Two critical PHP remote code execution flaws leaked ahead of today's emergency release, CISA and partners count about 600 SafePay ransomware victims, and eight compromised eMudhra CA keys force browsers, runtimes and clients to distrust certificates they once accepted.
🔴 CRITICAL (4)
PHP prepares emergency patches for two critical remote code execution flaws Confirmed
The PHP security team has given advance notice of a security release on 21 October at 14:00 UTC covering two vulnerabilities rated 9.2 under CVSS v4.0 and tracked as CVE-2026-109618 and CVE-2026-109619. Technical details leaked ahead of an embargo: watchTowr says it reproduced one flaw and that both affect PHP 5, 6, 7 and 8, while PHP has not confirmed affected versions or fixed releases. Exploitation has not been observed, but every internet-facing PHP application, including WordPress, Drupal and e-commerce stacks, should be inventoried now so the patches can be applied within hours of release.
Sources PHP.net|BleepingComputer|CERT-EU
CISA and partners warn SafePay ransomware has hit about 600 victims Confirmed
A joint advisory from CISA, the FBI, the US Secret Service and international partners says SafePay has been highly active since August 2024 and has affected roughly 600 victims, targeting businesses and critical infrastructure across North America, South America, Europe and Australia. The group gets in through stolen or guessed passwords, flaws in security products including VPNs, firewalls and backup tools, and phishing, then creates or hijacks accounts, disables protections and encrypts files. Priorities are phishing-resistant MFA on remote access, patching edge and backup appliances, and hunting for the account creation and tool use the advisory describes.
Eight eMudhra intermediate CA keys compromised, forcing emergency distrust across browsers Confirmed
Mozilla and Google’s Chrome Root Program confirmed on 20 October that the private keys for eight eMudhra intermediate certificate authorities were compromised, after a researcher submitted proof of key control on 17 October. The keys are weak, so anyone holding them can forge a certificate for any domain and impersonate it to intercept traffic. Apple and Microsoft root programs were notified, Go 1.27.3 and 1.26.10 now reject chains through the keys, and Cloudflare has shipped client and cloudflared updates with mitigations across its products. No forged certificates have been publicly observed, but trust stores, bundled CA files and pinned intermediates need updating, and breakage is likely where origin servers rely on eMudhra-issued chains.
Sources Cloudflare|The Hacker News|DarkReading
Qilin and INC ransomware crews keep exploiting the PAN-OS GlobalProtect flaw (CVE-2026-0257) Confirmed
Unit 42’s updated brief says Spikey Scorpius (Qilin) and Tarnished Scorpius (INC) are exploiting CVE-2026-0257, an authentication bypass in the GlobalProtect portal and gateway of PAN-OS that lets an attacker establish an unauthorised VPN connection, rated 7.8. Palo Alto Networks patched it in May 2026, so devices still on vulnerable builds remain exposed more than four months later. Unpatched firewalls should be upgraded and then treated as suspect: review GlobalProtect logs for unexpected VPN sessions, new local accounts and lateral movement from the firewall, and reset credentials for anyone who connected through it.
Sources Unit 42|The Hacker News|Palo Alto Networks
🟠 HIGH (6)
CISA adds four Plex Media Server flaws to KEV after Plex2Shell attacks Confirmed
CISA added CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656 for Plex Media Server to the Known Exploited Vulnerabilities catalog on 20 October, alongside SiteGuard Server Edition (CVE-2026-106931) and Siemens Software Center (CVE-2026-110936). The four Plex flaws chain as Plex2Shell and have been used since 17 October to drop XMRig miners and a Linux reverse proxy backdoor, a day after a public proof of concept. Federal deadlines are 23 October for three of the Plex flaws and 3 November for the fourth; anyone exposing Plex Media Server to the internet should patch now and check for miner processes and unexpected proxy binaries.
Sources CISA|The Hacker News
Backdoored OVHcloud CLI releases sat on GitHub for up to 94 minutes Confirmed
An attacker used a hijacked contributor GitHub account to replace the download archives on five existing OVHcloud CLI releases on 19 October, between 12:47 and 14:21 UTC, with a build designed to steal secrets stored on the disk of the machine that runs it. OVHcloud has pulled the tampered releases, but anyone who downloaded the CLI in that window, or built from those archives since, should rotate cloud credentials, API keys and SSH keys held on the host and review account activity for misuse.
