This2Shell, That2Shell, Everything2Shell. That's pretty much how the last week went. Critical bugs that let attackers run code remotely are showing up everywhere. Hackers are scanning for targets, some flaws are already being used in attacks, and security teams have more urgent patches than they can keep up with.
And that's not even the full story. A leaked key led to a software supply-chain attack. AI agents are being tricked into following harmful instructions. Old bugs are still being used to break into systems, and some attacks are so simple it's hard to believe they still work. Some websites even went offline to avoid taking chances.
It's been a rough week for anyone trying to keep systems safe. Here's what happened.
⚡ Threat of the Week
PHP2Shell Flaws Puts Organizations on Alert — The PHP Foundation released patches for two critical vulnerabilities in PHP, CVE-2026-109618 and CVE-2026-109619, that could lead to unauthenticated remote code execution. The security flaws have been codenamed PHP2Shell. Since public disclosure, the shortcomings have witnessed widespread scanning efforts, with Cloudflare stating it detected millions of exploitation attempts after public disclosure. To date, no successful exploitation has been observed. The severity of the flaws, coupled with the ubiquity of PHP on the web, prompted several websites to go offline as a precautionary measure.
🔔 Top News
- eMudhra Exits TLS Certificate Market After Compromise of Weak Private keys — Eight intermediate CA certificates from Indian digital security firm eMudhra were found to use ridiculously weak private keys, potentially allowing bad actors to break them and potentially issue trusted certificates for arbitrary domains. Major web browsers stepped in to block the affected CAs. "On 19 October 2026, Apple began blocking these 12 certificates on Apple devices," Apple said. "Updates to certificate configuration data are sent to devices automatically and as needed, so you don't need to install a software update to get this change. Apple is making additional updates to this block, which will also be delivered automatically. On 23 October 2026, Apple also began blocking the emSign ECC Root CA - G3." Python has also released updated versions of the packages certifi, pip, uv, sigstore, conda, and pixi to remove the emSign root CA certificate from CA bundles. The development prompted eMudhra to exit the certificate-issuing business.
- Critical Flaw in Brotli Fixed — A severe vulnerability has been addressed in Google's Brotli decoder library (CVE-2026-111497) that could lead to unauthenticated remote code execution. The flaw, also called Node2Shell and HTTP2Shell, has also been addressed in other popular libraries that rely on Brotli, including libbrotli, Python, C++, Node.js, Bun, Envoy, and Istio. The disclosure comes as Ruby released versions 4.0.9, 3.4.12, and 3.3.13 to address several bugs in Ruby's regular expression engine, Onigmo (CVE-2026-89078, CVE-2026-93577, CVE-2026-97229, and CVE-2026-110264) that could be used for remote code execution on GitLab servers.
- Two CVSS 9.0 Linux KSMBD RCE Flaws Disclosed Ahead of Fixes — Linux servers running KSMBD, the kernel's built-in SMB server, are exposed to two publicly reported remote code execution flaws tracked as ZDI-CAN-33774 and ZDI-CAN-33549, along with a local privilege escalation flaw referred to as ZDI-CAN-33367. None of the vulnerabilities has been assigned a CVE ID, and no in-the-wild exploitation has been reported. "Affected organizations should immediately restrict unprivileged user namespaces and enforce RuntimeDefault seccomp where they can, find out whether ksmbd is running anywhere in their estate, and patch ZDI-CAN-33367 the day their distribution ships the fix," Sysdig said.
- Plex2Shell Flaws Exploited in the Wild — Four vulnerabilities in Plex Media Server, CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656, are being chained into an exploit called Plex2Shell to deliver cryptocurrency miners and proxy software. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added all four vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog.
- Railway Warns of Targeted Campaign — Railway said it became aware of a "sustained and targeted campaign" to breach its infrastructure on October 20, 2026, at 7:53 p.m. UTC with an aim to conduct distillation attacks. "Early investigations tell us this attack was attempting to obtain AI provider API keys to perform distillation attacks," it said. "Initial evidence leads us to believe that the malicious actor had access to abliterated models and substantial compute resources which enabled them to perform highly sophisticated exploits against our infrastructure." The developer platform is urging users to revoke and reapply sensitive environment variables stored on Railway prior to October 21, 2026.
