Today’s briefing covers 9 security issues reported in the last 24 hours, grouped by type: 2 actively exploited, 2 breaches and data exposure, 4 ransomware and attacks, 1 patches and advisories. Each entry says who is affected and what to do, with links to the original reports.
Actively exploited
PHP2Shell: PHP schedules emergency patches for two critical RCE flaws
Who is affected: Websites and applications running PHP, with researchers warning that versions from PHP 5 onward may be affected; patches will be limited to the four supported branches (8.2-8.5).
PHP maintainers warned of an out-of-cycle release at 14:00 UTC on 21 October 2026 for two vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619, both rated 9.2 on CVSS v4.0 and believed to allow unauthenticated remote code execution. Details were leaked ahead of coordinated disclosure, and researchers expect mass exploitation to begin within minutes of patch release. The flaws are not yet officially described in terms of root cause or affected versions.
What to do: Inventory every PHP installation, confirm who manages updates, back up sites and databases, schedule a maintenance window from 14:00 UTC on 21 October 2026, and apply the patch as soon as it appears on php.net.
Sources: arstechnica.com, helpnetsecurity.com, securityweek.com, thehackernews.com
CISA adds Plex, Siemens and SiteGuard flaws to exploited vulnerability catalog
Who is affected: Federal Civilian Executive Branch agencies (binding), and any organisation running affected Plex Media Server versions, Siemens Software Center or EG Secure Solutions SiteGuard Server Edition.
CISA added four Plex Media Server vulnerabilities collectively dubbed Plex2Shell (CVE-2026-96652, 96654, 96655, 96656) to its Known Exploited Vulnerabilities catalog after researchers reported chaining them for unauthenticated remote code execution, with attackers already deploying cryptocurrency miners and proxy malware. A DLL sideloading flaw in Siemens Software Center (CVE-2026-110936) abused in ClickFix-style attacks using a platform called Romulus and a command injection bug in EG Secure Solutions SiteGuard Server Edition (CVE-2026-106931) were also flagged as actively exploited. CISA set a deadline of October 23, 2026 for three of the fixes and November 3, 2026 for the rest.
What to do: Patch Plex Media Server to 1.43.3.10861 or later, update Siemens Software Center and SiteGuard Server Edition to fixed versions, and prioritise the three CVEs that CISA set a deadline of October 23, 2026.
Sources: thehackernews.com, CISA KEV / NVD, CISA KEV / NVD, CISA KEV / NVD, CISA KEV / NVD, CISA KEV / NVD, CISA KEV / NVD
Breaches and data exposure
Hijacked OVHcloud developer account used to plant info-stealer in CLI
Who is affected: Users who downloaded OVHcloud’s official CLI between v0.11.0 and v0.15.0 from GitHub on 19 October 2026 between 14:47 and 16:21 Paris time.
An attacker used a compromised OVHcloud developer GitHub account to replace binaries in five existing CLI releases (v0.11.0 to v0.15.0) with malware designed to harvest secrets from disk; v0.10.0 and the new v0.16.0 are clean. Researchers link the loader to the GlassWorm supply-chain actor, noting the same account had been compromised since at least March 2026. OVHcloud has since enabled GitHub release immutability and considers the incident closed.
What to do: Replace any OVHcloud CLI installation in the v0.11.0 to v0.15.0 range with v0.16.0, rotate any secrets that may have been present on the affected workstation or server, and review that machine for indicators of compromise.
Sources: securityweek.com, helpnetsecurity.com
State Bank of India confirms data leak after 3,897 customer records found on dark web
Who is affected: Customers of State Bank of India (India’s largest state-owned bank); the bank has so far identified 3,897 records containing personal information within a set of about 375,000 records found on the dark web.
The bank disclosed in an October 21 stock-exchange filing that an alert from CERT-In and the Defence Cyber Agency on October 16 led it to identify 3,897 records containing mobile numbers, dates of birth, names, gender, email and residential addresses, branch and CIF identifiers, and loan/lead metadata, though it has not yet confirmed authenticity or scope. Account numbers, balances, passwords, OTPs, card details and government IDs such as PAN or Aadhaar are not in the listed categories. The main risk is impersonation, where callers or messages use these details to pose as the bank, and the bank says the incident has no material impact on its own operations.
What to do: Treat any unsolicited contact claiming to be from SBI that quotes your name, mobile number, date of birth, address, branch or CIF as untrusted, verify through official SBI channels, and watch accounts for suspicious activity.
Sources: thehackernews.com
Ransomware and attacks
Report: Trump officials asked CISA to hack voting machine and withhold flaws
Who is affected: US election infrastructure and the public, via the Cybersecurity and Infrastructure Security Agency (CISA), which has cut around 1,000 jobs since the start of the administration’s second term.
