PHP2Shell exploitation escalates into a rooted 25-server intrusion that reached a US government-affiliated network, two more actively exploited flaws enter CISA's KEV list with deadlines inside a fortnight, and Oracle E-Business Suite joins the products under active probing.
🔴 CRITICAL (2)
PHP2Shell intrusion roots 25 servers and reaches a US government-affiliated network Confirmed
Researchers detailed an intrusion observed on 25 October that chained the PHP2Shell flaws, CVE-2026-109618 and CVE-2026-109619, with a kernel privilege escalation and the Fragnesia exploit to gain root on 25 servers, two of them belonging to a US government-affiliated organisation. The activity was attributed to a suspected China-nexus actor and described as apparently AI-assisted, with fast tooling deployment and cleanup. Any internet-facing PHP service should be treated as exposed: patch to the fixed releases and hunt for web shells and unexpected privilege escalation.
Sources CISA|The Hacker News|SecurityWeek
CISA adds VMware ESX and Linux kernel flaws to KEV on evidence of exploitation Confirmed
CISA added CVE-2026-41709, an insufficient logging flaw in Broadcom VMware ESX, and CVE-2026-46300, a missing variable initialisation bug in the Linux kernel, to its Known Exploited Vulnerabilities catalog on 28 October. Federal civilian agencies must remediate the kernel flaw by 31 October and the ESX flaw by 11 November, deadlines that indicate both are in real use. Patch hypervisor and kernel builds now, and review hypervisor logging for gaps and tampering given the nature of the ESX flaw.
Sources CISA
🟠 HIGH (6)
PolyShell attacks breach hundreds of Adobe Commerce and Magento stores Confirmed
Attackers are exploiting the Adobe Commerce and Magento flaws that CISA added to its KEV catalog on 27 October, with researchers reporting hundreds of stores compromised under the PolyShell campaign name. Exploit traffic for the separate Brotli decoder bug CVE-2026-111497 is being seen alongside it, widening the set of exposed storefronts and Node.js services. Operators should apply the Adobe patches, check for rogue admin accounts and payment skimmers, and rotate credentials that touched affected hosts.
Sources The Hacker News
Attackers begin probing Oracle E-Business Suite flaw CVE-2026-101767 days after patch Under investigation
Scanning for CVE-2026-101767, a 9.8-rated improper authentication flaw in Oracle E-Business Suite’s Application Object Library that can be driven to remote code execution, began within days of Oracle’s October critical patch update. Defused Cyber and other researchers reported the probing, which usually precedes mass exploitation of an unauthenticated flaw. Internet-facing EBS instances should be patched and reviewed for unexpected Application Object Library access.
Volt Typhoon ran four zero-day campaigns through a 'Silent Train' relay network Confirmed
Lumen’s Black Lotus Labs attributed a covert relay framework called Silent Train to Volt Typhoon, saying the China-nexus group used rotating chains of compromised home routers, IoT devices and enterprise equipment to hide the origin of at least four zero-day exploitation campaigns. Operators opened short SSH sessions and pulled their tooling out within about eight hours, which defeats long log retention windows. Defenders should assume edge device management interfaces are targets and hunt for brief, unexplained outbound SSH from SOHO and IoT kit.
Sources Lumen Black Lotus Labs|The Hacker News|BleepingComputer
Bithumb breach traced to an internal employee system as Korean finance firms report attacks Under investigation
Bithumb, South Korea’s second-largest crypto exchange, said attackers reached an internal employee system that is separate from its trading platform, and is still assessing whether customer data was exposed. Two other South Korean financial firms reported breaches in the same window, with no link between the incidents established so far. Customers should expect targeted phishing that quotes exchange style details, and firms should review internal admin and third-party access paths.
Apple backports fix for exploited CoreGraphics flaw CVE-2026-86950 to older iPhones and iPads Confirmed
Apple extended fixes for CVE-2026-86950, an 8.8-rated out-of-bounds write in CoreGraphics that has been exploited in real attacks, to older iPhone and iPad models that missed the original update. Processing a malicious image or document can lead to arbitrary code execution on unpatched devices. Older devices are the ones most likely to be left behind, so confirm the update on every model still in service.