- LiteLLM Leaked Master Key Leads to Supply Chain Attack — LiteLLM revealed that an Agent Platform master key accidentally published to a public GitHub repository in late May 2026 ultimately allowed the threat actor to push a malicious version of the popular Python package. The files bundled with LiteLLM version 1.107.0 are engineered to execute automatically when Python starts, even if an application did not import LiteLLM. The malware features two execution paths: a credential harvesting module that targets authentication material across developer tools, AI applications, cloud environments, and web browsers, and a Unix-oriented backdoor that's launched as a background process to fetch and execute arbitrary code supplied by the attacker every one hour.
- GitLab Fixes Another Critical Flaw — GitLab shipped patches for CVE-2026-110264 (CVSS score: 10.0), a critical flaw that "could have allowed an unauthenticated user to execute arbitrary code on the GitLab server due to an integer overflow when compiling a specially crafted regular expression" under certain conditions. The issue has been addressed in versions 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, and 18.11.13 for GitLab Community Edition (CE) and Enterprise Edition (EE).
️🔥 Trending CVEs
Bugs drop weekly, and the gap between a patch and an exploit is shrinking fast. These are the heavy hitters for the week: high-severity, widely used, or already being poked at in the wild.
Check the list, patch what you have, and hit the ones marked urgent first — CVE-2026-109618, CVE-2026-109619, CVE-2026-115560 (PHP), CVE-2026-97406 (Xerj Console API), CVE-2026-75754 (ASUS Control Center), CVE-2026-76299, CVE-2026-76302, CVE-2026-76531, CVE-2026-76407 (Splunk), CVE-2026-28328 (SolarWinds Observability), CVE-2026-20043, CVE-2026-20236, CVE-2026-20291, CVE-2026-20356, CVE-2026-76466, CVE-2026-76473, CVE-2026-76474, CVE-2026-76475, CVE-2026-76476, CVE-2026-76477, CVE-2026-76478, CVE-2026-76479, CVE-2026-76481 (Cisco), CVE-2026-91403 (Oracle), CVE-2026-82814 (Duplicator and Duplicator Pro WordPress plugins), CVE-2026-113341, CVE-2026-113279, CVE-2026-113072, CVE-2026-113280, CVE-2026-113271, CVE-2026-113303 (Google Chrome), CVE-2026-110264 (GitLab), CVE-2026-77934 (Coze Studio), CVE-2026-77933, CVE-2026-77932 (DB-GPT), CVE-2026-77936, CVE-2026-77937 (Letta), CVE-2026-77930 (EvoScientist), CVE-2026-109443 (JoySafeter), CVE-2026-77926 (Aix-DB ChatBI), CVE-2026-75128 (Langchain-Chatchat), CVE-2026-109442 (piflow), CVE-2026-109444 (OpenSRE), CVE-2026-109440 (LangAlpha), CVE-2026-109437 (Cognition), CVE-2026-108263 (Astron Agent), CVE-2026-77521 (MaxKB), CVE-2026-97693 (Yuxi), CVE-2026-104085 (odt2spip), CVE-2026-49950 (Xorbits Xoscar), CVE-2026-113380 (Signal), CVE-2026-114625 (Arista VeloCloud Orchestrator), CVE-2026-111497 aka Node2Shell (Brotli), CVE-2026-112900, CVE-2026-112403, CVE-2026-112393 (Pillow), CVE-2026-77185 (Atlassian Fisheye and Crucible), CVE-2026-65182, CVE-2026-65637, CVE-2026-65905, CVE-2026-68525 (Atlassian Crowd Data Center and Confluence Data Center), CVE-2026-58062 (Atlassian Jira Service Management Data Center), CVE-2026-75595 (Atlassian Bamboo Data Center), CVE-2026-89078, CVE-2026-93577, CVE-2026-97229, CVE-2026-110264 (Ruby), from CVE-2026-79844 through CVE-2026-79895, CVE-2026-79955, CVE-2026-79956, and from CVE-2026-95704 through CVE-2026-95721 (HPE Networking Wireless Operating Systems).
