// Threat Intelligence

Current Threat
Landscape

Actively exploited vulnerabilities, ransomware activity and attack trends, compiled automatically twice a day from named public sources. Each item links to the original so you can check it. Items from earlier days are kept in the archive.

COMPILED TWICE DAILY
UPDATED: October 26, 2026 at 7:01 PM
THREATS: 7
The most urgent development of the past 24 to 48 hours is the confirmed active exploitation of the PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619). A researcher reported over the weekend that attackers successfully launched 35 shells across honeypot servers on October 24, with traffic closely matching a public proof-of-concept exploit. Mirai botnet operators have also joined the attack wave, and industrial vendors including Siemens, Schneider Electric, and ABB have confirmed that some of their products are affected. CISA updated its PHP2Shell alert on October 23 to add a Sigma detection rule, and governments worldwide are urging immediate patching to PHP versions 8.5.12, 8.4.27, 8.3.36, or 8.2.35. Organizations that cannot patch immediately are advised to take PHP-based systems offline. Also published today, Wiz Research disclosed the Gheist supply chain campaign, an ongoing automated operation that has used stolen GitHub tokens to plant secret-dumping workflows across more than 13,500 branches in over 850 compromised GitHub accounts since September 15, 2026. The attack has succeeded in private repositories and GitHub Enterprise environments, and follow-on cloud activity including AWS Secrets Manager enumeration has been observed in enterprise victims. Separately, Microsoft has attributed the October ConnectWise Cloud Backup supply chain compromise to Storm-0940, a China state-aligned threat actor, which used the ARTEX agentic AI penetration testing framework to attempt sign-ins across more than 2,250 Microsoft 365 tenants at machine speed, achieving privileged access at some organizations in under three hours. Beyond these lead stories, the UEFI bootkit BlackX was publicly documented this week targeting diplomatic organizations in Central Asia, exploiting the years-old Baton Drop flaw (CVE-2022-21894) to bypass Secure Boot on fully patched Windows systems where firmware revocation steps had not been applied. The FBI and CISA joint advisory AA26-293A on SafePay ransomware, issued October 20, confirmed that the group has hit at least 600 organizations across critical infrastructure sectors since August 2024 and deliberately destroys backup copies before encrypting systems. Security teams should treat all of these developments as requiring immediate action rather than routine scheduling.
FILTER:

How this page is made. It is compiled automatically twice a day. An AI model searches recent reporting from CISA, KrebsOnSecurity, BleepingComputer, Dark Reading, SecurityWeek, The Record, NVD and Schneier on Security, then writes the summaries. A person does not review each item before it is published, so check the linked source before you act on any detail. Severity labels are the compiler's judgment, not an official score.

CRITICAL

PHP2Shell (CVE-2026-109618 and CVE-2026-109619) - Active Exploitation Confirmed#

Two critical unauthenticated remote code execution flaws in PHP, collectively tracked as PHP2Shell, were patched on October 21, 2026, after information leaked online ahead of the planned disclosure. As of October 24, a researcher confirmed 35 shells successfully launched across honeypot servers, with traffic consistent with exploitation of CVE-2026-109618, and SecurityWeek reported this finding on October 26. The vulnerabilities affect all PHP installations serving web requests, including Apache with mod_php, PHP-FPM, php-cgi, FrankenPHP, and LiteSpeed, covering an estimated 70 percent of websites.
AFFECTS: All PHP installations serving web requests running versions prior to 8.5.12, 8.4.27, 8.3.36, or 8.2.35; downstream platforms including WordPress, Drupal, Joomla, and Magento; industrial control systems from Siemens, Schneider Electric, and ABB SOURCE: SecurityWeek 2026-10-26
Vulnerability
CRITICAL

Storm-0940 APT - ARTEX AI-Powered ConnectWise Supply Chain Attack#

Microsoft attributed the October 2026 ConnectWise Cloud Backup supply chain compromise to Storm-0940, a China state-aligned threat actor active since at least 2021. According to Microsoft, the actor used ARTEX, an agentic AI penetration testing framework, to automate password spraying at approximately 2,900 attempts per minute, targeting more than 2,250 Microsoft 365 tenants; in several cases privileged cloud access was achieved in under three hours of initial targeting. ConnectWise subsequently suspended Cloud Backup, SaaS Security, and Cloud Management services in response.
AFFECTS: Organizations using ConnectWise Cloud Backup (formerly SkyKick); downstream Microsoft 365 and Entra tenants across sectors including aerospace and defence, energy, financial services, government, manufacturing, and technology SOURCE: Dark Reading 2026-10-22
APT
CRITICAL