Sources The Hacker News
Talos ties UAT-11473 to the KeyDrift backdoor built on a Cisco SD-WAN auth bypass Confirmed
Talos published analysis of UAT-11473, a sophisticated group that exploited CVE-2026-20127, an authentication bypass in Cisco SD-WAN Catalyst Controller, to deploy a backdoor it calls KeyDrift. The targeting of network management infrastructure gives the attackers a position to observe and redirect traffic across an estate. Controllers should be on a fixed release, with logs reviewed for bypass attempts and unexplained configuration changes.
Sources Cisco Talos
🟡 MEDIUM (8)
Sixteen-year-old EDK II flaw allows code execution before Secure Boot during network boot Confirmed
A flaw that sat in EDK II, the reference UEFI implementation most hardware makers build on, for about 16 years lets an attacker run code before the operating system loads and bypass Secure Boot, but only while a machine boots over the network. Exploitation requires control of the boot server or a position on the network path, which limits exposure mostly to managed fleets that PXE boot. Apply firmware updates carrying the fix and restrict network boot to trusted segments.
Sources The Hacker News
FoxIO finds three TLS flaws in GoAhead web server used in hundreds of millions of devices Confirmed
FoxIO disclosed three TLS handling bugs in the GoAhead embedded web server, which ships in hundreds of millions of cameras, routers and IoT devices, including cases where revoked certificates are accepted and encrypted sessions can be exposed to eavesdroppers. No exploitation has been reported, and remediation depends on each device vendor shipping updated firmware. Inventory internet-facing GoAhead management interfaces and press vendors for firmware timelines.
Sources SecurityWeek
Chrome 156 and Firefox 159 patch more than 200 vulnerabilities Confirmed
Google’s Chrome 156 fixes 52 bugs and Mozilla’s Firefox 159 carries 167 security fixes, together more than 200 vulnerabilities across the two browsers. Neither vendor reported exploitation in the wild in these releases, though browser flaws are routinely chained by exploit kits soon after disclosure. Push both updates through managed channels and confirm the versions actually landed on endpoints.
Sources SecurityWeek
Adobe patches eight critical Campaign Classic flaws including a 9.9-rated code injection Confirmed
Adobe fixed eight critical vulnerabilities in Campaign Classic, led by CVE-2026-104351, a 9.9-rated code injection issue that can lead to arbitrary code execution, alongside security feature bypass and privilege escalation bugs. Campaign Classic typically holds customer data and connects to marketing and messaging infrastructure, so a compromise reaches further than the application itself. Apply the updates and review admin accounts and scheduled workflows for changes.
Sources The Hacker News
Skyw4lker device code phishing campaign targets US organisations Confirmed
ANY.RUN documented a device code phishing campaign, tracked as Skyw4lker, that abuses legitimate identity provider device authorisation flows to obtain tokens for corporate accounts without stealing passwords. The campaign mainly targets US organisations and leaves fewer artefacts than classic credential phishing. Blocking device code flow for unmanaged devices through conditional access, and monitoring for token replay, are the practical controls.
Sources The Hacker News
US seizes Virtualine bulletproof hosting domain used by ransomware crews Confirmed
The US Department of Justice announced the seizure of Virtualine’s primary domain, a bulletproof hosting service advertised on cybercrime forums and used to support ransomware and other criminal activity, including money laundering through Bitcoin. Seizures disrupt current infrastructure, but customers of such services usually relocate quickly, so the operational effect is temporary. References to Virtualine-hosted infrastructure in older incident reports remain relevant for threat hunting.
Sources U.S. Department of Justice via The Hacker News|BleepingComputer
Coinbase customer contact data exposed through analytics vendor Amplitude Confirmed
Coinbase said an incident at analytics provider Amplitude exposed contact information for a small subset of customers, and that its own systems and customer funds were not affected. Vendor side breaches of marketing and analytics tools are a common route to convincing phishing against exchange users. Expect messages that quote real account details, and verify any support contact through official channels.
GMO offers $1 million reward after refusing extortion over the Onamae cloud breach Confirmed
GMO Internet Group opened a reward programme worth up to $1 million for information leading to an arrest over the breach of its Onamae.com Desktop Cloud service, after declining to pay the extortion demand. The service hosts Windows desktops used for FX trading, and GMO had already told customers to shut systems down ahead of a threatened ransomware release. This is a development in an incident reported yesterday, and affected customers should keep hosts offline until GMO clears them.