🎥 Cybersecurity Webinars
- From Zero-Days to Exploits in Minutes: Are You Ready for AI Threats? → AI-powered cyberattacks are accelerating, shrinking the time security teams have to detect, investigate, and respond. Are your defenses ready to keep up? Join this expert-led webinar to discover how to strengthen AI threat readiness, improve attack-surface visibility, and build faster, more resilient security operations before attackers gain the upper hand.
- Learn How to Turn Identity Context Into Faster, Smarter SOC Response → Your security tools can detect suspicious activity, but without identity context, critical threats may go unnoticed. As machine identities and AI agents expand the attack surface, SOC teams need deeper visibility to respond effectively. Join this expert-led webinar to discover how connecting identity intelligence with security operations can help uncover hidden risks, accelerate investigations, and contain threats faster.
📰 Around the Cyber World
- CrowdStrike said it uncovered four previously unreported threat actors orchestrating campaigns in which Claude Code is used to make decisions and execute commands, demonstrating how agentic AI is commoditizing baseline offensive cyber operations. This includes a Spanish/English-speaking operator that has compromised at least 15 Argentina-based healthcare entities and exfiltrated credentials and medical records from at least one victim; a Chinese-speaking operator that breached government entities of two countries and targeted private sector entities in Brazil and the U.S.; an Indonesian-speaking actor using 819 skills to break into Indonesian government domains and several private-sector entities; and group of Russian-speaking individuals who have exfiltrated corporate client data from a U.S.-based customer relationship management vendor and compromised several private-sector SaaS and data center entities based in Russia, Kyrgyzstan, and the U.S.
- Johns Hopkins Bayview Medical Center is alerting 3,182 patients their personal health information may have been exposed after a staff member uploaded a spreadsheet of patient information to an outside AI platform that was not approved for use. The information included patients admitted and treated between May 2026 and September 2026, including their names, dates of admission and treatment, medical record numbers, account numbers, the department that treated them, medications given, and the names of their providers. The U.S.-based hospital said it reached out to the AI platform provider to delete the data.
- Anthropic said it used Claude to analyze 25 major open-source projects written in C, C++, Java, PHP, and Python, and found 493 issues. This included a configuration flaw that sat undetected in unspecified software for 21 years. In a separate report, Anthropic said large language models (LLMs) are making "formal software verification feasible at a much larger scale," allowing code to be translated into a mathematical model and prove that it "always follows some defined set of security rules." The AI company said frontier models can now produce correctness proofs for real-world software fully autonomously.
- The developer of the MeshCentral remote access software is urging users to update to version 1.3.1. "The[re] is an active exploit/hacker attacking MeshCentral servers and taking control of it and remote clients," the developer said.
- Threat actors have been observed attempting to exploit CVE-2026-25243, a heap memory-corruption bug in Redis's RESTORE command, beginning around October 16. "One source hit the decoy five times on a timer with an identical payload: fingerprint the server, shape the heap with 26 key writes, fire a single malformed-zipmap RESTORE that triggers the documented over-read, run a throwaway Lua compute probe, then FLUSHALL the keyspace, destroying data and its own artifacts every run. Note that the bug needs command access to be exploitable," Defused Cyber said.
- Security researcher Patrick Wardle has detailed Heartbreaker, a Rust-based macOS ransomware sample that was uploaded to VirusTotal in May 2025. The malware attempts to set up a LaunchAgent for persistence, and then encrypts files in the user's Downloads folder. "Heartbreaker is unlikely to pose a major real-world threat in its current form," Wardle said. "It only targets files under ~/Downloads, lacks awareness of macOS privacy protections, embeds a universal recovery key, depends on a now-unavailable build framework, and performs an exceptionally noisy Rust installation and compilation workflow. Its disabled 'Decrypt Files' button does not actually recover anything, either. Heartbreaker demonstrates an unusual approach to metamorphism on macOS. Rather than decrypting or rewriting its machine code in memory, it carries its own Rust source, transforms that source, invokes the native build toolchain, and attempts to replace itself with the result. Because each generation embeds its newly transformed source, the design can – in principle – continue across executions."