SafePay Ransomware - CISA/FBI Joint Advisory AA26-293A#

The FBI, CISA, the U.S. Secret Service, and international partners issued joint advisory AA26-293A on October 20, 2026, warning that the SafePay ransomware group has hit at least 600 organizations across critical infrastructure sectors since August 2024. According to the advisory, the group gains initial access through compromised or guessed credentials, phishing, and exploitation of VPN and edge devices, then performs double-extortion by exfiltrating data before encrypting systems and deliberately deleting shadow copies and resetting network-attached storage backup devices. The advisory covers victims in North America, South America, Europe, and Australia.
AFFECTS: Critical infrastructure sectors globally including finance, healthcare, manufacturing, and energy; organizations using internet-facing VPN appliances and edge devices SOURCE: CISA Advisories 2026-10-20
Ransomware
HIGH

BlackX UEFI Bootkit - Secure Boot Bypass via Baton Drop (CVE-2022-21894)#

Kaspersky researchers documented a new UEFI bootkit called BlackX, deployed in an espionage campaign in early 2026, which exploits the Baton Drop vulnerability (CVE-2022-21894) to bypass Secure Boot and load a malicious driver designed to interfere with security software including solutions from Kaspersky and Avast. Kaspersky found that affected systems had received Windows operating system updates but the required Secure Boot revocation measures, specifically adding the Windows Production PCA 2011 certificate to the firmware blocklist, had not been applied, leaving the bootkit able to exploit pre-patch signed bootloaders. BleepingComputer reported on October 24 that the campaign targeted diplomatic organizations in Tajikistan, Uzbekistan, and Turkmenistan; the attribution to APT41 carries medium confidence per Kaspersky.
AFFECTS: Windows 10 and Windows 11 systems where Secure Boot DBX revocation for CVE-2022-21894 has not been manually applied; diplomatic and government organizations in Central Asia SOURCE: BleepingComputer 2026-10-24
APT
HIGH

Gheist Campaign - Stolen GitHub Tokens Harvesting Cloud Secrets at Scale#

Wiz Research disclosed on October 26, 2026, that an automated campaign tracked as Gheist has been using stolen GitHub tokens since September 15, 2026, to plant a malicious GitHub Actions workflow named sync-check across accessible repositories, printing base32-encoded secrets into workflow logs and exfiltrating them via the GitHub API before deleting the runs. The campaign has affected more than 850 compromised accounts and planted more than 13,500 branches, with follow-on activity in enterprise environments including AWS Secrets Manager enumeration using harvested cloud credentials. Dark Reading reported that GitHub's approval controls protect public repositories but private and enterprise repositories remain at risk; Wiz linked token sources to infostealer logs and earlier supply chain attacks.
AFFECTS: Private GitHub repositories and GitHub Enterprise environments; developer cloud environments including AWS; organizations whose application secrets, private keys, and cloud credentials are stored as GitHub Actions secrets SOURCE: Dark Reading 2026-10-26
Malware
HIGH

Microsoft .NET Emergency Patch - Critical Brotli Flaw CVE-2026-111497#

Microsoft released emergency out-of-band security updates on October 25 and October 26, 2026, for a critical vulnerability tracked as CVE-2026-111497 and also referred to as Broccoli2Shell and HTTP2Shell, affecting the Brotli C decoder library built into .NET and Node.js. Microsoft rates the flaw Critical with a CVSS v3.1 score of 8.1, classifying it as an out-of-bounds write that can lead to elevation of privilege; the advisory notes no user interaction is required and the attack vector is network-reachable with high complexity. BleepingComputer reported on October 26 that the patches cover .NET 8, 9, and 10, and that the upstream Google Brotli library record was published in NVD on October 22.
AFFECTS: .NET 8, .NET 9, and .NET 10 applications; Node.js applications using the Brotli C decoder library; Google Brotli library versions 1.0.3 through 1.2.0 SOURCE: BleepingComputer 2026-10-26
Vulnerability
HIGH

Capcom Data Breach - 11.7 Million CAPCOM ID Accounts Exposed#

Capcom disclosed on October 22, 2026, that unauthorized access to its CAPCOM ID service exposed information associated with approximately 11,774,247 accounts, and SecurityWeek reported that attackers also changed login passwords for 196 accounts. According to SecurityWeek, the hackers stole approximately 11 million email addresses, and while passwords were reportedly not stolen for most accounts, the combination of account metadata and email addresses creates phishing and credential-reuse risk for affected users. BleepingComputer independently confirmed the incident on the same date.
AFFECTS: CAPCOM ID service account holders, approximately 11.7 million individuals globally SOURCE: SecurityWeek 2026-10-23
Data Breach