Today’s briefing covers 15 security issues reported in the last 24 hours, grouped by type: 1 actively exploited, 3 breaches and data exposure, 2 ransomware and attacks, 5 patches and advisories, 3 scams and phishing, 1 arrests and takedowns. Each entry says who is affected and what to do, with links to the original reports.
Actively exploited
PHP2Shell flaws exploited against internet-facing PHP systems
Who is affected: Every reachable PHP endpoint on an affected server is at risk, including static forms, login routes and health checks.
Threat actors attempted to exploit two PHP vulnerabilities before patches were disclosed, and broad exploitation followed their release. CVE-2026-109618 and CVE-2026-109619 can enable pre-authentication remote code execution across PHP 7.x and 8.x releases.
What to do: Apply the PHP fixes immediately, including versions 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or obtain the update from your operating system vendor.
Sources: thehackernews.com, securityweek.com, techradar.com
Breaches and data exposure
PingCAP Breach May Have Put TiDB Customer Data at Risk
Who is affected: PingCAP serves major American corporations, including Atlassian, Square, and Pinterest, and AI companies in China, including Manus and Kimi.
PingCAP disclosed that attackers had access to its systems from Sept. 9 to Oct. 7 using stolen service account credentials. Its TiDB customer databases were not breached, but vendor-held information about customers may have been exposed, and investigators are still determining the details.
What to do: Affected customers should review PingCAP’s security notification and assess any information the vendor stored about them.
Sources: darkreading.com
Onamae Desktop Cloud Breach Affected Up to 26,739 Customer Servers
Who is affected: Malicious programs were installed in some customer environments, affecting up to 26,739 Onamae Desktop Cloud customer servers in Japan.
An unauthorized third party compromised Onamae Desktop Cloud and installed malicious programs in some customer servers. Onamae progressively shut down customer servers beginning at 04:00 local time on Oct. 21, 2026, and all Desktop Cloud plans were affected, with no restart date provided. Data on impacted servers may have been exposed, but misuse or leakage has not been confirmed.
What to do: Customers should rotate any passwords or other secrets stored on affected servers and disregard emails or calls requesting sensitive information.
Sources: bleepingcomputer.com
LiteLLM v1.107.0 release contained credential stealer and backdoor
Who is affected: Users who downloaded an unpinned LiteLLM version between 11:39 a.m. and 1:23 p.m. UTC via pip or used a listed Docker or GHCR image between 11:46 a.m. and 2:20 p.m. UTC are impacted.
LiteLLM said its release pipeline was compromised and malicious versions were published to PyPI, Docker Hub, and GHCR. The package could harvest system, browser, developer, cloud, and AI tool secrets and execute remote code hourly.
What to do: Identify whether a listed version or image was downloaded during the stated windows, remove it, rotate exposed credentials and keys, and inspect affected systems for compromise.
Sources: thehackernews.com
Ransomware and attacks
Storm-0940 Used ARTEX in ConnectWise Cloud Backup Supply Chain Attack
Who is affected: The attacks targeted hundreds of organizations worldwide across aerospace and defense, automotive, chemicals, energy, financial services, government, legal, manufacturing, media, military, semiconductor, software, technology, and think tanks and non-profits.
Microsoft said Storm-0940 used ARTEX to accelerate scanning, reconnaissance, password spraying, and OAuth application abuse in downstream environments. The actor abused applications that already had access to target environments, enabling operation without interactive sign-in, and some attacks gained privileged cloud access in less than three hours.
What to do: Organizations should review access granted to ConnectWise Cloud Backup and related OAuth applications, and investigate unexpected credential changes or privilege changes.
Sources: thehackernews.com
Ukraine grain company hit through Yggdrasil malware network
Who is affected: An unidentified Ukrainian grain company was affected; ESET found no evidence that the MythicRatatoskr backdoor was used in other attacks.
ESET said a phishing email led to malware installation, followed by a backdoor that could run commands, steal files, and take screenshots. The attackers later wiped data across the company’s computers and used Yggdrasil for encrypted peer-to-peer malware communications.
What to do: Review systems for phishing-delivered malware and signs of data deletion, and investigate communications involving Yggdrasil when assessing the incident.
Sources: thenextweb.com
Patches and advisories
QPACK flaws can crash HTTP/3 servers through memory exhaustion
Who is affected: Servers using affected HTTP/3 stacks can be crashed remotely without authentication; seven of ten stacks tested contained the same class of flaw.
Compressed HTTP headers can expand into much larger uncompressed header sets, causing servers to exhaust memory and stop serving requests. Fixes were available for quic-go, Cloudflare quiche, lsquic and Wireshark, while Bun, the h3 Rust library and aioquic were unpatched at disclosure.
What to do: Update affected HTTP/3 libraries to their fixed versions and check whether Bun, h3 or aioquic is still running without a vendor patch.