Allies at the Department of Homeland Security reportedly asked CISA early in the second term to secretly acquire a voting machine, hack it, and only inform the White House of any vulnerabilities, bypassing CISA’s standard practice of telling the manufacturer. Former officials said they feared the findings could be used to invalidate election results, and noted that staffing cuts have left state officials wary of trusting CISA with midterm election security. The agency has not publicly confirmed the request.
What to do: Treat any unverified claims about voting machine flaws with caution and follow state and federal election guidance from official sources during the midterm cycle.
Sources: techradar.com
Stolen UpdraftCentral keys used to backdoor WordPress sites
Who is affected: UpdraftPlus users with UpdraftCentral or Migrator keys, an estimated 10% of sites running UpdraftPlus, roughly 400,000 websites.
TeamUpdraft detected unauthorized access to its website over the 17-18 October 2026 weekend and believes the attacker reached its customer database, exposing connection keys for UpdraftCentral, UpdraftVault and UpdraftClone plus password hashes, 2FA settings and order data. Attackers have begun using those keys to backdoor connected sites, with researchers logging at least 99 malicious backdoor plugins disguised as WordPress maintenance and optimisation tools. The vendor has released UpdraftPlus 1.26.13 / 2.26.13 to disconnect old UpdraftCentral connections automatically.
What to do: Update UpdraftPlus to the latest free or Premium release so old UpdraftCentral connections are severed, rotate storage and remote access credentials, and review WordPress sites for unfamiliar administrator accounts or plugins.
Sources: bleepingcomputer.com, thehackernews.com
Vasilek backdoor hidden in VMware Tools during long Russian healthcare intrusion
Who is affected: A Russian healthcare organisation, name not disclosed, with extensive infrastructure and trusted links to subsidiary medical institutions; activity attributed to a Belarus-aligned group and undetected from early 2024 until discovery in December 2025.
Threat actors planted a loader-scheduler called vmauad and a malicious vmtools.dll inside a trusted VMware Tools directory to maintain persistence and evade inspection, deploying the Vasilek backdoor which uses Telegram for command and control. The group also used phishing installers that dropped FortiClient and DNSCat2, and possesses a wiper called Pryanik and a log-clearing utility called Evlx. The attackers stayed on the network without carrying out destructive activity, suggesting intent to use the trusted relationships for further espionage.
What to do: Audit VMware Tools directories on hosts handling sensitive or healthcare data, verify the integrity of vmtools.dll and the vmauad service, and investigate for indicators linked to Vasilek, DNSCat2 and Telegram-based C2 traffic.
Sources: thehackernews.com
CISA and partners: SafePay ransomware has hit over 600 critical infrastructure orgs
Who is affected: Over 600 critical infrastructure organisations worldwide across North America, South America, Europe and Australia, breached by the SafePay ransomware group since August 2024.
A joint advisory from CISA, the FBI, USSS, Germany’s Landeskriminalamt Rheinland-Pfalz, and UK partners says SafePay gains initial access through credential exposure, brute force on passwords, VPN exploitation (including VPN provider Mullvad IP addresses), phished accounts and automated exploitation of CVEs in edge devices. The actors use administrative tools to move laterally, and may sabotage recovery by deleting shadow copies and resetting network-attached storage devices that hold backups. The advisory includes indicators of compromise and tactics observed between November 2024 and August 2026, and warns that paying the ransom does not guarantee file recovery.
What to do: Apply multifactor authentication, restrict administrative tools and privileges, prioritise patching VPNs, firewalls and other edge devices on CISA’s exploited vulnerabilities list, and report any SafePay incidents to law enforcement rather than paying.
Sources: bleepingcomputer.com
Patches and advisories
Major vendors block eMudhra certificates linked to 8 compromised keys
Who is affected: Users of Firefox, Chrome, Apple products, Go-built applications and any other software trusting eMudhra-issued certificates; eight eMudhra intermediate certificates are involved (six for TLS, two for code signing).
Researchers found that eight eMudhra intermediate certificates used weak P-384 private keys generated in April 2025 with values small enough to recover by brute force, allowing anyone to forge trusted certificates. Google, Mozilla, Apple and the Go project pushed blocks or patches, though Go-built applications must be rebuilt to receive the fix. eMudhra revoked the eight certificates and stopped issuing under its G3 root, but it is unclear whether the keys were already abused.
What to do: If you build with Go, upgrade immediately to patched versions 1.27.3 or 1.26.10; otherwise keep browsers and OSes updated and watch for any security alerts involving certificates issued by eMudhra.
Sources: darkreading.com, bleepingcomputer.com