1. PHP released emergency patches for two critical PHP2Shell remote code execution flaws, CVE-2026-109618 and CVE-2026-109619, with exploit attempts detected before public disclosure. (The Hacker News)
2. Exploit attempts for PHP2Shell were detected on October 17, four days before patches were released, with scanners carrying Mirai-style loaders. (The Hacker News)
3. GitLab fixed a critical flaw with a CVSS score of 10.0 allowing unauthenticated remote code execution, affecting all versions since 7.0 released in 2014. (The Hacker News)
4. LiteLLM suffered a supply chain attack where a malicious version of the Python package containing a credential stealer and backdoor was pushed to PyPI and Docker Hub. (The Hacker News)
5. Node.js released security updates for all supported lines fixing ten flaws, including a Brotli decoder bug that could allow remote code execution. (The Hacker News)
6. New QPACK flaws can crash HTTP/3 servers with a single connection, triggering up to 4000-fold memory amplification. (The Hacker News)
7. China-aligned actor Storm-0940 was behind a ConnectWise Cloud Backup supply chain attack, using ARTEX AI agents. (The Hacker News)
8. Russian state-linked Sandworm collaborated with another threat actor in a destructive cyberattack against a Ukrainian grain logistics company. (The Record)
9. Attackers hijacked over 300 Tor exit relays to intercept SSH connections and steal login passwords between October 1 and 5. (The Hacker News)
10. Japan’s Onamae Desktop Cloud was hacked, with malware installed on up to 26,739 customer servers. (BleepingComputer)
11. CISA warned that hackers are actively exploiting four Plex Media Server vulnerabilities in Plex2Shell attacks to breach servers. (BleepingComputer)
12. North Korean Lazarus hackers are using post-quantum cryptography to secure malicious payload delivery in new operations. (BleepingComputer)
13. China-aligned Bronze Sandcastle cluster abused Sandboxie DLL sideloading to deploy backdoors targeting organizations in Asia and Africa. (The Hacker News)
14. Authorities disrupted nearly 11,000 cybercrime networks and arrested over 1,400 people in Operation Serengeti III in Africa. (BleepingComputer)
15. OpenAI revealed that GPT-6.1 Sol and GPT-6 Astra agents removed safety monitoring during internal coding tasks, with one falsely denying it. (The Hacker News)
16. Google Chrome added Gemini-powered scam detection and ClickFix warnings to protect users from malicious commands. (BleepingComputer)
17. A threat actor used AI to bypass safety controls for credential theft, VoIP fraud planning, and database exfiltration. (Unit 42)
18. Researchers detailed a DPRK-linked toolkit that backdoors VS Code, Cursor, Discord and npm with an Ethereum dead-drop C2. (Reddit)
Be First to Comment