host key warning while connecting over Tor should treat those credentials as stolen and rotate them.
Sources SecurityWeek
PingCAP intruder copied customer records and source code over four weeks Under investigation
TiDB developer PingCAP says an unauthorised party used stolen service account access to reach its systems for roughly four weeks, copying customer records and source code. The company has not disclosed how many customers are affected. Customers should rotate credentials shared with PingCAP hosted services and support workflows, and watch for follow-on phishing that quotes real account details.
Sources SecurityWeek
State Bank of India reports 3,897 customer records found on the dark web Under investigation
SBI disclosed to stock exchanges on 21 October that 3,897 customer records containing names, mobile numbers, dates of birth and addresses appeared on the dark web, and has engaged an independent firm to establish the source and authenticity of the data. The bank has not attributed the exposure to a specific intrusion. Customers should expect convincing phishing built from those fields and verify any call or message that claims to come from the bank.
Sources DarkReading|Reuters
CrowdStrike documents four threat actors running intrusions through AI agents Confirmed
CrowdStrike described four previously unreported actors whose campaigns have AI agents making decisions and executing commands, including a Spanish and English speaking operator that hit at least 15 Argentina-based healthcare entities with a supervisor agent and an executor agent built on Claude Code. A Chinese speaking operator with more than 20 named targets compromised government systems in two countries and reached models through a China-based AI proxy service. Defenders should log agent tool calls, limit what coding assistants can reach, and treat unattended agent sessions as privileged accounts.
Sources CrowdStrike
⚪ WATCH (3)
US banks detect unsanctioned AI agents operating inside customer accounts Unconfirmed report
Axios reporting relayed by SecurityWeek says major US banks are finding third party AI agents logged into customer accounts and taking actions that appear independent of user instructions, in breach of most banks’ terms. Morgan Stanley has started blocking third party agents while JPMorgan, Bank of America and Citi are also restricting them, and most banks are moving toward read only access. The unresolved problem is attribution: banks often cannot tell whether a user actually directed the agent.
Sources SecurityWeek
Sweden blocks ChatGPT and Claude on government workstations and keeps Copilot Confirmed
Sweden’s Government Offices will block ChatGPT and Claude on staff computers from Monday and allow only Microsoft Copilot, the one assistant that passed its security review. The decision is a signal for regulated organisations weighing data residency and retention terms rather than model quality. Teams in similar positions should document which assistants are approved, where prompts and outputs are stored, and how staff request exceptions.
Sources Decrypt
Wallets tied to the Bitget breach moved 19.48 million dollars in 52 transfers Confirmed
Arkham tracked 19.48 million dollars of transfers from wallets linked to the September Bitget breach between 21 and 24 October, almost all of it in bitcoin, taking movement to new addresses to 78.01 million dollars since 15 October. Bitget puts the theft at about 387.5 million dollars, says customer balances were unaffected, and blames a flaw in a third party security product. The transfers do not establish that funds were sold or laundered, but exchanges and analytics teams should keep the labelled addresses on watch.
Sources Crypto.news
Methodology: compiled from vendor advisories, government feeds (CISA KEV, MSRC), security news sources and on-chain/security-firm alerts. Grouping: one incident, one entry, with every source cited. Unconfirmed reports are labeled. Crypto items are incident reporting, not investment advice. Corrections from prior digests are noted at the top when applicable.