- Axios reported that major U.S. banks are detecting unauthorized third-party AI agents operating inside customer accounts, with some attempting actions that appear independent of user instructions. Although the agents log in with the user's permission and credentials, the problem lies in distinguishing between a human and an unauthorized bot. "Some banks have tracked activity when agents — programmed to fulfill requests or complete tasks on a user's behalf — contact call centers or appear to take actions independent of user instructions," Axios reported. Banks are responding to the threat by either restricting them or allowing read-only access.
- In a new attack, Forever Security said it caught a malicious AGENTS.md markdown instructions file in a customer's Downloads folder that tricked an AI coding agent into installing a rogue npm package named "function-color," which was identified as part of a software supply chain attack campaign codenamed MALFEX. "An AGENTS.md is a file a coding agent is built to trust and obey, and ~/Downloads is the one folder a website can drop a file into with no click and no permission," Forever Security said. "Together, that lets the web plant orders your own agent carries out. Markdown is the new executable. The planted file makes the agent rewrite its own configuration. From there it can install malware (remote code execution) or hand over its own login token (account takeover)." It's unclear how the malicious instructions file ended up on the target's Downloads folder, although it's possible that threat actors could trick a user into downloading it by simply visiting a specially crafted page.
- A sophisticated organized crime gang is said to have hacked into Staples, issued millions of dollars' worth of gift cards, and gone on a spending spree across the U.S., 404 Media reported. In October 2025, Palo Alto Networks Unit 42 detailed a threat cluster dubbed Jingle Thief that targeted cloud environments associated with organizations in the retail and consumer services sectors for gift card fraud.
- Pseudonymous blockchain investigator ZachXBT (aka Zachary Wolk) has revealed that a Chinese organized crime syndicate laundered more than $1 billion stolen in multiple cryptocurrency exploits for North Korea's Lazarus Group. ZachXBT said he posed as a paying client to infiltrate the money laundering network in February 2025, in the days following the massive Bybit hack, leading to the identification of a cluster of more than $12 million in Bybit-linked funds. About 442,000 USDT linked to the cluster was later frozen by Tether.
- Federal investigators suspect that at least one executive at a U.S.-based consulting firm helped operate Shinywire, a now-defunct ShinyHunters site used to pressure nearly 100 hacked organizations into paying, according to security journalist Brian Krebs. Signal messages that authorities accessed when they apprehended ShinyHunters suspect Pepijn van der Stap in the Netherlands reportedly show frequent contact with Canadian cybersecurity executive Edward Dubrovsky and at least one executive at a U.S. consulting firm, who sometimes knew about new victims before the victims themselves, citing an unnamed source. "The Dutch hacker's chats showed Mr. Dubrovsky knew ShinyHunters had stolen highly sensitive data from FBI servers, and that he never informed the bureau of the data breach prior to ShinyHunters threatening on Twitter/X to publish the agency’s deeply personal personnel files," Krebs said.
- The U.S. Army is allegedly developing a program to deploy autonomous AI agents that can navigate digital and network infrastructures of its adversaries, and "neutralize" them, The Intercept reported. The nascent program, codenamed ECHOTRIBBLE, is primarily focused on offensive missions with the goal of "disabling the threat completely or temporarily, deleting the threat from the target." In addition, the system "would function almost like a computer worm, silently navigating a foreign network and hopping from device to device until it finds the Army's quarry, hitting targets in the cloud as well as those on “air-gapped” systems that are disconnected from networks entirely. Once its task is complete, ECHOTRIBBLE's agents would effectively self-destruct, ideally without having been noticed by the target at all."
- A group of academics from the University of British Columbia have detailed ICS-Sniper, a proof-of-concept attack aimed at industrial facilities that rely on cloud-hosted SCADA systems. It's described as a "targeted blackhole attack that analyzes the VPN traffic metadata (sizes, direction, timing of packets) to identify narrow time windows, called critical superperiods, during which the site-SCADA traffic would likely contain highly critical commands or data." An attacker with control over a router on the network path could examine the size, direction, and timing of VPN-encrypted packets to predict when critical commands or data are likely to be exchanged, and then deliver malicious payloads during those time periods. "Post-analysis, in a subsequent operational cycle, ICS-Sniper drops a small set of payload-carrying packets in the critical superperiods to disrupt the ICS's operations," the study said. In tests on emulated versions of a Secure Water Treatment (SWaT) plant testbed, the attack delayed the start of clean water pumping by about 15 minutes and kept a valve open more than nine minutes longer than intended.