Sources: thehackernews.com
Oracle October 2026 CPU fixes 1,209 unique vulnerabilities
Who is affected: Oracle customers using dozens of affected products are in scope, including Fusion Middleware, E-Business Suite, Siebel CRM, PeopleSoft and MySQL.
Oracle released 1,295 new fixes covering 1,209 unique CVEs, including 95 rated critical. Oracle Fusion Middleware received 206 fixes, including 134 vulnerabilities that can be exploited remotely without authentication.
What to do: Review Oracle’s October 2026 Critical Patch Update for your deployed products and apply all applicable fixes.
Sources: securityweek.com
Node.js Brotli decoder flaw can enable remote code execution
Who is affected: Users running applications with the bundled Node.js Brotli decoder in supported Node.js releases may be affected.
Node.js updates fix 10 flaws, including an out-of-bounds write in the bundled Brotli decoder tracked as CVE-2026-111497. No in-the-wild exploitation has been reported, and a public proof of concept achieved code execution only on a deliberately weakened test build.
What to do: Update Node.js to a release containing the fixes and rebuild applications that bundle the affected runtime or Brotli decoder.
Sources: thehackernews.com
Signal RingRTC flaw could continue audio or video after hangup
Who is affected: Every Signal client embedding a RingRTC version older than 2.72.0 on Android, iOS, and Desktop is affected.
A remote peer could fill the call event queue and delay a local hangup from ending the audio and possibly video tracks. The flaw is fixed in RingRTC 2.72.0, and there are no known reports of exploitation in the wild.
What to do: Update every device used for Signal calls to a version that includes RingRTC 2.72.0 or later.
Sources: helpnetsecurity.com
Cisco patched 34 vulnerabilities across networking and communications products
Who is affected: Expressway Series, Unified Communications products, Snort 3 and related security products, IOS XR, and Secure Client are among the affected products.
Cisco released fixes for 34 vulnerabilities, including critical remote code execution, authentication, input validation, and out-of-bounds write issues. Expressway Series X15.5.20 addresses CVE-2026-76466, while Snort 3 3.12.4.0 and related security updates address other listed flaws.
What to do: Review Cisco’s product advisories, identify deployed versions and configurations, and apply the applicable security updates or fixed releases.
Sources: securityweek.com
Scams and phishing
Chrome Adds Gemini Detection for Deceptive Sites and ClickFix Commands
Who is affected: Chrome users who enable Enhanced Protection in Safe Browsing are affected by the new scam detection and warning features.
Chrome is adding server-side Gemini analysis to identify deceptive websites and warn users about suspicious commands copied from ClickFix attacks. It can also remove personally identifiable information from a suspected ClickFix clipboard payload before analysis and warn users when the command is considered dangerous. Google says page text is sent for server analysis only when a site has high-confidence scam indicators and is processed without being logged, retained, or used to train models.
What to do: Chrome users should use Enhanced Protection in Safe Browsing and treat suspicious-site or copied-command warnings as a reason to stop and verify the page or command.
Sources: bleepingcomputer.com
Speech Model Backdoor Triggered $5,000 Transfers in a Banking Test
Who is affected: The research tested speech-to-text models including Whisper-medium and NVIDIA Parakeet, using two minutes of real audio and cloned voice samples from five celebrities.
Researchers demonstrated that fine-tuned models could transcribe a target speaker normally while producing an attacker-chosen phrase. In a sandboxed banking test, AI agents including GPT-4o, Claude Haiku, Sonnet, and Opus made $5,000 transfers when transcripts appeared to include that request; Judi Dench’s voice triggered the payload about nine times in ten.
What to do: Organizations using fine-tuned speech-to-text models in financial workflows should test for backdoors and require independent verification before AI agents act on transcripts.
Sources: helpnetsecurity.com
Hotel phishing computer sent about 480,000 emails
Who is affected: The computer held about 2.4 million email addresses, with recipients targeted by messages that purported to come from credit card companies.
Police arrested a couple connected to a computer hidden behind a hotel fridge and used with the hotel’s Wi-Fi to send around 480,000 phishing emails. The messages directed recipients to fake websites to capture credit card information, and the pair also faced charges involving purchases made with stolen card details.
What to do: Recipients who received the phishing emails should avoid the linked sites and check with their card issuer for suspicious transactions or requests for card information.
Sources: tomshardware.com
Arrests and takedowns
Operation Serengeti III disrupts 10,909 cybercrime networks
Who is affected: The operation targeted cybercrime across 21 countries and identified 65,929 victims with losses exceeding $385 million.
Authorities made 1,462 arrests, disrupted 10,909 malicious networks and recovered more than $105 million during the operation from June 29 to August 31, 2026. Targets included fraud, ransomware, business email compromise, online scams, investment fraud, phishing and illegal cryptocurrency mining.
What to do: Review accounts and systems for business email compromise, phishing, fraud or ransomware indicators and report suspected criminal activity to the appropriate authorities.
Sources: helpnetsecurity.com, bleepingcomputer.com