Sources BleepingComputer|The Hacker News
APT28 breaches a NATO naval shipbuilder and deploys a new reflective loader Confirmed
Symantec’s Threat Hunter Team attributes intrusions at two NATO member states, including a naval shipbuilding contractor, to APT28 (Fancy Bear, Forest Blizzard), tracked as Swallowtail. The actor used a backdoor called HOOKEDGE and a previously undocumented reflective loader, which runs payloads in memory to leave little on disk. Defence manufacturers and their suppliers should hunt for anomalous in-memory module loads on engineering workstations, review supplier and remote access paths into design networks, and treat shipbuilding and engineering data as the target.
Sources The Hacker News
AI pentest platform Cairn abused to breach more than 100 organisations Confirmed
Researchers who found the operators’ control panels exposed on the internet documented a Chinese-speaking crew pointing autonomous AI agents at company websites: the agents tried more than 1,200 sites and reached systems at over 100 organisations, including Deere, SharkNinja and Cummins. The crew used Cairn, a commercial AI penetration-testing platform, to automate discovery and exploitation, and used the access for persistent footholds and financial theft. Automated probing now happens at a scale manual testing never reached, so exposure management, login anomaly detection and rate limiting matter more than blocklists.
Sources DarkReading|SecurityWeek|The Hacker News
Public exploit released for critical FortiSIEM path traversal (CVE-2026-106173) Confirmed
Researchers published a proof-of-concept for CVE-2026-106173, a path traversal flaw rated 9.4 that allows an unauthenticated attacker to execute code or commands on FortiSIEM, which Fortinet patched in a recent release. FortiSIEM carries broad telemetry and privileged integrations across the estate, so a compromised appliance can hand an attacker credentials and visibility. Patch, restrict management interfaces to trusted networks, and check logs for traversal attempts against the appliance.
Sources The Hacker News
Zeabur shuts down after a second breach exposes 3.2 million environment variable records Confirmed
Development platform Zeabur says an attacker used internal credentials that were stored in plaintext to reach its infrastructure and take more than 3.2 million environment variable records plus data for 321,810 accounts, its second incident in two months, and the company is shutting the service down. Environment variables routinely hold database passwords, API keys and cloud tokens. Users should rotate every secret that was stored in Zeabur, review provider logs for use of those credentials, and check for unexpected cloud spend.
Sources BleepingComputer
🟡 MEDIUM (6)
Wallet tied to the 295 million dollar Drift heist moves 61 million dollars into Tornado Cash Confirmed
A wallet tied to April’s 295 million dollar Drift exploit, attributed to North Korean actors, pushed 25,700 ETH, about 61 million dollars, through Tornado Cash in roughly two hours and still holds about 198 million dollars. The steady laundering pace suggests the group is converting proceeds rather than waiting. Analytics teams and exchanges should watch for Tornado withdrawals into deposit addresses linked to the heist, and Drift users should assume those funds are not coming back.
Sources Decrypt
Citizen Lab confirms Pegasus on a Serbian rector's iPhone before the election Confirmed
Citizen Lab found NSO Group’s Pegasus on the iPhone of Vladan Djokic, rector of the University of Belgrade and a prominent supporter of Serbia’s student protest movement, six days before the 25 October snap election. The infection was zero-click, so no user action was required. High-risk individuals should use lockdown mode, keep devices updated and seek forensic checks after suspected targeting, and organisations should assume that phone calls and messages on compromised devices are readable.
Sources The Hacker News
Investigators suspect a ransom negotiator helped run ShinyHunters' extortion site Unconfirmed report
KrebsOnSecurity reports that federal investigators pursuing ShinyHunters, which recently stole sensitive data from the FBI, identified executives at two ransomware negotiation firms with unusually close ties to the group, and that one executive in the United States helped operate a website used to pressure victims into paying. No charges have been announced and the firms are not named. The practical point stands: before retaining an incident response or negotiation firm, ask who else it works with, and keep extortion decisions with your own counsel.
Sources KrebsOnSecurity
Paradigm Healthcare notifies 970,000 Medi-Cal members of a breach found a year ago Confirmed
Paradigm Healthcare Services says an intrusion was detected in October 2025 but notification to about 970,000 Medi-Cal members began only recently, close to a year later. The delay is the story: California breach rules and HIPAA both expect prompt notice, and affected members lose a year in which they could have watched for misuse. Members should check explanation of benefits statements for services they never received, watch for medical identity fraud and consider a credit freeze.