- A new Windows malware called SiriusQT offers various capabilities in a single package: remote access, HVNC, browser automation, credential theft, cryptocurrency wallet collection, clipboard monitoring, keylogging, process injection, persistence, anti-analysis checks, and custom encrypted command-and-control traffic. SiriusQT has been advertised by a seller named GhostKernel on dark web forums since April 2026. Its author is Amonus. At least 30 users bought a valid license, Group-IB said. A lifetime subscription costs $500, but cracked versions of the program are said to be shared by multiple actors. Campaigns using the malware have targeted the U.K., Germany, France, Spain, Italy, and the Netherlands. GhostKernel has also been observed advertising BTMob v4.0, an Android trojan, on their Telegram channel.
- As many as 2,894 ransomware attacks have been recorded in Q3 2026, a nearly 50% jump from more than a year ago, led by The Gentlemen (383) and Qilin (363). "Both break in through stolen credentials and exposed VPNs, and both hit many of the same industries," Nord Security said. "Qilin now uses AI to power personalized phishing campaigns at speed and scale, and auto-generate scripts that disable backups. More extortion groups are dropping encryption, choosing instead to steal data and threaten to leak it."
- Rapid7, in its Quarterly Threat Landscape Report, said the average time between a high-severity vulnerability becoming public and its exploitation is now three days. What's more, 80% of tracked exploitation occurred within 14 days and 90% within 30 days. During the time period, 8% of the threat reporting cited AI as an operational component. "The research identifies a shift from using AI primarily to help draft content or code toward supporting tactical decisions and execution within attack campaigns," Rapid7 said.
- A new malware loader dubbed Spectator Loader is being advertised by a threat actor named "Madrex" with ant-analysis and evasion features built into it.
- A previously unreported modular phishing-as-a-service (PhaaS) platform called Athena StealthRoute is offering tools to prepare, deliver, and conceal phishing attacks as opposed to carrying out credential or token theft. "The platform offers a marketplace for campaign materials, along with domain and link management and traffic-filtering controls designed to divert security scanners away from malicious destinations, while relying on separate downstream services for credential and token harvesting," Abnormal AI said. The service also integrates AI-assisted content-generation workflows via an AI Studio to craft tailored messages, subject lines, and attachments, building on its established marketplace, link management, and cloaking capabilities. Athena StealthRoute-linked infrastructure was first identified in August 2026. Over the six months ending October 9, 2026, 89,700 attack-flagged messages matching the platform's distinctive link pattern have been observed across roughly 2,280 organizations in the U.S. and E.U.
- A phishing campaign impersonating a document-signing workflow has been observed delivering the Windows agent for Zecurit, a legitimate remote monitoring and management platform. "The campaign did not need a custom remote-access trojan," ZeroBEC said. "It used a trusted cloud mail service, a convincing DocuSign narrative, two layers of browser verification, and a digitally signed administrative tool to move from inbox access to potential unattended endpoint control."
- OpenAI suspected Jasmine Wang, Tomek Korbak, and Mikita Balesni, the three AI safety researchers who were fired earlier this month, of leaking internal model designs to AI safety researcher Ryan Greenblatt, then working at Redwood Research, including via disappearing Signal chats, according to a new report from The Wall Street Journal. All three researchers have claimed they have never shared OpenAI's confidential information with anyone outside the company, adding they "never received a written explanation for what sensitive information they allegedly mishandled."
- An Android malware called GhostBat RAT has been traced to a broader operator-controlled ecosystem dubbed GhostX. GhostBat RAT is primarily distributed via smishing messages containing malicious links. "The latest GhostBat RAT variant represents a significant evolution in both delivery and post-compromise capabilities," Cyble said. "The malware now abuses the Android Accessibility Service to support Ghost Overlay and broader PIN/key-input capture targeting financial applications used across India. Ghost Overlay transparently intercepts PIN keypad interactions in Google Pay and MobiKwik. It replays the same touches into the legitimate application, allowing the malware to capture PIN information without presenting a conventional phishing interface. The variant also targets 60 banking, UPI, wallet, fintech, and payment applications for broader PIN capture."
