OSINT / CyberSec report 25.10.2026 00:13

1. CISA added two actively exploited critical flaws to its KEV catalog, CVE-2026-110447 in Collabora Online CODE Server and a VeloCloud Orchestrator issue, urging immediate patching (thehackernews.com).

2. A Brotli decoder memory-corruption flaw, CVE-2026-111497, enables remote code execution in Node.js, Bun, Python Brotli packages, and Envoy, with a proof-of-concept named Node2Shell demonstrated (thehackernews.com).

3. Attackers attempted to exploit PHP2Shell vulnerabilities CVE-2026-109618 and CVE-2026-109619 to deploy Mirai botnet variant Potassium, with millions of exploit attempts observed (thehackernews.com).

4. PHP warned of another unpatched RCE risk, CVE-2026-115560, affecting non-default web application configurations, recommending a feature disable instead of an emergency fix (thehackernews.com).

5. A critical Pillow image library flaw, CVE-2026-112900, allows code execution via crafted EPS images due to unchecked Ghostscript file names (thehackernews.com).

6. The BlackX UEFI bootkit, linked to APT41, bypassed Secure Boot using the Baton Drop flaw to target diplomatic organizations in Central Asia (bleepingcomputer.com).

7. Russian Sandworm and UAC-0099 used a new mesh network backdoor in a destructive wiping attack against a Ukrainian logistics company (thehackernews.com).

8. Ransomware affiliates of INC and The Gentlemen groups used an AI-driven Phantom framework for autonomous intrusions and data extortion (thehackernews.com).

9. A large-scale campaign breached enterprise firewalls and VPNs, exposing over 70,000 credentials from Fortinet and Palo Alto devices (thehackernews.com).

10. Quest Diagnostics confirmed a data breach exposing patient records after unauthorized access to its Quanum LSM system (bleepingcomputer.com).

11. Hackers leaked 281 GB of data from Germanys AfD party, including 421,179 internal emails, after breaching its hosting provider (bitdefender.com).

12. LiteLLM disclosed a leaked master key that allowed attackers to steal GitHub tokens and hijack its release pipeline (thehackernews.com).

13. Indian CA eMudhra had eight TLS certificates with compromised private keys, risking unauthorized signing and man-in-the-middle attacks (schneier.com).

14. HPE patched eight maximum-severity RCE and authentication bypass flaws in ArubaOS, among 72 total vulnerabilities (bleepingcomputer.com).

15. Ruby fixed three Onigmo regex engine bugs behind four critical GitLab RCE flaws, releasing versions 4.0.9, 3.4.12, and 3.3.13 (thehackernews.com).

16. Researchers pushed over 2 million updates to disable a vulnerable Time4Popcorn updater that could have enabled remote code execution on millions of PCs (thehackernews.com).

17. A critical x402 SDK flaw could let malicious APIs drain AI agents token balances due to missing spending limits in default clients (thehackernews.com).

18. Microsoft linked China-based Storm-0940 to a ConnectWise supply chain attack using an AI-enabled penetration-testing tool against over 2,200 tenants (darkreading.com).