Sources SecurityWeek
Forescout documents ROMULUS, a ClickFix delivery platform pushing LegionLoader Confirmed
Forescout’s Vedere Labs describes ROMULUS, a malware delivery service that uses ClickFix lures on fake landing pages to talk users into pasting a command that infects their own machine, and pushes LegionLoader and other payloads. ClickFix keeps working because it makes the victim the execution path and sidesteps email filtering. Block clipboard paste prompts where browsers allow it, tell staff that no legitimate site asks them to run a command, and hunt for mshta, powershell and curl processes spawned by browsers.
Sources The Hacker News
CISA publishes ICS advisories for Hitachi Energy, HMS Networks and Moxa products Confirmed
CISA’s 20 October batch covers Hitachi Energy RTU500 (multiple flaws in CMU firmware up to 13.8.2) and MicroSCADA X SYS600 (CSV formula injection and an authentication flaw, 7.8), HMS Networks PEAK-System PCAN Windows drivers (kernel crashes, 7.1) and Moxa AIG-302 ThingsPro Edge (missing authorisation plus a hard-coded key, 8.1). No public exploit is known, but these products sit in energy, transport and manufacturing networks. Asset owners should map affected firmware versions and schedule vendor updates.
⚪ WATCH (5)
Microsoft adds per-task permissions and risk scoring for AI agents Confirmed
Microsoft says enterprises should treat AI agents as insiders and is adding controls that grant access per task and tighten it as an agent’s risk score rises. The direction matters more than the feature list: agent identities are becoming a distinct class of non-human identity with their own lifecycle, owners and audit trail. Teams deploying agents should inventory them, give each a named owner, scope tokens to the task and log agent actions the way administrator actions are logged.
Sources SecurityWeek
October Patch Tuesday sets a record at 1,413 CVEs, and analysts ask why Confirmed
CrowdStrike counted 1,413 CVEs in October’s Microsoft release, including three zero-days and 75 critical vulnerabilities, while Talos notes the number rose from 975 in September against a pre-June average near 100 a month. Part of the jump reflects wider CVE issuance and faster discovery, including AI-assisted research, rather than a sudden collapse in code quality, but the operational effect is real: triage capacity, not patch availability, is now the constraint. Rank by exposure and known exploitation rather than CVSS alone.
Sources CrowdStrike|Cisco Talos
WhatsApp help pages carried hidden instructions steering its support chatbot away from regulators Confirmed
WhatsApp’s help pages contained hidden text telling its support chatbot not to recommend a data protection authority to users who could no longer delete their accounts, even though its European privacy policy says users can complain to a regulator. The text sat in page code, never on screen, and was removed by 18 October. It is a reminder that hidden instructions in web content are the same vector indirect prompt injection exploits, and that customer-facing chatbot instructions need review and audit.
Sources The Hacker News
Check Point examines AI-assisted antidetect browsers used for fraud at scale Confirmed
Check Point Research describes how antidetect browsers, now with AI features, let a small team run thousands of isolated and believable accounts across social platforms and marketplaces, supporting fraud and influence operations. Its detection guidance leans on behavioural and infrastructure signals rather than fingerprints alone. Fraud and trust teams should test onboarding against multi-account patterns and treat coordinated device-farm behaviour as a stronger signal than a clean fingerprint.
Sources Check Point Research
DHS orders federal civilian agencies to remove DeepSeek products Confirmed
The Department of Homeland Security told federal civilian agencies to stop using DeepSeek products and remove them from government systems. The order is a policy action rather than a reported incident, and it follows wider US restrictions on Chinese AI tools over data handling and model provenance. Enterprises with similar exposure should use it as a prompt to review where third-party AI tools send data, what their terms allow and which business units signed up without telling security.
Sources BleepingComputer
Methodology: compiled from vendor advisories, government feeds (CISA KEV, MSRC), security news sources and on-chain/security-firm alerts. Grouping: one incident, one entry, with every source cited. Unconfirmed reports are labeled. Crypto items are incident reporting, not investment advice. Corrections from prior digests are noted at the top when applicable.