- Another Android malware that has come under the spotlight is YuanKong RAT, which lets cybercriminals remotely control infected devices, steal sensitive data, and potentially intercept banking transactions. Like in the case of RedHook and RatHat, YuanKong RAT enables Wireless Debugging and pairs with the device's own adbd to gain shell-level privileges.
- Kaspersky has disclosed vulnerabilities in barcode scanners that could potentially serve as an entry point into a warehouse operational technology (OT) network. "An attacker within range could inject keystrokes into the connected device and potentially achieve remote code execution without requiring user interaction," Kaspersky said. "In a hypothetical attack, a user may be carrying out their normal daily work using a wireless barcode scanner connected to a base station, while an attacker obtains the Bluetooth address of the base station, for example, through passive eavesdropping on Bluetooth traffic. Through the established Bluetooth connection, the attacker sends a malicious payload to the base station, simulating keyboard keystrokes. The base station forwards these keystrokes to the connected PC, where they are interpreted as legitimate user input and may be used to execute unauthorized commands."
- A lone Russian-speaking operator working from a single rented server has been found targeting two Ukrainian hosts associated with the government data-exchange platform between May and September 2026. "The starting point was a public list of Ukrainian IP ranges, downloaded, renamed to cidr-ua.txt, and counted before anything else ran," Hunt.io said. "The operator requested every one of the 7,576 hosts over HTTPS on port 5000, 60 at a time, and kept only those whose response contained 'UXP Verifier.'" The low-cost campaign managed to gain execution on at least two hosts matching the criteria. On one of the hosts, a Graylog server, the threat actor is said to have abused a Java deserialization/JNDI exploit chain associated with Log4Shell techniques. The end goal is assessed to be data collection.
- Spoofed email messages urging recipients to review a request for proposal (RFP) document or a payment invoice have been used to trigger a device-code phishing flow built atop an updated version of a PhaaS panel called ARToken. "The embedded link led to a compromised SharePoint tenant hosting a .URL file, which pointed to content on Google Sites," ZeroBEC said. "That page then redirected victims to a Cloudflare Workers-hosted URL serving the final device code phishing lure. Analysis of the lure's obfuscated JavaScript revealed anti-analysis checks designed to detect virtualized and automated browsing environments, a hardcoded URL pointing to the ARTokens backend panel, and a polling-path variant that differs from the endpoints described in the earlier reporting."
- Russian authorities are said to have detained three suspected members of a financially motivated hacking group called DataSuckers following a cyber attack on a popular pizza chain that exposed vast amounts of customer information. This included a 19-year-old Denis Fridman, along with two unidentified individuals. A fourth member of the group remains at large, according to Russian newspaper Kommersant.
- Zheng Zhao, a 44-year-old Chinese national, has been extradited from the Netherlands to the U.S. for his alleged role in an international cryptocurrency investment conspiracy carried out from Cambodian scam centers that targeted 174 U.S. victims. "Zhao was allegedly part of an international criminal network that induced U.S. victims to transfer funds to accounts controlled by co-conspirators, who then laundered victim money through U.S. shell companies, international bank accounts, and digital asset wallets," the U.S. Department of Justice said. In August 2025, Zhao was charged with conspiracy to commit money laundering. If convicted, he faces a maximum penalty of 20 years in prison. Separately, the Justice Department announced that dozens of arrests have been made and 3.7 million fraudulent social media accounts, pages, and groups from Facebook and Instagram have been taken down in connection with scam networks operating from West Africa as part of a coordinated Joint Disruption Week.
Conclusion
If this week wasn't enough of a warning, nothing will be. Critical RCE bugs are piling up, attackers are already exploiting some of them, and millions of attempts are hitting newly disclosed flaws. Even widely trusted software and tools are becoming attack surfaces. The scary part? Some bugs don't even need a login, and some still have no fix available.
The lesson is simple: don't wait for proof of an attack before taking action. Check what's exposed, patch what you can, lock down what you can't, and treat leaked keys as urgent. Not every scanning attempt leads to a breach, but attackers only need one working path. With so many doors being tested at once, this is a bad week to leave even one wide open.
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.