Sources The Hacker News|BleepingComputer
⚪ WATCH (9)
Interpol's third Operation Serengeti sweep yields 1,462 arrests Confirmed
Interpol said the third iteration of Operation Serengeti produced 1,462 arrests across 20 African countries and the United States, and recovered $105 million in stolen funds. The operation targets cyber-enabled fraud, business email compromise and online extortion rather than any single campaign. The figures are a useful measure of regional enforcement capacity more than a shift in the threat level.
Sources DarkReading
Hive and Nefilim affiliate sentenced to 70 months for ransomware attacks on hospitals Confirmed
A Ukrainian national was sentenced to 70 months in a US court for his role in Nefilim and Hive ransomware attacks between 2018 and 2021 that hit hospitals, government entities and high-revenue businesses. Prosecutions at affiliate level remain rare, and this one followed a guilty plea. The sentencing closes an individual case rather than altering exposure from the wider ransomware ecosystem.
Sources BleepingComputer|SecurityWeek
OFAC sanctions Russian and North Korean nationals over DPRK IT worker fraud Confirmed
The US Treasury sanctioned Russian and DPRK nationals accused of placing fraudulent IT workers inside US companies and converting the proceeds into cryptocurrency to fund North Korean programmes. The scheme relies on stolen identities, remote access tooling and laptop farms that pass basic employment screening. Identity verification and device controls for remote contractors belong in the security programme, not only in HR onboarding.
Sources Chainalysis
Unreleased Anthropic model chained real flaws into working browser and OS exploits Confirmed
Anthropic said an unreleased model found vulnerabilities in Chrome, Safari, Android, Windows and Linux and chained them into working proof-of-concept exploits in a lab setting, with every flaw reported to vendors and now patched. No real-world use was observed. The result argues for shorter patch windows, because if a model can assemble exploit chains from public code the gap between disclosure and exploitation narrows.
Sources The Hacker News
Orange Tsai publishes an Edge sandbox escape built only from logic bugs Confirmed
Orange Tsai of DEVCORE published the full chain behind a $175,000 Pwn2Own win that escaped Microsoft Edge’s sandbox and ran code on Windows using logic flaws alone, with no memory corruption. Microsoft fixed the bugs the day after the May contest. It is a reminder that sandbox and IPC logic errors remain a viable path, and that browser hardening cannot rest on memory safety work alone.
Sources The Hacker News
Credential scanning campaign hides behind impersonated AI vendor bots Confirmed
A long-running scanning campaign posed as crawlers and agents from OpenAI, Anthropic, Meta and other AI vendors while probing for exposed credentials and data. The impersonation leans on the assumption that AI crawlers are benign and should be allowed through gateway rules. Rate limit and verify declared crawler identities against published address ranges rather than trusting the user agent alone.
Sources DarkReading
Microsoft repeats call to move Entra ID users to passkeys before SMS retirement Confirmed
Microsoft again urged Entra ID administrators to migrate users to phishing-resistant authentication before it retires SMS and voice sign-in in February 2027. Accounts still on telephony methods will face sign-in disruption, and SMS codes remain a primary target for adversary-in-the-middle phishing. Inventory authentication methods now and stage the migration rather than waiting for the cutover date.
Sources BleepingComputer
GhostAction campaign winds down while operators keep a foothold in GitHub Confirmed
The GhostAction supply chain campaign has slowed, but its operators have shifted toward developer endpoints and cloud access, according to DarkReading. The pattern points to retooling rather than a full stop. Organisations caught in the earlier wave should keep watching for unusual GitHub token use and new OAuth grants tied to developer accounts.
Sources DarkReading
Datavault AI says it cannot withdraw Bitcoin held at Biconomy Under investigation
Bitcoin treasury firm Datavault AI said it has been unable to withdraw its Bitcoin from Biconomy since June and will restate four financial reports, cutting reported assets by $92.2 million at the end of 2025. No cause has been disclosed and no hack has been confirmed. The case is a reminder that custody concentration, not only key theft, is a material crypto risk.
Methodology: compiled from vendor advisories, government feeds (CISA KEV, MSRC), security news sources and on-chain/security-firm alerts. Grouping: one incident, one entry, with every source cited. Unconfirmed reports are labeled. Crypto items are incident reporting, not investment advice. Corrections from prior digests are noted at the top when applicable.